Spyware / Malware / Virus Removal

[Resolved] "PassCapture" has my computer feeling blue

25 min read

Looking for the outcome? Ask AI

mattwest1 Topic Starter

Post #1March 17, 2009, 8:14 PM UTC

Do forgive my inexperience with the HijackThis program but I have no idea what to do about this issue. I have an infection on my HP dv6000 laptop running Windows XP SP2 that has several symptoms which collectively make my computer unable to effectively function.

When I start up the computer, first the background picture I had selected comes up and only the mouse is visible. Maybe 20 - 30 seconds later the start menu and the taskbar come up. Then about 20 - 30 seconds after that the icons come up while simulatenously changing my background image to a message: "“Warning Dangerous spyware Many viruses were found on your computer such as : Trojan horse, passcapture etc. your personal information can fall into in the ‘third hands.'"

This is where the fun begins.

One issue is that, although my internet connection is working just fine, as verified by my playstation portable, this infection has blocked any access to the internet from any program that needs it. It's as if the internet connection is completely down, but I know it's not.

Also a new error message has started popping up that I had never seen before this issue:

"Data Execution Prevention

To help protect your computer, Windows has closed this program.

Name: WMI
Publisher: Microsoft Corporation
[Close Message]"

This message will pop up usually around 5 or 6 times in accompaniment with a message that says "WMI has encountered a problem and needs to close…[Send Error Report] [Don't send]"

As far as program functionality goes, most things take a long time to load, usually around 90 seconds or so, and when they finally do they're very temperamental. Most clicks on the program itself cause about a 20 second freeze.

In addition to that, it seems as if an unusual amount of heat is being given off by the computer. The cooling fan is constantly running at it's fastest speed and if the computer stays on for usually about more than half an hour it will just turn off. No shut down or anything, it just completely turns off as if what it's trying to do is putting a ridiculous amount of strain on it. Also on occasion an error message will come up (I didn't get a chance to copy this one down, so this is from my memory) saying something along the lines of Windows NT forcing a restart and giving me a one minute countdown before restarting itself.

Also the task manager "has been disabled by the administrator" and I have read about people re-enabling the task manager as it relates to this PassCapture but the problem persists every time the computer is restarted.

I am posting this message from a public PC but I have my laptop here beside me and my intention is to be back at this computer everyday until the issue is fixed or at least workable. I have a program called Antispyware that is more of a nuissance than anything else. As far as I know it doesn't run any sort of scans on my computer and I have been sort of negligent when it comes to getting rid of that program

. The one program I use is Trend Micro Antivirus and I have run two scans since the infection (about a week ago) and quarantined everything in the box but that has yielded no apparent results. I have since rebooted into Safe Mode with networking to download HJT and ERUNT. I rebooted back in normal startup and had no apparent issues running a backup of the registry with ERUNT as directed. I also ran HJT in normal startup but during the scan a few error messages popped up. I copied down the first two:

"Rundll32.exe – Bad Image

The application or DLL C:\WINDOWS\system32\NTMARTA.DLL is not a valid Windows image. Please Check this against your installation diskette. [OK]"

and…

"Drwtsn.exe – unable to locate component

This application has failed to start because DBGHELP.dll was not found. Re-installing the application may fix this problem."

I would say maybe 10 of these popped up and were all either the "Bad Image" or "unable to locate component" boxes but had different applications and DLLs as the issue.

Here is the HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:55:47 PM, on 3/17/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\WINDOWS\system32\msdtc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
c:\WINDOWS\system32\ZuneBusEnum.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\TEMP\A917.tmp
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\TEMP\winlogqn.exe
C:\WINDOWS\system32\frmwrk32.exe
C:\WINDOWS\System32\rs32net.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Antispyware\Antispyware.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\System32\rs32net.exe
C:\WINDOWS\system32\dumprep.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ntdll64.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Trend Micro\Internet Security\UfUpdUi.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\uo19qg1z5.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…n&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.weather.com/weather/map/interac…om=hp_main_maps
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,
O1 - Hosts: 195.245.119.131 browser-security.microsoft.com
O2 - BHO: (no name) - {82d71015-6f1d-442c-a730-0fabd8d6e70f} - C:\WINDOWS\system32\majavuwu.dll
O2 - BHO: {4ec6c842-ce11-64da-2a54-71a2e3dc615b} - {b516cd3e-2a17-45a2-ad46-11ec248c6ce4} - C:\WINDOWS\system32\uwjqxh.dll
O2 - BHO: C:\WINDOWS\system32\kjr3iorojdnbfi43unjfd.dll - {C5BF40A2-94F3-42BD-F434-1604812C8955} - C:\WINDOWS\system32\kjr3iorojdnbfi43unjfd.dll
O3 - Toolbar: (no name) - {84938242-5C5B-4A55-B6B9-A1507543B418} - (no file)
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Criziviki] rundll32.exe "C:\WINDOWS\Ijodijucivic.dll",e
O4 - HKLM\..\Run: [kjahrfoi37rljanfaw3il7fhjd3f] C:\WINDOWS\TEMP\winlogqn.exe
O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe
O4 - HKLM\..\Run: [rs32net] C:\WINDOWS\System32\rs32net.exe
O4 - HKLM\..\Run: [Fzavavohiyesupa] rundll32.exe "C:\WINDOWS\axehejoz.dll",e
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [fekidizeni] Rundll32.exe "C:\WINDOWS\system32\tilafago.dll",s
O4 - HKLM\..\Run: [6cb3e72c] rundll32.exe "C:\WINDOWS\system32\tumaveko.dll",b
O4 - HKLM\..\Run: [CPM6f80d4b0] Rundll32.exe "c:\windows\system32\pegojehe.dll",a
O4 - HKLM\..\Run: [000000af] rundll32.exe "C:\WINDOWS\system32\tumaveko.dll",b
O4 - HKLM\..\Run: [] Rundll32.exe "c:\windows\system32\pegojehe.dll",a
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Antispyware] C:\Program Files\Antispyware\Antispyware.exe -boot
O4 - HKCU\..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\Owner\Application Data\Macromedia\Common\8b2600321.dll""
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [kjahrfoi37rljanfaw3il7fhjd3f] C:\WINDOWS\TEMP\winlogqn.exe
O4 - HKCU\..\Run: [rs32net] C:\WINDOWS\System32\rs32net.exe
O4 - HKCU\..\Run: [lyko18m79csccyc98a8rtcwx0u6gfbu2o1bf1] C:\WINDOWS\TEMP\lqntf5wmu2.exe
O4 - HKCU\..\Run: [ex3j74oaap2dy] C:\WINDOWS\TEMP\tuz9zh5cbr.exe
O4 - HKCU\..\Run: [k3o296wibl5i3mdnfbp] C:\DOCUME~1\Owner\LOCALS~1\Temp\kbvci62oeo.exe
O4 - HKCU\..\Run: [z7epwd8mfw92r01hbnd0umx9xhfawmq83ylynngdpj5w] C:\WINDOWS\TEMP\mmkskf2e1pq13.exe
O4 - HKCU\..\Run: [k8gmehz8uetlimicz7u] C:\WINDOWS\TEMP\hpnajazk.exe
O4 - HKCU\..\Run: [xzp9m0j3gjslro8bxl2bimy0f] C:\DOCUME~1\Owner\LOCALS~1\Temp\sjelhpljtvee.exe
O4 - HKCU\..\Run: [nz3hwdko99frf02gw979zs8kn5v3j38ry] C:\WINDOWS\TEMP\k16qhaees.exe
O4 - HKCU\..\Run: [t7ygx1eld4ooytf6pl5xwib0u0redvt26fxvs7pk1lxz2] C:\WINDOWS\TEMP\vd1tth.exe
O4 - HKCU\..\Run: [s07zwzz0h] C:\WINDOWS\TEMP\dqh55e.exe
O4 - HKCU\..\Run: [rktq5oj1w5xebw8t1yi3npicjunim26okksyejo] C:\WINDOWS\TEMP\qobhyjv.exe
O4 - HKCU\..\Run: [mzgleo0anpjzhrwi4q5avjt7gf5ikqknkrpx4x8vprdb0v] C:\DOCUME~1\Owner\LOCALS~1\Temp\xni2hvp4dw95h.exe
O4 - HKCU\..\Run: [vsvkyp0d9jc5hqoos2x22fvyws4mxh0ykzfjvfdts65lb5xdq] C:\DOCUME~1\Owner\LOCALS~1\Temp\j1ydqprtjo.exe
O4 - HKCU\..\Run: [i8639nuugrr9lmv5gkl9r] C:\WINDOWS\TEMP\tzxqmem9.exe
O4 - HKCU\..\Run: [ge5vet3nbcgjj9yg0] C:\WINDOWS\TEMP\ff602qcnkhu.exe
O4 - HKCU\..\Run: [ifvs7e0bvuke7h2jpqo8wnjq6bk1qlg] C:\DOCUME~1\Owner\LOCALS~1\Temp\kb786q.exe
O4 - HKCU\..\Run: [fbp6vnwlcxi6remyff33fdc909j485wag818remergd0] C:\DOCUME~1\Owner\LOCALS~1\Temp\gwqazr03.exe
O4 - HKCU\..\Run: [d49r99or3tr] C:\DOCUME~1\Owner\LOCALS~1\Temp\btu13a13gv.exe
O4 - HKCU\..\Run: [d9oolcpue4m80ijgit7m34k4gkr2zlzg3] C:\DOCUME~1\Owner\LOCALS~1\Temp\q4hrfa7g4.exe
O4 - HKCU\..\Run: [livmculy43g5genqijdn7] C:\DOCUME~1\Owner\LOCALS~1\Temp\u8adlyltv58.exe
O4 - HKCU\..\Run: [ynt7ytl8m] C:\DOCUME~1\Owner\LOCALS~1\Temp\kqavc4k.exe
O4 - HKCU\..\Run: [n5ey58em8vocfeh029r6mwgknegjtjg2x6arzo1uul] C:\DOCUME~1\Owner\LOCALS~1\Temp\gnhep6cbzh9v.exe
O4 - HKCU\..\Run: [ai10ivn4opigboz20cv67hy9jhilzu6xe858ap2gh6w3sjle] C:\DOCUME~1\Owner\LOCALS~1\Temp\ureb2k.exe
O4 - HKCU\..\Run: [sljnmyoicwby7] C:\DOCUME~1\Owner\LOCALS~1\Temp\fygeys.exe
O4 - HKCU\..\Run: [cqy93a4lc9ol8jvetwl80nlvm5ee952dy8brut8in35] C:\DOCUME~1\Owner\LOCALS~1\Temp\h95u0kk88.exe
O4 - HKCU\..\Run: [knuuzg2thzpr] C:\DOCUME~1\Owner\LOCALS~1\Temp\p2ogo3s.exe
O4 - HKCU\..\Run: [hu9pni1rd5] C:\DOCUME~1\Owner\LOCALS~1\Temp\mpvr9sf.exe
O4 - HKCU\..\Run: [kgr0daf55faw4ox5n04dhj4xbo18fgylz] C:\DOCUME~1\Owner\LOCALS~1\Temp\bwt4433w.exe
O4 - HKCU\..\Run: [wrdp8hvkzul26yeldalztsnb42ku9yrgjfhg6ski1gucde] C:\DOCUME~1\Owner\LOCALS~1\Temp\i6i0a8.exe
O4 - HKCU\..\Run: [agu12kp59mm61wryhg6jcmlstmozru76bc3qske0z3x5hp] C:\DOCUME~1\Owner\LOCALS~1\Temp\oamaeuf1iz9c5.exe
O4 - HKCU\..\Run: [quqne0hbzm2g2rakhgv626ktwqkokbhak0njmm8w] C:\DOCUME~1\Owner\LOCALS~1\Temp\i7gngcdq5b.exe
O4 - HKCU\..\Run: [d6a2df3n1bi6yxjadtqb2rinc8dkgheuiwzr6juohbi3or08f] C:\DOCUME~1\Owner\LOCALS~1\Temp\uj44u3zu9ndh.exe
O4 - HKCU\..\Run: [pl8hpr9q1t76oaee5x1ko5tplijdz2ovj16kqmn6126rz55ecy] C:\DOCUME~1\Owner\LOCALS~1\Temp\hmag3782g6.exe
O4 - HKCU\..\Run: [p0lwbqj4oenq4jzz] C:\DOCUME~1\Owner\LOCALS~1\Temp\vgsadrufed3.exe
O4 - HKCU\..\Run: [xo8refmqanqjvkfouq2igbueqtp6lcioucqr1duinqursml] C:\DOCUME~1\Owner\LOCALS~1\Temp\b5ux5mnz.exe
O4 - HKCU\..\Run: [agi56fu57rbs06] C:\DOCUME~1\Owner\LOCALS~1\Temp\y1po1vt3uwfm.exe
O4 - HKCU\..\Run: [fyem5goref2erfvkj9ehf4717hq0xq0cf0lthecv] C:\DOCUME~1\Owner\LOCALS~1\Temp\f7co0b8hqa.exe
O4 - HKCU\..\Run: [wlhewpgwr0u5iupm5cj8gg0bwishkqhwb0al0] C:\DOCUME~1\Owner\LOCALS~1\Temp\mt9klctn.exe
O4 - HKCU\..\Run: [au247evuj7ez7pq2oik4m] C:\DOCUME~1\Owner\LOCALS~1\Temp\fm4akou.exe
O4 - HKCU\..\Run: [jijwfegbon86of6cae] C:\DOCUME~1\Owner\LOCALS~1\Temp\l9kkax9.exe
O4 - HKCU\..\Run: [lv5vmewypo5v1yn8g7yvyb7] C:\DOCUME~1\Owner\LOCALS~1\Temp\chca1kx.exe
O4 - HKCU\..\Run: [jo144p8mo760] C:\DOCUME~1\Owner\LOCALS~1\Temp\rz9y055b.exe
O4 - HKCU\..\Run: [nppxw0y5uy5g4gk36fxcy] C:\DOCUME~1\Owner\LOCALS~1\Temp\yqiukoyugrm.exe
O4 - HKCU\..\Run: [msj12xdnklltt99v5o4dpbgmv9xz] C:\DOCUME~1\Owner\LOCALS~1\Temp\tw0yserfjk.exe
O4 - HKCU\..\Run: [m8l9n3scuf1a2haadk4x6lfpkz1kk4obngrzk] C:\DOCUME~1\Owner\LOCALS~1\Temp\dlgeyt.exe
O4 - HKCU\..\Run: [yw70ydx35xnt] C:\DOCUME~1\Owner\LOCALS~1\Temp\qizjzp.exe
O4 - HKCU\..\Run: [slyxaebk01f416v8wkdidi2oxn6yhcj0u2xwyn] C:\DOCUME~1\Owner\LOCALS~1\Temp\nbpltln4brro.exe
O4 - HKCU\..\Run: [npsquavmlfxv1fvr5pfvulfmbjm2] C:\DOCUME~1\Owner\LOCALS~1\Temp\op9cv699.exe
O4 - HKCU\..\Run: [gij5ufbk4m3nsehih25300xre8dtueiez4lqhw8ys1tivr0l] C:\DOCUME~1\Owner\LOCALS~1\Temp\ql959i.exe
O4 - HKCU\..\Run: [q1jms2ep8ujoguk8l8aid1d02pj93gn9k40] C:\DOCUME~1\Owner\LOCALS~1\Temp\yut8swowpk.exe
O4 - HKCU\..\Run: [vtldi9kl3mmnm5yin4mzi76] C:\DOCUME~1\Owner\LOCALS~1\Temp\a0i4l7.exe
O4 - HKCU\..\Run: [yr87iu4mkfk5o4o2j5rhcfaw] C:\DOCUME~1\Owner\LOCALS~1\Temp\achmrq9osne48.exe
O4 - HKCU\..\Run: [x5ee2tygwyy0vsepga1pq611lno7n23h5t8z2rm1] C:\DOCUME~1\Owner\LOCALS~1\Temp\wsoo4b175h.exe
O4 - HKCU\..\Run: [p8g6iphidru44v1wfwg5a5ltpeoga582x75wxhtlnwkc6fe] C:\DOCUME~1\Owner\LOCALS~1\Temp\jvu0dway.exe
O4 - HKCU\..\Run: [z0oz0c8pittw9] C:\DOCUME~1\Owner\LOCALS~1\Temp\icy9ecc.exe
O4 - HKCU\..\Run: [oa7npycu3mu50hc4p2] C:\DOCUME~1\Owner\LOCALS~1\Temp\k2ktc1yb0786q.exe
O4 - HKCU\..\Run: [t4hmodg9dwzosfy2weixxyxqiprnie7] C:\DOCUME~1\Owner\LOCALS~1\Temp\efujt40i.exe
O4 - HKCU\..\Run: [i1kacwwx5ylq17dv5zkq8n3i1cv4fvk] C:\DOCUME~1\Owner\LOCALS~1\Temp\mz1asmk1ai.exe
O4 - HKCU\..\Run: [rgmhmh5v3z6gcfmhh378nch0uq] C:\DOCUME~1\Owner\LOCALS~1\Temp\c76pdt2j8u.exe
O4 - HKCU\..\Run: [xekpzqe43vv2m8] C:\DOCUME~1\Owner\LOCALS~1\Temp\u0f433.exe
O4 - HKCU\..\Run: [pq9nn9v203dmjmw4jcao9d8hizqoahu797wmz] C:\DOCUME~1\Owner\LOCALS~1\Temp\nxwqn1xcqw.exe
O4 - HKCU\..\Run: [fw3upluxg43bdloh] C:\DOCUME~1\Owner\LOCALS~1\Temp\bb479h0naf6.exe
O4 - HKCU\..\Run: [qa7zxku6vnl18mepl7jdyz2yiug8] C:\DOCUME~1\Owner\LOCALS~1\Temp\mpv7dn5jcybi.exe
O4 - HKCU\..\Run: [hm1ygmn695kh] C:\DOCUME~1\Owner\LOCALS~1\Temp\bg7rwtk.exe
O4 - HKCU\..\Run: [g4o2jn1ugy2um7us5cw] C:\DOCUME~1\Owner\LOCALS~1\Temp\m49uskr.exe
O4 - HKCU\..\Run: [cwmi4bm883rnb7y48] C:\DOCUME~1\Owner\LOCALS~1\Temp\c9pl9r.exe
O4 - HKCU\..\Run: [c79486c8fqp61a81taovqnrd] C:\DOCUME~1\Owner\LOCALS~1\Temp\z4dlcd8vb.exe
O4 - HKCU\..\Run: [e6e4zxyfno6heszeehd03] C:\DOCUME~1\Owner\LOCALS~1\Temp\cex59p1xr8t.exe
O4 - HKCU\..\Run: [vvb9fyxpn2zrxpme] C:\DOCUME~1\Owner\LOCALS~1\Temp\k5bv9po7f.exe
O4 - HKCU\..\Run: [bsuzl57of89d9dy86wos2nlx] C:\DOCUME~1\Owner\LOCALS~1\Temp\br61nhbaqfd.exe
O4 - HKCU\..\Run: [dvrxylcv6byrxi48glj2sx1p5q9w2psjzmw3s5qayujx] C:\DOCUME~1\Owner\LOCALS~1\Temp\tefp2kvts.exe
O4 - HKCU\..\Run: [hbxc3rv8jilun5p7r] C:\DOCUME~1\Owner\LOCALS~1\Temp\hic3wydabaq.exe
O4 - HKCU\..\Run: [kn2vu34pggojfhm4] C:\DOCUME~1\Owner\LOCALS~1\Temp\l3csv43.exe
O4 - HKCU\..\Run: [b5cyh2zsku6h] C:\DOCUME~1\Owner\LOCALS~1\Temp\s115j664zxvru.exe
O4 - HKCU\..\Run: [yutckyxzsbvu4nlm0idoahjm7ywd5gfrumzsyxkj2] C:\DOCUME~1\Owner\LOCALS~1\Temp\m6yqj0179.exe
O4 - HKCU\..\Run: [cq1zi9n1hh9lp1qwymvwwdp5ykvvsm1m4gofh97pul4sqbsc] C:\DOCUME~1\Owner\LOCALS~1\Temp\dzutyc.exe
O4 - HKCU\..\Run: [f9z1p8xjrw7fuh8ft3cxn53vj3pb3taa1] C:\DOCUME~1\Owner\LOCALS~1\Temp\z7444jz4u2c.exe
O4 - HKCU\..\Run: [yfehbr370iuli4za23c5da] C:\DOCUME~1\Owner\LOCALS~1\Temp\onzvghc.exe
O4 - HKCU\..\Run: [o9e27sylnnophibapeo] C:\DOCUME~1\Owner\LOCALS~1\Temp\ggb8fpd16ga93.exe
O4 - HKCU\..\Run: [w2r9sewrya4h7sp0qfk5g99hfja1w62q] C:\DOCUME~1\Owner\LOCALS~1\Temp\qnpheg90or.exe
O4 - HKCU\..\Run: [fsd5a1mxffoiztkr4a6ko0esoi4pa7iwc0roodo7ci6wwt] C:\DOCUME~1\Owner\LOCALS~1\Temp\g8q30cqiv9.exe
O4 - HKCU\..\Run: [daj5pc6t6jvh3qulc8u74] C:\DOCUME~1\Owner\LOCALS~1\Temp\rz2s6fxj3m.exe
O4 - HKCU\..\Run: [hsvg6m82emwcpmejdp75ctc2vu0m15kft31iysevg25sljl2u3] C:\DOCUME~1\Owner\LOCALS~1\Temp\wxvj1hl.exe
O4 - HKCU\..\Run: [ewknok3fbiqa9fng58rj34axr3ci8h] C:\DOCUME~1\Owner\LOCALS~1\Temp\p51vandma9e.exe
O4 - HKCU\..\Run: [qfzwh0oworh7] C:\DOCUME~1\Owner\LOCALS~1\Temp\mh0dtgf.exe
O4 - HKCU\..\Run: [wdw7gq849c3xibjhiio95emboi1ufs77oa3b8o] C:\DOCUME~1\Owner\LOCALS~1\Temp\hooouwzumqp.exe
O4 - HKCU\..\Run: [s1f6uedro8zdt1x2hcroxjhrrv1uebg6a8m1jtwkul] C:\DOCUME~1\Owner\LOCALS~1\Temp\l884jrphkkr.exe
O4 - HKCU\..\Run: [merrshk6onqck9xkqwpf3zq] C:\DOCUME~1\Owner\LOCALS~1\Temp\uym1sm1.exe
O4 - HKCU\..\Run: [p284z205jtyl8e04wbetcvmaejg2f9wvaw6di37zbpo0q] C:\DOCUME~1\Owner\LOCALS~1\Temp\ca262ad1.exe
O4 - HKCU\..\Run: [r7x9wiftpzj32anqvjeo02n5w1vun4ndmxgkv3v] C:\DOCUME~1\Owner\LOCALS~1\Temp\ejils9fqh.exe
O4 - HKCU\..\Run: [y2tbkov41d8m6vz6vb1ul8] C:\DOCUME~1\Owner\LOCALS~1\Temp\wwr7yiw7n2e.exe
O4 - HKCU\..\Run: [bnehkdh7xi6xonlq0fwxtp] C:\DOCUME~1\Owner\LOCALS~1\Temp\xr70ek0ld.exe
O4 - HKCU\..\Run: [gvtpdiyeje06brnuvvd] C:\DOCUME~1\Owner\LOCALS~1\Temp\i4arv1upwoqe.exe
O4 - HKCU\..\Run: [jn1xheyp0ci3vyzv3q89gq3j6] C:\DOCUME~1\Owner\LOCALS~1\Temp\sq7mckyna1u3.exe
O4 - HKCU\..\Run: [zp9b2mfv4ab1pxgfwmrjv9tlqjp9y1y1ekck5vijcvobge] C:\DOCUME~1\Owner\LOCALS~1\Temp\j8uf943s.exe
O4 - HKCU\..\Run: [gapuutw6hqdbpwejhzg1v5b2zmkdzngfv31pwxa867k5jy] C:\DOCUME~1\Owner\LOCALS~1\Temp\fuxg3y.exe
O4 - HKCU\..\Run: [sy7x43slin] C:\DOCUME~1\Owner\LOCALS~1\Temp\quy158f6c911c.exe
O4 - HKCU\..\Run: [mirj536kuurgdo5ihhuz2nbfmv] C:\DOCUME~1\Owner\LOCALS~1\Temp\u5zl8dy6bzc.exe
O4 - HKCU\..\Run: [aa83zj615kca655qx] C:\DOCUME~1\Owner\LOCALS~1\Temp\d2zd95n9llx.exe
O4 - HKCU\..\Run: [ktjt1vb43k6cybncorjittse5] C:\DOCUME~1\Owner\LOCALS~1\Temp\slk87tkhy.exe
O4 - HKCU\..\Run: [w04xasozy49gmoe8c] C:\DOCUME~1\Owner\LOCALS~1\Temp\walqbpzsz.exe
O4 - HKCU\..\Run: [i0h48xixjb58nue0enhtb1dye0kk] C:\DOCUME~1\Owner\LOCALS~1\Temp\q8kj1p5eatvf.exe
O4 - HKCU\..\Run: [rkj548drlmjw2wvvc6lyfvszim5hy0vtxaok6u] C:\DOCUME~1\Owner\LOCALS~1\Temp\gy1zye.exe
O4 - HKCU\..\Run: [nfqbmxi6brqhhagl2140qqg6dl] C:\DOCUME~1\Owner\LOCALS~1\Temp\hzrpcgnkerf.exe
O4 - HKCU\..\Run: [dgsxzxoyekajj8jug10] C:\DOCUME~1\Owner\LOCALS~1\Temp\dl29dyq6t8yc.exe
O4 - HKCU\..\Run: [e6uke3cborcnzih1cdajpaycashqxohg] C:\DOCUME~1\Owner\LOCALS~1\Temp\q4dg2v6.exe
O4 - HKCU\..\Run: [l08c5auuvlzs3ojzzu8lf28bm] C:\DOCUME~1\Owner\LOCALS~1\Temp\d6u3m4ei7bgk1.exe
O4 - HKCU\..\Run: [m9hv95inr92ct8m9nfnf63rzb] C:\DOCUME~1\Owner\LOCALS~1\Temp\u9qu7atw5f9.exe
O4 - HKCU\..\Run: [vp7kq14sey9842am59ovpa7rw0eu3vlcu9uru58x] C:\DOCUME~1\Owner\LOCALS~1\Temp\v1zybhsduk.exe
O4 - HKCU\..\Run: [sd9yssmk0rthht2cs92ru] C:\DOCUME~1\Owner\LOCALS~1\Temp\ko155grunnw.exe
O4 - HKCU\..\Run: [gxfw117rtsxwopjuicofw] C:\DOCUME~1\Owner\LOCALS~1\Temp\te0vexjo.exe
O4 - HKCU\..\Run: [tiynj28lg] C:\DOCUME~1\Owner\LOCALS~1\Temp\wrz138.exe
O4 - HKCU\..\Run: [k6mk5haqo] C:\DOCUME~1\Owner\LOCALS~1\Temp\kr4lljjfz25rh.exe
O4 - HKCU\..\Run: [pejjo6e0uin01u5kfu132u6gvxijr5ow494oh4caelta] C:\DOCUME~1\Owner\LOCALS~1\Temp\kwcqbvhuj4.exe
O4 - HKCU\..\Run: [ijxa2jtm68qov] C:\DOCUME~1\Owner\LOCALS~1\Temp\h5g001vy.exe
O4 - HKCU\..\Run: [ftta424hb5vfw5ozf] C:\DOCUME~1\Owner\LOCALS~1\Temp\qkelu3ue.exe
O4 - HKCU\..\Run: [j494fdv9iiv9ym3xy9smilj8pqj3kkez0q9utw7w1g1klo] C:\DOCUME~1\Owner\LOCALS~1\Temp\hmcjxid7aq.exe
O4 - HKCU\..\Run: [pqjabtjqpvc6mjezxs3wbb1860p4] C:\DOCUME~1\Owner\LOCALS~1\Temp\ciu3m62ifyo5.exe
O4 - HKCU\..\Run: [urskus2hwui7rdh5hipp7a] C:\DOCUME~1\Owner\LOCALS~1\Temp\w1e2k34efyun.exe
O4 - HKCU\..\Run: [qpqugcmh2d2qyooyvhbbd0cjao3z7e4fx] C:\DOCUME~1\Owner\LOCALS~1\Temp\uuezgj5.exe
O4 - HKCU\..\Run: [y5n38lzamrn1atf0xak5i4lx6spkikheznh0qu] C:\DOCUME~1\Owner\LOCALS~1\Temp\m7wjo7uxq.exe
O4 - HKCU\..\Run: [yg3t1teihbr4wwlitudxspgdqc2mv] C:\DOCUME~1\Owner\LOCALS~1\Temp\r0spwpg.exe
O4 - HKCU\..\Run: [j5rx1k47ahjklcbh5hb63erkakkrzxrcnhr3f] C:\DOCUME~1\Owner\LOCALS~1\Temp\y9vxni10wps2j.exe
O4 - HKCU\..\Run: [oybeq4k3g73niu4xffgt3jeurqt74vtqq9cvhm] C:\DOCUME~1\Owner\LOCALS~1\Temp\za4f8rjedz5ao.exe
O4 - HKCU\..\Run: [veromrp1qsb3ay] C:\DOCUME~1\Owner\LOCALS~1\Temp\gu2voq.exe
O4 - HKCU\..\Run: [jo76vrrjeu1evwnzv09krghu] C:\DOCUME~1\Owner\LOCALS~1\Temp\cnjl0o.exe
O4 - HKCU\..\Run: [dibg1te2sudj1dyhvfo] C:\DOCUME~1\Owner\LOCALS~1\Temp\ujwmqtct2nnj.exe
O4 - HKCU\..\Run: [sdu2qmcpoaq] C:\DOCUME~1\Owner\LOCALS~1\Temp\ra8twlu2k.exe
O4 - HKCU\..\Run: [xpy9z9xkey0fpclgm521iwgoiy8rw4y1qj40qi3ac3rgp09tdy] C:\DOCUME~1\Owner\LOCALS~1\Temp\d0c5ov.exe
O4 - HKCU\..\Run: [vig53ojwpvno298jvjsmauh2yfqoos] C:\DOCUME~1\Owner\LOCALS~1\Temp\nlwsjph.exe
O4 - HKCU\..\Run: [snn3oj5gcn4h9] C:\DOCUME~1\Owner\LOCALS~1\Temp\fnpkn6.exe
O4 - HKCU\..\Run: [w7k7ecetuwkp198ziwe1sz83xxi94dgxm37] C:\DOCUME~1\Owner\LOCALS~1\Temp\nnt6qtgv.exe
O4 - HKCU\..\Run: [siamvljnoa6kswei4zz4g9yrlw44rhu] C:\DOCUME~1\Owner\LOCALS~1\Temp\qtyev5xh.exe
O4 - HKCU\..\Run: [s60sfiqw2wsr03qubna9v] C:\DOCUME~1\Owner\LOCALS~1\Temp\vzfsayuc.exe
O4 - HKCU\..\Run: [exe5ye7iwsghuglj5v6mx4y9xpfm53fwxocmuimfxazdtp7z] C:\DOCUME~1\Owner\LOCALS~1\Temp\ws2omf0aidd.exe
O4 - HKCU\..\Run: [gsthh4yl8crrnk5n2fokkvg4lf4grw4o6znvio15hq9o] C:\DOCUME~1\Owner\LOCALS~1\Temp\j3v64cctg3.exe
O4 - HKCU\..\Run: [itswh9e591at5bgycx0oxrfktg] C:\DOCUME~1\Owner\LOCALS~1\Temp\fbf2rp.exe
O4 - HKCU\..\Run: [s64nyub2khwz5hdppwgngeiagcd3b92o77ngd0q4uq1e1] C:\DOCUME~1\Owner\LOCALS~1\Temp\d3rc17b6.exe
O4 - HKCU\..\Run: [o07u7u8kv8d9rhedn5cjbi6er9pwznvrezppksh28] C:\DOCUME~1\Owner\LOCALS~1\Temp\pqmylpt.exe
O4 - HKCU\..\Run: [eoztvh87mgv15tsbhqfnoawq91y1doxzso1hwadkq] C:\DOCUME~1\Owner\LOCALS~1\Temp\efj1e91nieadt.exe
