Hihackthis Log, please help

Welcome !! Please take note of the following while we are working together:

• Your fix may take a couple posts so please be patient even if you don't see immediate results.
• I will working on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for the issues on this machine.
• Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear.
• If you don't know or understand something, please don't hesitate to say or ask!! It's definitely better to be sure and safe than sorry.

***************************************

1. Download combofix.exe by sUBs and save it to your desktop.
2. <> combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply

Warning: Please do not mouseclick combofix's window while it is running. This may cause it to stall.

Open HijackThis, click Config, click Misc Tools
Click "Open Uninstall Manager"
Click "Save List" (generates uninstall_list.txt)
Click Save, copy and paste the results in your next post.

In your next post, please include

• new hijackthis log
• combofix log
• uninstall list

*use separate posts to ensure the logs don't get cut off!

*************************

First, thanks for all the help! Here is the combofix log Dad - 06-08-21 18:13:41.70 ComboFix 06.08.18 - Running from: C:\Documents and Settings\[removed]\Desktop ((((((((((((((((((((((((((((((((((((((((((((( Look2Me's Log )))))))))))))))))))))))))))))))))))))))))))))))))) REGISTRY ENTRIES REMOVED: [HKEY_CLASSES_ROOT\CLSID\{05575734-F84C-402B-AA4F-4D99F3292839}] @="" "IDEx"="ADDR" [HKEY_CLASSES_ROOT\CLSID\{05575734-F84C-402B-AA4F-4D99F3292839}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{05575734-F84C-402B-AA4F-4D99F3292839}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{05575734-F84C-402B-AA4F-4D99F3292839}\InprocServer32] @="C:\\WINDOWS\\system32\\OABCCP32.DLL" "ThreadingModel"="Apartment" [HKEY_CLASSES_ROOT\CLSID\{FDF72985-8B89-4380-907D-E3C1AA3557A4}] [HKEY_CLASSES_ROOT\CLSID\{FDF72985-8B89-4380-907D-E3C1AA3557A4}\InprocServer32] [HKEY_CLASSES_ROOT\CLSID\{0F425BE6-FA5B-4679-A4F1-D0384FDB1650}] @="" "IDEx"="ADDR" [HKEY_CLASSES_ROOT\CLSID\{0F425BE6-FA5B-4679-A4F1-D0384FDB1650}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{0F425BE6-FA5B-4679-A4F1-D0384FDB1650}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{0F425BE6-FA5B-4679-A4F1-D0384FDB1650}\InprocServer32] @="C:\\WINDOWS\\system32\\qtery.dll" "ThreadingModel"="Apartment" [HKEY_CLASSES_ROOT\CLSID\{6A6CB645-494F-432D-A3A5-9936BB8ABE8F}] @="" "IDEx"="ADDR" [HKEY_CLASSES_ROOT\CLSID\{6A6CB645-494F-432D-A3A5-9936BB8ABE8F}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{6A6CB645-494F-432D-A3A5-9936BB8ABE8F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{6A6CB645-494F-432D-A3A5-9936BB8ABE8F}\InprocServer32] @="C:\\WINDOWS\\system32\\FSST30.DLL" "ThreadingModel"="Apartment" [HKEY_CLASSES_ROOT\CLSID\{E3AB7549-8111-4055-8D5C-C234B1683CCE}] @="" "IDEx"="ADDR" [HKEY_CLASSES_ROOT\CLSID\{E3AB7549-8111-4055-8D5C-C234B1683CCE}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{E3AB7549-8111-4055-8D5C-C234B1683CCE}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{E3AB7549-8111-4055-8D5C-C234B1683CCE}\InprocServer32] @="C:\\WINDOWS\\system32\\dsmodemx.dll" "ThreadingModel"="Apartment" [HKEY_CLASSES_ROOT\CLSID\{5D0FDFAA-08C2-45BB-B495-E8F4F617A09E}] [HKEY_CLASSES_ROOT\CLSID\{5D0FDFAA-08C2-45BB-B495-E8F4F617A09E}\InprocServer32] [HKEY_CLASSES_ROOT\CLSID\{A98A9EE1-03C4-4D1A-A98B-DD42DD34E1A6}] [HKEY_CLASSES_ROOT\CLSID\{A98A9EE1-03C4-4D1A-A98B-DD42DD34E1A6}\InprocServer32] [HKEY_CLASSES_ROOT\CLSID\{5CE02350-9DFE-4EE1-9E57-96D1F2868A7F}] [HKEY_CLASSES_ROOT\CLSID\{5CE02350-9DFE-4EE1-9E57-96D1F2868A7F}\InprocServer32] [HKEY_CLASSES_ROOT\CLSID\{064DA5F2-F869-479D-9E80-8FF2280EC23D}] [HKEY_CLASSES_ROOT\CLSID\{064DA5F2-F869-479D-9E80-8FF2280EC23D}\InprocServer32] [HKEY_CLASSES_ROOT\CLSID\{77A86A62-F2B7-4124-8260-4F879C135AED}] [HKEY_CLASSES_ROOT\CLSID\{77A86A62-F2B7-4124-8260-4F879C135AED}\InprocServer32] [HKEY_CLASSES_ROOT\CLSID\{3C4F01EE-E12B-4E01-9681-D35340051C26}] @="" [HKEY_CLASSES_ROOT\CLSID\{3C4F01EE-E12B-4E01-9681-D35340051C26}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{3C4F01EE-E12B-4E01-9681-D35340051C26}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{3C4F01EE-E12B-4E01-9681-D35340051C26}\InprocServer32] @="C:\\WINDOWS\\system32\\rtpairs303169590.dll" "ThreadingModel"="Apartment" [HKEY_CLASSES_ROOT\CLSID\{349C10D9-C8B6-4BF7-A7A0-466BBD7B84E4}] @="" [HKEY_CLASSES_ROOT\CLSID\{349C10D9-C8B6-4BF7-A7A0-466BBD7B84E4}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{349C10D9-C8B6-4BF7-A7A0-466BBD7B84E4}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{349C10D9-C8B6-4BF7-A7A0-466BBD7B84E4}\InprocServer32] @="C:\\WINDOWS\\system32\\NUSDEXTS.DLL" "ThreadingModel"="Apartment" [HKEY_CLASSES_ROOT\CLSID\{551BE00F-3468-4BA0-A795-7B7920FE3FB2}] @="" [HKEY_CLASSES_ROOT\CLSID\{551BE00F-3468-4BA0-A795-7B7920FE3FB2}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{551BE00F-3468-4BA0-A795-7B7920FE3FB2}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{551BE00F-3468-4BA0-A795-7B7920FE3FB2}\InprocServer32] @="C:\\WINDOWS\\system32\\KVDUZB.DLL" "ThreadingModel"="Apartment" * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * FILES REMOVED: C:\WINDOWS\SYSTEM32\ACIFIL32.DLL C:\WINDOWS\SYSTEM32\adl70.dll C:\WINDOWS\SYSTEM32\ADLUI.DLL C:\WINDOWS\SYSTEM32\ALSLDPC.DLL C:\WINDOWS\SYSTEM32\CLMCTL32.DLL C:\WINDOWS\SYSTEM32\DGINTF.DLL C:\WINDOWS\SYSTEM32\e8020idoe80c0.dll C:\WINDOWS\SYSTEM32\EGSVC.DLL C:\WINDOWS\SYSTEM32\en4ol1h31.dll C:\WINDOWS\SYSTEM32\fp8s03l7e.dll C:\WINDOWS\SYSTEM32\g4lm0e31eh.dll C:\WINDOWS\SYSTEM32\h44m0eh1eh4.dll C:\WINDOWS\SYSTEM32\hr6605jse.dll