O4 - HKCU\..\Run: [gl5zz4uambro67rvalvpz5] C:\DOCUME~1\Owner\LOCALS~1\Temp\dojl6w06gom.exe
O4 - HKCU\..\Run: [jmjm2d6e8bv5uw1nc91lub3wrvk00apzx1nh88] C:\DOCUME~1\Owner\LOCALS~1\Temp\xvflot.exe
O4 - HKCU\..\Run: [o4hzojs71dnsusko36cwcplhnv09ty6] C:\DOCUME~1\Owner\LOCALS~1\Temp\yd7po3eq.exe
O4 - HKCU\..\Run: [anorusrydcp] C:\DOCUME~1\Owner\LOCALS~1\Temp\m3h6hyzm21d.exe
O4 - HKCU\..\Run: [roavz2t31i9s3e] C:\DOCUME~1\Owner\LOCALS~1\Temp\e883ua.exe
O4 - HKCU\..\Run: [a74o93a8cm7phb5wg5d6jeiuwube49t01oemb0m63nf4xew] C:\DOCUME~1\Owner\LOCALS~1\Temp\w4wntf.exe
O4 - HKCU\..\Run: [m24e0wa3g6cw9hday] C:\DOCUME~1\Owner\LOCALS~1\Temp\cq9p5xklz.exe
O4 - HKCU\..\Run: [rv5eo7e1dozm8vawoudt0gr] C:\DOCUME~1\Owner\LOCALS~1\Temp\umxql2bci.exe
O4 - HKCU\..\Run: [z5mfq7bop5j1x4fj6w2orl9jkdladb] C:\DOCUME~1\Owner\LOCALS~1\Temp\r44hxtt2td.exe
O4 - HKCU\..\Run: [a7x699x8cfb2qux] C:\DOCUME~1\Owner\LOCALS~1\Temp\q58ehz19.exe
O4 - HKCU\..\Run: [fxqyjlom6df45ddzhw7fb4p] C:\DOCUME~1\Owner\LOCALS~1\Temp\arp80ovanzx.exe
O4 - HKCU\..\Run: [olq0qja2vkfz0io6i5zvf8] C:\DOCUME~1\Owner\LOCALS~1\Temp\gcc20y304hysj.exe
O4 - HKCU\..\Run: [kxj6yy1zwu] C:\DOCUME~1\Owner\LOCALS~1\Temp\mzbc77iwv5w36.exe
O4 - HKCU\..\Run: [w1tiqv484j6nhd6j1h8zb6jhk8xbljt56p2k40b1bfdo] C:\DOCUME~1\Owner\LOCALS~1\Temp\btkzap4q8.exe
O4 - HKCU\..\Run: [rdhyww1dnxgfi6wd7cvktqm6xyv1c79f0e6] C:\DOCUME~1\Owner\LOCALS~1\Temp\r281ky.exe
O4 - HKCU\..\Run: [kuqigvht5oibeye52wnygjijuktbkmgewtuyjfzc] C:\DOCUME~1\Owner\LOCALS~1\Temp\e3ngri.exe
O4 - HKCU\..\Run: [zi47heiequu0tqcwql90f1fm98xm] C:\DOCUME~1\Owner\LOCALS~1\Temp\lbfmxpmli3.exe
O4 - HKCU\..\Run: [d09cj5jid9r02zhty9d7ffd6qflg9kavvy] C:\DOCUME~1\Owner\LOCALS~1\Temp\c1lcpus.exe
O4 - HKCU\..\Run: [sflsi90app385m3vcc6bxpprbe] C:\DOCUME~1\Owner\LOCALS~1\Temp\k3oua1di.exe
O4 - HKCU\..\Run: [yum25xlr7n15jzwdckidhrejxgnhq64a96vzxmgqnu] C:\DOCUME~1\Owner\LOCALS~1\Temp\l2jgw83psh.exe
O4 - HKCU\..\Run: [tlpfkfnlfs4bki3fe4qvrh832i86xxabivro77i] C:\DOCUME~1\Owner\LOCALS~1\Temp\zxqzfgtoybxci.exe
O4 - HKCU\..\Run: [gxdwxhxoj22bf2v4ifsm0i0bbuu8l] C:\DOCUME~1\Owner\LOCALS~1\Temp\xvreou4g5.exe
O4 - HKCU\..\Run: [agxzjyjnyfhd9oolixjvhg5e4154o1gg5ct] C:\DOCUME~1\Owner\LOCALS~1\Temp\y8vfg4q1.exe
O4 - HKCU\..\Run: [ebtu4jbix3977pyc] C:\DOCUME~1\Owner\LOCALS~1\Temp\i65thbh.exe
O4 - HKCU\..\Run: [h44f07nq0z1rumj2zn2njm9] C:\DOCUME~1\Owner\LOCALS~1\Temp\gnj58om6kh2.exe
O4 - HKCU\..\Run: [fm2e7d13025t7jp3tbfo64f297ej] C:\DOCUME~1\Owner\LOCALS~1\Temp\yopsmcvx.exe
O4 - HKCU\..\Run: [j7u6sqkkhv7n3a2gfmejixu43fndliuqln3sk] C:\DOCUME~1\Owner\LOCALS~1\Temp\w1tuk4ujd281k.exe
O4 - HKCU\..\Run: [m1dp4bgggw3z87wb] C:\DOCUME~1\Owner\LOCALS~1\Temp\tx3h9sa.exe
O4 - HKCU\..\Run: [ulfrajeuphil158xsk3v0] C:\DOCUME~1\Owner\LOCALS~1\Temp\wdssuia1m.exe
O4 - HKCU\..\Run: [x2b9p4t9l96cc52s6moz69f6j5fd1alyl50t] C:\DOCUME~1\Owner\LOCALS~1\Temp\njm1v0862okn.exe
O4 - HKCU\..\Run: [zi8kesj4ay25rt9qj0iziz8u] C:\DOCUME~1\Owner\LOCALS~1\Temp\hx3i91gafdo.exe
O4 - HKCU\..\Run: [n7ne7aerlsp80qgj8tboq] C:\DOCUME~1\Owner\LOCALS~1\Temp\pgf3x46ag.exe
O4 - HKCU\..\Run: [qzj9ci824cig9siw1js1u] C:\DOCUME~1\Owner\LOCALS~1\Temp\cxiw6e8z8.exe
O4 - HKCU\..\Run: [r3ss3wbvixa0mrjh3tfplf43k9lv5fczm7d4z4f67vf] C:\DOCUME~1\Owner\LOCALS~1\Temp\vqu55qdu.exe
O4 - HKCU\..\Run: [jorj6sxyf90ybfg5tlkadxl6xzc4] C:\DOCUME~1\Owner\LOCALS~1\Temp\dkmjm675.exe
O4 - HKCU\..\Run: [j175nzz3hafs41] C:\DOCUME~1\Owner\LOCALS~1\Temp\quldcb.exe
O4 - HKCU\..\Run: [ashvlmvm72dychj25nhfwegy45oya5ywor4eml4a6u] C:\DOCUME~1\Owner\LOCALS~1\Temp\guaji4vbfi.exe
O4 - HKCU\..\Run: [osrol6hqebbx65wnizgwcakxmtosotek58lvmld5m] C:\DOCUME~1\Owner\LOCALS~1\Temp\j64i64864soif.exe
O4 - HKCU\..\Run: [sw4evghyzkixj8z2p4z2g5n65ohb7786rpdyuu62mnhf4dnmt] C:\DOCUME~1\Owner\LOCALS~1\Temp\xusmewyglwt.exe
O4 - HKCU\..\Run: [noq8u02h6vlf1ctpzbnf0lvk8nddn5zsr95yi] C:\DOCUME~1\Owner\LOCALS~1\Temp\ehb6xsr42.exe
O4 - HKCU\..\Run: [efcuqryff6zbkzza4wwclrlzoofn6sl0gnpxq] C:\DOCUME~1\Owner\LOCALS~1\Temp\wgtwpa9k246eo.exe
O4 - HKCU\..\Run: [zr7xcg4hvdqbg8n8z9obasr4fyid3tbxteus1rtno8ji] C:\DOCUME~1\Owner\LOCALS~1\Temp\ccii7pgh4ipe.exe
O4 - HKCU\..\Run: [j9v9ke8kl009o3dgdy3bu1v7wk8pbb2srkiyiz70aca99ga] C:\DOCUME~1\Owner\LOCALS~1\Temp\mrndqub.exe
O4 - HKCU\..\Run: [nxqgcqfxbgx170mz] C:\DOCUME~1\Owner\LOCALS~1\Temp\rq7t8ln.exe
O4 - HKCU\..\Run: [z8bufc10bg] C:\DOCUME~1\Owner\LOCALS~1\Temp\yubfiv94.exe
O4 - HKCU\..\Run: [qa549twuj1tfp8vky3zpbfenjh45n50q] C:\DOCUME~1\Owner\LOCALS~1\Temp\ay9xxj7rd.exe
O4 - HKCU\..\Run: [n5vl9x7u6awon7q9amtiwmgtgrr1l0h9x9so2j8ufcw] C:\DOCUME~1\Owner\LOCALS~1\Temp\o488xk1h.exe
O4 - HKCU\..\Run: [qzbzqee5yi5kp0yc8l1k7cuiszj1y0mwg3kxj8w] C:\DOCUME~1\Owner\LOCALS~1\Temp\qb7cf8.exe
O4 - HKCU\..\Run: [qsyv4g6c32uy0n] C:\DOCUME~1\Owner\LOCALS~1\Temp\zub8mu1sil7aq.exe
O4 - HKCU\..\Run: [b58eku0gcuks2i9z8wpi3tjun9red90g4zqib0n9ti3] C:\DOCUME~1\Owner\LOCALS~1\Temp\t24fsm210m.exe
O4 - HKCU\..\Run: [uqkjqx2vccsguy21evy4buyj9jbbtn5h653jmho3] C:\DOCUME~1\Owner\LOCALS~1\Temp\cbmq8cmur.exe
O4 - HKCU\..\Run: [zpm22umw3ytzqkkv92onnna] C:\DOCUME~1\Owner\LOCALS~1\Temp\vifwy73sf.exe
O4 - HKCU\..\Run: [r8bf8iuaadasrvkafw9043ppbw0gq5wpz0xrjkh2e5okz9ksnx] C:\DOCUME~1\Owner\LOCALS~1\Temp\swluqy.exe
O4 - HKCU\..\Run: [ko6vszvjo30urdn1r93azb7fftdpvoqhsrtbpmzu51ake9] C:\DOCUME~1\Owner\LOCALS~1\Temp\kn6uy13le9.exe
O4 - HKCU\..\Run: [v31l98e090j] C:\DOCUME~1\Owner\LOCALS~1\Temp\lqkbjxlau.exe
O4 - HKCU\..\Run: [dlvaah7j8jaorf896wraqkqrn3hvfoudz58] C:\DOCUME~1\Owner\LOCALS~1\Temp\i94ahd46u.exe
O4 - HKCU\..\Run: [kp57386pl3pvfk2f7jffqso74jnbyulzt2wsh3m5h] C:\DOCUME~1\Owner\LOCALS~1\Temp\dbk1ivh9.exe
O4 - HKCU\..\Run: [wdvzjyxa3] C:\DOCUME~1\Owner\LOCALS~1\Temp\fw4fukg3w5.exe
O4 - HKCU\..\Run: [bswsrcrb6df2i07ywqlol7gfygxh4axr6xsik95g8e2ft6uwoe] C:\DOCUME~1\Owner\LOCALS~1\Temp\z71807wqm.exe
O4 - HKCU\..\Run: [a30y7vuegwbrbq2cgh44ev7wpzxu7d8flv5zjo67rr] C:\DOCUME~1\Owner\LOCALS~1\Temp\mhg12soyj.exe
O4 - HKCU\..\Run: [v05pgvcfg] C:\DOCUME~1\Owner\LOCALS~1\Temp\wetdbwfj7.exe
O4 - HKCU\..\Run: [nyw0qab5m6y8a4d5lro] C:\DOCUME~1\Owner\LOCALS~1\Temp\e0vi5z1.exe
O4 - HKCU\..\Run: [xtohaffi26] C:\DOCUME~1\Owner\LOCALS~1\Temp\y70xpbhvr9.exe
O4 - HKCU\..\Run: [ofxj4yiu72b] C:\DOCUME~1\Owner\LOCALS~1\Temp\f7vqhy3.exe
O4 - HKCU\..\Run: [q63lq0gz8ha9ymek7w] C:\DOCUME~1\Owner\LOCALS~1\Temp\k495014ssh7qg.exe
O4 - HKCU\..\Run: [z44a3z77ts5cq5i6sjathyzjrev7w] C:\DOCUME~1\Owner\LOCALS~1\Temp\i89sqke0fnt0.exe
O4 - HKCU\..\Run: [un8j1jrwi3erbat3v6o13kbusdhklchwjh0ke1] C:\DOCUME~1\Owner\LOCALS~1\Temp\hb0xqqyg.exe
O4 - HKCU\..\Run: [bkc5k3mka90nb0sdycc01zjk8zg28r66qof5n3wvj5qqm1zodn] C:\DOCUME~1\Owner\LOCALS~1\Temp\sumbb5u.exe
O4 - HKCU\..\Run: [dd86iz0bmzui9k75h3q6qssxn35f72wlqc0oxxrr245q8le2] C:\DOCUME~1\Owner\LOCALS~1\Temp\dxl7fzo.exe
O4 - HKCU\..\Run: [doauccdrs3ki] C:\DOCUME~1\Owner\LOCALS~1\Temp\zi4980stz.exe
O4 - HKCU\..\Run: [t8xe6639dt2ojdsd1el] C:\DOCUME~1\Owner\LOCALS~1\Temp\ozlq29q0.exe
O4 - HKCU\..\Run: [fjyje3r1ymkqs2mrw2lzf0jq3khtm1hx0] C:\DOCUME~1\Owner\LOCALS~1\Temp\ykc3g63.exe
O4 - HKCU\..\Run: [qfxwc969gixvf18pfee3yq5w] C:\DOCUME~1\Owner\LOCALS~1\Temp\xkhvx6x4d.exe
O4 - HKCU\..\Run: [o61520aazfvu1lebn5vzu6ecbwee6cu9n5j9mz332o1] C:\DOCUME~1\Owner\LOCALS~1\Temp\an8sxtw9ca1f.exe
O4 - HKCU\..\Run: [ljxnrfkwvey4whfkgec3o8t7z7eqi01i5z3wpdj3] C:\DOCUME~1\Owner\LOCALS~1\Temp\nkm00x8ucoes.exe
O4 - HKCU\..\Run: [kmjsgo1nc8jwzvb7rj5e] C:\DOCUME~1\Owner\LOCALS~1\Temp\x8o84km.exe
O4 - HKCU\..\Run: [jq2q5xtoexelymsq2kak3p1fom7qyxjc] C:\DOCUME~1\Owner\LOCALS~1\Temp\yd00sdv659bm5.exe
O4 - HKCU\..\Run: [ngtuox787hhc9lok] C:\DOCUME~1\Owner\LOCALS~1\Temp\ap8289f.exe
O4 - HKCU\..\Run: [hj0v3ev831] C:\DOCUME~1\Owner\LOCALS~1\Temp\x9xs1m.exe
O4 - HKCU\..\Run: [bwxdvgg0cnbdn40785ose] C:\DOCUME~1\Owner\LOCALS~1\Temp\wgius03n.exe
O4 - HKCU\..\Run: [nxun78vnhvz] C:\DOCUME~1\Owner\LOCALS~1\Temp\hu3xiuz.exe
O4 - HKCU\..\Run: [z9xxg4tu7lkz1m7bte2c9oqp4nllrnak5aq1d] C:\DOCUME~1\Owner\LOCALS~1\Temp\jh38zc.exe
O4 - HKCU\..\Run: [rk4k8u3fzisdfko8] C:\DOCUME~1\Owner\LOCALS~1\Temp\h9cweytdar.exe
O4 - HKCU\..\Run: [zprd5gsxw61ztefbpq49bi59jec3w] C:\DOCUME~1\Owner\LOCALS~1\Temp\fzsqqm.exe
O4 - HKCU\..\Run: [ukjydo6teuytr032ahfl21qy5yr4k5wc9jz45h6o0aek4] C:\DOCUME~1\Owner\LOCALS~1\Temp\mdbst5b4f4jj0.exe
O4 - HKCU\..\Run: [bhh30s9o565lr026oe985ia816gfdltzvj30co2k5i] C:\DOCUME~1\Owner\LOCALS~1\Temp\gdmr2tsh.exe
O4 - HKCU\..\Run: [vfz91y1kxwys0j0acu5ywq6l] C:\DOCUME~1\Owner\LOCALS~1\Temp\tiqleo1.exe
O4 - HKCU\..\Run: [lp6lq3kxwvpic1v72isnac4nf5vn2qrwkzd2613r2f5] C:\DOCUME~1\Owner\LOCALS~1\Temp\p05fnmbzpm6.exe
O4 - HKCU\..\Run: [b1ek84yoa5emztb9vc8c2fbtfam1jhp3gxh1pbkw] C:\DOCUME~1\Owner\LOCALS~1\Temp\k7lsl7fzs.exe
O4 - HKCU\..\Run: [uodjj6wfm5x4652yo] C:\DOCUME~1\Owner\LOCALS~1\Temp\ccbo8r7oc.exe
O4 - HKCU\..\Run: [kd9uu09qszr7mtk9cp11moes8ergeh1nazxqn] C:\DOCUME~1\Owner\LOCALS~1\Temp\hy6cms.exe
O4 - HKCU\..\Run: [gkqousah68cdtq2rij0oi6d13lhca13m6jzdsz] C:\DOCUME~1\Owner\LOCALS~1\Temp\b8r0u5y4ebmag.exe
O4 - HKCU\..\Run: [kex7lpchhhag7bgiyre0l6gyd0wt5g] C:\DOCUME~1\Owner\LOCALS~1\Temp\m27bjkm.exe
O4 - HKCU\..\Run: [afhltq0h738dnl5u0qfd97kq1d5r] C:\DOCUME~1\Owner\LOCALS~1\Temp\bpzzwfau.exe
O4 - HKCU\..\Run: [saaho6f0bqdzgr9lrub1ikt6m1912vxsm2snh9x] C:\DOCUME~1\Owner\LOCALS~1\Temp\lxyyz3c49n.exe
O4 - HKCU\..\Run: [b0v080yzvwot27a4jimalouv] C:\DOCUME~1\Owner\LOCALS~1\Temp\tzody5.exe
O4 - HKCU\..\Run: [g96e7jd8vzi70av6d8ipzcly9hgxwmdriqusmmd43ztixae] C:\DOCUME~1\Owner\LOCALS~1\Temp\xsxa5nv.exe
O4 - HKCU\..\Run: [whkuxaneal9vmb84s3mea27i26an] C:\DOCUME~1\Owner\LOCALS~1\Temp\ym1bxx.exe
O4 - HKCU\..\Run: [tv5rfj5iqf4e8079y7] C:\DOCUME~1\Owner\LOCALS~1\Temp\f3q2idl3awp33.exe
O4 - HKCU\..\Run: [cc5eob7jo8v5im7ljc99] C:\DOCUME~1\Owner\LOCALS~1\Temp\pc0ruart4.exe
O4 - HKCU\..\Run: [tj1q904qghjezidw37v6epl8my48bi5rh16b1f9ldsfpac8yb] C:\DOCUME~1\Owner\LOCALS~1\Temp\hxwf23j36e.exe
O4 - HKCU\..\Run: [rwzeowh69x77f1j04sjbfzioa1fy4gfn] C:\DOCUME~1\Owner\LOCALS~1\Temp\ncw4i8.exe
O4 - HKCU\..\Run: [fyyeasxy5olhuopwv79k29yu3scqi7mma4vjru2tyx0d] C:\DOCUME~1\Owner\LOCALS~1\Temp\ms1ycz4pv4x4e.exe
O4 - HKCU\..\Run: [p39559g2nybaw31ubp] C:\DOCUME~1\Owner\LOCALS~1\Temp\y76l7wd3dicvk.exe
O4 - HKCU\..\Run: [zymu36cehr22jx78zkfpq41ugis9r4g] C:\DOCUME~1\Owner\LOCALS~1\Temp\mxmy3irixan6.exe
O4 - HKCU\..\Run: [nrlaj63yrhod7v6g10s5n4s7xp1xnd4lmf0e1h2] C:\DOCUME~1\Owner\LOCALS~1\Temp\xgg0l804tj.exe
O4 - HKCU\..\Run: [j2vefsq9pygnld1kr66llpe] C:\DOCUME~1\Owner\LOCALS~1\Temp\w3ib0ienqkz.exe
O4 - HKCU\..\Run: [mbt1rhq47ivrqtm7cubwfwcnh8p] C:\DOCUME~1\Owner\LOCALS~1\Temp\zenmg0d.exe
O4 - HKCU\..\Run: [olb4f08vd4orycis3d1smork52egh7ubo9vy70qfh5xe] C:\DOCUME~1\Owner\LOCALS~1\Temp\pzy4w980r7.exe
O4 - HKCU\..\Run: [zs68sk2s638mhtttjhelf11xcjytaydt5zr0] C:\DOCUME~1\Owner\LOCALS~1\Temp\j7hvyzst4uds.exe
O4 - HKCU\..\Run: [buz3tzt7c7m1unbko153mcwly4cj2ae6idozv9dp] C:\DOCUME~1\Owner\LOCALS~1\Temp\yxb2vnvs.exe
O4 - HKCU\..\Run: [t8qbsquaab9wr6z0cnc6z9dn1txvqc4fyth8i3m7e7eax8] C:\DOCUME~1\Owner\LOCALS~1\Temp\uyzke01t7a.exe
O4 - HKCU\..\Run: [ipip5ueawscigu0j34615y46k5het970o13tvnnvz9cghf] C:\DOCUME~1\Owner\LOCALS~1\Temp\kcw3mqzh.exe
O4 - HKCU\..\Run: [cilotr420zwevt4bsslmu7c9g] C:\DOCUME~1\Owner\LOCALS~1\Temp\yvokiwtch.exe
O4 - HKCU\..\Run: [v6yfa05c47qbcezvhzifleb30v09350d4e05hzeea8m] C:\DOCUME~1\Owner\LOCALS~1\Temp\aeenf5e06.exe
O4 - HKCU\..\Run: [t9ygrqevzd09ixpoq] C:\DOCUME~1\Owner\LOCALS~1\Temp\ny746ta.exe
O4 - HKCU\..\Run: [bd5dgq2rfrpvf5axxm25bwextb] C:\DOCUME~1\Owner\LOCALS~1\Temp\l9ypy78r.exe
O4 - HKCU\..\Run: [jcuy0bgmbpb6qcmp5cs6bme7kl2lji2] C:\DOCUME~1\Owner\LOCALS~1\Temp\e1drs53ufzwkp.exe
O4 - HKCU\..\Run: [i91wbhym8lo30vqr68f5a33tpna860pfbw6wlku7kll5y] C:\DOCUME~1\Owner\LOCALS~1\Temp\wc24wtk1cjyji.exe
O4 - HKCU\..\Run: [jpzkix7rs740db50ut2pxs] C:\DOCUME~1\Owner\LOCALS~1\Temp\ktq6bu5gdyv.exe
O4 - HKCU\..\Run: [xn60pt9ihngd] C:\DOCUME~1\Owner\LOCALS~1\Temp\lz7v0s.exe
O4 - HKCU\..\Run: [qpq1r0vz2orqt4vgiod34lw] C:\DOCUME~1\Owner\LOCALS~1\Temp\kuxv15ee0b.exe
O4 - HKCU\..\Run: [iow3n143qdx8rqs05f] C:\DOCUME~1\Owner\LOCALS~1\Temp\mhfvlwbd.exe
O4 - HKCU\..\Run: [clbb01rpbqwefczuz5pel8wyh4vlmk5] C:\DOCUME~1\Owner\LOCALS~1\Temp\cskbzdijf.exe
O4 - HKCU\..\Run: [hpt54sy9pvgk1z] C:\DOCUME~1\Owner\LOCALS~1\Temp\yi2fdsb7a01c.exe
O4 - HKCU\..\Run: [fii92xcoa5r0yl6] C:\DOCUME~1\Owner\LOCALS~1\Temp\ed3t2zjek7.exe
O4 - HKCU\..\Run: [n0gj2tq4t6xflc6o4gsrm2vdtcfzmgudyhsbgh] C:\DOCUME~1\Owner\LOCALS~1\Temp\iu0mvdz83wdi.exe
O4 - HKCU\..\Run: [f12s655ioakf345] C:\DOCUME~1\Owner\LOCALS~1\Temp\rj1u4xjupaqf.exe
O4 - HKCU\..\Run: [re073m49y] C:\DOCUME~1\Owner\LOCALS~1\Temp\btu67m2gfv.exe
O4 - HKCU\..\Run: [fkguhtl7wjtvnec37xmk5foq8g2zsj6m8icejshl54zi] C:\DOCUME~1\Owner\LOCALS~1\Temp\rgvlqv99.exe
O4 - HKCU\..\Run: [ol3lk26rwoq] C:\DOCUME~1\Owner\LOCALS~1\Temp\loltwpxn.exe
O4 - HKCU\..\Run: [llk9er4ncglkdrlsipap9occkk2otdkvx1axyywvndgq5vz79] C:\DOCUME~1\Owner\LOCALS~1\Temp\h6p4w49w87.exe
O4 - HKCU\..\Run: [axj04324q619hlrn081a2d8] C:\DOCUME~1\Owner\LOCALS~1\Temp\krbzdpr0j.exe
O4 - HKCU\..\Run: [lldswvx8xoil3d] C:\DOCUME~1\Owner\LOCALS~1\Temp\j51jrqqs.exe
O4 - HKCU\..\Run: [oq1z07gtva8kz8olzt470y2bd42xr4c07b61j9fq38kps] C:\DOCUME~1\Owner\LOCALS~1\Temp\htpi8htpv.exe
O4 - HKCU\..\Run: [zke4b759x1] C:\DOCUME~1\Owner\LOCALS~1\Temp\w5cw37o.exe
O4 - HKCU\..\Run: [ui2xecvqd12pbuhyu] C:\DOCUME~1\Owner\LOCALS~1\Temp\wudioa5f0.exe
O4 - HKCU\..\Run: [yxxs5mrui] C:\DOCUME~1\Owner\LOCALS~1\Temp\wk7f9u7x2yv.exe
O4 - HKCU\..\Run: [nkd1p0yu8nct8awr8cpoh3zdaerff5727c0w346g] C:\DOCUME~1\Owner\LOCALS~1\Temp\rv0onn8x6c4.exe
O4 - HKCU\..\Run: [o73y2vteurj6z6k3y3rgos1zx6uh] C:\DOCUME~1\Owner\LOCALS~1\Temp\yk16rjnr74z.exe
O4 - HKCU\..\Run: [loye3j4wt0q243yc842wdv] C:\DOCUME~1\Owner\LOCALS~1\Temp\vwm54h11nukx.exe
O4 - HKCU\..\Run: [rjtg6hg4n61e7j8i5d7z5u6xdcfce3z] C:\DOCUME~1\Owner\LOCALS~1\Temp\lnqh6pso.exe
O4 - HKCU\..\Run: [jm18l94whn8vl4d] C:\DOCUME~1\Owner\LOCALS~1\Temp\hv2edfj.exe
O4 - HKCU\..\Run: [okd1kvruy5hgh8slg037bxdihee0zdhf0myf] C:\DOCUME~1\Owner\LOCALS~1\Temp\eqfeoxs6.exe
O4 - HKCU\..\Run: [cmm21ax1gxrjbhe8y00lhqzq] C:\DOCUME~1\Owner\LOCALS~1\Temp\zzr0ts5z4.exe
O4 - HKCU\..\Run: [lt0zps4x0j4rejwp3if5o59ula] C:\DOCUME~1\Owner\LOCALS~1\Temp\cxf022o.exe
O4 - HKCU\..\Run: [rzdd2mln6jwxyvg5g2pmh18by1w2noj1m3au8h50m8u] C:\DOCUME~1\Owner\LOCALS~1\Temp\ef6tro.exe
O4 - HKCU\..\Run: [d4qehdn6qirp0u9y7uekvz8wimcaz] C:\DOCUME~1\Owner\LOCALS~1\Temp\ego1qi9.exe
O4 - HKCU\..\Run: [bom7nlphx34s5lvmubw9o51m] C:\DOCUME~1\Owner\LOCALS~1\Temp\qe5ik8.exe
O4 - HKCU\..\Run: [al08l79hc3l7gs006zdo2fm7k8ffhqjkbnrngm1vz0zz] C:\DOCUME~1\Owner\LOCALS~1\Temp\n9zyil44jns.exe
O4 - HKCU\..\Run: [sntcx94845cpn4dtk0iwj83vkin36bpwupp] C:\DOCUME~1\Owner\LOCALS~1\Temp\syyr1en5zfi9y.exe
O4 - HKCU\..\Run: [yhk33jhicx5ahnn3gbrvegqt2txt4lkxwwzjvb89n] C:\DOCUME~1\Owner\LOCALS~1\Temp\txfvsocom0ysn.exe
O4 - HKCU\..\Run: [kqkz2eht5xmg10f2c30utmzes24ay1t40aenf] C:\DOCUME~1\Owner\LOCALS~1\Temp\t5a2mxx5ox.exe
O4 - HKCU\..\Run: [nw3w5nz3x6nixfaicnv15cnxwcw] C:\DOCUME~1\Owner\LOCALS~1\Temp\xstlvl64.exe
O4 - HKCU\..\Run: [yp4d2ybc778sa1dznffwtlpcjgnoapz78cnzcscgy9mycf] C:\DOCUME~1\Owner\LOCALS~1\Temp\k8mqsnwr7.exe
O4 - HKCU\..\Run: [v5ukr3ue89v8u7yc8lldv6t7cng8jarccp] C:\DOCUME~1\Owner\LOCALS~1\Temp\cu44189i0e1sx.exe
O4 - HKCU\..\Run: [twxmm3tklfdumcn9od9hkhatnqyvtda] C:\DOCUME~1\Owner\LOCALS~1\Temp\rzhks2f.exe
O4 - HKCU\..\Run: [iiy328co04wklv426] C:\DOCUME~1\Owner\LOCALS~1\Temp\a82elx5.exe
O4 - HKCU\..\Run: [lvo94o67nkb266u707415o13qjec7j] C:\DOCUME~1\Owner\LOCALS~1\Temp\dz5ecnyperhy9.exe
O4 - HKCU\..\Run: [r22b5hbupaaq7vlhqnr1] C:\DOCUME~1\Owner\LOCALS~1\Temp\i0dq3fpvl5h.exe
O4 - HKCU\..\Run: [zjpe0db2zns0pgvi9o10pwryuphl9xc7vx7z6] C:\DOCUME~1\Owner\LOCALS~1\Temp\t49roi7xkgz9.exe
O4 - HKCU\..\Run: [y7mpyh17wkuee97ymvzjbnyca2fo2zpwmtvs9vco47c] C:\DOCUME~1\Owner\LOCALS~1\Temp\xt491x.exe
O4 - HKCU\..\Run: [d1yyrs06k96xuon6p1i92714g9l04ljgga7buy4tck15a5cq3r] C:\DOCUME~1\Owner\LOCALS~1\Temp\y3omltewlzshh.exe
O4 - HKCU\..\Run: [xwx57zust43t85sqixoqd5j2arrtp5arubx8gzvn3fa55x6jh] C:\DOCUME~1\Owner\LOCALS~1\Temp\uv84k6n2.exe
O4 - HKCU\..\Run: [dmbjblz7ncybotne5lt5r9m62r6bfhsft9bioe61j] C:\DOCUME~1\Owner\LOCALS~1\Temp\bzzssjx.exe
O4 - HKCU\..\Run: [nbmvs93w56eeonuai9klp6] C:\DOCUME~1\Owner\LOCALS~1\Temp\nm5wcwlxs0.exe
O4 - HKCU\..\Run: [qjluv2pnx2zru2i9iulyeskale6p68h9] C:\DOCUME~1\Owner\LOCALS~1\Temp\kfpyfbhcvh.exe
O4 - HKCU\..\Run: [a6009r926ka8l5p8d5b0x1qd49suszlue47n9in71st8nuqak] C:\DOCUME~1\Owner\LOCALS~1\Temp\inchfl.exe
O4 - HKCU\..\Run: [ekyntz0ponth43tj7fyiz8ejzqpbdkla1rjacc267o] C:\DOCUME~1\Owner\LOCALS~1\Temp\mlresl.exe
O4 - HKCU\..\Run: [o82en2dg7ykdi8svody2h2pjky8] C:\DOCUME~1\Owner\LOCALS~1\Temp\hzr5tlqq48.exe
O4 - HKCU\..\Run: [f81u6jwggxs8] C:\DOCUME~1\Owner\LOCALS~1\Temp\p0jz8gx8mctbw.exe
O4 - HKCU\..\Run: [wdw6jzsb6avpoymp1cbmw0jqz1rli0xh2] C:\DOCUME~1\Owner\LOCALS~1\Temp\zg12utc.exe
O4 - HKUS\S-1-5-19\..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\LocalService\Application Data\Macromedia\Common\8b2600321.dll"" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [fekidizeni] Rundll32.exe "C:\WINDOWS\system32\tilafago.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\NetworkService\Application Data\Macromedia\Common\8b2600321.dll"" (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [rundll32.exe] rundll32.exe "C:\WINDOWS\system32\config\systemprofile\Application Data\Macromedia\Common\8b2600321.dll"" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [n0not9xgrxc9zuqfgz8vaoo4rnfjdujz9tf2dge32cp1xo] C:\WINDOWS\TEMP\qpcft82vivwn3.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [j1r0qcisc7aczqznluvdl5d] C:\WINDOWS\TEMP\wka743jrzko.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [eidd265gl2ijodqgv] C:\WINDOWS\TEMP\l73qwa3z7i8.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [v0cpt7e2bw6s2w4q7g2q9q3u] C:\WINDOWS\TEMP\p3bo1ol.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [gywccf2hgp9c6yce1c2tyzb3wf5sk54] C:\WINDOWS\TEMP\aiavxbpyu.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [hrm48uncdkapml60mougv924p4uv7zbqw83av19ja] C:\WINDOWS\TEMP\a01zg5bvycgev.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [rundll32.exe] rundll32.exe "C:\WINDOWS\system32\config\systemprofile\Application Data\Macromedia\Common\8b2600321.dll"" (User 'Default user')
O4 - S-1-5-18 Startup: Vongo Tray.lnk = C:\Program Files\Vongo\Tray.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Vongo Tray.lnk (User 'Default user')
O4 - .DEFAULT User Startup: Vongo Tray.lnk = C:\Program Files\Vongo\Tray.exe (User 'Default user')
O4 - Startup: ChkDisk.lnk = ?
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\qos.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\qos.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\qos.dll
O10 - Unknown file in Winsock LSP: c:\docume~1\owner\locals~1\temp\ntdll64.dll
O10 - Unknown file in Winsock LSP: c:\docume~1\owner\locals~1\temp\ntdll64.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\qos.dll
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=64&bd=pavilion&pf=laptop
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612…ex/qtplugin.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200312…meInstaller.exe
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O20 - AppInit_DLLs: rsstx.dll C:\WINDOWS\system32\gobekado.dll fnvwjk.dll wpkbfp.dll fzlzwh.dll lieyfu.dll C:\WINDOWS\system32\gimemula.dll fpzqgb.dll ihaujx.dll cjpfgn.dll uwjqxh.dll c:\windows\system32\pegojehe.dll
O20 - Winlogon Notify: crypt - C:\WINDOWS\SYSTEM32\crypts.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\pegojehe.dll
O22 - SharedTaskScheduler: carolus - {} - (no file)
O22 - SharedTaskScheduler: klj3r93iorkemnfaja93riemef - {C5BF40A2-94F3-42BD-F434-1604812C8955} - C:\WINDOWS\system32\kjr3iorojdnbfi43unjfd.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\pegojehe.dll
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: Google Update Service (gupdate1c996c6aaa1b06b) (gupdate1c996c6aaa1b06b) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ICF (icf) - Unknown owner - C:\WINDOWS\system32\svchost.exe:ext.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
O23 - Service: Network Provisioning Service xmlprovidsvc (xmlprovidsvc) - Unknown owner - c:\xltwpuh.exe

–
End of file - 41902 bytes

This looks a bit different from other HJT logs I've seen before so I'm hoping I did it right. I just clicked scan and save logfile and this was the Notepad that came up immediately afterward. I appreciate any help you can give me and am very dedicated to fixing my computer! Thanks!

Essexboy

Post #2March 17, 2009, 9:10 PM UTC

Hi there you have what we call a severely infected computer, rather than try to fix it with Hijackthis I will go straight for the big hammer to make my task a little easier. I will need you to copy this programme to the infected system. When you get the prompt for recovery console select NO

Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop.

Link 1
Link 2
Link 3

[external image: Posted Image]

[external image: Posted Image]
——————————————————————–

Double click on Combo-Fix.exe & follow the prompts.

When finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a HijackThis log so we can continue cleaning the system.

mattwest1

Post #3March 18, 2009, 6:21 PM UTC

I went to safe mode with networking and downloaded the ComboFix and renamed it with the dash as instructed. I rebooted in normal startup and I attempted to run Combo-Fix. About 3 minutes into the scan, the message popped up Windows NT is forcing a restart and gave the 1 minute countdown. I wasn't sure what to do so I just let the timer run out and it restarted while the scan from Combo-Fix was still going on. When it came back up, I attempted to start Combo-Fix and it gave me the following message: "C:\Documents and Settings\[username]\Desktop\Combo-Fix.exe Not enough quota is available to process this command. [OK]" So I rebooted again. Then I tried to open up Combo-Fix again and it gave me this message: "Error – Win32 only Incompatible OS. ComboFix only works for workstations with Windows 2000 and XP. (repeated in several different languages) [OK]" So before I did anything further I figured I should consult back here. I have not done so yet, but a question popped up in my mind: Could either of these scans run in safe mode and still produce the logs you need? Thanks for any help you can offer.

Essexboy

Post #4March 18, 2009, 8:46 PM UTC

OK looks like I will have to get my hands dirty

This programme will run in safe mode. The first run will be for me to analyse and generate a fix

To ensure that I get all the information this log will need to be attached (instructions at the end) if it is to large to attach then upload to Mediafire and post the sharing link.

Download OTScanit2 to your Desktop and double-click on it to extract the files. It will create a folder named OTScanIt on your desktop.

Close ALL OTHER PROGRAMS.
Open the OTScanit folder and double-click on OTScanit.exe to start the program.
Check the box that says Scan All Users
Check the Radio button for Rootkit check YES
Under Additional Scans check the following:
- File - Lop Check
- File - Purity Scan
- Evnt - EventViewer Errors/Warnings (last 10)
Now click the Run Scan button on the toolbar.
Let it run unhindered until it finishes.
When the scan is complete Notepad will open with the report file loaded in it.
Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

Please attach the log in your next post.

To attach a file, do the following:

Click Add Reply
Under the reply panel is the Attachments Panel
Browse for the attachment file you want to upload, then click the green Upload button
Once it has uploaded, click the Manage Current Attachments drop down box
Click on [external image: Posted Image] to insert the attachment into your post

mattwest1

Post #5March 19, 2009, 10:10 PM UTC

My goodness this computer is having a difficult time with EVERYTHING! I downloaded the program in safe mode with networking from your link and everything loaded just fine. After closing all other programs, I opened OTScanit2 and followed all instructions before I clicked "Run Scan." About 30 seconds into the scan, I get the following popup message: "Otscanit2 ‘1/1/2099 12’ is not a valid date and time. [OK]" The bar across the bottom has stopped at "Looking for newly created files: C:\WINDOWS\System32\bajajiyi.dll…" Two things to note here. One is that during the scan an IE popup ad came up (my default browser is Firefox). The other is that the Combo-Fix scan from yesterday was interrupted by a forced restart and Combo-Fix, just before the restart happened, gave me a message that said something to the effect of 'the system clock has been changed. Do not change the clock settings they will be restored after the scan.' Pretty soon afterward the comp rebooted and my clock in the bottom corner reads 17:53 instead of 5:53. I figured this may or may not have something to do with the error message in OTScanit2. A continued thanks for taking the time to help me with all of this!

Essexboy

Post #6March 19, 2009, 10:42 PM UTC

OK I am nothing if not persistant

FIRST

A malicious .DLL file is disrupting the LSP chain on your computer. We need to get rid of it.

Please download LSPFix from here.
Run the LSPFix.exe that you have just finished downloading.
Check the I know what I'm doing box.
In the Keep box you should see one or more instances of qos.dll.
Select every instance of qos.dll and move each one to the Remove box by clicking the >> button.
The repeat the above steps for ntdll64.dll
When you are done click Finish>>.