C:\WINDOWS\SYSTEM32\i4420ehoeh4c0.dll C:\WINDOWS\SYSTEM32\i642lgho164c.dll C:\WINDOWS\SYSTEM32\i6lolg3316.dll C:\WINDOWS\SYSTEM32\INWPHBK.DLL C:\WINDOWS\SYSTEM32\IRAGEHLP.DLL C:\WINDOWS\SYSTEM32\irjsl5171.dll C:\WINDOWS\SYSTEM32\irpol5731.dll C:\WINDOWS\SYSTEM32\j62qlgf5162.dll C:\WINDOWS\SYSTEM32\jt4407hqe.dll C:\WINDOWS\SYSTEM32\kt4ml7h11.dll C:\WINDOWS\SYSTEM32\KVDUZB.DLL C:\WINDOWS\SYSTEM32\KZDNO.DLL C:\WINDOWS\SYSTEM32\LFHSVC.DLL C:\WINDOWS\SYSTEM32\LsgitCheckControl.DLL C:\WINDOWS\SYSTEM32\LURHELP.DLL C:\WINDOWS\SYSTEM32\lv0209doe.dll C:\WINDOWS\SYSTEM32\lv8u09l9e.dll C:\WINDOWS\SYSTEM32\m2ju0c19ef.dll C:\WINDOWS\SYSTEM32\MQIMTF.DLL C:\WINDOWS\SYSTEM32\mvl4l93q1.dll C:\WINDOWS\SYSTEM32\MYL_HP.DLL C:\WINDOWS\SYSTEM32\n44sleh71h4.dll C:\WINDOWS\SYSTEM32\NUSDEXTS.DLL C:\WINDOWS\SYSTEM32\RFSMXS.DLL C:\WINDOWS\SYSTEM32\rtpairs303169590.dll C:\WINDOWS\SYSTEM32\s088lalu1dq8.dll C:\WINDOWS\SYSTEM32\t48u0el9ehq.dll C:\WINDOWS\SYSTEM32\TDD32.DLL C:\WINDOWS\SYSTEM32\u4rule991h.dll C:\WINDOWS\SYSTEM32\WDISCMGR.DLL C:\WINDOWS\SYSTEM32\wisdmod.dll C:\WINDOWS\SYSTEM32\wmauboot.dll C:\WINDOWS\SYSTEM32\wwvdmoe2.dll Granting sedebugprivilege to Administrators … successful ((((((((((((((((((((((((((((((((((((((((((((( Qoologic's Log ))))))))))))))))))))))))))))))))))))))))))))))))))) * * * PRE-RUN - Filepaths extracted from the Registry * * * * * * * * * * * * * * * * * * * * * * O4 - HKEY_CURRENT_USER\…\Run C:\WINDOWS\SYSTEM32\vdpclq.exe O4 - HKEY_LOCAL_MACHINE\…\Run C:\WINDOWS\System32\vdpclq.exe F2 -REG:system.ini: Shell C:\WINDOWS\System32\lmggl.exe F2 -REG:system.ini: UserInit C:\WINDOWS\SYSTEM32\winkvwk.exe * * * PRE-RUN - Filepaths from Locate * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * 2006-08-21 18:16 289 –a—— C:\WINDOWS\txvjc.dll 2006-08-21 18:12 235749 -r–s—- C:\WINDOWS\SYSTEM32\KVDUZB.DLL 2006-08-21 17:51 52 –a—— C:\WINDOWS\wcocpe.dat 2006-08-18 11:57 235749 -r–s—- C:\WINDOWS\SYSTEM32\MQIMTF.DLL 2006-08-17 12:17 234272 –a—— C:\WINDOWS\SYSTEM32\ADLUI.DLL 2006-08-17 12:16 234272 -r–s—- C:\WINDOWS\SYSTEM32\LURHELP.DLL 2006-08-17 12:15 45056 –a—— C:\WINDOWS\SYSTEM32\ghynf.exe 2006-08-17 12:15 36864 –a—— C:\WINDOWS\SYSTEM32\n9nyb.exe 2006-08-17 12:14 235749 -r–s—- C:\WINDOWS\SYSTEM32\EGSVC.DLL 2006-08-14 19:48 235749 -r–s—- C:\WINDOWS\SYSTEM32\KZDNO.DLL 2006-08-12 20:42 235749 -r–s—- C:\WINDOWS\SYSTEM32\wisdmod.dll 2006-08-07 20:30 235679 -r–s—- C:\WINDOWS\SYSTEM32\TDD32.DLL 2006-08-05 21:05 2 –a—— C:\WINDOWS\SYSTEM32\wnstscc.exe 2006-07-20 16:31 36864 –a—— C:\WINDOWS\SYSTEM32\zqskw.exe 2006-07-20 16:31 1163264 –a—— C:\WINDOWS\SYSTEM32\wfxqhv.exe 2006-07-20 15:29 234272 -r–s—- C:\WINDOWS\SYSTEM32\DGINTF.DLL 2006-07-18 01:44 234272 -r–s—- C:\WINDOWS\SYSTEM32\INWPHBK.DLL 2006-07-13 21:26 84480 –a—— C:\WINDOWS\SYSTEM32\mscdaux.dll 2006-07-13 21:26 4608 –a—— C:\WINDOWS\SYSTEM32\taskdir.dll 