THEN

Download OTListIt2 to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTLI
O4 - HKLM\..\Run: [Criziviki] rundll32.exe "C:\WINDOWS\Ijodijucivic.dll",e
O4 - HKLM\..\Run: [kjahrfoi37rljanfaw3il7fhjd3f] C:\WINDOWS\TEMP\winlogqn.exe
O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe
O4 - HKLM\..\Run: [rs32net] C:\WINDOWS\System32\rs32net.exe
O4 - HKLM\..\Run: [Fzavavohiyesupa] rundll32.exe "C:\WINDOWS\axehejoz.dll",e
O4 - HKLM\..\Run: [fekidizeni] Rundll32.exe "C:\WINDOWS\system32\tilafago.dll",s
O4 - HKLM\..\Run: [6cb3e72c] rundll32.exe "C:\WINDOWS\system32\tumaveko.dll",b
O4 - HKLM\..\Run: [CPM6f80d4b0] Rundll32.exe "c:\windows\system32\pegojehe.dll",a
O4 - HKLM\..\Run: [000000af] rundll32.exe "C:\WINDOWS\system32\tumaveko.dll",b
O4 - HKLM\..\Run: [] Rundll32.exe "c:\windows\system32\pegojehe.dll",a
O4 - HKCU\..\Run: [Antispyware] C:\Program Files\Antispyware\Antispyware.exe -boot
O4 - HKCU\..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\Owner\Application Data\Macromedia\Common\8b2600321.dll""
O4 - HKCU\..\Run: [kjahrfoi37rljanfaw3il7fhjd3f] C:\WINDOWS\TEMP\winlogqn.exe
O4 - HKCU\..\Run: [rs32net] C:\WINDOWS\System32\rs32net.exe
O4 - HKCU\..\Run: [lyko18m79csccyc98a8rtcwx0u6gfbu2o1bf1] C:\WINDOWS\TEMP\lqntf5wmu2.exe
O4 - HKCU\..\Run: [ex3j74oaap2dy] C:\WINDOWS\TEMP\tuz9zh5cbr.exe
O4 - HKCU\..\Run: [k3o296wibl5i3mdnfbp] C:\DOCUME~1\Owner\LOCALS~1\Temp\kbvci62oeo.exe
O4 - HKCU\..\Run: [z7epwd8mfw92r01hbnd0umx9xhfawmq83ylynngdpj5w] C:\WINDOWS\TEMP\mmkskf2e1pq13.exe
O4 - HKCU\..\Run: [k8gmehz8uetlimicz7u] C:\WINDOWS\TEMP\hpnajazk.exe
O4 - HKCU\..\Run: [xzp9m0j3gjslro8bxl2bimy0f] C:\DOCUME~1\Owner\LOCALS~1\Temp\sjelhpljtvee.exe
O4 - HKCU\..\Run: [nz3hwdko99frf02gw979zs8kn5v3j38ry] C:\WINDOWS\TEMP\k16qhaees.exe
O4 - HKCU\..\Run: [t7ygx1eld4ooytf6pl5xwib0u0redvt26fxvs7pk1lxz2] C:\WINDOWS\TEMP\vd1tth.exe
O4 - HKCU\..\Run: [s07zwzz0h] C:\WINDOWS\TEMP\dqh55e.exe
O4 - HKCU\..\Run: [rktq5oj1w5xebw8t1yi3npicjunim26okksyejo] C:\WINDOWS\TEMP\qobhyjv.exe
O4 - HKCU\..\Run: [mzgleo0anpjzhrwi4q5avjt7gf5ikqknkrpx4x8vprdb0v] C:\DOCUME~1\Owner\LOCALS~1\Temp\xni2hvp4dw95h.exe
O4 - HKCU\..\Run: [vsvkyp0d9jc5hqoos2x22fvyws4mxh0ykzfjvfdts65lb5xdq] C:\DOCUME~1\Owner\LOCALS~1\Temp\j1ydqprtjo.exe
O4 - HKCU\..\Run: [i8639nuugrr9lmv5gkl9r] C:\WINDOWS\TEMP\tzxqmem9.exe
O4 - HKCU\..\Run: [ge5vet3nbcgjj9yg0] C:\WINDOWS\TEMP\ff602qcnkhu.exe
O4 - HKCU\..\Run: [ifvs7e0bvuke7h2jpqo8wnjq6bk1qlg] C:\DOCUME~1\Owner\LOCALS~1\Temp\kb786q.exe
O4 - HKCU\..\Run: [fbp6vnwlcxi6remyff33fdc909j485wag818remergd0] C:\DOCUME~1\Owner\LOCALS~1\Temp\gwqazr03.exe
O4 - HKCU\..\Run: [d49r99or3tr] C:\DOCUME~1\Owner\LOCALS~1\Temp\btu13a13gv.exe
O4 - HKCU\..\Run: [d9oolcpue4m80ijgit7m34k4gkr2zlzg3] C:\DOCUME~1\Owner\LOCALS~1\Temp\q4hrfa7g4.exe
O4 - HKCU\..\Run: [livmculy43g5genqijdn7] C:\DOCUME~1\Owner\LOCALS~1\Temp\u8adlyltv58.exe
O4 - HKCU\..\Run: [ynt7ytl8m] C:\DOCUME~1\Owner\LOCALS~1\Temp\kqavc4k.exe
O4 - HKCU\..\Run: [n5ey58em8vocfeh029r6mwgknegjtjg2x6arzo1uul] C:\DOCUME~1\Owner\LOCALS~1\Temp\gnhep6cbzh9v.exe
O4 - HKCU\..\Run: [ai10ivn4opigboz20cv67hy9jhilzu6xe858ap2gh6w3sjle] C:\DOCUME~1\Owner\LOCALS~1\Temp\ureb2k.exe
O4 - HKCU\..\Run: [sljnmyoicwby7] C:\DOCUME~1\Owner\LOCALS~1\Temp\fygeys.exe
O4 - HKCU\..\Run: [cqy93a4lc9ol8jvetwl80nlvm5ee952dy8brut8in35] C:\DOCUME~1\Owner\LOCALS~1\Temp\h95u0kk88.exe
O4 - HKCU\..\Run: [knuuzg2thzpr] C:\DOCUME~1\Owner\LOCALS~1\Temp\p2ogo3s.exe
O4 - HKCU\..\Run: [hu9pni1rd5] C:\DOCUME~1\Owner\LOCALS~1\Temp\mpvr9sf.exe
O4 - HKCU\..\Run: [kgr0daf55faw4ox5n04dhj4xbo18fgylz] C:\DOCUME~1\Owner\LOCALS~1\Temp\bwt4433w.exe
O4 - HKCU\..\Run: [wrdp8hvkzul26yeldalztsnb42ku9yrgjfhg6ski1gucde] C:\DOCUME~1\Owner\LOCALS~1\Temp\i6i0a8.exe
O4 - HKCU\..\Run: [agu12kp59mm61wryhg6jcmlstmozru76bc3qske0z3x5hp] C:\DOCUME~1\Owner\LOCALS~1\Temp\oamaeuf1iz9c5.exe
O4 - HKCU\..\Run: [quqne0hbzm2g2rakhgv626ktwqkokbhak0njmm8w] C:\DOCUME~1\Owner\LOCALS~1\Temp\i7gngcdq5b.exe
O4 - HKCU\..\Run: [d6a2df3n1bi6yxjadtqb2rinc8dkgheuiwzr6juohbi3or08f] C:\DOCUME~1\Owner\LOCALS~1\Temp\uj44u3zu9ndh.exe
O4 - HKCU\..\Run: [pl8hpr9q1t76oaee5x1ko5tplijdz2ovj16kqmn6126rz55ecy] C:\DOCUME~1\Owner\LOCALS~1\Temp\hmag3782g6.exe
O4 - HKCU\..\Run: [p0lwbqj4oenq4jzz] C:\DOCUME~1\Owner\LOCALS~1\Temp\vgsadrufed3.exe
O4 - HKCU\..\Run: [xo8refmqanqjvkfouq2igbueqtp6lcioucqr1duinqursml] C:\DOCUME~1\Owner\LOCALS~1\Temp\b5ux5mnz.exe
O4 - HKCU\..\Run: [agi56fu57rbs06] C:\DOCUME~1\Owner\LOCALS~1\Temp\y1po1vt3uwfm.exe
O4 - HKCU\..\Run: [fyem5goref2erfvkj9ehf4717hq0xq0cf0lthecv] C:\DOCUME~1\Owner\LOCALS~1\Temp\f7co0b8hqa.exe
O4 - HKCU\..\Run: [wlhewpgwr0u5iupm5cj8gg0bwishkqhwb0al0] C:\DOCUME~1\Owner\LOCALS~1\Temp\mt9klctn.exe
O4 - HKCU\..\Run: [au247evuj7ez7pq2oik4m] C:\DOCUME~1\Owner\LOCALS~1\Temp\fm4akou.exe
O4 - HKCU\..\Run: [jijwfegbon86of6cae] C:\DOCUME~1\Owner\LOCALS~1\Temp\l9kkax9.exe
O4 - HKCU\..\Run: [lv5vmewypo5v1yn8g7yvyb7] C:\DOCUME~1\Owner\LOCALS~1\Temp\chca1kx.exe
O4 - HKCU\..\Run: [jo144p8mo760] C:\DOCUME~1\Owner\LOCALS~1\Temp\rz9y055b.exe
O4 - HKCU\..\Run: [nppxw0y5uy5g4gk36fxcy] C:\DOCUME~1\Owner\LOCALS~1\Temp\yqiukoyugrm.exe
O4 - HKCU\..\Run: [msj12xdnklltt99v5o4dpbgmv9xz] C:\DOCUME~1\Owner\LOCALS~1\Temp\tw0yserfjk.exe
O4 - HKCU\..\Run: [m8l9n3scuf1a2haadk4x6lfpkz1kk4obngrzk] C:\DOCUME~1\Owner\LOCALS~1\Temp\dlgeyt.exe
O4 - HKCU\..\Run: [yw70ydx35xnt] C:\DOCUME~1\Owner\LOCALS~1\Temp\qizjzp.exe
O4 - HKCU\..\Run: [slyxaebk01f416v8wkdidi2oxn6yhcj0u2xwyn] C:\DOCUME~1\Owner\LOCALS~1\Temp\nbpltln4brro.exe
O4 - HKCU\..\Run: [npsquavmlfxv1fvr5pfvulfmbjm2] C:\DOCUME~1\Owner\LOCALS~1\Temp\op9cv699.exe
O4 - HKCU\..\Run: [gij5ufbk4m3nsehih25300xre8dtueiez4lqhw8ys1tivr0l] C:\DOCUME~1\Owner\LOCALS~1\Temp\ql959i.exe
O4 - HKCU\..\Run: [q1jms2ep8ujoguk8l8aid1d02pj93gn9k40] C:\DOCUME~1\Owner\LOCALS~1\Temp\yut8swowpk.exe
O4 - HKCU\..\Run: [vtldi9kl3mmnm5yin4mzi76] C:\DOCUME~1\Owner\LOCALS~1\Temp\a0i4l7.exe
O4 - HKCU\..\Run: [yr87iu4mkfk5o4o2j5rhcfaw] C:\DOCUME~1\Owner\LOCALS~1\Temp\achmrq9osne48.exe
O4 - HKCU\..\Run: [x5ee2tygwyy0vsepga1pq611lno7n23h5t8z2rm1] C:\DOCUME~1\Owner\LOCALS~1\Temp\wsoo4b175h.exe
O4 - HKCU\..\Run: [p8g6iphidru44v1wfwg5a5ltpeoga582x75wxhtlnwkc6fe] C:\DOCUME~1\Owner\LOCALS~1\Temp\jvu0dway.exe
O4 - HKCU\..\Run: [z0oz0c8pittw9] C:\DOCUME~1\Owner\LOCALS~1\Temp\icy9ecc.exe
O4 - HKCU\..\Run: [oa7npycu3mu50hc4p2] C:\DOCUME~1\Owner\LOCALS~1\Temp\k2ktc1yb0786q.exe
O4 - HKCU\..\Run: [t4hmodg9dwzosfy2weixxyxqiprnie7] C:\DOCUME~1\Owner\LOCALS~1\Temp\efujt40i.exe
O4 - HKCU\..\Run: [i1kacwwx5ylq17dv5zkq8n3i1cv4fvk] C:\DOCUME~1\Owner\LOCALS~1\Temp\mz1asmk1ai.exe
O4 - HKCU\..\Run: [rgmhmh5v3z6gcfmhh378nch0uq] C:\DOCUME~1\Owner\LOCALS~1\Temp\c76pdt2j8u.exe
O4 - HKCU\..\Run: [xekpzqe43vv2m8] C:\DOCUME~1\Owner\LOCALS~1\Temp\u0f433.exe
O4 - HKCU\..\Run: [pq9nn9v203dmjmw4jcao9d8hizqoahu797wmz] C:\DOCUME~1\Owner\LOCALS~1\Temp\nxwqn1xcqw.exe
O4 - HKCU\..\Run: [fw3upluxg43bdloh] C:\DOCUME~1\Owner\LOCALS~1\Temp\bb479h0naf6.exe
O4 - HKCU\..\Run: [qa7zxku6vnl18mepl7jdyz2yiug8] C:\DOCUME~1\Owner\LOCALS~1\Temp\mpv7dn5jcybi.exe
O4 - HKCU\..\Run: [hm1ygmn695kh] C:\DOCUME~1\Owner\LOCALS~1\Temp\bg7rwtk.exe
O4 - HKCU\..\Run: [g4o2jn1ugy2um7us5cw] C:\DOCUME~1\Owner\LOCALS~1\Temp\m49uskr.exe
O4 - HKCU\..\Run: [cwmi4bm883rnb7y48] C:\DOCUME~1\Owner\LOCALS~1\Temp\c9pl9r.exe
O4 - HKCU\..\Run: [c79486c8fqp61a81taovqnrd] C:\DOCUME~1\Owner\LOCALS~1\Temp\z4dlcd8vb.exe
O4 - HKCU\..\Run: [e6e4zxyfno6heszeehd03] C:\DOCUME~1\Owner\LOCALS~1\Temp\cex59p1xr8t.exe
O4 - HKCU\..\Run: [vvb9fyxpn2zrxpme] C:\DOCUME~1\Owner\LOCALS~1\Temp\k5bv9po7f.exe
O4 - HKCU\..\Run: [bsuzl57of89d9dy86wos2nlx] C:\DOCUME~1\Owner\LOCALS~1\Temp\br61nhbaqfd.exe
O4 - HKCU\..\Run: [dvrxylcv6byrxi48glj2sx1p5q9w2psjzmw3s5qayujx] C:\DOCUME~1\Owner\LOCALS~1\Temp\tefp2kvts.exe
O4 - HKCU\..\Run: [hbxc3rv8jilun5p7r] C:\DOCUME~1\Owner\LOCALS~1\Temp\hic3wydabaq.exe
O4 - HKCU\..\Run: [kn2vu34pggojfhm4] C:\DOCUME~1\Owner\LOCALS~1\Temp\l3csv43.exe
O4 - HKCU\..\Run: [b5cyh2zsku6h] C:\DOCUME~1\Owner\LOCALS~1\Temp\s115j664zxvru.exe
O4 - HKCU\..\Run: [yutckyxzsbvu4nlm0idoahjm7ywd5gfrumzsyxkj2] C:\DOCUME~1\Owner\LOCALS~1\Temp\m6yqj0179.exe
O4 - HKCU\..\Run: [cq1zi9n1hh9lp1qwymvwwdp5ykvvsm1m4gofh97pul4sqbsc] C:\DOCUME~1\Owner\LOCALS~1\Temp\dzutyc.exe
O4 - HKCU\..\Run: [f9z1p8xjrw7fuh8ft3cxn53vj3pb3taa1] C:\DOCUME~1\Owner\LOCALS~1\Temp\z7444jz4u2c.exe
O4 - HKCU\..\Run: [yfehbr370iuli4za23c5da] C:\DOCUME~1\Owner\LOCALS~1\Temp\onzvghc.exe
O4 - HKCU\..\Run: [o9e27sylnnophibapeo] C:\DOCUME~1\Owner\LOCALS~1\Temp\ggb8fpd16ga93.exe
O4 - HKCU\..\Run: [w2r9sewrya4h7sp0qfk5g99hfja1w62q] C:\DOCUME~1\Owner\LOCALS~1\Temp\qnpheg90or.exe
O4 - HKCU\..\Run: [fsd5a1mxffoiztkr4a6ko0esoi4pa7iwc0roodo7ci6wwt] C:\DOCUME~1\Owner\LOCALS~1\Temp\g8q30cqiv9.exe
O4 - HKCU\..\Run: [daj5pc6t6jvh3qulc8u74] C:\DOCUME~1\Owner\LOCALS~1\Temp\rz2s6fxj3m.exe
O4 - HKCU\..\Run: [hsvg6m82emwcpmejdp75ctc2vu0m15kft31iysevg25sljl2u3] C:\DOCUME~1\Owner\LOCALS~1\Temp\wxvj1hl.exe
O4 - HKCU\..\Run: [ewknok3fbiqa9fng58rj34axr3ci8h] C:\DOCUME~1\Owner\LOCALS~1\Temp\p51vandma9e.exe
O4 - HKCU\..\Run: [qfzwh0oworh7] C:\DOCUME~1\Owner\LOCALS~1\Temp\mh0dtgf.exe
O4 - HKCU\..\Run: [wdw7gq849c3xibjhiio95emboi1ufs77oa3b8o] C:\DOCUME~1\Owner\LOCALS~1\Temp\hooouwzumqp.exe
O4 - HKCU\..\Run: [s1f6uedro8zdt1x2hcroxjhrrv1uebg6a8m1jtwkul] C:\DOCUME~1\Owner\LOCALS~1\Temp\l884jrphkkr.exe
O4 - HKCU\..\Run: [merrshk6onqck9xkqwpf3zq] C:\DOCUME~1\Owner\LOCALS~1\Temp\uym1sm1.exe
O4 - HKCU\..\Run: [p284z205jtyl8e04wbetcvmaejg2f9wvaw6di37zbpo0q] C:\DOCUME~1\Owner\LOCALS~1\Temp\ca262ad1.exe
O4 - HKCU\..\Run: [r7x9wiftpzj32anqvjeo02n5w1vun4ndmxgkv3v] C:\DOCUME~1\Owner\LOCALS~1\Temp\ejils9fqh.exe
O4 - HKCU\..\Run: [y2tbkov41d8m6vz6vb1ul8] C:\DOCUME~1\Owner\LOCALS~1\Temp\wwr7yiw7n2e.exe
O4 - HKCU\..\Run: [bnehkdh7xi6xonlq0fwxtp] C:\DOCUME~1\Owner\LOCALS~1\Temp\xr70ek0ld.exe
O4 - HKCU\..\Run: [gvtpdiyeje06brnuvvd] C:\DOCUME~1\Owner\LOCALS~1\Temp\i4arv1upwoqe.exe
O4 - HKCU\..\Run: [jn1xheyp0ci3vyzv3q89gq3j6] C:\DOCUME~1\Owner\LOCALS~1\Temp\sq7mckyna1u3.exe
O4 - HKCU\..\Run: [zp9b2mfv4ab1pxgfwmrjv9tlqjp9y1y1ekck5vijcvobge] C:\DOCUME~1\Owner\LOCALS~1\Temp\j8uf943s.exe
O4 - HKCU\..\Run: [gapuutw6hqdbpwejhzg1v5b2zmkdzngfv31pwxa867k5jy] C:\DOCUME~1\Owner\LOCALS~1\Temp\fuxg3y.exe
O4 - HKCU\..\Run: [sy7x43slin] C:\DOCUME~1\Owner\LOCALS~1\Temp\quy158f6c911c.exe
O4 - HKCU\..\Run: [mirj536kuurgdo5ihhuz2nbfmv] C:\DOCUME~1\Owner\LOCALS~1\Temp\u5zl8dy6bzc.exe
O4 - HKCU\..\Run: [aa83zj615kca655qx] C:\DOCUME~1\Owner\LOCALS~1\Temp\d2zd95n9llx.exe
O4 - HKCU\..\Run: [ktjt1vb43k6cybncorjittse5] C:\DOCUME~1\Owner\LOCALS~1\Temp\slk87tkhy.exe
O4 - HKCU\..\Run: [w04xasozy49gmoe8c] C:\DOCUME~1\Owner\LOCALS~1\Temp\walqbpzsz.exe
O4 - HKCU\..\Run: [i0h48xixjb58nue0enhtb1dye0kk] C:\DOCUME~1\Owner\LOCALS~1\Temp\q8kj1p5eatvf.exe
O4 - HKCU\..\Run: [rkj548drlmjw2wvvc6lyfvszim5hy0vtxaok6u] C:\DOCUME~1\Owner\LOCALS~1\Temp\gy1zye.exe
O4 - HKCU\..\Run: [nfqbmxi6brqhhagl2140qqg6dl] C:\DOCUME~1\Owner\LOCALS~1\Temp\hzrpcgnkerf.exe
O4 - HKCU\..\Run: [dgsxzxoyekajj8jug10] C:\DOCUME~1\Owner\LOCALS~1\Temp\dl29dyq6t8yc.exe
O4 - HKCU\..\Run: [e6uke3cborcnzih1cdajpaycashqxohg] C:\DOCUME~1\Owner\LOCALS~1\Temp\q4dg2v6.exe
O4 - HKCU\..\Run: [l08c5auuvlzs3ojzzu8lf28bm] C:\DOCUME~1\Owner\LOCALS~1\Temp\d6u3m4ei7bgk1.exe
O4 - HKCU\..\Run: [m9hv95inr92ct8m9nfnf63rzb] C:\DOCUME~1\Owner\LOCALS~1\Temp\u9qu7atw5f9.exe
O4 - HKCU\..\Run: [vp7kq14sey9842am59ovpa7rw0eu3vlcu9uru58x] C:\DOCUME~1\Owner\LOCALS~1\Temp\v1zybhsduk.exe
O4 - HKCU\..\Run: [sd9yssmk0rthht2cs92ru] C:\DOCUME~1\Owner\LOCALS~1\Temp\ko155grunnw.exe
O4 - HKCU\..\Run: [gxfw117rtsxwopjuicofw] C:\DOCUME~1\Owner\LOCALS~1\Temp\te0vexjo.exe
O4 - HKCU\..\Run: [tiynj28lg] C:\DOCUME~1\Owner\LOCALS~1\Temp\wrz138.exe
O4 - HKCU\..\Run: [k6mk5haqo] C:\DOCUME~1\Owner\LOCALS~1\Temp\kr4lljjfz25rh.exe
O4 - HKCU\..\Run: [pejjo6e0uin01u5kfu132u6gvxijr5ow494oh4caelta] C:\DOCUME~1\Owner\LOCALS~1\Temp\kwcqbvhuj4.exe
O4 - HKCU\..\Run: [ijxa2jtm68qov] C:\DOCUME~1\Owner\LOCALS~1\Temp\h5g001vy.exe
O4 - HKCU\..\Run: [ftta424hb5vfw5ozf] C:\DOCUME~1\Owner\LOCALS~1\Temp\qkelu3ue.exe
O4 - HKCU\..\Run: [j494fdv9iiv9ym3xy9smilj8pqj3kkez0q9utw7w1g1klo] C:\DOCUME~1\Owner\LOCALS~1\Temp\hmcjxid7aq.exe
O4 - HKCU\..\Run: [pqjabtjqpvc6mjezxs3wbb1860p4] C:\DOCUME~1\Owner\LOCALS~1\Temp\ciu3m62ifyo5.exe
O4 - HKCU\..\Run: [urskus2hwui7rdh5hipp7a] C:\DOCUME~1\Owner\LOCALS~1\Temp\w1e2k34efyun.exe
O4 - HKCU\..\Run: [qpqugcmh2d2qyooyvhbbd0cjao3z7e4fx] C:\DOCUME~1\Owner\LOCALS~1\Temp\uuezgj5.exe
O4 - HKCU\..\Run: [y5n38lzamrn1atf0xak5i4lx6spkikheznh0qu] C:\DOCUME~1\Owner\LOCALS~1\Temp\m7wjo7uxq.exe
O4 - HKCU\..\Run: [yg3t1teihbr4wwlitudxspgdqc2mv] C:\DOCUME~1\Owner\LOCALS~1\Temp\r0spwpg.exe
O4 - HKCU\..\Run: [j5rx1k47ahjklcbh5hb63erkakkrzxrcnhr3f] C:\DOCUME~1\Owner\LOCALS~1\Temp\y9vxni10wps2j.exe
O4 - HKCU\..\Run: [oybeq4k3g73niu4xffgt3jeurqt74vtqq9cvhm] C:\DOCUME~1\Owner\LOCALS~1\Temp\za4f8rjedz5ao.exe
O4 - HKCU\..\Run: [veromrp1qsb3ay] C:\DOCUME~1\Owner\LOCALS~1\Temp\gu2voq.exe
O4 - HKCU\..\Run: [jo76vrrjeu1evwnzv09krghu] C:\DOCUME~1\Owner\LOCALS~1\Temp\cnjl0o.exe
O4 - HKCU\..\Run: [dibg1te2sudj1dyhvfo] C:\DOCUME~1\Owner\LOCALS~1\Temp\ujwmqtct2nnj.exe
O4 - HKCU\..\Run: [sdu2qmcpoaq] C:\DOCUME~1\Owner\LOCALS~1\Temp\ra8twlu2k.exe
O4 - HKCU\..\Run: [xpy9z9xkey0fpclgm521iwgoiy8rw4y1qj40qi3ac3rgp09tdy] C:\DOCUME~1\Owner\LOCALS~1\Temp\d0c5ov.exe
O4 - HKCU\..\Run: [vig53ojwpvno298jvjsmauh2yfqoos] C:\DOCUME~1\Owner\LOCALS~1\Temp\nlwsjph.exe
O4 - HKCU\..\Run: [snn3oj5gcn4h9] C:\DOCUME~1\Owner\LOCALS~1\Temp\fnpkn6.exe
O4 - HKCU\..\Run: [w7k7ecetuwkp198ziwe1sz83xxi94dgxm37] C:\DOCUME~1\Owner\LOCALS~1\Temp\nnt6qtgv.exe
O4 - HKCU\..\Run: [siamvljnoa6kswei4zz4g9yrlw44rhu] C:\DOCUME~1\Owner\LOCALS~1\Temp\qtyev5xh.exe
O4 - HKCU\..\Run: [s60sfiqw2wsr03qubna9v] C:\DOCUME~1\Owner\LOCALS~1\Temp\vzfsayuc.exe
O4 - HKCU\..\Run: [exe5ye7iwsghuglj5v6mx4y9xpfm53fwxocmuimfxazdtp7z] C:\DOCUME~1\Owner\LOCALS~1\Temp\ws2omf0aidd.exe
O4 - HKCU\..\Run: [gsthh4yl8crrnk5n2fokkvg4lf4grw4o6znvio15hq9o] C:\DOCUME~1\Owner\LOCALS~1\Temp\j3v64cctg3.exe
O4 - HKCU\..\Run: [itswh9e591at5bgycx0oxrfktg] C:\DOCUME~1\Owner\LOCALS~1\Temp\fbf2rp.exe
O4 - HKCU\..\Run: [s64nyub2khwz5hdppwgngeiagcd3b92o77ngd0q4uq1e1] C:\DOCUME~1\Owner\LOCALS~1\Temp\d3rc17b6.exe
O4 - HKCU\..\Run: [o07u7u8kv8d9rhedn5cjbi6er9pwznvrezppksh28] C:\DOCUME~1\Owner\LOCALS~1\Temp\pqmylpt.exe
O4 - HKCU\..\Run: [eoztvh87mgv15tsbhqfnoawq91y1doxzso1hwadkq] C:\DOCUME~1\Owner\LOCALS~1\Temp\efj1e91nieadt.exe
O4 - HKCU\..\Run: [gl5zz4uambro67rvalvpz5] C:\DOCUME~1\Owner\LOCALS~1\Temp\dojl6w06gom.exe
O4 - HKCU\..\Run: [jmjm2d6e8bv5uw1nc91lub3wrvk00apzx1nh88] C:\DOCUME~1\Owner\LOCALS~1\Temp\xvflot.exe
O4 - HKCU\..\Run: [o4hzojs71dnsusko36cwcplhnv09ty6] C:\DOCUME~1\Owner\LOCALS~1\Temp\yd7po3eq.exe
O4 - HKCU\..\Run: [anorusrydcp] C:\DOCUME~1\Owner\LOCALS~1\Temp\m3h6hyzm21d.exe
O4 - HKCU\..\Run: [roavz2t31i9s3e] C:\DOCUME~1\Owner\LOCALS~1\Temp\e883ua.exe
O4 - HKCU\..\Run: [a74o93a8cm7phb5wg5d6jeiuwube49t01oemb0m63nf4xew] C:\DOCUME~1\Owner\LOCALS~1\Temp\w4wntf.exe
O4 - HKCU\..\Run: [m24e0wa3g6cw9hday] C:\DOCUME~1\Owner\LOCALS~1\Temp\cq9p5xklz.exe
O4 - HKCU\..\Run: [rv5eo7e1dozm8vawoudt0gr] C:\DOCUME~1\Owner\LOCALS~1\Temp\umxql2bci.exe
O4 - HKCU\..\Run: [z5mfq7bop5j1x4fj6w2orl9jkdladb] C:\DOCUME~1\Owner\LOCALS~1\Temp\r44hxtt2td.exe
O4 - HKCU\..\Run: [a7x699x8cfb2qux] C:\DOCUME~1\Owner\LOCALS~1\Temp\q58ehz19.exe
O4 - HKCU\..\Run: [fxqyjlom6df45ddzhw7fb4p] C:\DOCUME~1\Owner\LOCALS~1\Temp\arp80ovanzx.exe
O4 - HKCU\..\Run: [olq0qja2vkfz0io6i5zvf8] C:\DOCUME~1\Owner\LOCALS~1\Temp\gcc20y304hysj.exe
O4 - HKCU\..\Run: [kxj6yy1zwu] C:\DOCUME~1\Owner\LOCALS~1\Temp\mzbc77iwv5w36.exe
O4 - HKCU\..\Run: [w1tiqv484j6nhd6j1h8zb6jhk8xbljt56p2k40b1bfdo] C:\DOCUME~1\Owner\LOCALS~1\Temp\btkzap4q8.exe
O4 - HKCU\..\Run: [rdhyww1dnxgfi6wd7cvktqm6xyv1c79f0e6] C:\DOCUME~1\Owner\LOCALS~1\Temp\r281ky.exe
O4 - HKCU\..\Run: [kuqigvht5oibeye52wnygjijuktbkmgewtuyjfzc] C:\DOCUME~1\Owner\LOCALS~1\Temp\e3ngri.exe
O4 - HKCU\..\Run: [zi47heiequu0tqcwql90f1fm98xm] C:\DOCUME~1\Owner\LOCALS~1\Temp\lbfmxpmli3.exe
O4 - HKCU\..\Run: [d09cj5jid9r02zhty9d7ffd6qflg9kavvy] C:\DOCUME~1\Owner\LOCALS~1\Temp\c1lcpus.exe
O4 - HKCU\..\Run: [sflsi90app385m3vcc6bxpprbe] C:\DOCUME~1\Owner\LOCALS~1\Temp\k3oua1di.exe
O4 - HKCU\..\Run: [yum25xlr7n15jzwdckidhrejxgnhq64a96vzxmgqnu] C:\DOCUME~1\Owner\LOCALS~1\Temp\l2jgw83psh.exe
O4 - HKCU\..\Run: [tlpfkfnlfs4bki3fe4qvrh832i86xxabivro77i] C:\DOCUME~1\Owner\LOCALS~1\Temp\zxqzfgtoybxci.exe
O4 - HKCU\..\Run: [gxdwxhxoj22bf2v4ifsm0i0bbuu8l] C:\DOCUME~1\Owner\LOCALS~1\Temp\xvreou4g5.exe
O4 - HKCU\..\Run: [agxzjyjnyfhd9oolixjvhg5e4154o1gg5ct] C:\DOCUME~1\Owner\LOCALS~1\Temp\y8vfg4q1.exe
O4 - HKCU\..\Run: [ebtu4jbix3977pyc] C:\DOCUME~1\Owner\LOCALS~1\Temp\i65thbh.exe
O4 - HKCU\..\Run: [h44f07nq0z1rumj2zn2njm9] C:\DOCUME~1\Owner\LOCALS~1\Temp\gnj58om6kh2.exe
O4 - HKCU\..\Run: [fm2e7d13025t7jp3tbfo64f297ej] C:\DOCUME~1\Owner\LOCALS~1\Temp\yopsmcvx.exe
O4 - HKCU\..\Run: [j7u6sqkkhv7n3a2gfmejixu43fndliuqln3sk] C:\DOCUME~1\Owner\LOCALS~1\Temp\w1tuk4ujd281k.exe
O4 - HKCU\..\Run: [m1dp4bgggw3z87wb] C:\DOCUME~1\Owner\LOCALS~1\Temp\tx3h9sa.exe
O4 - HKCU\..\Run: [ulfrajeuphil158xsk3v0] C:\DOCUME~1\Owner\LOCALS~1\Temp\wdssuia1m.exe
O4 - HKCU\..\Run: [x2b9p4t9l96cc52s6moz69f6j5fd1alyl50t] C:\DOCUME~1\Owner\LOCALS~1\Temp\njm1v0862okn.exe
O4 - HKCU\..\Run: [zi8kesj4ay25rt9qj0iziz8u] C:\DOCUME~1\Owner\LOCALS~1\Temp\hx3i91gafdo.exe
O4 - HKCU\..\Run: [n7ne7aerlsp80qgj8tboq] C:\DOCUME~1\Owner\LOCALS~1\Temp\pgf3x46ag.exe
O4 - HKCU\..\Run: [qzj9ci824cig9siw1js1u] C:\DOCUME~1\Owner\LOCALS~1\Temp\cxiw6e8z8.exe
O4 - HKCU\..\Run: [r3ss3wbvixa0mrjh3tfplf43k9lv5fczm7d4z4f67vf] C:\DOCUME~1\Owner\LOCALS~1\Temp\vqu55qdu.exe
O4 - HKCU\..\Run: [jorj6sxyf90ybfg5tlkadxl6xzc4] C:\DOCUME~1\Owner\LOCALS~1\Temp\dkmjm675.exe
O4 - HKCU\..\Run: [j175nzz3hafs41] C:\DOCUME~1\Owner\LOCALS~1\Temp\quldcb.exe
O4 - HKCU\..\Run: [ashvlmvm72dychj25nhfwegy45oya5ywor4eml4a6u] C:\DOCUME~1\Owner\LOCALS~1\Temp\guaji4vbfi.exe
O4 - HKCU\..\Run: [osrol6hqebbx65wnizgwcakxmtosotek58lvmld5m] C:\DOCUME~1\Owner\LOCALS~1\Temp\j64i64864soif.exe
O4 - HKCU\..\Run: [sw4evghyzkixj8z2p4z2g5n65ohb7786rpdyuu62mnhf4dnmt] C:\DOCUME~1\Owner\LOCALS~1\Temp\xusmewyglwt.exe
O4 - HKCU\..\Run: [noq8u02h6vlf1ctpzbnf0lvk8nddn5zsr95yi] C:\DOCUME~1\Owner\LOCALS~1\Temp\ehb6xsr42.exe
O4 - HKCU\..\Run: [efcuqryff6zbkzza4wwclrlzoofn6sl0gnpxq] C:\DOCUME~1\Owner\LOCALS~1\Temp\wgtwpa9k246eo.exe
O4 - HKCU\..\Run: [zr7xcg4hvdqbg8n8z9obasr4fyid3tbxteus1rtno8ji] C:\DOCUME~1\Owner\LOCALS~1\Temp\ccii7pgh4ipe.exe
O4 - HKCU\..\Run: [j9v9ke8kl009o3dgdy3bu1v7wk8pbb2srkiyiz70aca99ga] C:\DOCUME~1\Owner\LOCALS~1\Temp\mrndqub.exe
O4 - HKCU\..\Run: [nxqgcqfxbgx170mz] C:\DOCUME~1\Owner\LOCALS~1\Temp\rq7t8ln.exe
O4 - HKCU\..\Run: [z8bufc10bg] C:\DOCUME~1\Owner\LOCALS~1\Temp\yubfiv94.exe
O4 - HKCU\..\Run: [qa549twuj1tfp8vky3zpbfenjh45n50q] C:\DOCUME~1\Owner\LOCALS~1\Temp\ay9xxj7rd.exe
O4 - HKCU\..\Run: [n5vl9x7u6awon7q9amtiwmgtgrr1l0h9x9so2j8ufcw] C:\DOCUME~1\Owner\LOCALS~1\Temp\o488xk1h.exe
O4 - HKCU\..\Run: [qzbzqee5yi5kp0yc8l1k7cuiszj1y0mwg3kxj8w] C:\DOCUME~1\Owner\LOCALS~1\Temp\qb7cf8.exe
O4 - HKCU\..\Run: [qsyv4g6c32uy0n] C:\DOCUME~1\Owner\LOCALS~1\Temp\zub8mu1sil7aq.exe
O4 - HKCU\..\Run: [b58eku0gcuks2i9z8wpi3tjun9red90g4zqib0n9ti3] C:\DOCUME~1\Owner\LOCALS~1\Temp\t24fsm210m.exe
O4 - HKCU\..\Run: [uqkjqx2vccsguy21evy4buyj9jbbtn5h653jmho3] C:\DOCUME~1\Owner\LOCALS~1\Temp\cbmq8cmur.exe
O4 - HKCU\..\Run: [zpm22umw3ytzqkkv92onnna] C:\DOCUME~1\Owner\LOCALS~1\Temp\vifwy73sf.exe
O4 - HKCU\..\Run: [r8bf8iuaadasrvkafw9043ppbw0gq5wpz0xrjkh2e5okz9ksnx] C:\DOCUME~1\Owner\LOCALS~1\Temp\swluqy.exe
O4 - HKCU\..\Run: [ko6vszvjo30urdn1r93azb7fftdpvoqhsrtbpmzu51ake9] C:\DOCUME~1\Owner\LOCALS~1\Temp\kn6uy13le9.exe
O4 - HKCU\..\Run: [v31l98e090j] C:\DOCUME~1\Owner\LOCALS~1\Temp\lqkbjxlau.exe
O4 - HKCU\..\Run: [dlvaah7j8jaorf896wraqkqrn3hvfoudz58] C:\DOCUME~1\Owner\LOCALS~1\Temp\i94ahd46u.exe
O4 - HKCU\..\Run: [kp57386pl3pvfk2f7jffqso74jnbyulzt2wsh3m5h] C:\DOCUME~1\Owner\LOCALS~1\Temp\dbk1ivh9.exe
O4 - HKCU\..\Run: [wdvzjyxa3] C:\DOCUME~1\Owner\LOCALS~1\Temp\fw4fukg3w5.exe
O4 - HKCU\..\Run: [bswsrcrb6df2i07ywqlol7gfygxh4axr6xsik95g8e2ft6uwoe] C:\DOCUME~1\Owner\LOCALS~1\Temp\z71807wqm.exe
O4 - HKCU\..\Run: [a30y7vuegwbrbq2cgh44ev7wpzxu7d8flv5zjo67rr] C:\DOCUME~1\Owner\LOCALS~1\Temp\mhg12soyj.exe
O4 - HKCU\..\Run: [v05pgvcfg] C:\DOCUME~1\Owner\LOCALS~1\Temp\wetdbwfj7.exe
O4 - HKCU\..\Run: [nyw0qab5m6y8a4d5lro] C:\DOCUME~1\Owner\LOCALS~1\Temp\e0vi5z1.exe
O4 - HKCU\..\Run: [xtohaffi26] C:\DOCUME~1\Owner\LOCALS~1\Temp\y70xpbhvr9.exe
O4 - HKCU\..\Run: [ofxj4yiu72b] C:\DOCUME~1\Owner\LOCALS~1\Temp\f7vqhy3.exe
O4 - HKCU\..\Run: [q63lq0gz8ha9ymek7w] C:\DOCUME~1\Owner\LOCALS~1\Temp\k495014ssh7qg.exe
O4 - HKCU\..\Run: [z44a3z77ts5cq5i6sjathyzjrev7w] C:\DOCUME~1\Owner\LOCALS~1\Temp\i89sqke0fnt0.exe
O4 - HKCU\..\Run: [un8j1jrwi3erbat3v6o13kbusdhklchwjh0ke1] C:\DOCUME~1\Owner\LOCALS~1\Temp\hb0xqqyg.exe
O4 - HKCU\..\Run: [bkc5k3mka90nb0sdycc01zjk8zg28r66qof5n3wvj5qqm1zodn] C:\DOCUME~1\Owner\LOCALS~1\Temp\sumbb5u.exe
O4 - HKCU\..\Run: [dd86iz0bmzui9k75h3q6qssxn35f72wlqc0oxxrr245q8le2] C:\DOCUME~1\Owner\LOCALS~1\Temp\dxl7fzo.exe
O4 - HKCU\..\Run: [doauccdrs3ki] C:\DOCUME~1\Owner\LOCALS~1\Temp\zi4980stz.exe
O4 - HKCU\..\Run: [t8xe6639dt2ojdsd1el] C:\DOCUME~1\Owner\LOCALS~1\Temp\ozlq29q0.exe
O4 - HKCU\..\Run: [fjyje3r1ymkqs2mrw2lzf0jq3khtm1hx0] C:\DOCUME~1\Owner\LOCALS~1\Temp\ykc3g63.exe
O4 - HKCU\..\Run: [qfxwc969gixvf18pfee3yq5w] C:\DOCUME~1\Owner\LOCALS~1\Temp\xkhvx6x4d.exe
O4 - HKCU\..\Run: [o61520aazfvu1lebn5vzu6ecbwee6cu9n5j9mz332o1] C:\DOCUME~1\Owner\LOCALS~1\Temp\an8sxtw9ca1f.exe
O4 - HKCU\..\Run: [ljxnrfkwvey4whfkgec3o8t7z7eqi01i5z3wpdj3] C:\DOCUME~1\Owner\LOCALS~1\Temp\nkm00x8ucoes.exe
O4 - HKCU\..\Run: [kmjsgo1nc8jwzvb7rj5e] C:\DOCUME~1\Owner\LOCALS~1\Temp\x8o84km.exe
O4 - HKCU\..\Run: [jq2q5xtoexelymsq2kak3p1fom7qyxjc] C:\DOCUME~1\Owner\LOCALS~1\Temp\yd00sdv659bm5.exe
O4 - HKCU\..\Run: [ngtuox787hhc9lok] C:\DOCUME~1\Owner\LOCALS~1\Temp\ap8289f.exe
O4 - HKCU\..\Run: [hj0v3ev831] C:\DOCUME~1\Owner\LOCALS~1\Temp\x9xs1m.exe
O4 - HKCU\..\Run: [bwxdvgg0cnbdn40785ose] C:\DOCUME~1\Owner\LOCALS~1\Temp\wgius03n.exe
O4 - HKCU\..\Run: [nxun78vnhvz] C:\DOCUME~1\Owner\LOCALS~1\Temp\hu3xiuz.exe
O4 - HKCU\..\Run: [z9xxg4tu7lkz1m7bte2c9oqp4nllrnak5aq1d] C:\DOCUME~1\Owner\LOCALS~1\Temp\jh38zc.exe
O4 - HKCU\..\Run: [rk4k8u3fzisdfko8] C:\DOCUME~1\Owner\LOCALS~1\Temp\h9cweytdar.exe
O4 - HKCU\..\Run: [zprd5gsxw61ztefbpq49bi59jec3w] C:\DOCUME~1\Owner\LOCALS~1\Temp\fzsqqm.exe
O4 - HKCU\..\Run: [ukjydo6teuytr032ahfl21qy5yr4k5wc9jz45h6o0aek4] C:\DOCUME~1\Owner\LOCALS~1\Temp\mdbst5b4f4jj0.exe
O4 - HKCU\..\Run: [bhh30s9o565lr026oe985ia816gfdltzvj30co2k5i] C:\DOCUME~1\Owner\LOCALS~1\Temp\gdmr2tsh.exe
O4 - HKCU\..\Run: [vfz91y1kxwys0j0acu5ywq6l] C:\DOCUME~1\Owner\LOCALS~1\Temp\tiqleo1.exe
O4 - HKCU\..\Run: [lp6lq3kxwvpic1v72isnac4nf5vn2qrwkzd2613r2f5] C:\DOCUME~1\Owner\LOCALS~1\Temp\p05fnmbzpm6.exe
O4 - HKCU\..\Run: [b1ek84yoa5emztb9vc8c2fbtfam1jhp3gxh1pbkw] C:\DOCUME~1\Owner\LOCALS~1\Temp\k7lsl7fzs.exe
O4 - HKCU\..\Run: [uodjj6wfm5x4652yo] C:\DOCUME~1\Owner\LOCALS~1\Temp\ccbo8r7oc.exe
O4 - HKCU\..\Run: [kd9uu09qszr7mtk9cp11moes8ergeh1nazxqn] C:\DOCUME~1\Owner\LOCALS~1\Temp\hy6cms.exe
O4 - HKCU\..\Run: [gkqousah68cdtq2rij0oi6d13lhca13m6jzdsz] C:\DOCUME~1\Owner\LOCALS~1\Temp\b8r0u5y4ebmag.exe
O4 - HKCU\..\Run: [kex7lpchhhag7bgiyre0l6gyd0wt5g] C:\DOCUME~1\Owner\LOCALS~1\Temp\m27bjkm.exe
O4 - HKCU\..\Run: [afhltq0h738dnl5u0qfd97kq1d5r] C:\DOCUME~1\Owner\LOCALS~1\Temp\bpzzwfau.exe
O4 - HKCU\..\Run: [saaho6f0bqdzgr9lrub1ikt6m1912vxsm2snh9x] C:\DOCUME~1\Owner\LOCALS~1\Temp\lxyyz3c49n.exe
O4 - HKCU\..\Run: [b0v080yzvwot27a4jimalouv] C:\DOCUME~1\Owner\LOCALS~1\Temp\tzody5.exe
O4 - HKCU\..\Run: [g96e7jd8vzi70av6d8ipzcly9hgxwmdriqusmmd43ztixae] C:\DOCUME~1\Owner\LOCALS~1\Temp\xsxa5nv.exe
O4 - HKCU\..\Run: [whkuxaneal9vmb84s3mea27i26an] C:\DOCUME~1\Owner\LOCALS~1\Temp\ym1bxx.exe
O4 - HKCU\..\Run: [tv5rfj5iqf4e8079y7] C:\DOCUME~1\Owner\LOCALS~1\Temp\f3q2idl3awp33.exe
O4 - HKCU\..\Run: [cc5eob7jo8v5im7ljc99] C:\DOCUME~1\Owner\LOCALS~1\Temp\pc0ruart4.exe
O4 - HKCU\..\Run: [tj1q904qghjezidw37v6epl8my48bi5rh16b1f9ldsfpac8yb] C:\DOCUME~1\Owner\LOCALS~1\Temp\hxwf23j36e.exe
O4 - HKCU\..\Run: [rwzeowh69x77f1j04sjbfzioa1fy4gfn] C:\DOCUME~1\Owner\LOCALS~1\Temp\ncw4i8.exe
O4 - HKCU\..\Run: [fyyeasxy5olhuopwv79k29yu3scqi7mma4vjru2tyx0d] C:\DOCUME~1\Owner\LOCALS~1\Temp\ms1ycz4pv4x4e.exe
O4 - HKCU\..\Run: [p39559g2nybaw31ubp] C:\DOCUME~1\Owner\LOCALS~1\Temp\y76l7wd3dicvk.exe
O4 - HKCU\..\Run: [zymu36cehr22jx78zkfpq41ugis9r4g] C:\DOCUME~1\Owner\LOCALS~1\Temp\mxmy3irixan6.exe
O4 - HKCU\..\Run: [nrlaj63yrhod7v6g10s5n4s7xp1xnd4lmf0e1h2] C:\DOCUME~1\Owner\LOCALS~1\Temp\xgg0l804tj.exe
O4 - HKCU\..\Run: [j2vefsq9pygnld1kr66llpe] C:\DOCUME~1\Owner\LOCALS~1\Temp\w3ib0ienqkz.exe
O4 - HKCU\..\Run: [mbt1rhq47ivrqtm7cubwfwcnh8p] C:\DOCUME~1\Owner\LOCALS~1\Temp\zenmg0d.exe
O4 - HKCU\..\Run: [olb4f08vd4orycis3d1smork52egh7ubo9vy70qfh5xe] C:\DOCUME~1\Owner\LOCALS~1\Temp\pzy4w980r7.exe
O4 - HKCU\..\Run: [zs68sk2s638mhtttjhelf11xcjytaydt5zr0] C:\DOCUME~1\Owner\LOCALS~1\Temp\j7hvyzst4uds.exe
O4 - HKCU\..\Run: [buz3tzt7c7m1unbko153mcwly4cj2ae6idozv9dp] C:\DOCUME~1\Owner\LOCALS~1\Temp\yxb2vnvs.exe
O4 - HKCU\..\Run: [t8qbsquaab9wr6z0cnc6z9dn1txvqc4fyth8i3m7e7eax8] C:\DOCUME~1\Owner\LOCALS~1\Temp\uyzke01t7a.exe
O4 - HKCU\..\Run: [ipip5ueawscigu0j34615y46k5het970o13tvnnvz9cghf] C:\DOCUME~1\Owner\LOCALS~1\Temp\kcw3mqzh.exe
O4 - HKCU\..\Run: [cilotr420zwevt4bsslmu7c9g] C:\DOCUME~1\Owner\LOCALS~1\Temp\yvokiwtch.exe
O4 - HKCU\..\Run: [v6yfa05c47qbcezvhzifleb30v09350d4e05hzeea8m] C:\DOCUME~1\Owner\LOCALS~1\Temp\aeenf5e06.exe
O4 - HKCU\..\Run: [t9ygrqevzd09ixpoq] C:\DOCUME~1\Owner\LOCALS~1\Temp\ny746ta.exe
O4 - HKCU\..\Run: [bd5dgq2rfrpvf5axxm25bwextb] C:\DOCUME~1\Owner\LOCALS~1\Temp\l9ypy78r.exe
O4 - HKCU\..\Run: [jcuy0bgmbpb6qcmp5cs6bme7kl2lji2] C:\DOCUME~1\Owner\LOCALS~1\Temp\e1drs53ufzwkp.exe
O4 - HKCU\..\Run: [i91wbhym8lo30vqr68f5a33tpna860pfbw6wlku7kll5y] C:\DOCUME~1\Owner\LOCALS~1\Temp\wc24wtk1cjyji.exe
O4 - HKCU\..\Run: [jpzkix7rs740db50ut2pxs] C:\DOCUME~1\Owner\LOCALS~1\Temp\ktq6bu5gdyv.exe
O4 - HKCU\..\Run: [xn60pt9ihngd] C:\DOCUME~1\Owner\LOCALS~1\Temp\lz7v0s.exe
O4 - HKCU\..\Run: [qpq1r0vz2orqt4vgiod34lw] C:\DOCUME~1\Owner\LOCALS~1\Temp\kuxv15ee0b.exe
O4 - HKCU\..\Run: [iow3n143qdx8rqs05f] C:\DOCUME~1\Owner\LOCALS~1\Temp\mhfvlwbd.exe
O4 - HKCU\..\Run: [clbb01rpbqwefczuz5pel8wyh4vlmk5] C:\DOCUME~1\Owner\LOCALS~1\Temp\cskbzdijf.exe
O4 - HKCU\..\Run: [hpt54sy9pvgk1z] C:\DOCUME~1\Owner\LOCALS~1\Temp\yi2fdsb7a01c.exe
O4 - HKCU\..\Run: [fii92xcoa5r0yl6] C:\DOCUME~1\Owner\LOCALS~1\Temp\ed3t2zjek7.exe
O4 - HKCU\..\Run: [n0gj2tq4t6xflc6o4gsrm2vdtcfzmgudyhsbgh] C:\DOCUME~1\Owner\LOCALS~1\Temp\iu0mvdz83wdi.exe
O4 - HKCU\..\Run: [f12s655ioakf345] C:\DOCUME~1\Owner\LOCALS~1\Temp\rj1u4xjupaqf.exe
O4 - HKCU\..\Run: [re073m49y] C:\DOCUME~1\Owner\LOCALS~1\Temp\btu67m2gfv.exe
O4 - HKCU\..\Run: [fkguhtl7wjtvnec37xmk5foq8g2zsj6m8icejshl54zi] C:\DOCUME~1\Owner\LOCALS~1\Temp\rgvlqv99.exe
O4 - HKCU\..\Run: [ol3lk26rwoq] C:\DOCUME~1\Owner\LOCALS~1\Temp\loltwpxn.exe
O4 - HKCU\..\Run: [llk9er4ncglkdrlsipap9occkk2otdkvx1axyywvndgq5vz79] C:\DOCUME~1\Owner\LOCALS~1\Temp\h6p4w49w87.exe
O4 - HKCU\..\Run: [axj04324q619hlrn081a2d8] C:\DOCUME~1\Owner\LOCALS~1\Temp\krbzdpr0j.exe
O4 - HKCU\..\Run: [lldswvx8xoil3d] C:\DOCUME~1\Owner\LOCALS~1\Temp\j51jrqqs.exe
O4 - HKCU\..\Run: [oq1z07gtva8kz8olzt470y2bd42xr4c07b61j9fq38kps] C:\DOCUME~1\Owner\LOCALS~1\Temp\htpi8htpv.exe
O4 - HKCU\..\Run: [zke4b759x1] C:\DOCUME~1\Owner\LOCALS~1\Temp\w5cw37o.exe
O4 - HKCU\..\Run: [ui2xecvqd12pbuhyu] C:\DOCUME~1\Owner\LOCALS~1\Temp\wudioa5f0.exe
O4 - HKCU\..\Run: [yxxs5mrui] C:\DOCUME~1\Owner\LOCALS~1\Temp\wk7f9u7x2yv.exe
O4 - HKCU\..\Run: [nkd1p0yu8nct8awr8cpoh3zdaerff5727c0w346g] C:\DOCUME~1\Owner\LOCALS~1\Temp\rv0onn8x6c4.exe
O4 - HKCU\..\Run: [o73y2vteurj6z6k3y3rgos1zx6uh] C:\DOCUME~1\Owner\LOCALS~1\Temp\yk16rjnr74z.exe
O4 - HKCU\..\Run: [loye3j4wt0q243yc842wdv] C:\DOCUME~1\Owner\LOCALS~1\Temp\vwm54h11nukx.exe
O4 - HKCU\..\Run: [rjtg6hg4n61e7j8i5d7z5u6xdcfce3z] C:\DOCUME~1\Owner\LOCALS~1\Temp\lnqh6pso.exe
O4 - HKCU\..\Run: [jm18l94whn8vl4d] C:\DOCUME~1\Owner\LOCALS~1\Temp\hv2edfj.exe
O4 - HKCU\..\Run: [okd1kvruy5hgh8slg037bxdihee0zdhf0myf] C:\DOCUME~1\Owner\LOCALS~1\Temp\eqfeoxs6.exe
O4 - HKCU\..\Run: [cmm21ax1gxrjbhe8y00lhqzq] C:\DOCUME~1\Owner\LOCALS~1\Temp\zzr0ts5z4.exe
O4 - HKCU\..\Run: [lt0zps4x0j4rejwp3if5o59ula] C:\DOCUME~1\Owner\LOCALS~1\Temp\cxf022o.exe
O4 - HKCU\..\Run: [rzdd2mln6jwxyvg5g2pmh18by1w2noj1m3au8h50m8u] C:\DOCUME~1\Owner\LOCALS~1\Temp\ef6tro.exe
O4 - HKCU\..\Run: [d4qehdn6qirp0u9y7uekvz8wimcaz] C:\DOCUME~1\Owner\LOCALS~1\Temp\ego1qi9.exe
O4 - HKCU\..\Run: [bom7nlphx34s5lvmubw9o51m] C:\DOCUME~1\Owner\LOCALS~1\Temp\qe5ik8.exe
O4 - HKCU\..\Run: [al08l79hc3l7gs006zdo2fm7k8ffhqjkbnrngm1vz0zz] C:\DOCUME~1\Owner\LOCALS~1\Temp\n9zyil44jns.exe
O4 - HKCU\..\Run: [sntcx94845cpn4dtk0iwj83vkin36bpwupp] C:\DOCUME~1\Owner\LOCALS~1\Temp\syyr1en5zfi9y.exe
O4 - HKCU\..\Run: [yhk33jhicx5ahnn3gbrvegqt2txt4lkxwwzjvb89n] C:\DOCUME~1\Owner\LOCALS~1\Temp\txfvsocom0ysn.exe
O4 - HKCU\..\Run: [kqkz2eht5xmg10f2c30utmzes24ay1t40aenf] C:\DOCUME~1\Owner\LOCALS~1\Temp\t5a2mxx5ox.exe
O4 - HKCU\..\Run: [nw3w5nz3x6nixfaicnv15cnxwcw] C:\DOCUME~1\Owner\LOCALS~1\Temp\xstlvl64.exe
O4 - HKCU\..\Run: [yp4d2ybc778sa1dznffwtlpcjgnoapz78cnzcscgy9mycf] C:\DOCUME~1\Owner\LOCALS~1\Temp\k8mqsnwr7.exe
O4 - HKCU\..\Run: [v5ukr3ue89v8u7yc8lldv6t7cng8jarccp] C:\DOCUME~1\Owner\LOCALS~1\Temp\cu44189i0e1sx.exe
O4 - HKCU\..\Run: [twxmm3tklfdumcn9od9hkhatnqyvtda] C:\DOCUME~1\Owner\LOCALS~1\Temp\rzhks2f.exe
O4 - HKCU\..\Run: [iiy328co04wklv426] C:\DOCUME~1\Owner\LOCALS~1\Temp\a82elx5.exe
O4 - HKCU\..\Run: [lvo94o67nkb266u707415o13qjec7j] C:\DOCUME~1\Owner\LOCALS~1\Temp\dz5ecnyperhy9.exe
O4 - HKCU\..\Run: [r22b5hbupaaq7vlhqnr1] C:\DOCUME~1\Owner\LOCALS~1\Temp\i0dq3fpvl5h.exe
O4 - HKCU\..\Run: [zjpe0db2zns0pgvi9o10pwryuphl9xc7vx7z6] C:\DOCUME~1\Owner\LOCALS~1\Temp\t49roi7xkgz9.exe
O4 - HKCU\..\Run: [y7mpyh17wkuee97ymvzjbnyca2fo2zpwmtvs9vco47c] C:\DOCUME~1\Owner\LOCALS~1\Temp\xt491x.exe
O4 - HKCU\..\Run: [d1yyrs06k96xuon6p1i92714g9l04ljgga7buy4tck15a5cq3r] C:\DOCUME~1\Owner\LOCALS~1\Temp\y3omltewlzshh.exe
O4 - HKCU\..\Run: [xwx57zust43t85sqixoqd5j2arrtp5arubx8gzvn3fa55x6jh] C:\DOCUME~1\Owner\LOCALS~1\Temp\uv84k6n2.exe
O4 - HKCU\..\Run: [dmbjblz7ncybotne5lt5r9m62r6bfhsft9bioe61j] C:\DOCUME~1\Owner\LOCALS~1\Temp\bzzssjx.exe
O4 - HKCU\..\Run: [nbmvs93w56eeonuai9klp6] C:\DOCUME~1\Owner\LOCALS~1\Temp\nm5wcwlxs0.exe
O4 - HKCU\..\Run: [qjluv2pnx2zru2i9iulyeskale6p68h9] C:\DOCUME~1\Owner\LOCALS~1\Temp\kfpyfbhcvh.exe
O4 - HKCU\..\Run: [a6009r926ka8l5p8d5b0x1qd49suszlue47n9in71st8nuqak] C:\DOCUME~1\Owner\LOCALS~1\Temp\inchfl.exe
O4 - HKCU\..\Run: [ekyntz0ponth43tj7fyiz8ejzqpbdkla1rjacc267o] C:\DOCUME~1\Owner\LOCALS~1\Temp\mlresl.exe
O4 - HKCU\..\Run: [o82en2dg7ykdi8svody2h2pjky8] C:\DOCUME~1\Owner\LOCALS~1\Temp\hzr5tlqq48.exe
O4 - HKCU\..\Run: [f81u6jwggxs8] C:\DOCUME~1\Owner\LOCALS~1\Temp\p0jz8gx8mctbw.exe
O4 - HKCU\..\Run: [wdw6jzsb6avpoymp1cbmw0jqz1rli0xh2] C:\DOCUME~1\Owner\LOCALS~1\Temp\zg12utc.exe
O4 - HKUS\S-1-5-19\..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\LocalService\Application Data\Macromedia\Common\8b2600321.dll"" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [fekidizeni] Rundll32.exe "C:\WINDOWS\system32\tilafago.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\NetworkService\Application Data\Macromedia\Common\8b2600321.dll"" (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [rundll32.exe] rundll32.exe "C:\WINDOWS\system32\config\systemprofile\Application Data\Macromedia\Common\8b2600321.dll"" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [n0not9xgrxc9zuqfgz8vaoo4rnfjdujz9tf2dge32cp1xo] C:\WINDOWS\TEMP\qpcft82vivwn3.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [j1r0qcisc7aczqznluvdl5d] C:\WINDOWS\TEMP\wka743jrzko.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [eidd265gl2ijodqgv] C:\WINDOWS\TEMP\l73qwa3z7i8.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [v0cpt7e2bw6s2w4q7g2q9q3u] C:\WINDOWS\TEMP\p3bo1ol.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [gywccf2hgp9c6yce1c2tyzb3wf5sk54] C:\WINDOWS\TEMP\aiavxbpyu.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [hrm48uncdkapml60mougv924p4uv7zbqw83av19ja] C:\WINDOWS\TEMP\a01zg5bvycgev.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [rundll32.exe] rundll32.exe "C:\WINDOWS\system32\config\systemprofile\Application Data\Macromedia\Common\8b2600321.dll"" (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200312…meInstaller.exe
O20 - AppInit_DLLs: rsstx.dll C:\WINDOWS\system32\gobekado.dll fnvwjk.dll wpkbfp.dll fzlzwh.dll lieyfu.dll C:\WINDOWS\system32\gimemula.dll fpzqgb.dll ihaujx.dll cjpfgn.dll uwjqxh.dll c:\windows\system32\pegojehe.dll
O20 - Winlogon Notify: crypt - C:\WINDOWS\SYSTEM32\crypts.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\pegojehe.dll
O22 - SharedTaskScheduler: carolus - {} - (no file)
O22 - SharedTaskScheduler: klj3r93iorkemnfaja93riemef - {C5BF40A2-94F3-42BD-F434-1604812C8955} - C:\WINDOWS\system32\kjr3iorojdnbfi43unjfd.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\pegojehe.dll
O23 - Service: ICF (icf) - Unknown owner - C:\WINDOWS\system32\svchost.exe:ext.exe
O23 - Service: Network Provisioning Service xmlprovidsvc (xmlprovidsvc) - Unknown owner - c:\xltwpuh.exe

:Services

:Reg

:Files

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
A log of actions will be produced , paste that in your next post

ON COMPLETION

Double click on the OTListit icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTListIt.Txt and Extras.Txt. These are saved in the same location as OTListIt2.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

mattwest1

Post #7March 20, 2009, 6:07 PM UTC

I suppose it should come as no great surprise that my computer couldn't pull this off either. I downloaded LSPFix and removed the single instances of qos.dll and ntdll64.dll as instructed and that happened with no issues.

I downloaded OTListit2 in safe mode with networking. I copied the custom fix as is to OTListit2 and clicked Run Fix. From there it seems like the program just froze up, but I didn't bother it. Whenever the mouse hovered over the program it showed the hourglass. It seemed to me as if the program was not responding. Nothing within the program moved at all. As I was waiting for something to happen (maybe 20 minutes) the computer overheated and just cut off. But I am persistant as well! If it's possible to fix this computer, I have total faith that you're the man for the job!

Essexboy

Post #8March 20, 2009, 6:40 PM UTC

OK then this looks like a baby steps removal as we nibble away at it - all this can be done in safe mode

Step one

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below.

O4 - HKLM\..\Run: [Criziviki] rundll32.exe "C:\WINDOWS\Ijodijucivic.dll",e
O4 - HKLM\..\Run: [kjahrfoi37rljanfaw3il7fhjd3f] C:\WINDOWS\TEMP\winlogqn.exe
O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe
O4 - HKLM\..\Run: [rs32net] C:\WINDOWS\System32\rs32net.exe
O4 - HKLM\..\Run: [Fzavavohiyesupa] rundll32.exe "C:\WINDOWS\axehejoz.dll",e
O4 - HKLM\..\Run: [fekidizeni] Rundll32.exe "C:\WINDOWS\system32\tilafago.dll",s
O4 - HKLM\..\Run: [6cb3e72c] rundll32.exe "C:\WINDOWS\system32\tumaveko.dll",b
O4 - HKLM\..\Run: [CPM6f80d4b0] Rundll32.exe "c:\windows\system32\pegojehe.dll",a
O4 - HKLM\..\Run: [000000af] rundll32.exe "C:\WINDOWS\system32\tumaveko.dll",b
O4 - HKLM\..\Run: [] Rundll32.exe "c:\windows\system32\pegojehe.dll",a
O4 - HKCU\..\Run: [Antispyware] C:\Program Files\Antispyware\Antispyware.exe -boot
O4 - HKCU\..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\Owner\Application Data\Macromedia\Common\8b2600321.dll""
O4 - HKCU\..\Run: [kjahrfoi37rljanfaw3il7fhjd3f] C:\WINDOWS\TEMP\winlogqn.exe
O4 - HKCU\..\Run: [rs32net] C:\WINDOWS\System32\rs32net.exe
O4 - HKCU\..\Run: [lyko18m79csccyc98a8rtcwx0u6gfbu2o1bf1] C:\WINDOWS\TEMP\lqntf5wmu2.exe
O4 - HKCU\..\Run: [ex3j74oaap2dy] C:\WINDOWS\TEMP\tuz9zh5cbr.exe
O4 - HKCU\..\Run: [k3o296wibl5i3mdnfbp] C:\DOCUME~1\Owner\LOCALS~1\Temp\kbvci62oeo.exe
O4 - HKCU\..\Run: [z7epwd8mfw92r01hbnd0umx9xhfawmq83ylynngdpj5w] C:\WINDOWS\TEMP\mmkskf2e1pq13.exe
O4 - HKCU\..\Run: [k8gmehz8uetlimicz7u] C:\WINDOWS\TEMP\hpnajazk.exe
O4 - HKCU\..\Run: [xzp9m0j3gjslro8bxl2bimy0f] C:\DOCUME~1\Owner\LOCALS~1\Temp\sjelhpljtvee.exe
O4 - HKCU\..\Run: [nz3hwdko99frf02gw979zs8kn5v3j38ry] C:\WINDOWS\TEMP\k16qhaees.exe
O4 - HKCU\..\Run: [t7ygx1eld4ooytf6pl5xwib0u0redvt26fxvs7pk1lxz2] C:\WINDOWS\TEMP\vd1tth.exe
O4 - HKCU\..\Run: [s07zwzz0h] C:\WINDOWS\TEMP\dqh55e.exe
O4 - HKCU\..\Run: [rktq5oj1w5xebw8t1yi3npicjunim26okksyejo] C:\WINDOWS\TEMP\qobhyjv.exe
O4 - HKCU\..\Run: [mzgleo0anpjzhrwi4q5avjt7gf5ikqknkrpx4x8vprdb0v] C:\DOCUME~1\Owner\LOCALS~1\Temp\xni2hvp4dw95h.exe
O4 - HKCU\..\Run: [vsvkyp0d9jc5hqoos2x22fvyws4mxh0ykzfjvfdts65lb5xdq] C:\DOCUME~1\Owner\LOCALS~1\Temp\j1ydqprtjo.exe
O4 - HKCU\..\Run: [i8639nuugrr9lmv5gkl9r] C:\WINDOWS\TEMP\tzxqmem9.exe
O4 - HKCU\..\Run: [ge5vet3nbcgjj9yg0] C:\WINDOWS\TEMP\ff602qcnkhu.exe
O4 - HKCU\..\Run: [ifvs7e0bvuke7h2jpqo8wnjq6bk1qlg] C:\DOCUME~1\Owner\LOCALS~1\Temp\kb786q.exe
O4 - HKCU\..\Run: [fbp6vnwlcxi6remyff33fdc909j485wag818remergd0] C:\DOCUME~1\Owner\LOCALS~1\Temp\gwqazr03.exe
O4 - HKCU\..\Run: [d49r99or3tr] C:\DOCUME~1\Owner\LOCALS~1\Temp\btu13a13gv.exe
O4 - HKCU\..\Run: [d9oolcpue4m80ijgit7m34k4gkr2zlzg3] C:\DOCUME~1\Owner\LOCALS~1\Temp\q4hrfa7g4.exe
O4 - HKCU\..\Run: [livmculy43g5genqijdn7] C:\DOCUME~1\Owner\LOCALS~1\Temp\u8adlyltv58.exe
O4 - HKCU\..\Run: [ynt7ytl8m] C:\DOCUME~1\Owner\LOCALS~1\Temp\kqavc4k.exe
O4 - HKCU\..\Run: [n5ey58em8vocfeh029r6mwgknegjtjg2x6arzo1uul] C:\DOCUME~1\Owner\LOCALS~1\Temp\gnhep6cbzh9v.exe
O4 - HKCU\..\Run: [ai10ivn4opigboz20cv67hy9jhilzu6xe858ap2gh6w3sjle] C:\DOCUME~1\Owner\LOCALS~1\Temp\ureb2k.exe
O4 - HKCU\..\Run: [sljnmyoicwby7] C:\DOCUME~1\Owner\LOCALS~1\Temp\fygeys.exe
O4 - HKCU\..\Run: [cqy93a4lc9ol8jvetwl80nlvm5ee952dy8brut8in35] C:\DOCUME~1\Owner\LOCALS~1\Temp\h95u0kk88.exe
O4 - HKCU\..\Run: [knuuzg2thzpr] C:\DOCUME~1\Owner\LOCALS~1\Temp\p2ogo3s.exe
O4 - HKCU\..\Run: [hu9pni1rd5] C:\DOCUME~1\Owner\LOCALS~1\Temp\mpvr9sf.exe
O4 - HKCU\..\Run: [kgr0daf55faw4ox5n04dhj4xbo18fgylz] C:\DOCUME~1\Owner\LOCALS~1\Temp\bwt4433w.exe
O4 - HKCU\..\Run: [wrdp8hvkzul26yeldalztsnb42ku9yrgjfhg6ski1gucde] C:\DOCUME~1\Owner\LOCALS~1\Temp\i6i0a8.exe
O4 - HKCU\..\Run: [agu12kp59mm61wryhg6jcmlstmozru76bc3qske0z3x5hp] C:\DOCUME~1\Owner\LOCALS~1\Temp\oamaeuf1iz9c5.exe
O4 - HKCU\..\Run: [quqne0hbzm2g2rakhgv626ktwqkokbhak0njmm8w] C:\DOCUME~1\Owner\LOCALS~1\Temp\i7gngcdq5b.exe
O4 - HKCU\..\Run: [d6a2df3n1bi6yxjadtqb2rinc8dkgheuiwzr6juohbi3or08f] C:\DOCUME~1\Owner\LOCALS~1\Temp\uj44u3zu9ndh.exe
O4 - HKCU\..\Run: [pl8hpr9q1t76oaee5x1ko5tplijdz2ovj16kqmn6126rz55ecy] C:\DOCUME~1\Owner\LOCALS~1\Temp\hmag3782g6.exe
O4 - HKCU\..\Run: [p0lwbqj4oenq4jzz] C:\DOCUME~1\Owner\LOCALS~1\Temp\vgsadrufed3.exe
O4 - HKCU\..\Run: [xo8refmqanqjvkfouq2igbueqtp6lcioucqr1duinqursml] C:\DOCUME~1\Owner\LOCALS~1\Temp\b5ux5mnz.exe
O4 - HKCU\..\Run: [agi56fu57rbs06] C:\DOCUME~1\Owner\LOCALS~1\Temp\y1po1vt3uwfm.exe
O4 - HKCU\..\Run: [fyem5goref2erfvkj9ehf4717hq0xq0cf0lthecv] C:\DOCUME~1\Owner\LOCALS~1\Temp\f7co0b8hqa.exe
O4 - HKCU\..\Run: [wlhewpgwr0u5iupm5cj8gg0bwishkqhwb0al0] C:\DOCUME~1\Owner\LOCALS~1\Temp\mt9klctn.exe
O4 - HKCU\..\Run: [au247evuj7ez7pq2oik4m] C:\DOCUME~1\Owner\LOCALS~1\Temp\fm4akou.exe
O4 - HKCU\..\Run: [jijwfegbon86of6cae] C:\DOCUME~1\Owner\LOCALS~1\Temp\l9kkax9.exe
O4 - HKCU\..\Run: [lv5vmewypo5v1yn8g7yvyb7] C:\DOCUME~1\Owner\LOCALS~1\Temp\chca1kx.exe
O4 - HKCU\..\Run: [jo144p8mo760] C:\DOCUME~1\Owner\LOCALS~1\Temp\rz9y055b.exe
O4 - HKCU\..\Run: [nppxw0y5uy5g4gk36fxcy] C:\DOCUME~1\Owner\LOCALS~1\Temp\yqiukoyugrm.exe
O4 - HKCU\..\Run: [msj12xdnklltt99v5o4dpbgmv9xz] C:\DOCUME~1\Owner\LOCALS~1\Temp\tw0yserfjk.exe
O4 - HKCU\..\Run: [m8l9n3scuf1a2haadk4x6lfpkz1kk4obngrzk] C:\DOCUME~1\Owner\LOCALS~1\Temp\dlgeyt.exe
O4 - HKCU\..\Run: [yw70ydx35xnt] C:\DOCUME~1\Owner\LOCALS~1\Temp\qizjzp.exe
O4 - HKCU\..\Run: [slyxaebk01f416v8wkdidi2oxn6yhcj0u2xwyn] C:\DOCUME~1\Owner\LOCALS~1\Temp\nbpltln4brro.exe
O4 - HKCU\..\Run: [npsquavmlfxv1fvr5pfvulfmbjm2] C:\DOCUME~1\Owner\LOCALS~1\Temp\op9cv699.exe
O4 - HKCU\..\Run: [gij5ufbk4m3nsehih25300xre8dtueiez4lqhw8ys1tivr0l] C:\DOCUME~1\Owner\LOCALS~1\Temp\ql959i.exe
O4 - HKCU\..\Run: [q1jms2ep8ujoguk8l8aid1d02pj93gn9k40] C:\DOCUME~1\Owner\LOCALS~1\Temp\yut8swowpk.exe
O4 - HKCU\..\Run: [vtldi9kl3mmnm5yin4mzi76] C:\DOCUME~1\Owner\LOCALS~1\Temp\a0i4l7.exe
O4 - HKCU\..\Run: [yr87iu4mkfk5o4o2j5rhcfaw] C:\DOCUME~1\Owner\LOCALS~1\Temp\achmrq9osne48.exe
O4 - HKCU\..\Run: [x5ee2tygwyy0vsepga1pq611lno7n23h5t8z2rm1] C:\DOCUME~1\Owner\LOCALS~1\Temp\wsoo4b175h.exe
O4 - HKCU\..\Run: [p8g6iphidru44v1wfwg5a5ltpeoga582x75wxhtlnwkc6fe] C:\DOCUME~1\Owner\LOCALS~1\Temp\jvu0dway.exe
O4 - HKCU\..\Run: [z0oz0c8pittw9] C:\DOCUME~1\Owner\LOCALS~1\Temp\icy9ecc.exe
O4 - HKCU\..\Run: [oa7npycu3mu50hc4p2] C:\DOCUME~1\Owner\LOCALS~1\Temp\k2ktc1yb0786q.exe
O4 - HKCU\..\Run: [t4hmodg9dwzosfy2weixxyxqiprnie7] C:\DOCUME~1\Owner\LOCALS~1\Temp\efujt40i.exe
O4 - HKCU\..\Run: [i1kacwwx5ylq17dv5zkq8n3i1cv4fvk] C:\DOCUME~1\Owner\LOCALS~1\Temp\mz1asmk1ai.exe
O4 - HKCU\..\Run: [rgmhmh5v3z6gcfmhh378nch0uq] C:\DOCUME~1\Owner\LOCALS~1\Temp\c76pdt2j8u.exe
O4 - HKCU\..\Run: [xekpzqe43vv2m8] C:\DOCUME~1\Owner\LOCALS~1\Temp\u0f433.exe
O4 - HKCU\..\Run: [pq9nn9v203dmjmw4jcao9d8hizqoahu797wmz] C:\DOCUME~1\Owner\LOCALS~1\Temp\nxwqn1xcqw.exe
O4 - HKCU\..\Run: [fw3upluxg43bdloh] C:\DOCUME~1\Owner\LOCALS~1\Temp\bb479h0naf6.exe
O4 - HKCU\..\Run: [qa7zxku6vnl18mepl7jdyz2yiug8] C:\DOCUME~1\Owner\LOCALS~1\Temp\mpv7dn5jcybi.exe
O4 - HKCU\..\Run: [hm1ygmn695kh] C:\DOCUME~1\Owner\LOCALS~1\Temp\bg7rwtk.exe
O4 - HKCU\..\Run: [g4o2jn1ugy2um7us5cw] C:\DOCUME~1\Owner\LOCALS~1\Temp\m49uskr.exe
O4 - HKCU\..\Run: [cwmi4bm883rnb7y48] C:\DOCUME~1\Owner\LOCALS~1\Temp\c9pl9r.exe
O4 - HKCU\..\Run: [c79486c8fqp61a81taovqnrd] C:\DOCUME~1\Owner\LOCALS~1\Temp\z4dlcd8vb.exe
O4 - HKCU\..\Run: [e6e4zxyfno6heszeehd03] C:\DOCUME~1\Owner\LOCALS~1\Temp\cex59p1xr8t.exe
O4 - HKCU\..\Run: [vvb9fyxpn2zrxpme] C:\DOCUME~1\Owner\LOCALS~1\Temp\k5bv9po7f.exe
O4 - HKCU\..\Run: [bsuzl57of89d9dy86wos2nlx] C:\DOCUME~1\Owner\LOCALS~1\Temp\br61nhbaqfd.exe
O4 - HKCU\..\Run: [dvrxylcv6byrxi48glj2sx1p5q9w2psjzmw3s5qayujx] C:\DOCUME~1\Owner\LOCALS~1\Temp\tefp2kvts.exe
O4 - HKCU\..\Run: [hbxc3rv8jilun5p7r] C:\DOCUME~1\Owner\LOCALS~1\Temp\hic3wydabaq.exe
O4 - HKCU\..\Run: [kn2vu34pggojfhm4] C:\DOCUME~1\Owner\LOCALS~1\Temp\l3csv43.exe
O4 - HKCU\..\Run: [b5cyh2zsku6h] C:\DOCUME~1\Owner\LOCALS~1\Temp\s115j664zxvru.exe
O4 - HKCU\..\Run: [yutckyxzsbvu4nlm0idoahjm7ywd5gfrumzsyxkj2] C:\DOCUME~1\Owner\LOCALS~1\Temp\m6yqj0179.exe
O4 - HKCU\..\Run: [cq1zi9n1hh9lp1qwymvwwdp5ykvvsm1m4gofh97pul4sqbsc] C:\DOCUME~1\Owner\LOCALS~1\Temp\dzutyc.exe
O4 - HKCU\..\Run: [f9z1p8xjrw7fuh8ft3cxn53vj3pb3taa1] C:\DOCUME~1\Owner\LOCALS~1\Temp\z7444jz4u2c.exe
O4 - HKCU\..\Run: [yfehbr370iuli4za23c5da] C:\DOCUME~1\Owner\LOCALS~1\Temp\onzvghc.exe
O4 - HKCU\..\Run: [o9e27sylnnophibapeo] C:\DOCUME~1\Owner\LOCALS~1\Temp\ggb8fpd16ga93.exe
O4 - HKCU\..\Run: [w2r9sewrya4h7sp0qfk5g99hfja1w62q] C:\DOCUME~1\Owner\LOCALS~1\Temp\qnpheg90or.exe
O4 - HKCU\..\Run: [fsd5a1mxffoiztkr4a6ko0esoi4pa7iwc0roodo7ci6wwt] C:\DOCUME~1\Owner\LOCALS~1\Temp\g8q30cqiv9.exe
O4 - HKCU\..\Run: [daj5pc6t6jvh3qulc8u74] C:\DOCUME~1\Owner\LOCALS~1\Temp\rz2s6fxj3m.exe
O4 - HKCU\..\Run: [hsvg6m82emwcpmejdp75ctc2vu0m15kft31iysevg25sljl2u3] C:\DOCUME~1\Owner\LOCALS~1\Temp\wxvj1hl.exe
O4 - HKCU\..\Run: [ewknok3fbiqa9fng58rj34axr3ci8h] C:\DOCUME~1\Owner\LOCALS~1\Temp\p51vandma9e.exe
O4 - HKCU\..\Run: [qfzwh0oworh7] C:\DOCUME~1\Owner\LOCALS~1\Temp\mh0dtgf.exe
O4 - HKCU\..\Run: [wdw7gq849c3xibjhiio95emboi1ufs77oa3b8o] C:\DOCUME~1\Owner\LOCALS~1\Temp\hooouwzumqp.exe
O4 - HKCU\..\Run: [s1f6uedro8zdt1x2hcroxjhrrv1uebg6a8m1jtwkul] C:\DOCUME~1\Owner\LOCALS~1\Temp\l884jrphkkr.exe
O4 - HKCU\..\Run: [merrshk6onqck9xkqwpf3zq] C:\DOCUME~1\Owner\LOCALS~1\Temp\uym1sm1.exe
O4 - HKCU\..\Run: [p284z205jtyl8e04wbetcvmaejg2f9wvaw6di37zbpo0q] C:\DOCUME~1\Owner\LOCALS~1\Temp\ca262ad1.exe
O4 - HKCU\..\Run: [r7x9wiftpzj32anqvjeo02n5w1vun4ndmxgkv3v] C:\DOCUME~1\Owner\LOCALS~1\Temp\ejils9fqh.exe
O4 - HKCU\..\Run: [y2tbkov41d8m6vz6vb1ul8] C:\DOCUME~1\Owner\LOCALS~1\Temp\wwr7yiw7n2e.exe
O4 - HKCU\..\Run: [bnehkdh7xi6xonlq0fwxtp] C:\DOCUME~1\Owner\LOCALS~1\Temp\xr70ek0ld.exe
O4 - HKCU\..\Run: [gvtpdiyeje06brnuvvd] C:\DOCUME~1\Owner\LOCALS~1\Temp\i4arv1upwoqe.exe
O4 - HKCU\..\Run: [jn1xheyp0ci3vyzv3q89gq3j6] C:\DOCUME~1\Owner\LOCALS~1\Temp\sq7mckyna1u3.exe
O4 - HKCU\..\Run: [zp9b2mfv4ab1pxgfwmrjv9tlqjp9y1y1ekck5vijcvobge] C:\DOCUME~1\Owner\LOCALS~1\Temp\j8uf943s.exe
O4 - HKCU\..\Run: [gapuutw6hqdbpwejhzg1v5b2zmkdzngfv31pwxa867k5jy] C:\DOCUME~1\Owner\LOCALS~1\Temp\fuxg3y.exe
O4 - HKCU\..\Run: [sy7x43slin] C:\DOCUME~1\Owner\LOCALS~1\Temp\quy158f6c911c.exe
O4 - HKCU\..\Run: [mirj536kuurgdo5ihhuz2nbfmv] C:\DOCUME~1\Owner\LOCALS~1\Temp\u5zl8dy6bzc.exe
O4 - HKCU\..\Run: [aa83zj615kca655qx] C:\DOCUME~1\Owner\LOCALS~1\Temp\d2zd95n9llx.exe
O4 - HKCU\..\Run: [ktjt1vb43k6cybncorjittse5] C:\DOCUME~1\Owner\LOCALS~1\Temp\slk87tkhy.exe
O4 - HKCU\..\Run: [w04xasozy49gmoe8c] C:\DOCUME~1\Owner\LOCALS~1\Temp\walqbpzsz.exe
O4 - HKCU\..\Run: [i0h48xixjb58nue0enhtb1dye0kk] C:\DOCUME~1\Owner\LOCALS~1\Temp\q8kj1p5eatvf.exe
O4 - HKCU\..\Run: [rkj548drlmjw2wvvc6lyfvszim5hy0vtxaok6u] C:\DOCUME~1\Owner\LOCALS~1\Temp\gy1zye.exe
O4 - HKCU\..\Run: [nfqbmxi6brqhhagl2140qqg6dl] C:\DOCUME~1\Owner\LOCALS~1\Temp\hzrpcgnkerf.exe
O4 - HKCU\..\Run: [dgsxzxoyekajj8jug10] C:\DOCUME~1\Owner\LOCALS~1\Temp\dl29dyq6t8yc.exe
O4 - HKCU\..\Run: [e6uke3cborcnzih1cdajpaycashqxohg] C:\DOCUME~1\Owner\LOCALS~1\Temp\q4dg2v6.exe
O4 - HKCU\..\Run: [l08c5auuvlzs3ojzzu8lf28bm] C:\DOCUME~1\Owner\LOCALS~1\Temp\d6u3m4ei7bgk1.exe
O4 - HKCU\..\Run: [m9hv95inr92ct8m9nfnf63rzb] C:\DOCUME~1\Owner\LOCALS~1\Temp\u9qu7atw5f9.exe
O4 - HKCU\..\Run: [vp7kq14sey9842am59ovpa7rw0eu3vlcu9uru58x] C:\DOCUME~1\Owner\LOCALS~1\Temp\v1zybhsduk.exe
O4 - HKCU\..\Run: [sd9yssmk0rthht2cs92ru] C:\DOCUME~1\Owner\LOCALS~1\Temp\ko155grunnw.exe
O4 - HKCU\..\Run: [gxfw117rtsxwopjuicofw] C:\DOCUME~1\Owner\LOCALS~1\Temp\te0vexjo.exe
O4 - HKCU\..\Run: [tiynj28lg] C:\DOCUME~1\Owner\LOCALS~1\Temp\wrz138.exe
O4 - HKCU\..\Run: [k6mk5haqo] C:\DOCUME~1\Owner\LOCALS~1\Temp\kr4lljjfz25rh.exe
O4 - HKCU\..\Run: [pejjo6e0uin01u5kfu132u6gvxijr5ow494oh4caelta] C:\DOCUME~1\Owner\LOCALS~1\Temp\kwcqbvhuj4.exe
O4 - HKCU\..\Run: [ijxa2jtm68qov] C:\DOCUME~1\Owner\LOCALS~1\Temp\h5g001vy.exe
O4 - HKCU\..\Run: [ftta424hb5vfw5ozf] C:\DOCUME~1\Owner\LOCALS~1\Temp\qkelu3ue.exe
O4 - HKCU\..\Run: [j494fdv9iiv9ym3xy9smilj8pqj3kkez0q9utw7w1g1klo] C:\DOCUME~1\Owner\LOCALS~1\Temp\hmcjxid7aq.exe
O4 - HKCU\..\Run: [pqjabtjqpvc6mjezxs3wbb1860p4] C:\DOCUME~1\Owner\LOCALS~1\Temp\ciu3m62ifyo5.exe
O4 - HKCU\..\Run: [urskus2hwui7rdh5hipp7a] C:\DOCUME~1\Owner\LOCALS~1\Temp\w1e2k34efyun.exe
O4 - HKCU\..\Run: [qpqugcmh2d2qyooyvhbbd0cjao3z7e4fx] C:\DOCUME~1\Owner\LOCALS~1\Temp\uuezgj5.exe
O4 - HKCU\..\Run: [y5n38lzamrn1atf0xak5i4lx6spkikheznh0qu] C:\DOCUME~1\Owner\LOCALS~1\Temp\m7wjo7uxq.exe
O4 - HKCU\..\Run: [yg3t1teihbr4wwlitudxspgdqc2mv] C:\DOCUME~1\Owner\LOCALS~1\Temp\r0spwpg.exe
O4 - HKCU\..\Run: [j5rx1k47ahjklcbh5hb63erkakkrzxrcnhr3f] C:\DOCUME~1\Owner\LOCALS~1\Temp\y9vxni10wps2j.exe
O4 - HKCU\..\Run: [oybeq4k3g73niu4xffgt3jeurqt74vtqq9cvhm] C:\DOCUME~1\Owner\LOCALS~1\Temp\za4f8rjedz5ao.exe
O4 - HKCU\..\Run: [veromrp1qsb3ay] C:\DOCUME~1\Owner\LOCALS~1\Temp\gu2voq.exe
O4 - HKCU\..\Run: [jo76vrrjeu1evwnzv09krghu] C:\DOCUME~1\Owner\LOCALS~1\Temp\cnjl0o.exe
O4 - HKCU\..\Run: [dibg1te2sudj1dyhvfo] C:\DOCUME~1\Owner\LOCALS~1\Temp\ujwmqtct2nnj.exe
O4 - HKCU\..\Run: [sdu2qmcpoaq] C:\DOCUME~1\Owner\LOCALS~1\Temp\ra8twlu2k.exe
O4 - HKCU\..\Run: [xpy9z9xkey0fpclgm521iwgoiy8rw4y1qj40qi3ac3rgp09tdy] C:\DOCUME~1\Owner\LOCALS~1\Temp\d0c5ov.exe
O4 - HKCU\..\Run: [vig53ojwpvno298jvjsmauh2yfqoos] C:\DOCUME~1\Owner\LOCALS~1\Temp\nlwsjph.exe
O4 - HKCU\..\Run: [snn3oj5gcn4h9] C:\DOCUME~1\Owner\LOCALS~1\Temp\fnpkn6.exe
O4 - HKCU\..\Run: [w7k7ecetuwkp198ziwe1sz83xxi94dgxm37] C:\DOCUME~1\Owner\LOCALS~1\Temp\nnt6qtgv.exe
O4 - HKCU\..\Run: [siamvljnoa6kswei4zz4g9yrlw44rhu] C:\DOCUME~1\Owner\LOCALS~1\Temp\qtyev5xh.exe
O4 - HKCU\..\Run: [s60sfiqw2wsr03qubna9v] C:\DOCUME~1\Owner\LOCALS~1\Temp\vzfsayuc.exe
O4 - HKCU\..\Run: [exe5ye7iwsghuglj5v6mx4y9xpfm53fwxocmuimfxazdtp7z] C:\DOCUME~1\Owner\LOCALS~1\Temp\ws2omf0aidd.exe
O4 - HKCU\..\Run: [gsthh4yl8crrnk5n2fokkvg4lf4grw4o6znvio15hq9o] C:\DOCUME~1\Owner\LOCALS~1\Temp\j3v64cctg3.exe
O4 - HKCU\..\Run: [itswh9e591at5bgycx0oxrfktg] C:\DOCUME~1\Owner\LOCALS~1\Temp\fbf2rp.exe
O4 - HKCU\..\Run: [s64nyub2khwz5hdppwgngeiagcd3b92o77ngd0q4uq1e1] C:\DOCUME~1\Owner\LOCALS~1\Temp\d3rc17b6.exe
O4 - HKCU\..\Run: [o07u7u8kv8d9rhedn5cjbi6er9pwznvrezppksh28] C:\DOCUME~1\Owner\LOCALS~1\Temp\pqmylpt.exe
O4 - HKCU\..\Run: [eoztvh87mgv15tsbhqfnoawq91y1doxzso1hwadkq] C:\DOCUME~1\Owner\LOCALS~1\Temp\efj1e91nieadt.exe
O4 - HKCU\..\Run: [gl5zz4uambro67rvalvpz5] C:\DOCUME~1\Owner\LOCALS~1\Temp\dojl6w06gom.exe
O4 - HKCU\..\Run: [jmjm2d6e8bv5uw1nc91lub3wrvk00apzx1nh88] C:\DOCUME~1\Owner\LOCALS~1\Temp\xvflot.exe
O4 - HKCU\..\Run: [o4hzojs71dnsusko36cwcplhnv09ty6] C:\DOCUME~1\Owner\LOCALS~1\Temp\yd7po3eq.exe
O4 - HKCU\..\Run: [anorusrydcp] C:\DOCUME~1\Owner\LOCALS~1\Temp\m3h6hyzm21d.exe
O4 - HKCU\..\Run: [roavz2t31i9s3e] C:\DOCUME~1\Owner\LOCALS~1\Temp\e883ua.exe
O4 - HKCU\..\Run: [a74o93a8cm7phb5wg5d6jeiuwube49t01oemb0m63nf4xew] C:\DOCUME~1\Owner\LOCALS~1\Temp\w4wntf.exe
O4 - HKCU\..\Run: [m24e0wa3g6cw9hday] C:\DOCUME~1\Owner\LOCALS~1\Temp\cq9p5xklz.exe
O4 - HKCU\..\Run: [rv5eo7e1dozm8vawoudt0gr] C:\DOCUME~1\Owner\LOCALS~1\Temp\umxql2bci.exe
O4 - HKCU\..\Run: [z5mfq7bop5j1x4fj6w2orl9jkdladb] C:\DOCUME~1\Owner\LOCALS~1\Temp\r44hxtt2td.exe
O4 - HKCU\..\Run: [a7x699x8cfb2qux] C:\DOCUME~1\Owner\LOCALS~1\Temp\q58ehz19.exe
O4 - HKCU\..\Run: [fxqyjlom6df45ddzhw7fb4p] C:\DOCUME~1\Owner\LOCALS~1\Temp\arp80ovanzx.exe
O4 - HKCU\..\Run: [olq0qja2vkfz0io6i5zvf8] C:\DOCUME~1\Owner\LOCALS~1\Temp\gcc20y304hysj.exe
O4 - HKCU\..\Run: [kxj6yy1zwu] C:\DOCUME~1\Owner\LOCALS~1\Temp\mzbc77iwv5w36.exe
O4 - HKCU\..\Run: [w1tiqv484j6nhd6j1h8zb6jhk8xbljt56p2k40b1bfdo] C:\DOCUME~1\Owner\LOCALS~1\Temp\btkzap4q8.exe
O4 - HKCU\..\Run: [rdhyww1dnxgfi6wd7cvktqm6xyv1c79f0e6] C:\DOCUME~1\Owner\LOCALS~1\Temp\r281ky.exe
O4 - HKCU\..\Run: [kuqigvht5oibeye52wnygjijuktbkmgewtuyjfzc] C:\DOCUME~1\Owner\LOCALS~1\Temp\e3ngri.exe
O4 - HKCU\..\Run: [zi47heiequu0tqcwql90f1fm98xm] C:\DOCUME~1\Owner\LOCALS~1\Temp\lbfmxpmli3.exe
O4 - HKCU\..\Run: [d09cj5jid9r02zhty9d7ffd6qflg9kavvy] C:\DOCUME~1\Owner\LOCALS~1\Temp\c1lcpus.exe
O4 - HKCU\..\Run: [sflsi90app385m3vcc6bxpprbe] C:\DOCUME~1\Owner\LOCALS~1\Temp\k3oua1di.exe
O4 - HKCU\..\Run: [yum25xlr7n15jzwdckidhrejxgnhq64a96vzxmgqnu] C:\DOCUME~1\Owner\LOCALS~1\Temp\l2jgw83psh.exe
O4 - HKCU\..\Run: [tlpfkfnlfs4bki3fe4qvrh832i86xxabivro77i] C:\DOCUME~1\Owner\LOCALS~1\Temp\zxqzfgtoybxci.exe
O4 - HKCU\..\Run: [gxdwxhxoj22bf2v4ifsm0i0bbuu8l] C:\DOCUME~1\Owner\LOCALS~1\Temp\xvreou4g5.exe
O4 - HKCU\..\Run: [agxzjyjnyfhd9oolixjvhg5e4154o1gg5ct] C:\DOCUME~1\Owner\LOCALS~1\Temp\y8vfg4q1.exe
O4 - HKCU\..\Run: [ebtu4jbix3977pyc] C:\DOCUME~1\Owner\LOCALS~1\Temp\i65thbh.exe
O4 - HKCU\..\Run: [h44f07nq0z1rumj2zn2njm9] C:\DOCUME~1\Owner\LOCALS~1\Temp\gnj58om6kh2.exe
O4 - HKCU\..\Run: [fm2e7d13025t7jp3tbfo64f297ej] C:\DOCUME~1\Owner\LOCALS~1\Temp\yopsmcvx.exe
O4 - HKCU\..\Run: [j7u6sqkkhv7n3a2gfmejixu43fndliuqln3sk] C:\DOCUME~1\Owner\LOCALS~1\Temp\w1tuk4ujd281k.exe
O4 - HKCU\..\Run: [m1dp4bgggw3z87wb] C:\DOCUME~1\Owner\LOCALS~1\Temp\tx3h9sa.exe
O4 - HKCU\..\Run: [ulfrajeuphil158xsk3v0] C:\DOCUME~1\Owner\LOCALS~1\Temp\wdssuia1m.exe
O4 - HKCU\..\Run: [x2b9p4t9l96cc52s6moz69f6j5fd1alyl50t] C:\DOCUME~1\Owner\LOCALS~1\Temp\njm1v0862okn.exe
O4 - HKCU\..\Run: [zi8kesj4ay25rt9qj0iziz8u] C:\DOCUME~1\Owner\LOCALS~1\Temp\hx3i91gafdo.exe
O4 - HKCU\..\Run: [n7ne7aerlsp80qgj8tboq] C:\DOCUME~1\Owner\LOCALS~1\Temp\pgf3x46ag.exe
O4 - HKCU\..\Run: [qzj9ci824cig9siw1js1u] C:\DOCUME~1\Owner\LOCALS~1\Temp\cxiw6e8z8.exe
O4 - HKCU\..\Run: [r3ss3wbvixa0mrjh3tfplf43k9lv5fczm7d4z4f67vf] C:\DOCUME~1\Owner\LOCALS~1\Temp\vqu55qdu.exe
O4 - HKCU\..\Run: [jorj6sxyf90ybfg5tlkadxl6xzc4] C:\DOCUME~1\Owner\LOCALS~1\Temp\dkmjm675.exe
O4 - HKCU\..\Run: [j175nzz3hafs41] C:\DOCUME~1\Owner\LOCALS~1\Temp\quldcb.exe
O4 - HKCU\..\Run: [ashvlmvm72dychj25nhfwegy45oya5ywor4eml4a6u] C:\DOCUME~1\Owner\LOCALS~1\Temp\guaji4vbfi.exe
O4 - HKCU\..\Run: [osrol6hqebbx65wnizgwcakxmtosotek58lvmld5m] C:\DOCUME~1\Owner\LOCALS~1\Temp\j64i64864soif.exe
O4 - HKCU\..\Run: [sw4evghyzkixj8z2p4z2g5n65ohb7786rpdyuu62mnhf4dnmt] C:\DOCUME~1\Owner\LOCALS~1\Temp\xusmewyglwt.exe
O4 - HKCU\..\Run: [noq8u02h6vlf1ctpzbnf0lvk8nddn5zsr95yi] C:\DOCUME~1\Owner\LOCALS~1\Temp\ehb6xsr42.exe
O4 - HKCU\..\Run: [efcuqryff6zbkzza4wwclrlzoofn6sl0gnpxq] C:\DOCUME~1\Owner\LOCALS~1\Temp\wgtwpa9k246eo.exe
O4 - HKCU\..\Run: [zr7xcg4hvdqbg8n8z9obasr4fyid3tbxteus1rtno8ji] C:\DOCUME~1\Owner\LOCALS~1\Temp\ccii7pgh4ipe.exe
O4 - HKCU\..\Run: [j9v9ke8kl009o3dgdy3bu1v7wk8pbb2srkiyiz70aca99ga] C:\DOCUME~1\Owner\LOCALS~1\Temp\mrndqub.exe
O4 - HKCU\..\Run: [nxqgcqfxbgx170mz] C:\DOCUME~1\Owner\LOCALS~1\Temp\rq7t8ln.exe
O4 - HKCU\..\Run: [z8bufc10bg] C:\DOCUME~1\Owner\LOCALS~1\Temp\yubfiv94.exe
O4 - HKCU\..\Run: [qa549twuj1tfp8vky3zpbfenjh45n50q] C:\DOCUME~1\Owner\LOCALS~1\Temp\ay9xxj7rd.exe
O4 - HKCU\..\Run: [n5vl9x7u6awon7q9amtiwmgtgrr1l0h9x9so2j8ufcw] C:\DOCUME~1\Owner\LOCALS~1\Temp\o488xk1h.exe
O4 - HKCU\..\Run: [qzbzqee5yi5kp0yc8l1k7cuiszj1y0mwg3kxj8w] C:\DOCUME~1\Owner\LOCALS~1\Temp\qb7cf8.exe
O4 - HKCU\..\Run: [qsyv4g6c32uy0n] C:\DOCUME~1\Owner\LOCALS~1\Temp\zub8mu1sil7aq.exe
O4 - HKCU\..\Run: [b58eku0gcuks2i9z8wpi3tjun9red90g4zqib0n9ti3] C:\DOCUME~1\Owner\LOCALS~1\Temp\t24fsm210m.exe
O4 - HKCU\..\Run: [uqkjqx2vccsguy21evy4buyj9jbbtn5h653jmho3] C:\DOCUME~1\Owner\LOCALS~1\Temp\cbmq8cmur.exe
O4 - HKCU\..\Run: [zpm22umw3ytzqkkv92onnna] C:\DOCUME~1\Owner\LOCALS~1\Temp\vifwy73sf.exe
O4 - HKCU\..\Run: [r8bf8iuaadasrvkafw9043ppbw0gq5wpz0xrjkh2e5okz9ksnx] C:\DOCUME~1\Owner\LOCALS~1\Temp\swluqy.exe
O4 - HKCU\..\Run: [ko6vszvjo30urdn1r93azb7fftdpvoqhsrtbpmzu51ake9] C:\DOCUME~1\Owner\LOCALS~1\Temp\kn6uy13le9.exe
O4 - HKCU\..\Run: [v31l98e090j] C:\DOCUME~1\Owner\LOCALS~1\Temp\lqkbjxlau.exe
O4 - HKCU\..\Run: [dlvaah7j8jaorf896wraqkqrn3hvfoudz58] C:\DOCUME~1\Owner\LOCALS~1\Temp\i94ahd46u.exe
O4 - HKCU\..\Run: [kp57386pl3pvfk2f7jffqso74jnbyulzt2wsh3m5h] C:\DOCUME~1\Owner\LOCALS~1\Temp\dbk1ivh9.exe
O4 - HKCU\..\Run: [wdvzjyxa3] C:\DOCUME~1\Owner\LOCALS~1\Temp\fw4fukg3w5.exe
O4 - HKCU\..\Run: [bswsrcrb6df2i07ywqlol7gfygxh4axr6xsik95g8e2ft6uwoe] C:\DOCUME~1\Owner\LOCALS~1\Temp\z71807wqm.exe
O4 - HKCU\..\Run: [a30y7vuegwbrbq2cgh44ev7wpzxu7d8flv5zjo67rr] C:\DOCUME~1\Owner\LOCALS~1\Temp\mhg12soyj.exe
O4 - HKCU\..\Run: [v05pgvcfg] C:\DOCUME~1\Owner\LOCALS~1\Temp\wetdbwfj7.exe
O4 - HKCU\..\Run: [nyw0qab5m6y8a4d5lro] C:\DOCUME~1\Owner\LOCALS~1\Temp\e0vi5z1.exe
O4 - HKCU\..\Run: [xtohaffi26] C:\DOCUME~1\Owner\LOCALS~1\Temp\y70xpbhvr9.exe
O4 - HKCU\..\Run: [ofxj4yiu72b] C:\DOCUME~1\Owner\LOCALS~1\Temp\f7vqhy3.exe
O4 - HKCU\..\Run: [q63lq0gz8ha9ymek7w] C:\DOCUME~1\Owner\LOCALS~1\Temp\k495014ssh7qg.exe
O4 - HKCU\..\Run: [z44a3z77ts5cq5i6sjathyzjrev7w] C:\DOCUME~1\Owner\LOCALS~1\Temp\i89sqke0fnt0.exe
O4 - HKCU\..\Run: [un8j1jrwi3erbat3v6o13kbusdhklchwjh0ke1] C:\DOCUME~1\Owner\LOCALS~1\Temp\hb0xqqyg.exe
O4 - HKCU\..\Run: [bkc5k3mka90nb0sdycc01zjk8zg28r66qof5n3wvj5qqm1zodn] C:\DOCUME~1\Owner\LOCALS~1\Temp\sumbb5u.exe
O4 - HKCU\..\Run: [dd86iz0bmzui9k75h3q6qssxn35f72wlqc0oxxrr245q8le2] C:\DOCUME~1\Owner\LOCALS~1\Temp\dxl7fzo.exe
O4 - HKCU\..\Run: [doauccdrs3ki] C:\DOCUME~1\Owner\LOCALS~1\Temp\zi4980stz.exe
O4 - HKCU\..\Run: [t8xe6639dt2ojdsd1el] C:\DOCUME~1\Owner\LOCALS~1\Temp\ozlq29q0.exe
O4 - HKCU\..\Run: [fjyje3r1ymkqs2mrw2lzf0jq3khtm1hx0] C:\DOCUME~1\Owner\LOCALS~1\Temp\ykc3g63.exe
O4 - HKCU\..\Run: [qfxwc969gixvf18pfee3yq5w] C:\DOCUME~1\Owner\LOCALS~1\Temp\xkhvx6x4d.exe
O4 - HKCU\..\Run: [o61520aazfvu1lebn5vzu6ecbwee6cu9n5j9mz332o1] C:\DOCUME~1\Owner\LOCALS~1\Temp\an8sxtw9ca1f.exe
O4 - HKCU\..\Run: [ljxnrfkwvey4whfkgec3o8t7z7eqi01i5z3wpdj3] C:\DOCUME~1\Owner\LOCALS~1\Temp\nkm00x8ucoes.exe
O4 - HKCU\..\Run: [kmjsgo1nc8jwzvb7rj5e] C:\DOCUME~1\Owner\LOCALS~1\Temp\x8o84km.exe
O4 - HKCU\..\Run: [jq2q5xtoexelymsq2kak3p1fom7qyxjc] C:\DOCUME~1\Owner\LOCALS~1\Temp\yd00sdv659bm5.exe
O4 - HKCU\..\Run: [ngtuox787hhc9lok] C:\DOCUME~1\Owner\LOCALS~1\Temp\ap8289f.exe
O4 - HKCU\..\Run: [hj0v3ev831] C:\DOCUME~1\Owner\LOCALS~1\Temp\x9xs1m.exe
O4 - HKCU\..\Run: [bwxdvgg0cnbdn40785ose] C:\DOCUME~1\Owner\LOCALS~1\Temp\wgius03n.exe
O4 - HKCU\..\Run: [nxun78vnhvz] C:\DOCUME~1\Owner\LOCALS~1\Temp\hu3xiuz.exe
O4 - HKCU\..\Run: [z9xxg4tu7lkz1m7bte2c9oqp4nllrnak5aq1d] C:\DOCUME~1\Owner\LOCALS~1\Temp\jh38zc.exe
O4 - HKCU\..\Run: [rk4k8u3fzisdfko8] C:\DOCUME~1\Owner\LOCALS~1\Temp\h9cweytdar.exe
O4 - HKCU\..\Run: [zprd5gsxw61ztefbpq49bi59jec3w] C:\DOCUME~1\Owner\LOCALS~1\Temp\fzsqqm.exe
O4 - HKCU\..\Run: [ukjydo6teuytr032ahfl21qy5yr4k5wc9jz45h6o0aek4] C:\DOCUME~1\Owner\LOCALS~1\Temp\mdbst5b4f4jj0.exe
O4 - HKCU\..\Run: [bhh30s9o565lr026oe985ia816gfdltzvj30co2k5i] C:\DOCUME~1\Owner\LOCALS~1\Temp\gdmr2tsh.exe
O4 - HKCU\..\Run: [vfz91y1kxwys0j0acu5ywq6l] C:\DOCUME~1\Owner\LOCALS~1\Temp\tiqleo1.exe
O4 - HKCU\..\Run: [lp6lq3kxwvpic1v72isnac4nf5vn2qrwkzd2613r2f5] C:\DOCUME~1\Owner\LOCALS~1\Temp\p05fnmbzpm6.exe
O4 - HKCU\..\Run: [b1ek84yoa5emztb9vc8c2fbtfam1jhp3gxh1pbkw] C:\DOCUME~1\Owner\LOCALS~1\Temp\k7lsl7fzs.exe
O4 - HKCU\..\Run: [uodjj6wfm5x4652yo] C:\DOCUME~1\Owner\LOCALS~1\Temp\ccbo8r7oc.exe
O4 - HKCU\..\Run: [kd9uu09qszr7mtk9cp11moes8ergeh1nazxqn] C:\DOCUME~1\Owner\LOCALS~1\Temp\hy6cms.exe
O4 - HKCU\..\Run: [gkqousah68cdtq2rij0oi6d13lhca13m6jzdsz] C:\DOCUME~1\Owner\LOCALS~1\Temp\b8r0u5y4ebmag.exe
O4 - HKCU\..\Run: [kex7lpchhhag7bgiyre0l6gyd0wt5g] C:\DOCUME~1\Owner\LOCALS~1\Temp\m27bjkm.exe
O4 - HKCU\..\Run: [afhltq0h738dnl5u0qfd97kq1d5r] C:\DOCUME~1\Owner\LOCALS~1\Temp\bpzzwfau.exe
O4 - HKCU\..\Run: [saaho6f0bqdzgr9lrub1ikt6m1912vxsm2snh9x] C:\DOCUME~1\Owner\LOCALS~1\Temp\lxyyz3c49n.exe
O4 - HKCU\..\Run: [b0v080yzvwot27a4jimalouv] C:\DOCUME~1\Owner\LOCALS~1\Temp\tzody5.exe
O4 - HKCU\..\Run: [g96e7jd8vzi70av6d8ipzcly9hgxwmdriqusmmd43ztixae] C:\DOCUME~1\Owner\LOCALS~1\Temp\xsxa5nv.exe
O4 - HKCU\..\Run: [whkuxaneal9vmb84s3mea27i26an] C:\DOCUME~1\Owner\LOCALS~1\Temp\ym1bxx.exe
O4 - HKCU\..\Run: [tv5rfj5iqf4e8079y7] C:\DOCUME~1\Owner\LOCALS~1\Temp\f3q2idl3awp33.exe
O4 - HKCU\..\Run: [cc5eob7jo8v5im7ljc99] C:\DOCUME~1\Owner\LOCALS~1\Temp\pc0ruart4.exe
O4 - HKCU\..\Run: [tj1q904qghjezidw37v6epl8my48bi5rh16b1f9ldsfpac8yb] C:\DOCUME~1\Owner\LOCALS~1\Temp\hxwf23j36e.exe
O4 - HKCU\..\Run: [rwzeowh69x77f1j04sjbfzioa1fy4gfn] C:\DOCUME~1\Owner\LOCALS~1\Temp\ncw4i8.exe
O4 - HKCU\..\Run: [fyyeasxy5olhuopwv79k29yu3scqi7mma4vjru2tyx0d] C:\DOCUME~1\Owner\LOCALS~1\Temp\ms1ycz4pv4x4e.exe
O4 - HKCU\..\Run: [p39559g2nybaw31ubp] C:\DOCUME~1\Owner\LOCALS~1\Temp\y76l7wd3dicvk.exe
O4 - HKCU\..\Run: [zymu36cehr22jx78zkfpq41ugis9r4g] C:\DOCUME~1\Owner\LOCALS~1\Temp\mxmy3irixan6.exe
O4 - HKCU\..\Run: [nrlaj63yrhod7v6g10s5n4s7xp1xnd4lmf0e1h2] C:\DOCUME~1\Owner\LOCALS~1\Temp\xgg0l804tj.exe
O4 - HKCU\..\Run: [j2vefsq9pygnld1kr66llpe] C:\DOCUME~1\Owner\LOCALS~1\Temp\w3ib0ienqkz.exe
O4 - HKCU\..\Run: [mbt1rhq47ivrqtm7cubwfwcnh8p] C:\DOCUME~1\Owner\LOCALS~1\Temp\zenmg0d.exe
O4 - HKCU\..\Run: [olb4f08vd4orycis3d1smork52egh7ubo9vy70qfh5xe] C:\DOCUME~1\Owner\LOCALS~1\Temp\pzy4w980r7.exe
O4 - HKCU\..\Run: [zs68sk2s638mhtttjhelf11xcjytaydt5zr0] C:\DOCUME~1\Owner\LOCALS~1\Temp\j7hvyzst4uds.exe
O4 - HKCU\..\Run: [buz3tzt7c7m1unbko153mcwly4cj2ae6idozv9dp] C:\DOCUME~1\Owner\LOCALS~1\Temp\yxb2vnvs.exe
O4 - HKCU\..\Run: [t8qbsquaab9wr6z0cnc6z9dn1txvqc4fyth8i3m7e7eax8] C:\DOCUME~1\Owner\LOCALS~1\Temp\uyzke01t7a.exe
O4 - HKCU\..\Run: [ipip5ueawscigu0j34615y46k5het970o13tvnnvz9cghf] C:\DOCUME~1\Owner\LOCALS~1\Temp\kcw3mqzh.exe
O4 - HKCU\..\Run: [cilotr420zwevt4bsslmu7c9g] C:\DOCUME~1\Owner\LOCALS~1\Temp\yvokiwtch.exe
O4 - HKCU\..\Run: [v6yfa05c47qbcezvhzifleb30v09350d4e05hzeea8m] C:\DOCUME~1\Owner\LOCALS~1\Temp\aeenf5e06.exe
O4 - HKCU\..\Run: [t9ygrqevzd09ixpoq] C:\DOCUME~1\Owner\LOCALS~1\Temp\ny746ta.exe
O4 - HKCU\..\Run: [bd5dgq2rfrpvf5axxm25bwextb] C:\DOCUME~1\Owner\LOCALS~1\Temp\l9ypy78r.exe
O4 - HKCU\..\Run: [jcuy0bgmbpb6qcmp5cs6bme7kl2lji2] C:\DOCUME~1\Owner\LOCALS~1\Temp\e1drs53ufzwkp.exe
O4 - HKCU\..\Run: [i91wbhym8lo30vqr68f5a33tpna860pfbw6wlku7kll5y] C:\DOCUME~1\Owner\LOCALS~1\Temp\wc24wtk1cjyji.exe
O4 - HKCU\..\Run: [jpzkix7rs740db50ut2pxs] C:\DOCUME~1\Owner\LOCALS~1\Temp\ktq6bu5gdyv.exe
O4 - HKCU\..\Run: [xn60pt9ihngd] C:\DOCUME~1\Owner\LOCALS~1\Temp\lz7v0s.exe
O4 - HKCU\..\Run: [qpq1r0vz2orqt4vgiod34lw] C:\DOCUME~1\Owner\LOCALS~1\Temp\kuxv15ee0b.exe
O4 - HKCU\..\Run: [iow3n143qdx8rqs05f] C:\DOCUME~1\Owner\LOCALS~1\Temp\mhfvlwbd.exe
O4 - HKCU\..\Run: [clbb01rpbqwefczuz5pel8wyh4vlmk5] C:\DOCUME~1\Owner\LOCALS~1\Temp\cskbzdijf.exe
O4 - HKCU\..\Run: [hpt54sy9pvgk1z] C:\DOCUME~1\Owner\LOCALS~1\Temp\yi2fdsb7a01c.exe
O4 - HKCU\..\Run: [fii92xcoa5r0yl6] C:\DOCUME~1\Owner\LOCALS~1\Temp\ed3t2zjek7.exe
O4 - HKCU\..\Run: [n0gj2tq4t6xflc6o4gsrm2vdtcfzmgudyhsbgh] C:\DOCUME~1\Owner\LOCALS~1\Temp\iu0mvdz83wdi.exe
O4 - HKCU\..\Run: [f12s655ioakf345] C:\DOCUME~1\Owner\LOCALS~1\Temp\rj1u4xjupaqf.exe
O4 - HKCU\..\Run: [re073m49y] C:\DOCUME~1\Owner\LOCALS~1\Temp\btu67m2gfv.exe
O4 - HKCU\..\Run: [fkguhtl7wjtvnec37xmk5foq8g2zsj6m8icejshl54zi] C:\DOCUME~1\Owner\LOCALS~1\Temp\rgvlqv99.exe
O4 - HKCU\..\Run: [ol3lk26rwoq] C:\DOCUME~1\Owner\LOCALS~1\Temp\loltwpxn.exe
O4 - HKCU\..\Run: [llk9er4ncglkdrlsipap9occkk2otdkvx1axyywvndgq5vz79] C:\DOCUME~1\Owner\LOCALS~1\Temp\h6p4w49w87.exe
O4 - HKCU\..\Run: [axj04324q619hlrn081a2d8] C:\DOCUME~1\Owner\LOCALS~1\Temp\krbzdpr0j.exe
O4 - HKCU\..\Run: [lldswvx8xoil3d] C:\DOCUME~1\Owner\LOCALS~1\Temp\j51jrqqs.exe
O4 - HKCU\..\Run: [oq1z07gtva8kz8olzt470y2bd42xr4c07b61j9fq38kps] C:\DOCUME~1\Owner\LOCALS~1\Temp\htpi8htpv.exe
O4 - HKCU\..\Run: [zke4b759x1] C:\DOCUME~1\Owner\LOCALS~1\Temp\w5cw37o.exe
O4 - HKCU\..\Run: [ui2xecvqd12pbuhyu] C:\DOCUME~1\Owner\LOCALS~1\Temp\wudioa5f0.exe
O4 - HKCU\..\Run: [yxxs5mrui] C:\DOCUME~1\Owner\LOCALS~1\Temp\wk7f9u7x2yv.exe
O4 - HKCU\..\Run: [nkd1p0yu8nct8awr8cpoh3zdaerff5727c0w346g] C:\DOCUME~1\Owner\LOCALS~1\Temp\rv0onn8x6c4.exe
O4 - HKCU\..\Run: [o73y2vteurj6z6k3y3rgos1zx6uh] C:\DOCUME~1\Owner\LOCALS~1\Temp\yk16rjnr74z.exe
O4 - HKCU\..\Run: [loye3j4wt0q243yc842wdv] C:\DOCUME~1\Owner\LOCALS~1\Temp\vwm54h11nukx.exe
O4 - HKCU\..\Run: [rjtg6hg4n61e7j8i5d7z5u6xdcfce3z] C:\DOCUME~1\Owner\LOCALS~1\Temp\lnqh6pso.exe
O4 - HKCU\..\Run: [jm18l94whn8vl4d] C:\DOCUME~1\Owner\LOCALS~1\Temp\hv2edfj.exe
O4 - HKCU\..\Run: [okd1kvruy5hgh8slg037bxdihee0zdhf0myf] C:\DOCUME~1\Owner\LOCALS~1\Temp\eqfeoxs6.exe
O4 - HKCU\..\Run: [cmm21ax1gxrjbhe8y00lhqzq] C:\DOCUME~1\Owner\LOCALS~1\Temp\zzr0ts5z4.exe
O4 - HKCU\..\Run: [lt0zps4x0j4rejwp3if5o59ula] C:\DOCUME~1\Owner\LOCALS~1\Temp\cxf022o.exe
O4 - HKCU\..\Run: [rzdd2mln6jwxyvg5g2pmh18by1w2noj1m3au8h50m8u] C:\DOCUME~1\Owner\LOCALS~1\Temp\ef6tro.exe
O4 - HKCU\..\Run: [d4qehdn6qirp0u9y7uekvz8wimcaz] C:\DOCUME~1\Owner\LOCALS~1\Temp\ego1qi9.exe
O4 - HKCU\..\Run: [bom7nlphx34s5lvmubw9o51m] C:\DOCUME~1\Owner\LOCALS~1\Temp\qe5ik8.exe
O4 - HKCU\..\Run: [al08l79hc3l7gs006zdo2fm7k8ffhqjkbnrngm1vz0zz] C:\DOCUME~1\Owner\LOCALS~1\Temp\n9zyil44jns.exe
O4 - HKCU\..\Run: [sntcx94845cpn4dtk0iwj83vkin36bpwupp] C:\DOCUME~1\Owner\LOCALS~1\Temp\syyr1en5zfi9y.exe
O4 - HKCU\..\Run: [yhk33jhicx5ahnn3gbrvegqt2txt4lkxwwzjvb89n] C:\DOCUME~1\Owner\LOCALS~1\Temp\txfvsocom0ysn.exe
O4 - HKCU\..\Run: [kqkz2eht5xmg10f2c30utmzes24ay1t40aenf] C:\DOCUME~1\Owner\LOCALS~1\Temp\t5a2mxx5ox.exe
O4 - HKCU\..\Run: [nw3w5nz3x6nixfaicnv15cnxwcw] C:\DOCUME~1\Owner\LOCALS~1\Temp\xstlvl64.exe
O4 - HKCU\..\Run: [yp4d2ybc778sa1dznffwtlpcjgnoapz78cnzcscgy9mycf] C:\DOCUME~1\Owner\LOCALS~1\Temp\k8mqsnwr7.exe
O4 - HKCU\..\Run: [v5ukr3ue89v8u7yc8lldv6t7cng8jarccp] C:\DOCUME~1\Owner\LOCALS~1\Temp\cu44189i0e1sx.exe
O4 - HKCU\..\Run: [twxmm3tklfdumcn9od9hkhatnqyvtda] C:\DOCUME~1\Owner\LOCALS~1\Temp\rzhks2f.exe
O4 - HKCU\..\Run: [iiy328co04wklv426] C:\DOCUME~1\Owner\LOCALS~1\Temp\a82elx5.exe
O4 - HKCU\..\Run: [lvo94o67nkb266u707415o13qjec7j] C:\DOCUME~1\Owner\LOCALS~1\Temp\dz5ecnyperhy9.exe
O4 - HKCU\..\Run: [r22b5hbupaaq7vlhqnr1] C:\DOCUME~1\Owner\LOCALS~1\Temp\i0dq3fpvl5h.exe
O4 - HKCU\..\Run: [zjpe0db2zns0pgvi9o10pwryuphl9xc7vx7z6] C:\DOCUME~1\Owner\LOCALS~1\Temp\t49roi7xkgz9.exe
O4 - HKCU\..\Run: [y7mpyh17wkuee97ymvzjbnyca2fo2zpwmtvs9vco47c] C:\DOCUME~1\Owner\LOCALS~1\Temp\xt491x.exe
O4 - HKCU\..\Run: [d1yyrs06k96xuon6p1i92714g9l04ljgga7buy4tck15a5cq3r] C:\DOCUME~1\Owner\LOCALS~1\Temp\y3omltewlzshh.exe
O4 - HKCU\..\Run: [xwx57zust43t85sqixoqd5j2arrtp5arubx8gzvn3fa55x6jh] C:\DOCUME~1\Owner\LOCALS~1\Temp\uv84k6n2.exe
O4 - HKCU\..\Run: [dmbjblz7ncybotne5lt5r9m62r6bfhsft9bioe61j] C:\DOCUME~1\Owner\LOCALS~1\Temp\bzzssjx.exe
O4 - HKCU\..\Run: [nbmvs93w56eeonuai9klp6] C:\DOCUME~1\Owner\LOCALS~1\Temp\nm5wcwlxs0.exe
O4 - HKCU\..\Run: [qjluv2pnx2zru2i9iulyeskale6p68h9] C:\DOCUME~1\Owner\LOCALS~1\Temp\kfpyfbhcvh.exe
O4 - HKCU\..\Run: [a6009r926ka8l5p8d5b0x1qd49suszlue47n9in71st8nuqak] C:\DOCUME~1\Owner\LOCALS~1\Temp\inchfl.exe
O4 - HKCU\..\Run: [ekyntz0ponth43tj7fyiz8ejzqpbdkla1rjacc267o] C:\DOCUME~1\Owner\LOCALS~1\Temp\mlresl.exe
O4 - HKCU\..\Run: [o82en2dg7ykdi8svody2h2pjky8] C:\DOCUME~1\Owner\LOCALS~1\Temp\hzr5tlqq48.exe
O4 - HKCU\..\Run: [f81u6jwggxs8] C:\DOCUME~1\Owner\LOCALS~1\Temp\p0jz8gx8mctbw.exe
O4 - HKCU\..\Run: [wdw6jzsb6avpoymp1cbmw0jqz1rli0xh2] C:\DOCUME~1\Owner\LOCALS~1\Temp\zg12utc.exe
O4 - HKUS\S-1-5-19\..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\LocalService\Application Data\Macromedia\Common\8b2600321.dll"" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [fekidizeni] Rundll32.exe "C:\WINDOWS\system32\tilafago.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\NetworkService\Application Data\Macromedia\Common\8b2600321.dll"" (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [rundll32.exe] rundll32.exe "C:\WINDOWS\system32\config\systemprofile\Application Data\Macromedia\Common\8b2600321.dll"" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [n0not9xgrxc9zuqfgz8vaoo4rnfjdujz9tf2dge32cp1xo] C:\WINDOWS\TEMP\qpcft82vivwn3.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [j1r0qcisc7aczqznluvdl5d] C:\WINDOWS\TEMP\wka743jrzko.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [eidd265gl2ijodqgv] C:\WINDOWS\TEMP\l73qwa3z7i8.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [v0cpt7e2bw6s2w4q7g2q9q3u] C:\WINDOWS\TEMP\p3bo1ol.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [gywccf2hgp9c6yce1c2tyzb3wf5sk54] C:\WINDOWS\TEMP\aiavxbpyu.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [hrm48uncdkapml60mougv924p4uv7zbqw83av19ja] C:\WINDOWS\TEMP\a01zg5bvycgev.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [rundll32.exe] rundll32.exe "C:\WINDOWS\system32\config\systemprofile\Application Data\Macromedia\Common\8b2600321.dll"" (User 'Default user')
O4 - Startup: ChkDisk.lnk = ?
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200312…meInstaller.exe
O20 - AppInit_DLLs: rsstx.dll C:\WINDOWS\system32\gobekado.dll fnvwjk.dll wpkbfp.dll fzlzwh.dll lieyfu.dll C:\WINDOWS\system32\gimemula.dll fpzqgb.dll ihaujx.dll cjpfgn.dll uwjqxh.dll c:\windows\system32\pegojehe.dll
O20 - Winlogon Notify: crypt - C:\WINDOWS\SYSTEM32\crypts.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\pegojehe.dll
O22 - SharedTaskScheduler: carolus - {} - (no file)
O22 - SharedTaskScheduler: klj3r93iorkemnfaja93riemef - {C5BF40A2-94F3-42BD-F434-1604812C8955} - C:\WINDOWS\system32\kjr3iorojdnbfi43unjfd.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\pegojehe.dll
O23 - Service: ICF (icf) - Unknown owner - C:\WINDOWS\system32\svchost.exe:ext.exe
O23 - Service: Network Provisioning Service xmlprovidsvc (xmlprovidsvc) - Unknown owner - c:\xltwpuh.exe

Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis.

Step two

To ensure that I get all the information this log will need to be attached (instructions at the end) if it is to large to attach then upload to Mediafire and post the sharing link.

Download OTScanit2 to your Desktop and double-click on it to extract the files. It will create a folder named OTScanIt on your desktop.

Close ALL OTHER PROGRAMS.
Open the OTScanit folder and double-click on OTScanit.exe to start the program.
Check the box that says Scan All Users
Check the Radio button for Rootkit check YES
Under Additional Scans check the following:
- File - Lop Check
- File - Purity Scan
- Evnt - EventViewer Errors/Warnings (last 10)
Now click the Run Scan button on the toolbar.
Let it run unhindered until it finishes.
When the scan is complete Notepad will open with the report file loaded in it.
Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

Please attach the log in your next post.

To attach a file, do the following:

Click Add Reply
Under the reply panel is the Attachments Panel
Browse for the attachment file you want to upload, then click the green Upload button
Once it has uploaded, click the Manage Current Attachments drop down box
Click on [external image: Posted Image] to insert the attachment into your post

mattwest1

Post #9March 23, 2009, 4:20 AM UTC

Okay I got through HijackThis by checking each of the things you listed and clicking "fix checked." The first couple of items prompted a message saying "regedit has been disabled by administrator." But everything into the items that look like alphabet soup seemed to go through just fine. I opened OTScanit2 and set everything up as it needed to be and clicked run scan. Exact same result as the previous time: "‘1/1/2099 12’ is not a valid date and time." and the bottom progress bar was stuck on the exact same item - "Looking for newly created files: C:\WINDOWS\System32\bajajiyi.dll…" This is as far as it wants to go.

Essexboy

Post #10March 23, 2009, 8:11 PM UTC

I have more tools in my armoury

We will now do a deep search of your processes and files

Download avz4.zip from here

Unzip it to your desktop to a folder named avz4
Double click on AVZ.exe to run it.
Run an update by clicking the Auto Update button on the Right of the Log window: [external image: Posted Image]
Click Start to begin the update

Note: If you recieve an error message, chose a different source, then click Start again

Start AVZ.
Choose from the menu "File" => "Standard scripts " and mark the "Healing/Quarantine and Advanced System Investigation" check box.
Click on the “Execute selected scripts”.
Automatic scanning, healing and system check will be executed.
A logfile (avz_sysinfo.htm) will be created and saved in the LOG folder in the AVZ directory as virusinfo_syscure.zip.
It is necessary to reboot your machine, because AVZ might disturb some program operations (like antiviruses and firewall) during the system scan.
All applications will work properly after the system restart.

When restarted

Start AVZ.
Choose from the menu "File" => "Standard scripts " and mark the “Advanced System Investigation" check box.
Click on the "Execute selected scripts".
A system check will be automatically performed, and the created logfile (avz_sysinfo.htm) will be saved in the LOG folder in the AVZ directory as virusinfo_syscheck.zip.

Attach both zip files to your next post

To attach a file, do the following:

Click Add Reply
Under the reply panel is the Attachments Panel
Browse for the attachment file you want to upload, then click the green Upload button
Once it has uploaded, click the Manage Current Attachments drop down box
Click on [external image: Posted Image] to insert the attachment into your post

mattwest1

Post #11March 24, 2009, 9:54 PM UTC last edited March 24, 2009, 10:05 PM UTC

Alright so everything in your previous post was completed successfully. Even though I'm sure this machine still has a long way to go, I'm just relieved that it actually got through these scans! The first scan was run in Safe Mode with networking. After it was completed, I restarted to regular Safe Mode where I ran the second scan. After that one completed, I rebooted to normal startup to find my desktop background is the "active desktop recovery" although when I go to desktop properties to change the background, it is still blocked off and says my desktop background is the previous 'warning: infections have been found' screen. Two significant improvements: The cooling fan is no longer constantly running at high speed. It now primarily seems to be at it's 2nd slowest speed, although it switches from its slowest speed to it's 2nd fastest speed every 10 seconds or so. The other improvement is that my computer has regained internet access in normal startup mode so it *would appear* that I can work in normal mode from here and I will let you know if that changes.

Attachments:

Essexboy

Post #12March 24, 2009, 10:09 PM UTC

They can run but they can't hide lets try this shall we

AVZ FIX

Double click on AVZ.exe
Click File > Custom scripts

Copy & paste the contents of the following codebox in the box in the program (start with begin and end with end )

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 DeleteFile('C:\DOCUME~1\Owner\LOCALS~1\Temp\mousehook.dll');
 BC_DeleteFile('C:\DOCUME~1\Owner\LOCALS~1\Temp\mousehook.dll');
 BC_DeleteFile('c:\windows\system32\buloboti.dll');
 DeleteFile('c:\windows\system32\buloboti.dll');
 BC_DeleteFile('C:\WINDOWS\system32\gimemula.dll');
 DeleteFile('C:\WINDOWS\system32\gimemula.dll');
 BC_DeleteFile('C:\WINDOWS\system32\kjr3iorojdnbfi43unjfd.dll');
 DeleteFile('C:\WINDOWS\system32\kjr3iorojdnbfi43unjfd.dll');
 BC_DeleteFile('c:\xltwpuh.exe');
 DeleteFile('c:\xltwpuh.exe');
 BC_DeleteFile('C:\DOCUME~1\Owner\LOCALS~1\Temp\951374200.exe');
 DeleteFile('C:\DOCUME~1\Owner\LOCALS~1\Temp\951374200.exe');
 BC_DeleteFile('C:\WINDOWS\TEMP\t1603tasmh7k.exe');
 DeleteFile('C:\WINDOWS\TEMP\t1603tasmh7k.exe');
 BC_DeleteFile('C:\WINDOWS\TEMP\ty7xj08im0xpc.exe');
 DeleteFile('C:\WINDOWS\TEMP\ty7xj08im0xpc.exe');
 BC_DeleteFile('C:\WINDOWS\TEMP\winlogqn.exe');
 DeleteFile('C:\WINDOWS\TEMP\winlogqn.exe');
 BC_DeleteFile('C:\WINDOWS\system32\linoseku.dll');
 DeleteFile('C:\WINDOWS\system32\linoseku.dll');
 DeleteFile('C:\WINDOWS\system32\sdra64.exe');
 BC_DeleteFile('C:\WINDOWS\system32\sdra64.exe');
 BC_DeleteFile('C:\WINDOWS\system32\tilafago.dll');
 DeleteFile('C:\WINDOWS\system32\tilafago.dll');
 BC_DeleteFile('C:\WINDOWS\system32\majavuwu.dll');
 DeleteFile('C:\WINDOWS\system32\majavuwu.dll');
 BC_DeleteFile('C:\Program Files\Antispyware\Antispyware.exe');
 DeleteFile('C:\Program Files\Antispyware\Antispyware.exe');
 BC_DeleteFile('c:\windows\system32\svchost.exe:ext.exe:$DATA');
 DeleteFile('c:\windows\system32\svchost.exe:ext.exe:$DATA');
 BC_DeleteFile('C:\WINDOWS\Fonts\RandFont.dll');
 DeleteFile('C:\WINDOWS\Fonts\RandFont.dll');
 BC_DeleteFile('D:\autorun.inf');
 DeleteFile('D:\autorun.inf');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

Note: When you run the script, your PC will be restarted
Click Run
Restart your PC if it doesn't do it automatically.

ON COMPLETION

Start AVZ.
Choose from the menu "File" => "Standard scripts " and mark the “Advanced System Investigation" check box.
Click on the "Execute selected scripts".
A system check will be automatically performed, and the created logfile (avz_sysinfo.htm) will be saved in the LOG folder in the AVZ directory as virusinfo_syscheck.zip.

Attach the zip file to your next post

mattwest1

Post #13March 24, 2009, 10:37 PM UTC

No issues with either task.

Attachments:

📎virusinfo_syscheck.zip

Essexboy

Post #14March 24, 2009, 10:55 PM UTC

One more run with AVZ immediately followed by Combofix and we may see the light at the end of the tunnel

AVZ FIX

Double click on AVZ.exe
Click File > Custom scripts

Copy & paste the contents of the following codebox in the box in the program (start with begin and end with end )

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 DelBHO('{84938242-5C5B-4A55-B6B9-A1507543B418}');
 DelBHO('{C5BF40A2-94F3-42BD-F434-1604812C8955}');
 DelBHO('{82d71015-6f1d-442c-a730-0fabd8d6e70f}');
 TerminateProcessByName('c:\docume~1\owner\locals~1\temp\1250959964.exe');
 BC_DeleteFile('c:\docume~1\owner\locals~1\temp\1250959964.exe');
 DeleteFile('c:\docume~1\owner\locals~1\temp\1250959964.exe');
 BC_DeleteFile('c:\documents and settings\owner\zcrol.dll');
 DeleteFile('c:\documents and settings\owner\zcrol.dll');
 BC_DeleteFile('C:\DOCUME~1\Owner\LOCALS~1\Temp\1250959964.exe');
 DeleteFile('C:\DOCUME~1\Owner\LOCALS~1\Temp\1250959964.exe');
 BC_DeleteFile('c:\windows\system32\buloboti.dll');
 DeleteFile('c:\windows\system32\buloboti.dll');
 BC_DeleteFile('C:\WINDOWS\system32\majavuwu.dll');
 DeleteFile('C:\WINDOWS\system32\majavuwu.dll');
 BC_DeleteFile('C:\WINDOWS\system32\kjr3iorojdnbfi43unjfd.dll');
 DeleteFile('C:\WINDOWS\system32\kjr3iorojdnbfi43unjfd.dll');
 BC_DeleteFile('C:\Program Files\Antispyware\Antispyware.exe');
 DeleteFile('C:\Program Files\Antispyware\Antispyware.exe');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

Note: When you run the script, your PC will be restarted
Click Run
Restart your PC if it doesn't do it automatically.

ON COMPLETION

Start AVZ.
Choose from the menu "File" => "Standard scripts " and mark the “Advanced System Investigation" check box.
Click on the "Execute selected scripts".
A system check will be automatically performed, and the created logfile (avz_sysinfo.htm) will be saved in the LOG folder in the AVZ directory as virusinfo_syscheck.zip.

Attach the zip file to your next post

THEN

Delete the current Combofix

Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop.

Link 1
Link 2
Link 3

[external image: Posted Image]

[external image: Posted Image]
——————————————————————–

Double click on Combo-Fix.exe & follow the prompts.

When finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a OTListit log so we can continue cleaning the system.

mattwest1

Post #15March 25, 2009, 12:56 AM UTC

Here we go:
————————–
Combo-Fix Log
————————–

ComboFix 09-03-23.01 - Owner 2009-03-24 20:11:55.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2038.1524 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
AV: Trend Micro AntiVirus *On-access scanning disabled* (Outdated)

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\Owner\LOCALS~1\Temp\ntdll64.dll
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\program files\Antispyware
c:\program files\Antispyware\Antispyware.url
c:\program files\Antispyware\DataBase.ref
c:\program files\Antispyware\SpyCleaner.dll
c:\program files\Antispyware\TCL.dll
c:\program files\Antispyware\vistaCPtasks.xml
c:\program files\Antispyware\zlib.dll
c:\program files\Microsoft Common
c:\program files\Microsoft Common\svchost.exe
c:\windows\Ijodijucivic.dll
c:\windows\system32\_003599_.tmp.dll
c:\windows\system32\_003600_.tmp.dll
c:\windows\system32\_003601_.tmp.dll
c:\windows\system32\_003602_.tmp.dll
c:\windows\system32\_003609_.tmp.dll
c:\windows\system32\_003610_.tmp.dll
c:\windows\system32\_003611_.tmp.dll
c:\windows\system32\_003612_.tmp.dll
c:\windows\system32\_003614_.tmp.dll
c:\windows\system32\_003615_.tmp.dll
c:\windows\system32\_003618_.tmp.dll
c:\windows\system32\_003619_.tmp.dll
c:\windows\system32\_003621_.tmp.dll
c:\windows\system32\_003622_.tmp.dll
c:\windows\system32\_003623_.tmp.dll
c:\windows\system32\_003624_.tmp.dll
c:\windows\system32\_003625_.tmp.dll
c:\windows\system32\_003628_.tmp.dll
c:\windows\system32\_003629_.tmp.dll
c:\windows\system32\_003633_.tmp.dll
c:\windows\system32\_003634_.tmp.dll
c:\windows\system32\_003636_.tmp.dll
c:\windows\system32\_003639_.tmp.dll
c:\windows\system32\_003641_.tmp.dll
c:\windows\system32\_003642_.tmp.dll
c:\windows\system32\_003643_.tmp.dll
c:\windows\system32\_003644_.tmp.dll
c:\windows\system32\_003645_.tmp.dll
c:\windows\system32\_003648_.tmp.dll
c:\windows\system32\_003649_.tmp.dll
c:\windows\system32\_003650_.tmp.dll
c:\windows\system32\_003651_.tmp.dll
c:\windows\system32\_003652_.tmp.dll
c:\windows\system32\_003657_.tmp.dll
c:\windows\system32\_003659_.tmp.dll
c:\windows\system32\_003660_.tmp.dll
c:\windows\system32\aaphyy.dll
c:\windows\system32\abizonot.ini
c:\windows\system32\abumogug.ini
c:\windows\system32\acqkfg.dll
c:\windows\system32\ademunud.ini
c:\windows\system32\afigipay.ini
c:\windows\system32\afobeyur.ini
c:\windows\system32\ahohifef.ini
c:\windows\system32\ahtn.htm
c:\windows\system32\ajopaboj.ini
c:\windows\system32\ak
c:\windows\system32\akehatow.ini
c:\windows\system32\alomosah.ini
c:\windows\system32\amepapij.ini
c:\windows\system32\amotesop.ini
c:\windows\system32\amukazip.ini
c:\windows\system32\anuvahih.ini
c:\windows\system32\aomkpr.dll
c:\windows\system32\apeniyum.ini
c:\windows\system32\apolujet.ini
c:\windows\system32\apugihad.ini
c:\windows\system32\arapupil.ini
c:\windows\system32\arirahom.ini
c:\windows\system32\arosalem.ini
c:\windows\system32\asorelan.ini
c:\windows\system32\atpsst.dll
c:\windows\system32\atulunir.ini
c:\windows\system32\atumelov.ini
c:\windows\system32\avejoyuw.ini
c:\windows\system32\avunetaf.ini
c:\windows\system32\awobekil.ini
c:\windows\system32\awupewaj.ini
c:\windows\system32\ayipoman.ini
c:\windows\system32\ayomarek.ini
c:\windows\system32\bajiyaje.dll
c:\windows\system32\banoroya.dll
c:\windows\system32\bapemode.dll
c:\windows\system32\basilobe.dll
c:\windows\system32\bb1.dat
c:\windows\system32\bevefime.dll
c:\windows\system32\bigatake.dll
c:\windows\system32\birizofu.dll
c:\windows\system32\bnwsvc.dll
c:\windows\system32\bodonope.dll
c:\windows\system32\bopoyufi.dll
c:\windows\system32\ceyqdf.dll
c:\windows\system32\cikszg.dll
c:\windows\system32\cjpfgn.dll
c:\windows\system32\config\systemprofile\Application Data\Macromedia\Common
c:\windows\system32\config\systemprofile\Application Data\Macromedia\Common\8b2600321.dll
c:\windows\system32\cookie1.dat
c:\windows\system32\cqolca.dll
c:\windows\system32\crypts.dll
c:\windows\system32\cs.dat
c:\windows\system32\cwpuru.dll
c:\windows\system32\dafanole.dll
c:\windows\system32\dahigupa.dll
c:\windows\system32\dajufiwe.dll
c:\windows\system32\deditami.dll
c:\windows\system32\dekiduhe.dll
c:\windows\system32\dipunomu.dll
c:\windows\system32\dolemiju.dll
c:\windows\system32\domagihi.dll
c:\windows\system32\dopikera.dll
c:\windows\system32\dunumeda.dll
c:\windows\system32\dxdmtr.dll
c:\windows\system32\dxuugx.dll
c:\windows\system32\ealwun.dll
c:\windows\system32\eaxqmt.dll
c:\windows\system32\ebayulan.ini
c:\windows\system32\ebikuyuz.ini
c:\windows\system32\ebodagug.ini
c:\windows\system32\ebumefok.ini
c:\windows\system32\edijamaj.ini
c:\windows\system32\edofeloy.ini
c:\windows\system32\eduridim.ini
c:\windows\system32\efajutiy.ini
c:\windows\system32\efamidos.ini
c:\windows\system32\efugohih.ini
c:\windows\system32\efuryd.dll
c:\windows\system32\egifulam.ini
c:\windows\system32\egokitin.ini
c:\windows\system32\ehavogek.ini
c:\windows\system32\ehawipoz.ini
c:\windows\system32\ehekurow.ini
c:\windows\system32\ehulejuw.ini
c:\windows\system32\ejayijab.ini
c:\windows\system32\ejededon.ini
c:\windows\system32\ekagusok.ini
c:\windows\system32\ekatagib.ini
c:\windows\system32\eketejiv.ini
c:\windows\system32\ekopenen.ini
c:\windows\system32\ekugavan.ini
c:\windows\system32\elafetok.ini
c:\windows\system32\elaluwed.ini
c:\windows\system32\elarabow.ini
c:\windows\system32\emevukep.ini
c:\windows\system32\emikuged.ini
c:\windows\system32\eniveser.ini
c:\windows\system32\enobapuj.ini
c:\windows\system32\epazavey.ini
c:\windows\system32\epejojit.ini
c:\windows\system32\epenivak.ini
c:\windows\system32\epifohal.ini
c:\windows\system32\epohatek.ini
c:\windows\system32\epohijek.ini
c:\windows\system32\epopapot.ini
c:\windows\system32\erakeloz.ini
c:\windows\system32\eregozop.ini
c:\windows\system32\erifesip.ini
c:\windows\system32\esinigag.ini
c:\windows\system32\esipayij.ini
c:\windows\system32\esowopuv.ini
c:\windows\system32\etolaweh.ini
c:\windows\system32\evikaraf.ini
c:\windows\system32\evodamim.ini
c:\windows\system32\ewunurad.ini
c:\windows\system32\eyetonip.ini
c:\windows\system32\eyineriy.ini
c:\windows\system32\eyofibej.ini
c:\windows\system32\eyovinuz.ini
c:\windows\system32\fajubayo.dll
c:\windows\system32\fakuhazu.dll
c:\windows\system32\famuheno.dll
c:\windows\system32\febawoyi.dll
c:\windows\system32\fefiweta.dll
c:\windows\system32\fegovoku.dll
c:\windows\system32\fjfdmw.dll
c:\windows\system32\flekat.dll
c:\windows\system32\fnuvgw.dll
c:\windows\system32\fnvwjk.dll
c:\windows\system32\foponiga.dll
c:\windows\system32\fpzqgb.dll
c:\windows\system32\frmwrk32.exe
c:\windows\system32\fufuwatu.dll
c:\windows\system32\fzlzwh.dll
c:\windows\system32\ganafihe.dll
c:\windows\system32\garafufe.dll
c:\windows\system32\gcebuc.dll
c:\windows\system32\gedofano.dll
c:\windows\system32\gefesohi.dll.tmp
c:\windows\system32\gehiraso.dll
c:\windows\system32\gehuseda.dll
c:\windows\system32\gepibura.dll
c:\windows\system32\ghcuwv.dll
c:\windows\system32\gigijomo.dll
c:\windows\system32\gijareyi.dll.tmp
c:\windows\system32\gijotoda.dll
c:\windows\system32\girodado.dll
c:\windows\system32\gizehure.dll
c:\windows\system32\gobekado.dll.tmp
c:\windows\system32\gowajiwe.dll
c:\windows\system32\gukevewi.dll
c:\windows\system32\guratayo.dll
c:\windows\system32\hadezabi.dll
c:\windows\system32\hafolura.dll
c:\windows\system32\halihupe.dll
c:\windows\system32\hapoyuho.dll
c:\windows\system32\hauikh.dll
c:\windows\system32\hcpgsk.dll
c:\windows\system32\hegizuku.dll
c:\windows\system32\hehoyoze.dll
c:\windows\system32\hejapive.dll
c:\windows\system32\heruhozu.dll
c:\windows\system32\hevotuza.dll
c:\windows\system32\hibopiro.dll
c:\windows\system32\higudivo.dll
c:\windows\system32\hilavabi.dll
c:\windows\system32\hisikuga.dll
c:\windows\system32\hiyokovu.dll
c:\windows\system32\hnwfnf.dll
c:\windows\system32\hobukubo.dll
c:\windows\system32\hohileta.dll
c:\windows\system32\hokegemu.dll
c:\windows\system32\hopagatu.dll
c:\windows\system32\horihiju.dll
c:\windows\system32\hqrzkc.dll
c:\windows\system32\hugehf.dll
c:\windows\system32\hunupave.dll.tmp
c:\windows\system32\ibawuzed.ini
c:\windows\system32\ibazedah.ini
c:\windows\system32\ibizejed.ini
c:\windows\system32\ibuhinew.ini
c:\windows\system32\ifebikil.ini
c:\windows\system32\ifejoyod.ini
c:\windows\system32\ifezehab.ini
c:\windows\system32\igibimed.ini
c:\windows\system32\ihahudud.ini
c:\windows\system32\ihaujx.dll
c:\windows\system32\ijereron.ini
c:\windows\system32\ijezudis.ini
c:\windows\system32\ijotujuj.ini
c:\windows\system32\ijudigoj.ini
c:\windows\system32\ikayijuj.ini
c:\windows\system32\ilebuhop.ini
c:\windows\system32\imujezaj.ini
c:\windows\system32\inozenin.ini
c:\windows\system32\ipanolet.ini
c:\windows\system32\ipenovom.ini
c:\windows\system32\ipiduseh.ini
c:\windows\system32\ipivetay.ini
c:\windows\system32\ipunukeh.ini
c:\windows\system32\irevivos.ini
c:\windows\system32\irezepup.ini
c:\windows\system32\itefubif.ini
c:\windows\system32\itowigir.ini
c:\windows\system32\ituzuzib.ini
c:\windows\system32\ivonusup.ini
c:\windows\system32\ivowideh.ini
c:\windows\system32\ivozarot.ini
c:\windows\system32\iwhgfg.dll
c:\windows\system32\izatiyan.ini
c:\windows\system32\izazanuh.ini
c:\windows\system32\jaguvonu.dll
c:\windows\system32\jamajide.dll
c:\windows\system32\jarekapu.dll
c:\windows\system32\jarugimo.dll
c:\windows\system32\jayamuja.dll
c:\windows\system32\jemugezu.dll
c:\windows\system32\jenuhisu.dll
c:\windows\system32\jepiliwu.dll
c:\windows\system32\jezemimu.dll
c:\windows\system32\jizdvp.dll
c:\windows\system32\joliyusi.dll
c:\windows\system32\jorofudo.dll
c:\windows\system32\jotejazo.dll.vir
c:\windows\system32\juropawo.dll
c:\windows\system32\juzeziwi.dll
c:\windows\system32\juzuzoji.dll
c:\windows\system32\kajorila.dll
c:\windows\system32\kayugibu.dll
c:\windows\system32\kebajupa.dll.tmp
c:\windows\system32\kefuzego.dll
c:\windows\system32\kelarozo.dll
c:\windows\system32\kerojade.dll
c:\windows\system32\ketowuhi.dll
c:\windows\system32\kevupavo.dll
c:\windows\system32\kijngl.dll
c:\windows\system32\kiligefu.dll
c:\windows\system32\kimupabe.dll
c:\windows\system32\kivifivu.dll
c:\windows\system32\kkpbgj.dll
c:\windows\system32\kosugake.dll
c:\windows\system32\kozotifa.dll
c:\windows\system32\kupaviba.dll.tmp
c:\windows\system32\kuwotevi.dll
c:\windows\system32\kuyajome.dll
c:\windows\system32\lavorosa.dll.tmp
c:\windows\system32\ledamine.dll
c:\windows\system32\lefekeku.dll
c:\windows\system32\lejutuzu.dll
c:\windows\system32\letiyube.dll
c:\windows\system32\libayewu.dll
c:\windows\system32\lidiwuza.dll
c:\windows\system32\lieyfu.dll
c:\windows\system32\liwibaju.dll
c:\windows\system32\lowsec
c:\windows\system32\lowsec\local.ds
c:\windows\system32\lowsec\user.ds
c:\windows\system32\lowsec\user.ds.lll
c:\windows\system32\lutawudi.dll
c:\windows\system32\lwphnd.dll
c:\windows\system32\mafazupe.dll
c:\windows\system32\majudohi.dll
c:\windows\system32\malufige.dll
c:\windows\system32\masedaro.dll
c:\windows\system32\medidobu.dll
c:\windows\system32\memotoga.dll
c:\windows\system32\mesegahe.dll
c:\windows\system32\meyoreho.dll
c:\windows\system32\midepoba.dll
c:\windows\system32\midirude.dll
c:\windows\system32\mikomuyo.dll.tmp
c:\windows\system32\mimadove.dll
c:\windows\system32\mjfdzv.dll
c:\windows\system32\moharira.dll
c:\windows\system32\molukoza.dll
c:\windows\system32\mtbbtm.dll
c:\windows\system32\mubosoje.dll
c:\windows\system32\mukejowe.dll
c:\windows\system32\mulanaha.dll
c:\windows\system32\napuruya.dll
c:\windows\system32\nayitazi.dll
c:\windows\system32\nazoluha.dll
c:\windows\system32\nazomafo.dll
c:\windows\system32\nehalofu.dll
c:\windows\system32\nevibuni.dll
c:\windows\system32\nirotona.dll
c:\windows\system32\noyiniwe.dll.tmp
c:\windows\system32\ntdll64.exe
c:\windows\system32\nudehiye.dll
c:\windows\system32\nuhufise.dll
c:\windows\system32\nujeruze.dll
c:\windows\system32\nupotuku.dll
c:\windows\system32\nuretuze.dll
c:\windows\system32\nutuvuga.dll
c:\windows\system32\nuvutoki.dll
c:\windows\system32\nuyajuku.dll
c:\windows\system32\nuyimuto.dll.tmp
c:\windows\system32\nwylci.dll
c:\windows\system32\nyoooo.dll
c:\windows\system32\nzwugo.dll
c:\windows\system32\obewojot.ini
c:\windows\system32\odilojep.ini
c:\windows\system32\ofojumib.ini
c:\windows\system32\ofoloveh.ini
c:\windows\system32\ogahibef.ini
c:\windows\system32\ogezufek.ini
c:\windows\system32\oguweram.ini
c:\windows\system32\oheroyem.ini
c:\windows\system32\ojayigog.ini
c:\windows\system32\ojepumiv.ini
c:\windows\system32\ojipokul.ini
c:\windows\system32\okevamut.ini
c:\windows\system32\olahavip.ini
c:\windows\system32\olunutat.ini
c:\windows\system32\omajonov.ini
c:\windows\system32\omugakoy.ini
c:\windows\system32\omutofej.ini
c:\windows\system32\orulujum.ini
c:\windows\system32\osaparul.ini
c:\windows\system32\oseniriv.ini
c:\windows\system32\otekifol.ini
c:\windows\system32\ovajutev.ini
c:\windows\system32\ovalugiz.ini
c:\windows\system32\ovubonuj.ini
c:\windows\system32\ovudunop.ini
c:\windows\system32\owakowed.ini
c:\windows\system32\owaporuj.ini
c:\windows\system32\owuwowot.ini
c:\windows\system32\oyasiwab.ini
c:\windows\system32\ozoralek.ini
c:\windows\system32\padifisa.dll
c:\windows\system32\pajuwojo.dll.tmp
c:\windows\system32\papupona.dll
c:\windows\system32\pegojehe.dll
c:\windows\system32\pejolido.dll
c:\windows\system32\pepowewa.dll
c:\windows\system32\pexnge.dll
c:\windows\system32\pgusim.dll
c:\windows\system32\pirabumo.dll
c:\windows\system32\pitorewe.dll
c:\windows\system32\pmqeuf.dll
c:\windows\system32\podoposi.dll
c:\windows\system32\pogepehe.dll
c:\windows\system32\pojezija.dll
c:\windows\system32\ponimero.dll.vir
c:\windows\system32\ps1.dat
c:\windows\system32\pupezeri.dll
c:\windows\system32\purahulu.dll
c:\windows\system32\puwohuwu.dll
c:\windows\system32\pwxsbc.dll
c:\windows\system32\pwzihy.dll
c:\windows\system32\qfxxit.dll
c:\windows\system32\qwsxmo.dll
c:\windows\system32\rapevivo.dll
c:\windows\system32\raramuge.dll
c:\windows\system32\rc.dat
c:\windows\system32\reposoku.dll
c:\windows\system32\repudana.dll
c:\windows\system32\rijikoyi.dll
c:\windows\system32\rogiwofi.dll
c:\windows\system32\rowaloko.dll
c:\windows\system32\rs32net.exe
c:\windows\system32\rshnfb.dll
c:\windows\system32\rukabipe.dll
c:\windows\system32\rusejafe.dll
c:\windows\system32\ruyumuno.dll
c:\windows\system32\ryrczm.dll
c:\windows\system32\satukivu.dll
c:\windows\system32\sazujimo.dll
c:\windows\system32\segivubo.dll
c:\windows\system32\sesanujo.dll
c:\windows\system32\shalss.dll
c:\windows\system32\sihosido.dll
c:\windows\system32\sinspn.dll
c:\windows\system32\siyohiho.dll
c:\windows\system32\sodimafe.dll
c:\windows\system32\sorubaro.dll
c:\windows\system32\sosazuhe.dll
c:\windows\system32\suhokamo.dll
c:\windows\system32\tadepabe.dll
c:\windows\system32\tamowevu.dll
c:\windows\system32\tayudupi.dll
c:\windows\system32\tb.dr
c:\windows\system32\tehunevo.dll
c:\windows\system32\tetupaha.dll
c:\windows\system32\tezohonu.dll
c:\windows\system32\tikatabi.dll.vir
c:\windows\system32\tizuguve.dll
c:\windows\system32\togitata.dll
c:\windows\system32\togusiyu.dll
c:\windows\system32\topature.dll
c:\windows\system32\topitavi.dll
c:\windows\system32\torazovi.dll
c:\windows\system32\toyedofi.dll
c:\windows\system32\tsuisw.dll
c:\windows\system32\tukideka.dll.tmp
c:\windows\system32\tumaveko.dll
c:\windows\system32\tuyuvela.dll
c:\windows\system32\ubakunem.ini
c:\windows\system32\ubemelih.ini
c:\windows\system32\ubomulum.ini
c:\windows\system32\ugoyadar.ini
c:\windows\system32\uhofozop.ini
c:\windows\system32\ujdenu.dll
c:\windows\system32\ujoyubaf.ini
c:\windows\system32\ukesonil.ini
c:\windows\system32\ukezaniy.ini
c:\windows\system32\ukuzigeh.ini
c:\windows\system32\umaliwuv.ini
c:\windows\system32\umegekoh.ini
c:\windows\system32\umugosup.ini
c:\windows\system32\umutegas.ini
c:\windows\system32\uniq.tll
c:\windows\system32\unohozet.ini
c:\windows\system32\upobovab.ini
c:\windows\system32\uqipet.dll
c:\windows\system32\urahudoj.ini
c:\windows\system32\urvdjq.dll
c:\windows\system32\usasulam.ini
c:\windows\system32\utagapoh.ini
c:\windows\system32\utodehaz.ini
c:\windows\system32\uvanarer.ini
c:\windows\system32\uvewaner.ini
c:\windows\system32\uwarorun.ini
c:\windows\system32\uwehefez.ini
c:\windows\system32\uwilipej.ini
c:\windows\system32\uwjqxh.dll
c:\windows\system32\uymxkw.dll
c:\windows\system32\uyohobay.ini
c:\windows\system32\uyoyalab.ini
c:\windows\system32\uyoyonef.ini
c:\windows\system32\uyyiba.dll
c:\windows\system32\uzebusaw.ini
c:\windows\system32\uzewigor.ini
c:\windows\system32\uzodipom.ini
c:\windows\system32\vagiluke.dll
c:\windows\system32\vahdcm.dll
c:\windows\system32\vcpskb.dll
c:\windows\system32\vebiwoju.dll
c:\windows\system32\vepuhuje.dll
c:\windows\system32\vesujuji.dll
c:\windows\system32\vifefata.dll
c:\windows\system32\vikotiyu.dll
c:\windows\system32\vimupejo.dll
c:\windows\system32\vitetija.dll
c:\windows\system32\vodafoju.dll
c:\windows\system32\vubulaku.dll
c:\windows\system32\vuganele.dll
c:\windows\system32\vxpwwm.dll
c:\windows\system32\vzjwde.dll
c:\windows\system32\wadumepo.dll
c:\windows\system32\wagopiva.dll
c:\windows\system32\wakosoli.dll
c:\windows\system32\wanelebu.dll
c:\windows\system32\warning.gif
c:\windows\system32\wasoteba.dll
c:\windows\system32\weluyotu.dll
c:\windows\system32\wenabebi.dll
c:\windows\system32\wevoyira.dll
c:\windows\system32\wilubore.dll
c:\windows\system32\win32hlp.cnf
c:\windows\system32\wotifiri.dll
c:\windows\system32\wpkbfp.dll
c:\windows\system32\wukojohe.dll
c:\windows\system32\wurilipo.dll
c:\windows\system32\wurinuza.dll
c:\windows\system32\wuvajepe.dll.tmp
c:\windows\system32\wuyofage.dll
c:\windows\system32\wuyowoli.dll
c:\windows\system32\xafeji.dll
c:\windows\system32\xjkdor.dll
c:\windows\system32\xomyxd.dll
c:\windows\system32\xpcdbz.dll
c:\windows\system32\yaboyade.dll
c:\windows\system32\yabxtp.dll
c:\windows\system32\yebukobe.dll
c:\windows\system32\yedonuse.dll
c:\windows\system32\yemavema.dll
c:\windows\system32\yeteyohi.dll.tmp
c:\windows\system32\yikizafe.dll
c:\windows\system32\yizesoko.dll
c:\windows\system32\yizobejo.dll
c:\windows\system32\yofivowi.dll
c:\windows\system32\yokagumo.dll
c:\windows\system32\yolefode.dll
c:\windows\system32\yonbtz.dll
c:\windows\system32\yorerufo.dll
c:\windows\system32\yoyorena.dll
c:\windows\system32\yujitana.dll
c:\windows\system32\yumikedi.dll
c:\windows\system32\yunukino.dll
c:\windows\system32\yupohote.dll
c:\windows\system32\zabanalu.dll
c:\windows\system32\zabjet.dll
c:\windows\system32\zahedotu.dll
c:\windows\system32\zajeribo.dll
c:\windows\system32\zakulapa.dll
c:\windows\system32\zanelupo.dll
c:\windows\system32\zazovera.dll
c:\windows\system32\zazovuba.dll
c:\windows\system32\zeladugu.dll
c:\windows\system32\zelovumi.dll.tmp
c:\windows\system32\ziyiwori.dll
c:\windows\system32\zncidt.dll
c:\windows\system32\zodavula.dll
c:\windows\system32\zubeyune.dll
c:\windows\system32\zudisaho.dll
c:\windows\system32\zuleluje.dll
c:\windows\system32\zuvczv.dll
c:\windows\temp\186.exe
c:\windows\temp\2.exe
c:\windows\temp\2439511420.exe
c:\windows\temp\3542877220.exe
c:\windows\temp\3759798050.exe
c:\windows\temp\3966002220.exe
.
—- Previous Run ——-
.
c:\docume~1\Owner\APPLIC~1\MACROM~1\Common\8B2600~1.DLL

—– BITS: Possible infected sites —–

hxxp://updates.swarmcast.net
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_icf
——-\Legacy_tcpsr
——-\Service_icf
——-\Service_tcpsr

((((((((((((((((((((((((( Files Created from 2009-02-25 to 2009-03-25 )))))))))))))))))))))))))))))))
.