2006-07-13 18:54 234272 -r–s—- C:\WINDOWS\SYSTEM32\ALSLDPC.DLL 2006-07-13 18:54 234272 -r–s—- C:\WINDOWS\SYSTEM32\adl70.dll 2006-07-13 18:52 234272 -r–s—- C:\WINDOWS\SYSTEM32\MYL_HP.DLL 2006-07-08 13:18 380928 –a—— C:\WINDOWS\SYSTEM32\WinNB58.dll 2006-07-03 00:38 24576 –a—— C:\WINDOWS\SYSTEM32\msxml3a.dll 2006-07-02 14:54 235733 -r–s—- C:\WINDOWS\SYSTEM32\LFHSVC.DLL 2006-07-02 12:35 235733 -r–s—- C:\WINDOWS\SYSTEM32\RFSMXS.DLL 2006-07-02 07:35 48167 –a—— C:\WINDOWS\SYSTEM32\VSL05.exe 2006-07-02 07:33 8464 –a—— C:\WINDOWS\SYSTEM32\sporder.dll 2006-07-02 07:30 51712 –a—— C:\WINDOWS\SYSTEM32\ckpccyv.dll 2006-07-02 07:30 32256 –a—— C:\WINDOWS\SYSTEM32\dmonwv.dll 2006-07-02 07:30 28672 –a—— C:\WINDOWS\SYSTEM32\lmggl.exe 2006-07-02 07:30 127488 –a—— C:\WINDOWS\SYSTEM32\vdpclq.exe 2006-07-02 07:30 127488 –a—— C:\WINDOWS\SYSTEM32\bbefw.dat 2006-07-02 07:30 127488 –a—— C:\Documents and Settings\All Users\Start Menu\Programs\Startup\nkcdr.exe 2006-06-29 05:24 83456 –a—— C:\WINDOWS\SYSTEM32\nsx255.dll 2006-06-29 05:24 83456 –a—— C:\WINDOWS\SYSTEM32\nsh254.dll * * * PRE-RUN - Filepaths extracted by Memory Dump * * * * * * * * * * * * * * * * * * * * * * 2006-07-02 07:30 127488 C:\WINDOWS\SYSTEM32\vdpclq.exe 2006-07-02 07:30 51712 C:\WINDOWS\SYSTEM32\ckpccyv.dll 2006-07-02 07:30 23552 C:\WINDOWS\SYSTEM32\winkvwk.exe 2006-07-02 07:30 127488 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\nkcdr.exe 2006-08-21 18:16 289 C:\WINDOWS\txvjc.dll 2006-07-02 07:30 127488 C:\WINDOWS\SYSTEM32\bbefw.dat 2006-07-02 07:30 28672 C:\WINDOWS\SYSTEM32\lmggl.exe * * * POST-RUN - Files in the Quarantine folder * * * * * * * * * * * * * * * * * * * * * * * * * 06-07-02 07:30 127488 vdpclq.exe.qoo 06-07-02 07:30 127488 nkcdr.exe.qoo 06-07-02 07:30 127488 bbefw.dat.qoo 06-07-02 07:30 51712 ckpccyv.dll.qoo 06-07-02 07:30 32256 dmonwv.dll.qoo 06-07-02 07:30 28672 lmggl.exe.qoo 06-08-21 18:16 289 txvjc.dll.qoo 06-08-21 17:51 52 wcocpe.dat.qoo DO NOT DELETE ANY FILES FROM THIS DIRECTORY UNLESS INSTRUCTED TO ((((((((((((((((((((((((((((((((((((((((((( E-Give / Ssk's Log ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\repairs303169590.dll C:\Documents and Settings\Dad\Application Data\Sskknwrd.dll C:\Documents and Settings\Dan\Application Data\Sskknwrd.dll C:\Documents and Settings\Guest\Application Data\Sskknwrd.dll C:\Documents and Settings\John\Application Data\Sskcwrd.dll C:\Documents and Settings\John\Application Data\Sskdmns.dll C:\Documents and Settings\John\Application Data\Sskknwrd.dll C:\WINDOWS\system32\bk.exe C:\Program Files\surfsidekick 3\Ssk.exe C:\Program Files\surfsidekick 3\SskBho.dll C:\Program Files\surfsidekick 3\SskCore.dll * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * C:\WINDOWS\system32\repairs303169590.dll C:\Program Files\surfsidekick 3\Ssk.exe C:\Program Files\surfsidekick 3\SskBho.dll C:\Program Files\surfsidekick 3\SskCore.dll (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\SYSTEM32\vxgame1.exe C:\WINDOWS\SYSTEM32\vxgame2.exe C:\WINDOWS\SYSTEM32\vxgame3.exe C:\WINDOWS\SYSTEM32\vxgame4.exe C:\WINDOWS\SYSTEM32\vxgame6.exe C:\WINDOWS\SYSTEM32\vxgamet1.exe C:\WINDOWS\SYSTEM32\vxgamet2.exe C:\WINDOWS\SYSTEM32\vxgamet3.exe C:\WINDOWS\SYSTEM32\vxgamet4.exe C:\WINDOWS\cfg32.exe C:\WINDOWS\cfg32a.exe C:\WINDOWS\Duce6.exe C:\WINDOWS\keyboard1.dat C:\WINDOWS\MTE3NDI6ODoxNg.exe C:\WINDOWS\newname.dat C:\dfndrac_6.exe C:\dfndrad_5.exe C:\dfndrb_3.exe C:\dfndrc_4a.exe C:\dfndrd_5.exe C:\dfndre_5.exe C:\dfndrff_11.exe C:\dfndrff_12.exe C:\drsmartload.exe C:\drsmartload1.exe C:\drsmartload45a2002.exe C:\drsmartload45a3344a.exe C:\drsmartload45t.exe C:\drsmartload45w.exe C:\drsmartload45x.exe C:\drsmartload45z.exe C:\drsmartload46a2002.exe C:\drsmartload46a3344a.exe C:\drsmartload46t.exe C:\drsmartload46w.exe C:\drsmartload46x.exe C:\drsmartload46z.exe C:\drsmartload849a.exe C:\drsmartload849a2002.exe C:\drsmartload849a3344a.exe C:\drsmartload849t.exe C:\drsmartload849w.exe C:\drsmartload849x.exe C:\drsmartload849z.exe C:\kybrdac_6.exe C:\kybrdad_5.exe C:\kybrdb_3.exe C:\kybrdc_4.exe C:\kybrdd_5.exe C:\kybrde_5.exe C:\kybrdff_11.exe C:\kybrdff_12.exe C:\mc-110-12-0000228.exe C:\Mendoza1.exe C:\MTE3NDI6ODoxNg.exe C:\MTE3NDI6ODoxNgnew.exe C:\nwnmad_5.exe C:\nwnmb_3.exe C:\nwnmc_4.exe C:\nwnmd_5.exe C:\nwnme_5.exe C:\nwnmff_11.exe C:\nwnmff_12.exe C:\stub_113_4_0_4_0new.exe C:\stub_113_4_0_4_0newer.exe C:\warebundle2.exe C:\warebundlenew.exe C:\warebundlenewer.exe C:\Documents and Settings\Dad\Local Settings\Temporary Internet Files\Content.IE5\25LYBYP4\kybrdff_11[1].exe C:\Documents and Settings\Dad\Local Settings\Temporary Internet Files\Content.IE5\8DKRLPUC\nwnmd_5[1].exe C:\Documents and Settings\Dad\Local Settings\Temporary Internet Files\Content.IE5\C5CZSF0R\mc-110-12-0000228[1].exe C:\Documents and Settings\Dad\Local Settings\Temporary Internet Files\Content.IE5\GDG2QWC1\kybrdd_5[1].exe C:\Documents and Settings\Dad\Local Settings\Temporary Internet Files\Content.IE5\GDG2QWC1\nwnmff_11[1].exe C:\Documents and Settings\Dad\Local Settings\Temporary Internet Files\Content.IE5\GHQNCPA3\drsmartload45a[1].exe C:\Documents and Settings\Dad\Local Settings\Temporary Internet Files\Content.IE5\GHQNCPA3\drsmartload849a[1].exe C:\Documents and Settings\Dad\Local Settings\Temporary Internet Files\Content.IE5\GXMJ0PUB\dfndrff_11[1].exe C:\Documents and Settings\Dad\Local Settings\Temporary Internet Files\Content.IE5\GXMJ0PUB\nwnmff_12[1].exe C:\Documents and Settings\Dad\Local Settings\Temporary Internet Files\Content.IE5\MFH95IVE\drsmartload45a[1].exe C:\Documents and Settings\Dad\Local Settings\Temporary Internet Files\Content.IE5\PF3NT10U\drsmartload849a[2].exe