2009-05-10 22:35 . 2009-05-10 22:35 2,713 —hs—- c:\windows\system32\tigifofi.dll
2009-05-10 10:37 . 2009-05-10 10:37 2,713 —hs—- c:\windows\system32\dafirulo.dll
2009-05-09 15:55 . 2009-05-09 15:55 2,713 —hs—- c:\windows\system32\tohagugu.dll
2009-03-20 13:00 . 2009-03-20 13:00 d——– C:\_OTListIt
2009-03-14 18:39 . 2009-03-14 18:39 0 –a—— C:\iivopso.exe
2009-03-13 17:40 . 2009-03-13 17:41 d——– c:\program files\ERUNT
2009-03-13 17:15 . 2009-03-13 17:15 41,472 –a—— C:\lwvjuv.exe
2009-03-13 17:14 . 2009-03-19 17:15 10,240 –a—— c:\windows\instsp2.exe
2009-03-12 03:24 . 2009-03-14 18:30 104,960 –a—— c:\windows\system32\dllcache\userinit.exe
2009-03-12 03:24 . 2009-03-12 03:24 95,232 –a—— c:\windows\system32\QoS.dll
2009-03-11 16:10 . 2009-03-11 16:10 134,656 –a—— c:\windows\axehejoz.dll
2009-03-11 16:00 . 2009-03-11 16:02 717,650 –ahs—- c:\windows\system32\1025o.sys
2009-03-11 16:00 . 2009-03-11 16:00 21,504 –ahs—- c:\windows\system32\$winnt$w.dll
2009-03-11 16:00 . 2009-03-11 16:00 16,384 –ahs—- c:\windows\system32\$winnt$wg.dll
2009-03-11 16:00 . 2009-03-11 16:00 26 –a—— c:\windows\system32\advapi32a.sys
2009-03-11 15:59 . 2009-03-14 18:41 123,392 –a—— C:\mfvse.exe
2009-03-11 15:59 . 2009-03-11 16:00 407 –a-s—- c:\windows\system32\909338939.dat
2009-03-11 15:59 . 2009-03-11 15:59 2 –a—— C:\1823729539
2009-03-11 15:59 . 2009-03-13 17:16 0 –a—— c:\windows\system32\drivers\c377109c.sys
2009-03-11 15:58 . 2009-03-11 15:58 76,288 -r-hs—- c:\windows\system32\afobeyurq.exe
2009-03-11 15:58 . 2009-03-14 18:17 41,984 –a—— C:\tcrnwc.exe
2009-03-11 15:58 . 2009-03-14 18:17 32,768 –a—— C:\ucpdcu.exe
2009-03-07 18:04 . 2009-03-11 15:58 10,240 –a—— c:\windows\instsp1.exe
2009-02-26 15:56 . 2009-02-26 15:56 2,713 —hs—- c:\windows\system32\gilefede.dll
2009-02-25 20:40 . 2009-02-25 20:40 d——– c:\windows\system32\Adobe
2009-02-25 02:24 . 2009-02-25 02:24 2,713 —hs—- c:\windows\system32\loganini.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-20 17:35 ——— d—–w c:\documents and settings\Owner\Application Data\Antispyware
2009-03-19 21:14 ——— d—–w c:\documents and settings\All Users\Application Data\Google Updater
2009-03-13 21:32 ——— d—–w c:\program files\Trend Micro
2009-03-13 02:53 ——— d—–w c:\documents and settings\All Users\Application Data\avg8
2009-03-11 07:00 16,384 —-a-w c:\windows\DCEBoot.exe
2009-03-06 02:17 36,368 —-a-w c:\windows\system32\drivers\tmpreflt.sys
2009-03-06 02:17 205,328 —-a-w c:\windows\system32\drivers\tmxpflt.sys
2009-03-06 02:17 1,195,512 —-a-w c:\windows\system32\drivers\vsapint.sys
2009-03-03 23:12 80,400 —-a-w c:\windows\system32\drivers\tmtdi.sys
2009-03-03 08:34 50,192 —-a-w c:\windows\system32\drivers\tmevtmgr.sys
2009-03-03 08:34 50,192 —-a-w c:\windows\system32\drivers\tmactmon.sys
2009-03-03 08:34 150,032 —-a-w c:\windows\system32\drivers\tmcomm.sys
2009-02-24 21:27 ——— d—–w c:\program files\Google
2009-02-17 02:17 ——— d—–w c:\documents and settings\Owner\Application Data\Move Networks
2009-02-13 07:00 ——— d—–w c:\documents and settings\Owner\Application Data\Amazon
2009-02-13 06:58 ——— d—–w c:\program files\Amazon
2009-02-04 21:03 ——— d—–w c:\program files\Malwarebytes' Anti-Malware
2009-02-04 21:03 ——— d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-04 20:57 ——— d—a-w c:\documents and settings\All Users\Application Data\TEMP
2009-01-05 21:17 81,920 —-a-w c:\documents and settings\Owner\Application Data\ezpinst.exe
2009-01-05 21:17 47,360 —-a-w c:\documents and settings\Owner\Application Data\pcouffin.sys
2007-06-21 04:19 604 —ha-w c:\program files\STLL Notifier
2008-09-23 03:17 57,344 –sha-w c:\windows\system32\vidohosi.dll
.

——- Sigcheck ——-

2005-05-25 23:07 359936 63fdfea54eb53de2d863ee454937ce1e c:\windows\$hf_mig$\KB893066\SP2QFE\tcpip.sys
2006-01-13 21:07 360448 5562cc0a47b2aef06d3417b733f3c195 c:\windows\$hf_mig$\KB913446\SP2QFE\tcpip.sys
2006-04-20 08:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
2007-10-30 12:53 360832 64798ecfa43d78c7178375fcdd16d8c8 c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
2008-06-20 06:44 360960 744e57c99232201ae98c49168b918f48 c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
2008-06-20 07:51 361600 9aefa14bd6b182d61e3119fa5f436d3d c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
2008-06-20 07:59 361600 ad978a1b783b5719720cff204b666c8e c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
2006-03-16 00:00 359040 9f4b36614a0fc234525ba224957de55c c:\windows\$NtUninstallKB893066$\tcpip.sys
2005-05-25 23:04 359808 88763a98a4c26c409741b4aa162720c9 c:\windows\$NtUninstallKB913446$\tcpip.sys
2006-04-20 07:51 359808 1dbf125862891817f374f407626967f4 c:\windows\$NtUninstallKB941644$\tcpip.sys
2007-10-30 13:20 360064 90caff4b094573449a0872a0f919b178 c:\windows\$NtUninstallKB951748$\tcpip.sys
2008-04-13 15:20 361344 accf5a9a1ffaa490f33dba1c632b95e1 c:\windows\ServicePackFiles\i386\tcpip.sys
2008-04-13 15:20 361344 93ea8d04ec73a85db02eb8805988f733 c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\tcpip.sys
2008-04-13 15:20 361344 accf5a9a1ffaa490f33dba1c632b95e1 c:\windows\system32\drivers\tcpip.sys

2008-04-13 20:12 26112 a93aee1928a9d7ce3e16d24ec7380f89 c:\windows\ServicePackFiles\i386\userinit.exe
2008-04-13 20:12 26112 a93aee1928a9d7ce3e16d24ec7380f89 c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\userinit.exe
2009-03-12 03:23 264704 9aae01609c3060b79b58e3b085caf4bf c:\windows\system32\userinit.exe
2009-03-14 18:30 104960 1463c159a718b86444e146bf0c5c3381 c:\windows\system32\dllcache\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"UfSeAgnt.exe"="c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe" [2009-03-13 995528]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"midi5"= xgusb.cpl

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ati0iqxx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ati1krxx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ati3nuxx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ati4nuxx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ati5qxxx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ati5raxx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ati6ahxx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ati6emxx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ati6wgxx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ati7raxx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ati8ryxx.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk
backup=c:\windows\pss\HP Photosmart Premier Fast Start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
–a—— 2008-12-15 23:20 342848 c:\program files\BitTorrent_DNA\btdna.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
–a—— 2005-08-06 00:56 64512 c:\windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
–a—— 2005-02-17 02:11 49152 c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant]
–a—— 2006-05-04 01:58 458752 c:\program files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
–a—— 2006-03-22 16:13 77824 c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
–a—— 2006-03-22 16:17 118784 c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
–a—— 2006-03-22 16:17 94208 c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
–a—— 2005-08-11 19:30 249856 c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
–a—— 2005-08-11 19:30 81920 c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
–a—— 2008-03-17 17:59 2289664 c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl]
–a—— 2006-06-19 14:33 163840 c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService]
–a—— 2006-07-19 18:14 102400 c:\program files\HP\QuickPlay\QPService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-05-27 10:50 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RecGuard]
–a—— 2005-10-11 13:23 1187840 c:\windows\SMINST\Recguard.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2005-11-11 00:03 36975 c:\program files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
–a—— 2006-06-17 01:22 794713 c:\program files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
–a—— 2007-11-15 22:51 166304 c:\program files\Zune\ZuneLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
–a—— 2006-06-02 11:02 61952 c:\windows\system32\CHDAudPropShortcut.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsmqIntCert]
–a—— 2008-04-13 20:11 177152 c:\windows\system32\mqrt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"hpqwmiex"=2 (0x2)
"IDriverT"=3 (0x3)
"LightScribeService"=2 (0x2)
"Vongo Service"=2 (0x2)
"Viewpoint Manager Service"=2 (0x2)
"iPod Service"=3 (0x3)
"btwdins"=2 (0x2)
"avg8wd"=2 (0x2)
"avg8emc"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\BitTorrent_DNA\\dna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\TVAnts\\Tvants.exe"=
"c:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
"c:\\Program Files\\BitTorrent_DNA\\btdna.exe"=
"c:\\Program Files\\Google\\Common\\Google Updater\\GoogleUpdaterService.exe"=
"c:\\Program Files\\Viewpoint\\Common\\ViewpointService.exe"=
"c:\\Program Files\\WIDCOMM\\Bluetooth Software\\bin\\btwdins.exe"=
"c:\\Program Files\\AIM6\\aolsoftware.exe"=
"c:\\WINDOWS\\system32\\ZuneBusEnum.exe"=

R2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [2009-01-12 50192]
R2 tmpreflt;tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [2008-07-30 36368]
R2 TmProxy;Trend Micro Proxy Service;c:\program files\Trend Micro\Internet Security\TmProxy.exe [2009-01-12 677128]
S0 ati0iqxx;ati0iqxx;c:\windows\system32\Drivers\ati0iqxx.sys –> c:\windows\system32\Drivers\ati0iqxx.sys [?]
S0 ati1krxx;ati1krxx;c:\windows\system32\Drivers\ati1krxx.sys –> c:\windows\system32\Drivers\ati1krxx.sys [?]
S0 ati3nuxx;ati3nuxx;c:\windows\system32\Drivers\ati3nuxx.sys –> c:\windows\system32\Drivers\ati3nuxx.sys [?]
S0 ati4nuxx;ati4nuxx;c:\windows\system32\Drivers\ati4nuxx.sys –> c:\windows\system32\Drivers\ati4nuxx.sys [?]
S0 ati5qxxx;ati5qxxx;c:\windows\system32\Drivers\ati5qxxx.sys –> c:\windows\system32\Drivers\ati5qxxx.sys [?]
S0 ati5raxx;ati5raxx;c:\windows\system32\Drivers\ati5raxx.sys –> c:\windows\system32\Drivers\ati5raxx.sys [?]
S0 ati6emxx;ati6emxx;c:\windows\system32\Drivers\ati6emxx.sys –> c:\windows\system32\Drivers\ati6emxx.sys [?]
S0 ati7raxx;ati7raxx;c:\windows\system32\Drivers\ati7raxx.sys –> c:\windows\system32\Drivers\ati7raxx.sys [?]
S0 ati8ryxx;ati8ryxx;c:\windows\system32\Drivers\ati8ryxx.sys –> c:\windows\system32\Drivers\ati8ryxx.sys [?]
S1 c377109c;c377109c;c:\windows\system32\drivers\c377109c.sys [2009-03-11 0]
S1 vdmzmty5;AVZ-BC Kernel Driver;\??\c:\windows\system32\Drivers\vdmzmty5.sys –> c:\windows\system32\Drivers\vdmzmty5.sys [?]
S2 gupdate1c996c6aaa1b06b;Google Update Service (gupdate1c996c6aaa1b06b);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-24 133104]
S2 kjtahoyq;kjtahoyq;c:\windows\System32\svchost.exe -k netsvcs [2006-03-16 14336]
S3 ati6ahxx;ati6ahxx;\??\c:\windows\System32\drivers\ati6ahxx.sys –> c:\windows\System32\drivers\ati6ahxx.sys [?]
S3 ati6wgxx;ati6wgxx;\??\c:\windows\System32\drivers\ati6wgxx.sys –> c:\windows\System32\drivers\ati6wgxx.sys [?]
S3 iComp;HP Analog TV Tuner;c:\windows\system32\drivers\p2usbwdm.sys [2006-03-17 1544704]
S4 5U870CAP_VID_1262&PID;_25FD;HP Pavilion Webcam ;c:\windows\system32\Drivers\5U870CAP.sys –> c:\windows\system32\Drivers\5U870CAP.sys [?]
S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-03-02 24652]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
Kjtahoyq

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c98f1c48-4f29-11dc-a9b0-0019154db70f}]
\Shell\AutoRun\command - F:\LapNetWizard.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c98f1c4b-4f29-11dc-a9b0-0019154db70f}]
\Shell\AutoRun\command - F:\LapNetWizard.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{da50e292-cba1-11db-a91f-0018de311df1}]
\Shell\AutoRun\command - F:\LaunchU3.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder

2009-03-20 c:\windows\Tasks\Antispyware Scheduled Scan.job
- c:\program files\Antispyware\Antispyware.exe []

2009-03-20 c:\windows\Tasks\Antispyware Scheduled Scan.job
- c:\program files\Antispyware []

2009-03-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]

2009-03-25 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-24 17:30]

2009-03-25 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-24 17:27]

2009-03-25 c:\windows\Tasks\User_Feed_Synchronization-{093592A9-671E-4241-9C3D-A7D7146614B6}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 13:58]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-rundll32.exe - c:\documents and settings\Owner\Application Data\Macromedia\Common\8b2600321.dll
HKCU-Run-Aim6 - (no file)
SafeBoot-ati0fnxx.sys
SafeBoot-ati1dkxx.sys
SafeBoot-ati2elxx.sys
SafeBoot-ati2ksxx.sys
SafeBoot-ati2vdxx.sys
SafeBoot-ati3ovxx.sys
SafeBoot-ati3pwxx.sys
SafeBoot-ati3udxx.sys
SafeBoot-ati4jsxx.sys
SafeBoot-ati7sbxx.sys
MSConfigStartUp-AVG8_TRAY - c:\progra~1\AVG\AVG8\avgtray.exe
MSConfigStartUp-GoBoingo - c:\program files\Boingo\GoBoingo\GoBoingo.lnk
MSConfigStartUp-ISTray - c:\program files\Spyware Doctor\pctsTray.exe

.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.weather.com/weather/map/interactive/?from=hp_main_maps
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth; Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\7t1ert72.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/findfriends.php#/home.php?ref=home
FF - plugin: c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\7t1ert72.default\extensions\[removed]\plugins\npTVUAx.dll
FF - plugin: c:\program files\BitTorrent_DNA\plugins\npbtdna.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-24 20:19:45
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(964)
c:\windows\system32\xgusb.cpl

- - - - - - - > 'lsass.exe'(1024)
c:\windows\system32\xgusb.cpl
.
———————— Other Running Processes ————————
.
c:\program files\Trend Micro\BM\TMBMSRV.exe
c:\windows\system32\msdtc.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Trend Micro\Internet Security\SfCtlCom.exe
c:\windows\system32\ZuneBusEnum.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\mqsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\mqtgsvc.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-03-24 20:23:12 - machine was rebooted [Owner]
ComboFix-quarantined-files.txt 2009-03-25 00:23:08

Pre-Run: 58,964,279,296 bytes free
Post-Run: 62,614,626,304 bytes free

911 — E O F — 2008-11-23 06:38:19

And here is the OTListIt.txt

OTListIt logfile created on: 3/24/2009 8:39:58 PM - Run 1
OTListIt2 by OldTimer - Version 2.0.7.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Media Center Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.46 Gb Available Physical Memory | 73.49% Memory free
3.84 Gb Paging File | 3.49 Gb Available in Paging File | 90.92% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 99.09 Gb Total Space | 58.35 Gb Free Space | 58.89% Space Free | Partition Type: NTFS
Drive D: | 11.67 Gb Total Space | 1.39 Gb Free Space | 11.88% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: MATTHEW
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Standard
File Age = 30 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

PRC - [2009/02/24 17:27:04 | 00,133,104 | —- | M] (Google Inc.) – C:\Program Files\Google\Update\GoogleUpdate.exe
PRC - [2008/04/13 20:12:19 | 01,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\Explorer.EXE
PRC - [2009/03/13 06:41:22 | 00,995,528 | —- | M] (Trend Micro Inc.) – C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
PRC - [2006/10/18 22:05:26 | 00,204,288 | —- | M] (Microsoft Corporation) – C:\Program Files\Windows Media Player\WMPNSCFG.exe
PRC - [2009/03/03 04:46:13 | 00,341,256 | —- | M] (Trend Micro Inc.) – C:\Program Files\Trend Micro\BM\TMBMSRV.exe
PRC - [2006/10/09 18:16:56 | 00,237,568 | —- | M] (Microsoft Corporation) – C:\WINDOWS\eHome\ehRecvr.exe
PRC - [2005/08/06 00:56:32 | 00,102,912 | —- | M] (Microsoft Corporation) – C:\WINDOWS\eHome\ehSched.exe
PRC - [2009/03/13 06:41:02 | 00,711,248 | —- | M] (Trend Micro Inc.) – C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
PRC - [2009/03/13 06:41:20 | 00,677,128 | —- | M] (Trend Micro Inc.) – C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
PRC - [2007/11/15 22:51:42 | 00,059,296 | —- | M] (Microsoft Corporation) – c:\WINDOWS\system32\ZuneBusEnum.exe
PRC - [2005/08/06 00:27:08 | 00,099,328 | —- | M] (Microsoft Corporation) – C:\WINDOWS\ehome\mcrdsvc.exe
PRC - [2008/04/13 20:12:27 | 00,004,608 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\mqsvc.exe
PRC - [2006/10/18 22:05:24 | 00,913,408 | —- | M] (Microsoft Corporation) – C:\Program Files\Windows Media Player\WMPNetwk.exe
PRC - [2008/04/13 20:12:27 | 00,117,248 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\mqtgsvc.exe
PRC - [2008/04/13 20:12:41 | 00,013,824 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\wscntfy.exe
PRC - [2009/02/04 14:02:01 | 00,307,704 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009/03/20 12:58:27 | 00,499,200 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTListIt2.exe

========== Win32 Services (SafeList) ==========

SRV - [2006/06/12 16:27:28 | 00,126,976 | —- | M] (Hewlett-Packard Development Company, L.P.) – C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe – (AddFiltr [On_Demand | Stopped])
SRV - [2007/10/24 01:47:22 | 00,033,800 | —- | M] (Microsoft Corporation) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe – (aspnet_state [On_Demand | Stopped])
SRV - [2006/06/07 17:57:46 | 00,266,295 | —- | M] (Broadcom Corporation.) – C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe – (btwdins [Disabled | Stopped])
SRV - [2007/10/24 01:47:40 | 00,070,144 | —- | M] (Microsoft Corporation) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])
SRV - [2006/10/09 18:16:56 | 00,237,568 | —- | M] (Microsoft Corporation) – C:\WINDOWS\eHome\ehRecvr.exe – (ehRecvr [Auto | Running])
SRV - [2005/08/06 00:56:32 | 00,102,912 | —- | M] (Microsoft Corporation) – C:\WINDOWS\eHome\ehSched.exe – (ehSched [Auto | Running])
SRV - [2006/10/20 21:21:24 | 00,036,864 | —- | M] (Microsoft Corporation) – c:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe – (FontCache3.0.0.0 [On_Demand | Stopped])
SRV - [2009/02/24 17:27:04 | 00,133,104 | —- | M] (Google Inc.) – C:\Program Files\Google\Update\GoogleUpdate.exe – (gupdate1c996c6aaa1b06b [Auto | Stopped])
SRV - [2009/03/24 17:30:20 | 00,183,280 | —- | M] (Google) – C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe – (gusvc [Auto | Stopped])
SRV - [2008/04/13 20:12:02 | 00,038,400 | —- | M] (Microsoft Corporation) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll – (helpsvc [Auto | Running])
SRV - [2006/05/02 18:41:28 | 00,135,168 | —- | M] (Hewlett-Packard Development Company, L.P.) – C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe – (hpqwmiex [Disabled | Stopped])
SRV - [2005/04/04 03:41:10 | 00,069,632 | —- | M] (Macrovision Corporation) – C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe – (IDriverT [Disabled | Stopped])
SRV - [2006/10/30 03:33:58 | 00,741,376 | —- | M] (Microsoft Corporation) – C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe – (idsvc [Unknown | Stopped])
SRV - File not found – – (iPod Service [Disabled | Stopped])
SRV - [2008/03/17 18:07:02 | 00,073,728 | —- | M] (Hewlett-Packard Company) – C:\Program Files\Common Files\LightScribe\LSSrvc.exe – (LightScribeService [Disabled | Stopped])
SRV - [2005/08/06 00:27:08 | 00,099,328 | —- | M] (Microsoft Corporation) – C:\WINDOWS\ehome\mcrdsvc.exe – (McrdSvc [Auto | Running])
SRV - [2004/08/10 15:11:50 | 00,085,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\mhn.dll – (MHN [On_Demand | Stopped])
SRV - [2008/04/13 20:12:27 | 00,004,608 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\mqsvc.exe – (MSMQ [Auto | Running])
SRV - [2008/04/13 20:12:27 | 00,117,248 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\mqtgsvc.exe – (MSMQTriggers [Auto | Running])
SRV - [2006/10/30 03:34:02 | 00,122,880 | —- | M] (Microsoft Corporation) – C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe – (NetTcpPortSharing [Disabled | Stopped])
SRV - [2003/07/28 14:28:22 | 00,089,136 | —- | M] (Microsoft Corporation) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE – (ose [On_Demand | Stopped])
SRV - [2009/03/13 06:41:02 | 00,711,248 | —- | M] (Trend Micro Inc.) – C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe – (SfCtlCom [Auto | Running])
SRV - [2009/03/03 04:46:13 | 00,341,256 | —- | M] (Trend Micro Inc.) – C:\Program Files\Trend Micro\BM\TMBMSRV.exe – (TMBMServer [Auto | Running])
SRV - [2009/03/13 06:41:20 | 00,677,128 | —- | M] (Trend Micro Inc.) – C:\Program Files\Trend Micro\Internet Security\TmProxy.exe – (TmProxy [Auto | Running])
SRV - [2008/04/13 20:12:02 | 00,038,400 | —- | M] (Microsoft Corporation) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll – (uploadmgr [Auto | Stopped])
SRV - [2007/01/04 17:38:08 | 00,024,652 | —- | M] (Viewpoint Corporation) – C:\Program Files\Viewpoint\Common\ViewpointService.exe – (Viewpoint Manager Service [Disabled | Stopped])
SRV - File not found – – (Vongo Service [Disabled | Stopped])
SRV - [2006/10/18 22:05:24 | 00,913,408 | —- | M] (Microsoft Corporation) – C:\Program Files\Windows Media Player\WMPNetwk.exe – (WMPNetworkSvc [Auto | Running])
SRV - [2007/11/15 22:51:42 | 00,059,296 | —- | M] (Microsoft Corporation) – c:\WINDOWS\system32\ZuneBusEnum.exe – (ZuneBusEnum [Auto | Running])
SRV - [2007/11/15 22:52:24 | 02,124,192 | —- | M] (Microsoft Corporation) – c:\Program Files\Zune\ZuneNss.exe – (ZuneNetworkSvc [On_Demand | Stopped])
SRV - [2007/11/15 22:51:56 | 00,245,664 | —- | M] (Microsoft Corporation) – c:\WINDOWS\system32\ZuneWlanCfgSvc.exe – (ZuneWlanCfgSvc [On_Demand | Stopped])

========== Driver Services (SafeList) ==========

DRV - [2001/08/18 00:51:56 | 00,005,248 | —- | M] (Acer Laboratories Inc.) – C:\WINDOWS\system32\DRIVERS\aliide.sys – (AliIde [Boot | Running])
DRV - [2008/04/13 14:36:39 | 00,043,008 | —- | M] (Advanced Micro Devices, Inc.) – C:\WINDOWS\system32\DRIVERS\amdagp.sys – (amdagp [Disabled | Stopped])
DRV - [2001/08/18 00:52:00 | 00,026,496 | —- | M] (Advanced System Products, Inc.) – C:\WINDOWS\system32\DRIVERS\asc.sys – (asc [Disabled | Stopped])
DRV - [2001/08/18 00:51:58 | 00,014,848 | —- | M] (Advanced System Products, Inc.) – C:\WINDOWS\system32\DRIVERS\asc3550.sys – (asc3550 [Disabled | Stopped])
DRV - [2004/07/20 01:41:48 | 00,016,512 | —- | M] (Adaptec) – C:\WINDOWS\System32\drivers\aspi32.sys – (ASPI32 [System | Running])
DRV - [2006/06/07 23:06:58 | 00,329,901 | —- | M] (Broadcom Corporation.) – C:\WINDOWS\system32\drivers\btaudio.sys – (btaudio [On_Demand | Running])
DRV - [2006/06/07 17:29:10 | 00,030,459 | —- | M] (Broadcom Corporation.) – C:\WINDOWS\system32\DRIVERS\btport.sys – (BTDriver [On_Demand | Stopped])
DRV - [2006/06/07 17:33:34 | 00,855,018 | —- | M] (Broadcom Corporation.) – C:\WINDOWS\system32\DRIVERS\btkrnl.sys – (BTKRNL [On_Demand | Running])
DRV - [2006/06/07 17:28:20 | 00,149,028 | —- | M] (Broadcom Corporation.) – C:\WINDOWS\system32\DRIVERS\btwdndis.sys – (BTWDNDIS [On_Demand | Stopped])
DRV - [2006/06/07 17:23:20 | 00,047,811 | —- | M] (Broadcom Corporation.) – C:\WINDOWS\system32\DRIVERS\btwhid.sys – (btwhid [On_Demand | Stopped])
DRV - [2006/05/12 16:05:02 | 00,057,320 | —- | M] (Broadcom Corporation.) – C:\WINDOWS\System32\Drivers\btwusb.sys – (BTWUSB [On_Demand | Stopped])
DRV - [2009/03/13 17:16:28 | 00,000,000 | —- | M] () – C:\WINDOWS\System32\drivers\c377109c.sys – (c377109c [System | Stopped])
DRV - [2001/08/18 00:51:54 | 00,006,656 | —- | M] (CMD Technology, Inc.) – C:\WINDOWS\system32\DRIVERS\cmdide.sys – (CmdIde [Disabled | Stopped])
DRV - [2001/08/18 00:52:16 | 00,179,584 | —- | M] (Mylex Corporation) – C:\WINDOWS\system32\DRIVERS\dac2w2k.sys – (dac2w2k [Disabled | Stopped])
DRV - [2006/04/11 06:35:18 | 00,163,328 | —- | M] (Intel Corporation) – C:\WINDOWS\system32\DRIVERS\e100b325.sys – (E100B [On_Demand | Running])
DRV - [2005/09/19 17:23:52 | 00,007,808 | —- | M] (Hewlett-Packard Development Company, L.P.) – C:\WINDOWS\system32\DRIVERS\eabfiltr.sys – (eabfiltr [System | Running])
DRV - [2005/09/19 17:24:20 | 00,005,760 | —- | M] (Hewlett-Packard Development Company, L.P.) – C:\WINDOWS\system32\DRIVERS\eabusb.sys – (eabusb [On_Demand | Stopped])
DRV - [2007/03/22 13:57:14 | 00,028,672 | –S- | M] (Gteko Ltd.) – C:\WINDOWS\system32\DRIVERS\elagopro.sys – (elagopro [Auto | Running])
DRV - [2007/03/22 13:57:14 | 00,005,376 | –S- | M] (Gteko Ltd.) – C:\WINDOWS\system32\DRIVERS\elaunidr.sys – (elaunidr [Auto | Running])
DRV - [2005/09/19 17:24:10 | 00,009,344 | —- | M] (Hewlett-Packard Development Company, L.P.) – C:\WINDOWS\system32\DRIVERS\cpqbttn.sys – (HBtnKey [On_Demand | Running])
DRV - [2006/06/02 11:02:36 | 00,572,928 | —- | M] (Conexant Systems Inc.) – C:\WINDOWS\system32\drivers\CHDAud.sys – (HdAudAddService [On_Demand | Running])
DRV - [2008/04/13 12:36:05 | 00,144,384 | —- | M] (Windows ® Server 2003 DDK provider) – C:\WINDOWS\system32\DRIVERS\HDAudBus.sys – (HDAudBus [On_Demand | Running])
DRV - [2006/04/20 12:02:40 | 00,208,000 | —- | M] (Conexant Systems, Inc.) – C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys – (HSFHWAZL [On_Demand | Running])
DRV - [2006/04/20 12:03:20 | 00,995,712 | —- | M] (Conexant Systems, Inc.) – C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys – (HSF_DPV [On_Demand | Running])
DRV - [2006/03/22 16:47:06 | 01,166,972 | —- | M] (Intel Corporation) – C:\WINDOWS\system32\DRIVERS\ialmnt5.sys – (ialm [On_Demand | Running])
DRV - [2005/10/13 05:07:12 | 00,874,240 | —- | M] (Intel Corporation) – C:\WINDOWS\system32\DRIVERS\iaStor.sys – (iaStor [Boot | Running])
DRV - [2006/03/17 19:34:00 | 01,544,704 | —- | M] (Conexant Systems Inc.) – C:\WINDOWS\system32\DRIVERS\p2usbwdm.sys – (iComp [On_Demand | Stopped])
DRV - [2008/04/13 14:45:34 | 00,046,592 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\DRIVERS\IrBus.sys – (IrBus [On_Demand | Stopped])
DRV - [2006/02/15 07:57:46 | 00,012,672 | —- | M] (Conexant) – C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys – (mdmxsdk [Auto | Running])
DRV - [2008/04/13 14:39:44 | 00,092,544 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\drivers\mqac.sys – (MQAC [On_Demand | Running])
DRV - [2001/08/18 00:52:12 | 00,017,280 | —- | M] (American Megatrends Inc.) – C:\WINDOWS\system32\DRIVERS\mraid35x.sys – (mraid35x [Disabled | Stopped])
DRV - [2009/01/05 17:17:48 | 00,047,360 | —- | M] (VSO Software) – C:\WINDOWS\System32\Drivers\pcouffin.sys – (pcouffin [On_Demand | Running])
DRV - [2006/03/16 00:00:00 | 00,017,792 | —- | M] (Parallel Technologies, Inc.) – C:\WINDOWS\system32\DRIVERS\ptilink.sys – (Ptilink [On_Demand | Running])
DRV - [2005/06/20 20:05:58 | 00,020,640 | —- | M] (Sonic Solutions) – C:\WINDOWS\System32\Drivers\PxHelp20.sys – (PxHelp20 [Boot | Running])
DRV - [2001/08/18 00:52:20 | 00,040,320 | —- | M] (QLogic Corporation) – C:\WINDOWS\system32\DRIVERS\ql1080.sys – (ql1080 [Disabled | Stopped])
DRV - [2001/08/18 00:52:20 | 00,045,312 | —- | M] (QLogic Corporation) – C:\WINDOWS\system32\DRIVERS\ql12160.sys – (ql12160 [Disabled | Stopped])
DRV - [2001/08/18 00:52:18 | 00,049,024 | —- | M] (QLogic Corporation) – C:\WINDOWS\system32\DRIVERS\ql1280.sys – (ql1280 [Disabled | Stopped])
DRV - [2005/11/16 16:28:32 | 00,028,928 | —- | M] (REDC) – C:\WINDOWS\system32\DRIVERS\rimmptsk.sys – (rimmptsk [On_Demand | Running])
DRV - [2005/12/22 13:02:22 | 00,051,840 | —- | M] (REDC) – C:\WINDOWS\system32\DRIVERS\rimsptsk.sys – (rimsptsk [On_Demand | Running])
DRV - [2005/11/01 14:08:00 | 00,308,992 | —- | M] (REDC) – C:\WINDOWS\system32\DRIVERS\rixdptsk.sys – (rismxdp [On_Demand | Running])
DRV - [2008/04/13 14:55:08 | 00,202,624 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\drivers\RMCast.sys – (RMCAST [On_Demand | Running])
DRV - [2004/08/04 02:31:34 | 00,020,992 | —- | M] (Realtek Semiconductor Corporation) – C:\WINDOWS\system32\DRIVERS\RTL8139.SYS – (rtl8139 [On_Demand | Stopped])
DRV - [2007/11/13 06:25:53 | 00,020,480 | —- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) – C:\WINDOWS\system32\DRIVERS\secdrv.sys – (Secdrv [On_Demand | Stopped])
DRV - [2008/04/13 14:36:39 | 00,040,960 | —- | M] (Silicon Integrated Systems Corporation) – C:\WINDOWS\system32\DRIVERS\sisagp.sys – (sisagp [Disabled | Stopped])
DRV - [2001/08/18 01:07:44 | 00,019,072 | —- | M] (Adaptec, Inc.) – C:\WINDOWS\system32\DRIVERS\sparrow.sys – (Sparrow [Disabled | Stopped])
DRV - [2001/08/18 01:07:34 | 00,016,256 | —- | M] (Symbios Logic Inc.) – C:\WINDOWS\system32\DRIVERS\symc810.sys – (symc810 [Disabled | Stopped])
DRV - [2001/08/18 01:07:36 | 00,032,640 | —- | M] (LSI Logic) – C:\WINDOWS\system32\DRIVERS\symc8xx.sys – (symc8xx [Disabled | Stopped])
DRV - [2001/08/18 01:07:40 | 00,028,384 | —- | M] (LSI Logic) – C:\WINDOWS\system32\DRIVERS\sym_hi.sys – (sym_hi [Disabled | Stopped])
DRV - [2001/08/18 01:07:42 | 00,030,688 | —- | M] (LSI Logic) – C:\WINDOWS\system32\DRIVERS\sym_u3.sys – (sym_u3 [Disabled | Stopped])
DRV - [2006/06/17 00:40:56 | 00,193,120 | —- | M] (Synaptics, Inc.) – C:\WINDOWS\system32\DRIVERS\SynTP.sys – (SynTP [On_Demand | Running])
DRV - [2009/03/03 04:34:17 | 00,050,192 | —- | M] (Trend Micro Inc.) – C:\WINDOWS\system32\drivers\tmactmon.sys – (tmactmon [Auto | Running])
DRV - [2009/03/03 04:34:20 | 00,150,032 | —- | M] (Trend Micro Inc.) – C:\WINDOWS\system32\drivers\tmcomm.sys – (tmcomm [Auto | Running])
DRV - [2009/03/03 04:34:24 | 00,050,192 | —- | M] (Trend Micro Inc.) – C:\WINDOWS\system32\drivers\tmevtmgr.sys – (tmevtmgr [Auto | Running])
DRV - [2009/03/05 22:17:48 | 00,036,368 | —- | M] (Trend Micro Inc.) – C:\WINDOWS\system32\DRIVERS\tmpreflt.sys – (tmpreflt [Auto | Running])
DRV - [2009/03/03 19:12:44 | 00,080,400 | —- | M] (Trend Micro Inc.) – C:\WINDOWS\system32\DRIVERS\tmtdi.sys – (tmtdi [System | Running])
DRV - [2009/03/05 22:17:48 | 00,205,328 | —- | M] (Trend Micro Inc.) – C:\WINDOWS\system32\DRIVERS\tmxpflt.sys – (tmxpflt [Auto | Running])
DRV - [2001/08/18 00:52:22 | 00,036,736 | —- | M] (Promise Technology, Inc.) – C:\WINDOWS\system32\DRIVERS\ultra.sys – (ultra [Disabled | Stopped])
DRV - [2009/03/05 22:17:48 | 01,195,512 | —- | M] (Trend Micro Inc.) – C:\WINDOWS\system32\DRIVERS\vsapint.sys – (vsapint [Auto | Running])
DRV - [2006/04/21 13:06:24 | 01,429,632 | —- | M] (Intel® Corporation) – C:\WINDOWS\system32\DRIVERS\w39n51.sys – (w39n51 [On_Demand | Running])
DRV - [2006/04/20 12:02:36 | 00,727,296 | —- | M] (Conexant Systems, Inc.) – C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys – (winachsf [On_Demand | Running])
DRV - [2003/01/22 18:54:48 | 00,169,088 | R— | M] (YAMAHA Corporation) – C:\WINDOWS\System32\Drivers\ymidusb.sys – (YMIDUSB [On_Demand | Stopped])
DRV - [2007/11/15 22:38:16 | 00,040,832 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\DRIVERS\zumbus.sys – (zumbus [Auto | Running])