C:\Documents and Settings\Dad\Local Settings\Temporary Internet Files\Content.IE5\PF3NT10U\stub_113_4_0_4_0[1].exe C:\Documents and Settings\Dad\Local Settings\Temporary Internet Files\Content.IE5\S68PG3U9\dfndrd_5[1].exe C:\Documents and Settings\Dad\Local Settings\Temporary Internet Files\Content.IE5\S68PG3U9\kybrdff_12[1].exe C:\Documents and Settings\Dad\Local Settings\Temporary Internet Files\Content.IE5\WPMZ8HAV\drsmartload[1].exe C:\Documents and Settings\Dad\Local Settings\Temporary Internet Files\Content.IE5\ZMRPW4LV\dfndrff_12[1].exe C:\Documents and Settings\Dad\Local Settings\Temporary Internet Files\Content.IE5\ZUSRNP49\drsmartload46a[1].exe C:\Documents and Settings\Dad\Local Settings\Temporary Internet Files\Content.IE5\ZUSRNP49\drsmartload[1].exe C:\WINDOWS\system32\kernels8.exe C:\WINDOWS\system32\maxd641.exe C:\WINDOWS\system32\tsuninst.exe C:\WINDOWS\system32\xeymi.dll C:\deskbar.exe C:\Installer3.exe C:\mte3ndi6odoxng.exe C:\RDFX4.exe C:\ucmoreiex.exe C:\visfx500new.exe C:\WINDOWS\elpp100drop.exe C:\WINDOWS\ssqbn.exe C:\WINDOWS\thiselt.exe C:\WINDOWS\uni_ehhh.exe C:\WINDOWS\wallpap.exe C:\WINDOWS\xpupdate.exe C:\WINDOWS\YOINSI.exe C:\WINDOWS\uninstall_nmon.vbs C:\WINDOWS\SYSTEM32\atmtd.dll C:\WINDOWS\SYSTEM32\atmtd.dll._ C:\Documents and Settings\LocalService\Application Data\NetMon C:\Program Files\Common Files\misc001 C:\Program Files\Common Files\simtest C:\Program Files\Common Files\svchostsys C:\Program Files\elticons C:\Program Files\TheSearchAccelerator C:\Program Files\network monitor C:\WINDOWS\TGF1cmVuIFBsdW5rZXR0 C:\Program Files\Deskbar ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\QooBox\Purity\WINDOWS\FNTS~1 C:\QooBox\Purity\WINDOWS\FNTS~1\FNTS~1 C:\QooBox\Purity\WINDOWS\FNTS~1\wuaclt.exe ((((((((((((((((((((((((((((((( Files Created from 2006-07-21 to 2006-08-21 )))))))))))))))))))))))))))))))))) 2006-08-21 17:51 214,752 C:\Setup100.exe 2006-08-21 17:50 48,190 C:\WINDOWS\RDFX4.exe 2006-08-17 12:17 186,223 C:\WINDOWS\srvowpxjfn.exe 2006-08-17 12:16 353,280 C:\803_104.exe 2006-08-17 12:16 27,648 C:\dist13.exe 2006-08-17 12:16 21,504 C:\WINDOWS\offun.exe 2006-08-17 12:16 1,054,816 C:\WINDOWS\ecjnnyoA.exe 2006-08-17 12:15 57,344 C:\fym9bvo.exe 2006-08-17 12:15 45,056 C:\WINDOWS\System32ghynf.exe 2006-08-17 12:15 45,056 C:\WINDOWS\system32\ghynf.exe 2006-08-17 12:15 36,864 C:\WINDOWS\System32n9nyb.exe 2006-08-17 12:15 36,864 C:\WINDOWS\system32\zqskw.exe 2006-08-17 12:15 36,864 C:\WINDOWS\system32\n9nyb.exe 2006-08-17 12:15 30,208 C:\SS1001newer.exe 2006-08-17 12:15 28,672 C:\WINDOWS\System32bez6n4r21.exe 2006-08-17 12:15 28,672 C:\WINDOWS\system32\iqqr.exe 2006-08-17 12:15 28,672 C:\WINDOWS\system32\bez6n4r21.exe 2006-08-17 12:15 159,744 C:\WINDOWS\system32\cvn0.exe 2006-08-17 12:15 1,163,264 C:\WINDOWS\system32\wfxqhv.exe 2006-08-11 12:05 155,648 C:\WINDOWS\vSg21-d.exe (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-08-21 18:17 ——– d——– C:\Program Files\Common Files 2006-08-21 17:53 ——– d——– C:\Program Files\Windows Media Player 2006-08-21 17:53 ——– d——– C:\Program Files\MSN 2006-08-21 17:53 ——– d——– C:\Program Files\Microsoft AntiSpyware 2006-08-21 17:53 ——– d——– C:\Program Files\Messenger 2006-08-21 17:51 214752 –a—— C:\Setup100.exe 2006-08-21 17:50 48190 –a—— C:\WINDOWS\RDFX4.exe 2006-08-21 17:50 1167 –a—— C:\WINDOWS\SYSTEM32\wve942e1.sys 2006-08-18 14:34 ——– d——– C:\Program Files\Common Files\Symantec Shared 2006-08-17 12:31 ——– d——– C:\Program Files\whInstall 2006-08-17 12:17 186223 –a—— C:\WINDOWS\srvowpxjfn.exe 2006-08-17 12:17 ——– d——– C:\Program Files\PSLister 2006-08-17 12:16 353280 –a—— C:\803_104.exe 2006-08-17 12:16 27648 –a—— C:\dist13.exe 2006-08-17 12:16 ——– d——– C:\Program Files\Cas2Stub 2006-08-17 12:15 57344 –a—— C:\fym9bvo.exe 2006-08-17 12:15 45056 –a—— C:\WINDOWS\System32ghynf.exe 2006-08-17 12:15 45056 –a—— C:\WINDOWS\SYSTEM32\ghynf.exe 2006-08-17 12:15 36864 –a—— C:\WINDOWS\System32n9nyb.exe 2006-08-17 12:15 36864 –a—— C:\WINDOWS\SYSTEM32\n9nyb.exe 2006-08-17 12:15 30208 –a—— C:\SS1001newer.exe 2006-08-17 12:15 28672 –a—— C:\WINDOWS\System32bez6n4r21.exe 2006-08-17 12:15 28672 –a—— C:\WINDOWS\SYSTEM32\iqqr.exe 2006-08-17 12:15 28672 –a—— C:\WINDOWS\SYSTEM32\bez6n4r21.exe 2006-08-11 12:05 155648 –a—— C:\WINDOWS\vSg21-d.exe 2006-08-07 20:30 ——– d——– C:\Program Files\SurfSideKick 3 2006-08-05 22:23 ——– d——– C:\Program Files\Common Files\32vegas 2006-08-05 21:11 61952 –a—— C:\WINDOWS\SYSTEM32\wve942e1.dll 2006-08-05 21:05 81920 –a—— C:\WINDOWS\SYSTEM32\wuauboot.dll 2006-08-05 21:05 2 –a—— C:\WINDOWS\SYSTEM32\wnstscc.exe 2006-08-05 20:42 ——– d——– C:\Program Files\PokerStars 2006-07-26 15:49 159744 –a—— C:\WINDOWS\SYSTEM32\cvn0.exe 2006-07-20 16:31 36864 –a—— C:\WINDOWS\SYSTEM32\zqskw.exe 2006-07-20 16:31 1163264 –a—— C:\WINDOWS\SYSTEM32\wfxqhv.exe 2006-07-14 02:15 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwyxsn.exe 2006-07-14 02:05 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwdahx.exe 2006-07-14 01:54 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwjxxn.exe 2006-07-14 01:44 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwfeev.exe 2006-07-14 01:34 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwnkiu.exe 2006-07-14 01:23 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwkzji.exe 2006-07-14 01:13 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwgxep.exe 2006-07-14 01:03 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwzssu.exe 2006-07-14 00:53 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwywtx.exe 2006-07-14 00:42 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwaequ.exe 2006-07-14 00:32 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwuuds.exe 