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.weather.com/weather/map/interac…om=hp_main_maps
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\CNNSI, = search.sportsillustrated.cnn.com/pages/search.jsp?query=%s
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\Dictionary, = dictionary.reference.com/search?q=%s
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\Google, = google.com/search?q=%s
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\GoogleGroups, = groups-beta.google.com/groups?q=%s
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\GoogleImages, = images.google.com/images?hl=en&lr;=&q;=%s
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\GoogleNews, = news.google.com/news?tab=gn&hl;=en&ie;=UTF-8&q;=%s&btnG;=Search+News
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\KB, = support.microsoft.com/search/default.aspx?query=%s
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\KBDLL, = support.microsoft.com/dllhelp/default.aspx?dlltype=file&l;=55α=%s&S;=1
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\Movies, = fandango.com/my_box_office.asp?searchby=2&txtCityZip;=%s
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\MSN, = search.msn.com/results.asp?q=%s
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\Thesaurus, = thesaurus.reference.com/search?q=%s
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\Weather, = weather.com/weather/local/%s
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\Yahoo, = search.yahoo.com/search?p=%s
IE - URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..browser.startup.homepage: "http://www.facebook.com/findfriends.php#/home.php?ref=home"
FF - prefs.js..extensions.enabledItems: {DCBD1271-D228-4082-9FBC-36D9B7660B03}:1.1.8
FF - prefs.js..extensions.enabledItems: {34274bf4-1d97-a289-e984-17e546307e4f}:0.5.3.043
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20080609.0
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0.07103010
FF - prefs.js..extensions.enabledItems: [removed]:2
FF - prefs.js..extensions.enabledItems: 4
FF - prefs.js..extensions.enabledItems: 1
FF - prefs.js..extensions.enabledItems: 0
FF - prefs.js..extensions.enabledItems: {00604B54-C288-4153-8356-EF3471265D5D}:1.0
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.6

FF - HKLM\software\mozilla\Firefox\Extensions\\{00604B54-C288-4153-8356-EF3471265D5D}: C:\DOCUMENTS AND SETTINGS\OWNER\LOCAL SETTINGS\APPLICATION DATA\{00604B54-C288-4153-8356-EF3471265D5D} [2009/02/25 01:54:54 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.6\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009/03/12 23:20:45 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.6\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009/02/25 20:40:44 | 00,000,000 | —D | M]

[2008/07/07 09:47:29 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Extensions
[2008/07/07 09:47:29 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/02/25 12:51:14 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\7t1ert72.default\extensions
[2008/05/01 17:49:16 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\7t1ert72.default\extensions\{34274bf4-1d97-a289-e984-17e546307e4f}
[2008/12/18 10:01:55 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\7t1ert72.default\extensions\{DCBD1271-D228-4082-9FBC-36D9B7660B03}
[2008/09/14 23:35:15 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\7t1ert72.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2008/11/17 12:29:45 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\7t1ert72.default\extensions\[removed]
[2009/05/10 15:06:18 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\7t1ert72.default\extensions\[removed]
[2008/07/07 09:47:30 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions
[2009/02/04 14:02:10 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009/02/04 14:02:00 | 00,023,032 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/02/04 14:02:00 | 00,134,648 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2008/05/29 10:24:14 | 00,001,394 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml
[2008/05/29 10:24:14 | 00,002,193 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2008/05/29 10:24:14 | 00,001,534 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2008/11/14 21:16:17 | 00,002,343 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay.xml
[2008/05/29 10:24:14 | 00,001,706 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\google.xml
[2008/05/29 10:24:14 | 00,001,178 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
[2008/05/29 10:24:14 | 00,000,792 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo.xml

O1 HOSTS File: (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" (Adobe Systems Incorporated)
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (Apple Inc.)
O4 - HKLM..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe" (Trend Micro Inc.)
O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Sites: //@surf.mar@/ ([]money in Local intranet)
O15 - HKCU\..Trusted Domains: 2 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://a1540.g.akamai.net/7/1540/52/200612…ex/qtplugin.cab (QuickTime Object)
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} http://upload.facebook.com/controls/Facebo…otoUploader.cab (Facebook Photo Uploader Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe ()
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2001/07/27 22:07:38 | 00,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O33 - MountPoints2\{c98f1c48-4f29-11dc-a9b0-0019154db70f}\Shell - "" = AutoRun
O33 - MountPoints2\{c98f1c48-4f29-11dc-a9b0-0019154db70f}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{c98f1c48-4f29-11dc-a9b0-0019154db70f}\Shell\AutoRun\command - "" = F:\LapNetWizard.exe – File not found
O33 - MountPoints2\{c98f1c4b-4f29-11dc-a9b0-0019154db70f}\Shell - "" = AutoRun
O33 - MountPoints2\{c98f1c4b-4f29-11dc-a9b0-0019154db70f}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{c98f1c4b-4f29-11dc-a9b0-0019154db70f}\Shell\AutoRun\command - "" = F:\LapNetWizard.exe – File not found
O33 - MountPoints2\{da50e292-cba1-11db-a91f-0018de311df1}\Shell - "" = AutoRun
O33 - MountPoints2\{da50e292-cba1-11db-a91f-0018de311df1}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{da50e292-cba1-11db-a91f-0018de311df1}\Shell\AutoRun\command - "" = F:\LaunchU3.exe – File not found
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun - "" = Auto&Play;
O34 - HKLM BootExecute: (autocheck autochk *) - File not found

========== Files/Folders - Created Within 30 Days ==========

[289 C:\WINDOWS\System32\*.tmp files]
[4 C:\WINDOWS\*.tmp files]
[2009/05/10 22:35:57 | 00,002,713 | -HS- | C] () – C:\WINDOWS\System32\tigifofi.dll
[2009/05/10 10:37:12 | 00,002,713 | -HS- | C] () – C:\WINDOWS\System32\dafirulo.dll
[2009/05/09 15:55:55 | 00,002,713 | -HS- | C] () – C:\WINDOWS\System32\tohagugu.dll
[2009/03/24 20:23:17 | 00,000,000 | —D | C] – C:\WINDOWS\temp
[2009/03/24 20:09:18 | 02,934,667 | R— | C] () – C:\Documents and Settings\Owner\Desktop\Combo-Fix.exe
[2009/03/24 17:29:31 | 21,370,51136 | -HS- | C] () – C:\hiberfil.sys
[2009/03/24 16:31:56 | 00,000,000 | —D | C] – C:\Documents and Settings\Owner\Desktop\avz4
[2009/03/24 16:30:26 | 04,626,422 | —- | C] () – C:\Documents and Settings\Owner\Desktop\avz4.zip
[2009/03/20 13:00:30 | 00,000,000 | —D | C] – C:\_OTListIt
[2009/03/20 12:58:27 | 00,499,200 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTListIt2.exe
[2009/03/20 12:56:30 | 00,186,880 | —- | C] (CEXX.ORG) – C:\Documents and Settings\Owner\Desktop\LSPFix.exe
[2009/03/19 17:24:14 | 00,000,000 | —D | C] – C:\Documents and Settings\Owner\Desktop\OTScanIt2
[2009/03/19 17:23:28 | 00,661,370 | —- | C] () – C:\Documents and Settings\Owner\Desktop\OTScanIt2.exe
[2009/03/18 13:07:34 | 00,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2009/03/18 13:07:34 | 00,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2009/03/18 13:07:34 | 00,029,696 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2009/03/18 13:07:33 | 00,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2009/03/18 13:07:33 | 00,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2009/03/18 13:07:33 | 00,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2009/03/18 13:07:33 | 00,089,504 | —- | C] (Smallfrogs Studio) – C:\WINDOWS\fdsv.exe
[2009/03/18 13:07:33 | 00,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2009/03/18 13:07:33 | 00,049,152 | —- | C] () – C:\WINDOWS\VFIND.exe
[2009/03/18 13:04:04 | 00,000,000 | —D | C] – C:\Qoobox
[2009/03/14 18:39:05 | 00,000,000 | —- | C] () – C:\iivopso.exe
[2009/03/14 18:22:12 | 00,000,496 | —- | C] () – C:\WINDOWS\tasks\Antispyware Scheduled Scan.job
[2009/03/13 17:41:49 | 00,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2009/03/13 17:40:45 | 00,000,611 | —- | C] () – C:\Documents and Settings\Owner\Desktop\NTREGOPT.lnk
[2009/03/13 17:40:45 | 00,000,592 | —- | C] () – C:\Documents and Settings\Owner\Desktop\ERUNT.lnk
[2009/03/13 17:40:44 | 00,000,000 | —D | C] – C:\Program Files\ERUNT
[2009/03/13 17:40:14 | 00,791,393 | —- | C] (Lars Hederer ) – C:\Documents and Settings\Owner\Desktop\erunt-setup.exe
[2009/03/13 17:32:24 | 00,001,734 | —- | C] () – C:\Documents and Settings\Owner\Desktop\HijackThis.lnk
[2009/03/13 17:32:10 | 00,812,344 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Owner\Desktop\HJTInstall.exe
[2009/03/13 17:15:42 | 00,041,472 | —- | C] (MainConcept AG) – C:\lwvjuv.exe
[2009/03/13 17:14:23 | 00,010,240 | —- | C] () – C:\WINDOWS\instsp2.exe
[2009/03/12 23:06:56 | 00,000,000 | -HSD | C] – C:\WINDOWS\CSC
[2009/03/12 03:24:15 | 00,095,232 | —- | C] () – C:\WINDOWS\System32\QoS.dll
[2009/03/12 03:24:11 | 00,104,960 | —- | C] () – C:\WINDOWS\System32\dllcache\userinit.exe
[2009/03/11 16:00:22 | 00,016,384 | -HS- | C] () – C:\WINDOWS\System32\$winnt$wg.dll
[2009/03/11 16:00:20 | 00,717,650 | -HS- | C] () – C:\WINDOWS\System32\1025o.sys
[2009/03/11 16:00:20 | 00,000,026 | —- | C] () – C:\WINDOWS\System32\advapi32a.sys
[2009/03/11 16:00:19 | 00,021,504 | -HS- | C] () – C:\WINDOWS\System32\$winnt$w.dll
[2009/03/11 15:59:22 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\drivers\c377109c.sys
[2009/03/11 15:59:13 | 00,123,392 | —- | C] () – C:\mfvse.exe
[2009/03/11 15:59:04 | 00,000,407 | –S- | C] () – C:\WINDOWS\System32\909338939.dat
[2009/03/11 15:59:00 | 00,000,002 | —- | C] () – C:\1823729539
[2009/03/11 15:58:56 | 00,076,288 | RHS- | C] () – C:\WINDOWS\System32\afobeyurq.exe
[2009/03/11 15:58:53 | 00,032,768 | —- | C] (Microsoft Corporation) – C:\ucpdcu.exe
[2009/03/11 15:58:48 | 00,041,984 | —- | C] (MainConcept AG) – C:\tcrnwc.exe
[2009/03/10 17:05:23 | 00,032,256 | —- | C] () – C:\Documents and Settings\Owner\Desktop\tarea lecc 4.doc
[2009/03/07 18:04:01 | 00,010,240 | —- | C] () – C:\WINDOWS\instsp1.exe
[2009/02/26 15:56:39 | 00,002,713 | -HS- | C] () – C:\WINDOWS\System32\gilefede.dll
[2009/02/25 20:40:30 | 00,000,000 | —D | C] – C:\WINDOWS\System32\Adobe
[2009/02/25 20:40:03 | 04,566,456 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Shockwave_Installer_Slim.exe
[2009/02/25 02:24:42 | 00,002,713 | -HS- | C] () – C:\WINDOWS\System32\loganini.dll
[2009/02/25 01:54:54 | 00,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\{00604B54-C288-4153-8356-EF3471265D5D}
[2009/02/24 17:28:29 | 00,001,836 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2009/02/24 17:27:16 | 00,000,880 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachine.job
[2009/02/24 17:04:18 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Google
[2009/02/24 16:51:59 | 00,000,868 | —- | C] () – C:\WINDOWS\tasks\Google Software Updater.job
[2009/02/24 16:51:30 | 01,046,648 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Google Updater.exe
[2009/02/24 01:54:57 | 00,002,713 | -HS- | C] () – C:\WINDOWS\System32\posetoma.dll
[2009/02/23 14:58:55 | 00,033,280 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Tarea_lecc_3r.doc

========== Files - Modified Within 30 Days ==========

[289 C:\WINDOWS\System32\*.tmp files]
[4 C:\WINDOWS\*.tmp files]
[2009/05/10 22:35:57 | 00,002,713 | -HS- | M] () – C:\WINDOWS\System32\tigifofi.dll
[2009/05/10 10:37:12 | 00,002,713 | -HS- | M] () – C:\WINDOWS\System32\dafirulo.dll
[2009/05/09 15:55:55 | 00,002,713 | -HS- | M] () – C:\WINDOWS\System32\tohagugu.dll
[2009/03/24 20:40:00 | 00,000,422 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{093592A9-671E-4241-9C3D-A7D7146614B6}.job
[2009/03/24 20:32:32 | 00,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2009/03/24 20:32:16 | 00,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2009/03/24 20:32:14 | 00,000,441 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.ics
[2009/03/24 20:31:57 | 00,000,880 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachine.job
[2009/03/24 20:31:55 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/03/24 20:31:54 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/03/24 20:31:52 | 21,370,51136 | -HS- | M] () – C:\hiberfil.sys
[2009/03/24 20:19:51 | 00,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2009/03/24 20:17:51 | 00,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2009/03/24 20:09:18 | 02,934,667 | R— | M] () – C:\Documents and Settings\Owner\Desktop\Combo-Fix.exe
[2009/03/24 18:26:37 | 00,011,168 | -H– | M] () – C:\WINDOWS\System32\lerinifo
[2009/03/24 17:34:33 | 00,457,568 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2009/03/24 17:34:33 | 00,076,548 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2009/03/24 17:34:32 | 00,543,492 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2009/03/24 16:31:02 | 04,626,422 | —- | M] () – C:\Documents and Settings\Owner\Desktop\avz4.zip
[2009/03/20 13:34:22 | 00,000,496 | —- | M] () – C:\WINDOWS\tasks\Antispyware Scheduled Scan.job
[2009/03/20 12:58:27 | 00,499,200 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTListIt2.exe
[2009/03/20 12:56:30 | 00,186,880 | —- | M] (CEXX.ORG) – C:\Documents and Settings\Owner\Desktop\LSPFix.exe
[2009/03/19 17:23:28 | 00,661,370 | —- | M] () – C:\Documents and Settings\Owner\Desktop\OTScanIt2.exe
[2009/03/19 17:15:37 | 00,010,240 | —- | M] () – C:\WINDOWS\instsp2.exe
[2009/03/19 17:15:36 | 00,103,424 | -HS- | M] () – C:\WINDOWS\System32\bajajiyi.dll
[2009/03/14 18:41:02 | 00,123,392 | —- | M] () – C:\mfvse.exe
[2009/03/14 18:39:05 | 00,000,000 | —- | M] () – C:\iivopso.exe
[2009/03/14 18:30:53 | 00,104,960 | —- | M] () – C:\WINDOWS\System32\dllcache\userinit.exe
[2009/03/14 18:17:59 | 00,032,768 | —- | M] (Microsoft Corporation) – C:\ucpdcu.exe
[2009/03/14 18:17:46 | 00,041,984 | —- | M] (MainConcept AG) – C:\tcrnwc.exe
[2009/03/14 18:17:34 | 00,102,912 | -HS- | M] () – C:\WINDOWS\System32\tijawani.dll
[2009/03/13 17:40:45 | 00,000,611 | —- | M] () – C:\Documents and Settings\Owner\Desktop\NTREGOPT.lnk
[2009/03/13 17:40:45 | 00,000,592 | —- | M] () – C:\Documents and Settings\Owner\Desktop\ERUNT.lnk
[2009/03/13 17:40:17 | 00,791,393 | —- | M] (Lars Hederer ) – C:\Documents and Settings\Owner\Desktop\erunt-setup.exe
[2009/03/13 17:32:24 | 00,001,734 | —- | M] () – C:\Documents and Settings\Owner\Desktop\HijackThis.lnk
[2009/03/13 17:32:10 | 00,812,344 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Owner\Desktop\HJTInstall.exe
[2009/03/13 17:16:28 | 00,000,000 | —- | M] () – C:\WINDOWS\System32\drivers\c377109c.sys
[2009/03/13 17:15:44 | 00,041,472 | —- | M] (MainConcept AG) – C:\lwvjuv.exe
[2009/03/13 17:14:23 | 00,101,888 | -HS- | M] () – C:\WINDOWS\System32\borazufu.dll
[2009/03/12 22:55:19 | 00,006,456 | -H– | M] () – C:\WINDOWS\System32\bezayoze
[2009/03/12 22:14:15 | 04,280,736 | -H– | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\IconCache.db
[2009/03/12 03:24:16 | 00,095,232 | —- | M] () – C:\WINDOWS\System32\QoS.dll
[2009/03/12 03:23:27 | 00,264,704 | —- | M] () – C:\WINDOWS\System32\userinit.exe
[2009/03/12 00:52:40 | 00,014,336 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\svchost.exe
[2009/03/12 00:52:40 | 00,014,336 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\svchost.exe
[2009/03/11 16:50:51 | 00,087,552 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/03/11 16:02:12 | 00,717,650 | -HS- | M] () – C:\WINDOWS\System32\1025o.sys
[2009/03/11 16:00:31 | 00,000,026 | —- | M] () – C:\WINDOWS\System32\advapi32a.sys
[2009/03/11 16:00:23 | 00,000,407 | –S- | M] () – C:\WINDOWS\System32\909338939.dat
[2009/03/11 16:00:22 | 00,016,384 | -HS- | M] () – C:\WINDOWS\System32\$winnt$wg.dll
[2009/03/11 16:00:19 | 00,021,504 | -HS- | M] () – C:\WINDOWS\System32\$winnt$w.dll
[2009/03/11 15:59:07 | 00,000,002 | —- | M] () – C:\1823729539
[2009/03/11 15:58:52 | 00,076,288 | RHS- | M] () – C:\WINDOWS\System32\afobeyurq.exe
[2009/03/11 15:58:43 | 00,101,376 | -HS- | M] () – C:\WINDOWS\System32\lifuremi.dll
[2009/03/11 15:58:43 | 00,010,240 | —- | M] () – C:\WINDOWS\instsp1.exe
[2009/03/11 14:56:00 | 00,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/03/11 03:00:25 | 00,016,384 | —- | M] () – C:\WINDOWS\DCEBoot.exe
[2009/03/10 17:47:49 | 00,032,256 | —- | M] () – C:\Documents and Settings\Owner\Desktop\tarea lecc 4.doc
[2009/03/10 15:59:17 | 00,101,376 | -HS- | M] () – C:\WINDOWS\System32\yibavisu.dll
[2009/03/07 18:04:00 | 00,101,888 | -HS- | M] () – C:\WINDOWS\System32\wiboniza.dll
[2009/03/05 22:17:48 | 01,195,512 | —- | M] (Trend Micro Inc.) – C:\WINDOWS\System32\drivers\vsapint.sys
[2009/03/05 22:17:48 | 00,205,328 | —- | M] (Trend Micro Inc.) – C:\WINDOWS\System32\drivers\tmxpflt.sys
[2009/03/05 22:17:48 | 00,036,368 | —- | M] (Trend Micro Inc.) – C:\WINDOWS\System32\drivers\tmpreflt.sys
[2009/03/04 00:07:17 | 00,002,497 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Word.lnk
[2009/03/03 19:12:44 | 00,080,400 | —- | M] (Trend Micro Inc.) – C:\WINDOWS\System32\drivers\tmtdi.sys
[2009/03/03 04:34:24 | 00,050,192 | —- | M] (Trend Micro Inc.) – C:\WINDOWS\System32\drivers\tmevtmgr.sys
[2009/03/03 04:34:20 | 00,150,032 | —- | M] (Trend Micro Inc.) – C:\WINDOWS\System32\drivers\tmcomm.sys
[2009/03/03 04:34:17 | 00,050,192 | —- | M] (Trend Micro Inc.) – C:\WINDOWS\System32\drivers\tmactmon.sys
[2009/02/26 15:56:39 | 00,002,713 | -HS- | M] () – C:\WINDOWS\System32\gilefede.dll
[2009/02/25 20:40:06 | 04,566,456 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Shockwave_Installer_Slim.exe
[2009/02/25 02:24:42 | 00,002,713 | -HS- | M] () – C:\WINDOWS\System32\loganini.dll
[2009/02/25 01:42:32 | 00,012,288 | -H– | M] () – C:\Documents and Settings\Owner\Desktop\a.exe
[2009/02/24 17:28:29 | 00,001,836 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2009/02/24 16:51:37 | 01,046,648 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Google Updater.exe
[2009/02/24 01:54:57 | 00,002,713 | -HS- | M] () – C:\WINDOWS\System32\posetoma.dll
[2009/02/24 01:54:53 | 00,095,374 | —- | M] () – C:\WINDOWS\System32\fefihoha.dll
[2009/02/23 16:45:20 | 00,033,280 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Tarea_lecc_3r.doc
[2009/02/23 13:56:42 | 00,095,507 | —- | M] () – C:\WINDOWS\System32\pusunovi.dll
< End of report >

There is also a file from otlistit called extras.txt and here are the contents of it if you need them:

OTListIt Extras logfile created on: 3/24/2009 8:39:58 PM - Run 1
OTListIt2 by OldTimer - Version 2.0.7.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Media Center Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.46 Gb Available Physical Memory | 73.49% Memory free
3.84 Gb Paging File | 3.49 Gb Available in Paging File | 90.92% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 99.09 Gb Total Space | 58.35 Gb Free Space | 58.89% Space Free | Partition Type: NTFS
Drive D: | 11.67 Gb Total Space | 1.39 Gb Free Space | 11.88% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: MATTHEW
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Standard
File Age = 30 Days
Company Name Whitelist: On

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[2008/04/13 20:12:27 | 00,004,608 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\mqsvc.exe:*:Enabled:Message Queuing
[2008/04/13 14:53:32 | 00,558,080 | —- | M] (Microsoft Corporation) – %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
[2008/04/13 20:12:27 | 00,004,608 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\mqsvc.exe:*:Enabled:Message Queuing
[2008/04/13 14:53:32 | 00,558,080 | —- | M] (Microsoft Corporation) – %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
[2006/11/03 03:17:27 | 00,010,800 | —- | M] (AOL LLC) – C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader
[2007/04/17 20:19:12 | 00,208,384 | —- | M] () – C:\Program Files\BitTorrent_DNA\dna.exe:*:Enabled:DNA
[2008/09/26 19:44:20 | 00,634,672 | —- | M] (BitTorrent, Inc.) – C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
[2008/08/21 16:59:55 | 00,147,456 | —- | M] (Lime Wire, LLC) – C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire
[2009/02/04 14:02:01 | 00,307,704 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Mozilla Firefox
[2008/06/19 13:51:30 | 00,050,528 | —- | M] (AOL LLC) – C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM
[2008/04/13 20:12:28 | 01,695,232 | —- | M] (Microsoft Corporation) – C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger
[2008/04/13 20:12:18 | 00,083,456 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test
[2007/12/23 23:02:06 | 02,179,072 | —- | M] (Zhejiang University) – C:\Program Files\TVAnts\Tvants.exe:*:Enabled:TVAnts
[2008/10/08 06:24:14 | 02,083,920 | —- | M] (TVU networks) – C:\Program Files\TVUPlayer\TVUPlayer.exe:*:Enabled:TVUPlayer Component
[2008/12/15 23:20:40 | 00,342,848 | —- | M] (BitTorrent, Inc.) – C:\Program Files\BitTorrent_DNA\btdna.exe:*:Enabled:DNA
[2009/03/24 17:30:20 | 00,183,280 | —- | M] (Google) – C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe:*:Enabled:GoogleUpdaterService
[2007/01/04 17:38:08 | 00,024,652 | —- | M] (Viewpoint Corporation) – C:\Program Files\Viewpoint\Common\ViewpointService.exe:*:Enabled:ViewpointService
[2006/06/07 17:57:46 | 00,266,295 | —- | M] (Broadcom Corporation.) – C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe:*:Enabled:btwdins
[2007/10/08 17:50:56 | 00,041,824 | —- | M] (AOL LLC) – C:\Program Files\AIM6\aolsoftware.exe:*:Enabled:aolsoftware
[2007/11/15 22:51:42 | 00,059,296 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\ZuneBusEnum.exe:*:Enabled:ZuneBusEnum

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{004C5DA2-2051-4D25-94BA-51CF810C91EB}" = LightScribe System Software 1.12.37.1
"{0076E1AC-9E7B-4B9F-A62A-4CC9511AD8E3}" = Zune Language Pack (FR)
"{02DFF6B1-1654-411C-8D7B-FD6052EF016F}" = Apple Software Update
"{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic Data Module
"{08CA9554-B5FE-4313-938F-D4A417B81175}" = QuickTime
"{09D8492A-C8E2-421E-927D-46800FB327A3}" = Wireless Home Network Setup
"{0E54911F-5E03-4513-AB56-BF7393E64866}" = FxBear MOV Video Converter
"{15095BF3-A3D7-4DDF-B193-3A496881E003}" = Microsoft .NET Framework 3.0
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1A7A65DA-F9C1-48F0-B5AD-AD9D9A03284E}" = Antispyware
"{1CB34CE9-0E6B-493F-BB66-3425E5DF76E5}" = CP_CalendarTemplates1
"{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD Plus
"{22DE1881-9D24-4981-B5CC-EC7E9F2F4D52}" = Rhapsody Player Engine
"{23012310-3E05-46A5-88A9-C6CBCABCAC79}" = Customer Experience Enhancement
"{23B35809-5E4A-4F14-8332-1CDEDDFAC089}" = CP_Package_Variety2
"{24BEBF2E-73F3-4599-840B-EDC612CCDD0D}" = Destinations
"{2A548002-9042-4083-A270-B67473DE1073}" = SkinsHP1
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{305D4B08-5807-4475-B1C8-D54685534864}" = LightScribeTemplateLabeler
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.10 A2
"{34F3FCF1-817B-4D61-B6AF-19D9486AFEA0}" = Unload
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{36D620AD-EEBA-4973-BA86-0C9AE6396620}" = OptionalContentQFolder
"{3F4EC965-28EF-45C3-B063-04B25D4E9679}" = WIDCOMM Bluetooth Software
"{3FE0CFAB-584A-4AA5-B8CD-C32284CFA308}" = RandMap
"{4041C245-7099-4C96-9738-5EBC23827B3C}" = BufferChm
"{40E12A55-C504-4223-AFAC-7672DBF1ACDE}" = Trend Micro AntiVirus
"{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}" = Microsoft Works
"{4302B2DD-D958-40E3-BAF3-B07FFE1978CE}" = HP Wireless Assistant 2.00 G2
"{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP QuickPlay 2.3
"{47D2103B-FD51-4017-9C20-DD408B17D726}" = Office 2003 Trial Assistant
"{491DD792-AD81-429C-9EB4-86DD3D22E333}" = Windows Communication Foundation
"{494D17B5-3369-4905-8C4B-80C972C5E0FF}" = CP_Panorama1Config
"{4DA4012B-39AF-48c2-B23B-A4D570D233A6}" = cp_LightScribeConfig
"{522D1D79-9C0A-4361-91F8-2AFF8EC6C2E1}" = CP_Package_Variety1
"{52FBAE98-D389-4281-8C14-21B4046CCB4E}" = SonicAC3Encoder
"{53EE9E42-CECB-4C92-BF76-9CA65DAF8F1C}" = FullDPAppQFolder
"{548EAC70-EE00-11DD-908C-005056806466}" = Google Earth
"{54F0998F-73C8-4b51-8286-FE903C231BED}" = cp_PosterPrintConfig
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Sonic Express Labeler
"{6815FCDD-401D-481E-BA88-31B4754C2B46}" = Macromedia Flash Player 8
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6D3C6846-CDB6-418F-8FDB-DA21FE064F86}" = YAMAHA Musicsoft Downloader 5.0
"{718D791F-F4E8-4aa7-98A6-15FDED17BDD0}" = Trend Micro AntiVirus
"{7373184D-8E8F-4308-912A-3901071FA1AD}" = LightScribe Applications
"{766633B3-1AFA-44B6-A3FC-1DE991CD9C52}" = CP_Package_Basic1
"{79F8E1D4-36C1-439C-95FA-F695050B5B07}" = Sonic_PrimoSDK
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX
"{7D1B85BD-AA07-48B8-808D-67A4067FC6BD}" = Windows Workflow Foundation
"{7E20EFE6-E604-48C6-8B39-BA4742F2CDB4}" = Zune Desktop Theme
"{7F1B3341-A94E-4F5C-B587-CA0EB964221E}" = Microsoft Money Shared Libraries
"{80AE27BA-B0ED-4288-A8B9-D8194BCF4115}" = cp_UpdateProjectsConfig
"{838A1BC9-95CA-4880-9BE3-2A7D23600A2B}" = Macromedia Shockwave Player
"{869C3062-4745-4949-B6C9-98AF24D89030}" = PhotoGallery
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Graphics Media Accelerator Driver
"{8BBF6DFD-0AD9-43A7-9FBD-BF065E3866AF}" = URGE
"{91120409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{939F8208-C8CE-4AFF-B7BA-ACEB2E74A6CB}" =
"{9D4ABB0C-F60B-44A6-956C-A4A63D5495C9}" = CueTour
"{A01FC76F-CC09-4658-9E37-5C2F635EE708}" = TourSetup
"{A1960A82-DB70-474D-A86B-FA74466103C6}" = Drivers Install For Linksys Easylink Advisor
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}" = HP Help and Support
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic Audio Module
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{B11E71BA-498C-42D4-9F1A-9D7A89D9DA61}" = CP_AtenaShokunin1Config
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic Copy Module
"{B16AF568-A644-483C-A6DA-5028CD019C8C}" = SonicMPEGEncoder
"{B508B3F1-A24A-32C0-B310-85786919EF28}" = Microsoft .NET Framework 2.0 Service Pack 1
"{B57F2FF0-5A25-4332-B503-4592B370C02F}" = CP_Package_Variety3
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BB85ED9C-AFC9-43BD-B8DC-258C3C7DF72E}" = HP Update
"{BBD3BF67-5B89-4CBB-BA58-5818ED5F3290}" = cp_OnlineProjectsConfig
"{BE247E71-C143-40BB-ADF2-A465DF062BAB}" = HP User Guides 0035
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D050D7362D214723AD585B541FFB6C11}" = DivX Content Uploader
"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp
"{DB7E00C9-6DEF-489A-8112-D8F81614F45A}" = Vongo
"{EE4ACABF-531E-419A-9225-B8E0FA4955AF}" = Zune Language Pack (ES)
"{FC8D25A7-FF1B-41BB-BB3B-9A06C0A60AE0}" = InstantShareDevices
"{FE0256DB-509C-40AC-B888-2543AD4298E6}" = Zune
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"AIM_6" = AIM 6
"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.3
"Audacity_is1" = Audacity 1.2.6
"B3EE3001-DC24-4cd1-8743-5692C716659F" = Otto
"CNXT_HDAUDIO" = Conexant HD Audio
"CNXT_MODEM_PCI_VEN_14F1&DEV;_5045_at8ven5m" = Soft Data Fax Modem with SmartCP
"DVD Decrypter" = DVD Decrypter (Remove Only)
"EasyLinkAdvisor" = Linksys EasyLink Advisor 1.6 (0032)
"ERUNT_is1" = ERUNT 1.1j
"Exact Audio Copy PSP Edition" = Exact Audio Copy PSP Edition 1.0
"GIF Animator" = Microsoft GIF Animator
"Google Updater" = Google Updater
"Hauppauge MCE2005 Software Encoder" = Hauppauge MCE XP/Vista Software Encoder (2.0.25149)
"HijackThis" = HijackThis 2.0.2
"HP Imaging Device Functions" = HP Imaging Device Functions 6.0
"HP Photo & Imaging" = HP Photosmart Premier Software 6.0
"HP Rhapsody" = HP Rhapsody
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"iMesh" = iMesh
"InstallShield_{23012310-3E05-46A5-88A9-C6CBCABCAC79}" = Customer Experience Enhancement
"LimeWire" = LimeWire 4.18.6
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.0" = Microsoft .NET Framework 3.0
"Money2006b" = Microsoft Money 2006
"Money2008b" = Microsoft Money Plus
"Mozilla Firefox (3.0.6)" = Mozilla Firefox (3.0.6)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Native Instruments Sibelius Player" = Native Instruments Sibelius Player
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PROSet" = Intel® PRO Network Connections Drivers
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"Sibelius 4" = Sibelius 4
"ST6UNST #1" = Project1
"Super Screen Capture_is1" = Super Screen Capture 3.1
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Timed Shutdown_is1" = Timed Shutdown 0.5b
"TradersLittleHelper_is1" = Trader's Little Helper 1.1.1
"TVAnts 1.0" = TVAnts 1.0
"TVUPlayer" = TVUPlayer [removed]
"Viewpoint Manager" = Viewpoint Manager (Remove Only)
"Viewpoint Toolbar" = Viewpoint Toolbar
"ViewpointMediaPlayer" = Viewpoint Media Player
"WAV to MP3 Encoder" = WAV to MP3 Encoder
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"WIC" = Windows Imaging Component
"WildTangent CDA" = WildTangent Web Driver
"WildTangent hplaptop Master Uninstall" = My HP Games
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WMCSetup" = Windows Media Connect
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BitTorrent" = BitTorrent
"BitTorrent DNA" = DNA
"DNA" = DNA

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 11/28/2008 10:25:35 AM | Computer Name = MATTHEW | Source = Application Error | ID = 1000
Description = Faulting application firefox.exe, version 1.9.0.3224, faulting module
unknown, version 0.0.0.0, fault address 0x0f1e6017.

[ System Events ]
Error - 3/11/2009 5:05:44 PM | Computer Name = MATTHEW | Source = Service Control Manager | ID = 7028
Description = The wuauserv Registry key denied access to SYSTEM account programs
so the Service Control Manager took ownership of the Registry key.

Error - 3/11/2009 5:07:31 PM | Computer Name = MATTHEW | Source = Service Control Manager | ID = 7028
Description = The wuauserv Registry key denied access to SYSTEM account programs
so the Service Control Manager took ownership of the Registry key.

Error - 3/11/2009 5:07:36 PM | Computer Name = MATTHEW | Source = Service Control Manager | ID = 7028
Description = The wuauserv Registry key denied access to SYSTEM account programs
so the Service Control Manager took ownership of the Registry key.

Error - 3/11/2009 5:08:49 PM | Computer Name = MATTHEW | Source = Service Control Manager | ID = 7028
Description = The wuauserv Registry key denied access to SYSTEM account programs
so the Service Control Manager took ownership of the Registry key.

Error - 3/11/2009 5:10:31 PM | Computer Name = MATTHEW | Source = Service Control Manager | ID = 7028
Description = The wuauserv Registry key denied access to SYSTEM account programs
so the Service Control Manager took ownership of the Registry key.

Error - 3/11/2009 5:10:41 PM | Computer Name = MATTHEW | Source = Service Control Manager | ID = 7028
Description = The wuauserv Registry key denied access to SYSTEM account programs
so the Service Control Manager took ownership of the Registry key.

Error - 3/11/2009 5:11:52 PM | Computer Name = MATTHEW | Source = Service Control Manager | ID = 7028
Description = The wuauserv Registry key denied access to SYSTEM account programs
so the Service Control Manager took ownership of the Registry key.

Error - 3/11/2009 5:13:36 PM | Computer Name = MATTHEW | Source = Service Control Manager | ID = 7028
Description = The wuauserv Registry key denied access to SYSTEM account programs
so the Service Control Manager took ownership of the Registry key.

Error - 3/11/2009 5:13:46 PM | Computer Name = MATTHEW | Source = Service Control Manager | ID = 7028
Description = The wuauserv Registry key denied access to SYSTEM account programs
so the Service Control Manager took ownership of the Registry key.

Error - 3/11/2009 5:14:57 PM | Computer Name = MATTHEW | Source = Service Control Manager | ID = 7028
Description = The wuauserv Registry key denied access to SYSTEM account programs
so the Service Control Manager took ownership of the Registry key.

< End of report >

and attached is the .zip from AVZ.

Noted improvements: Desktop background is restored to normal. Also computer is running much much faster as a whole and the cooling fan is back to its normal state of just a very quite whurring noise.

Attachments:

📎virusinfo_syscheck.zip

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] "PassCapture" has my computer feeling blue

✨ Ask AI

Ask AI