2006-07-14 00:22 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwpdnx.exe 2006-07-14 00:12 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwdyho.exe 2006-07-14 00:02 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwzmak.exe 2006-07-13 23:51 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwzwxy.exe 2006-07-13 23:41 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwlggm.exe 2006-07-13 23:31 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwjyjl.exe 2006-07-13 23:21 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwmzyo.exe 2006-07-13 23:10 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwites.exe 2006-07-13 23:00 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwziqc.exe 2006-07-13 22:50 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwjfme.exe 2006-07-13 22:39 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwmaxh.exe 2006-07-13 22:29 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwmgmw.exe 2006-07-13 22:19 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwntct.exe 2006-07-13 22:09 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwwrip.exe 2006-07-13 21:59 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwqkbp.exe 2006-07-13 21:48 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwbdaf.exe 2006-07-13 21:38 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwxyfa.exe 2006-07-13 21:31 1632 –a—— C:\WINDOWS\SYSTEM32\qvxgamet4.exe 2006-07-13 21:28 49880 –a—— C:\WINDOWS\SYSTEM32\ipv6mons.dll 2006-07-13 21:27 9266 –a—— C:\WINDOWS\SYSTEM32\taskdir~.exe 2006-07-13 21:27 46592 –a—— C:\WINDOWS\SYSTEM32\zlbw.dll 2006-07-13 21:27 1313 –a—— C:\svhost.exe 2006-07-13 21:26 84480 –a—— C:\WINDOWS\SYSTEM32\mscdaux.dll 2006-07-13 21:26 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwoygu.exe 2006-07-13 21:26 63562 –a—— C:\WINDOWS\SYSTEM32\taskdir.exe 2006-07-13 21:26 63562 –a—— C:\WINDOWS\SYSTEM32\ipod.raw.exe 2006-07-13 21:26 4608 –a—— C:\WINDOWS\SYSTEM32\taskdir.dll 2006-07-13 21:25 4608 –a—— C:\WINDOWS\SYSTEM32\qvxgamet3.exe 2006-07-13 21:25 1632 –a—— C:\WINDOWS\SYSTEM32\qvxgamet2.exe 2006-07-13 21:24 7051 –a—— C:\WINDOWS\SYSTEM32\dlh9jkdq7.exe 2006-07-13 21:24 6630 –a—— C:\WINDOWS\SYSTEM32\dlh9jkdq5.exe 2006-07-13 21:24 6539 –a—— C:\WINDOWS\SYSTEM32\dlh9jkdq6.exe 2006-07-13 21:24 5744 –a—— C:\WINDOWS\SYSTEM32\testtestt.exe 2006-07-13 21:24 2518 –a—— C:\WINDOWS\SYSTEM32\dlh9jkdq1.exe 2006-07-13 21:24 21504 –a—— C:\WINDOWS\SYSTEM32\14295a63.exe 2006-07-13 21:24 17894 –a—— C:\WINDOWS\SYSTEM32\dlh9jkdq2.exe 2006-07-13 21:24 15 –a—— C:\WINDOWS\SYSTEM32\dlh9jkdq8.exe 2006-07-13 21:24 ——– d——– C:\Program Files\BraveSentry 2006-07-13 19:01 32768 –a—— C:\WINDOWS\dzzoxdxh.exe 2006-07-13 18:55 45056 –a—— C:\WINDOWS\cfg32s.dll 2006-07-13 18:55 397312 –a—— C:\WINDOWS\cfg32p.dll 2006-07-13 18:55 110592 –a—— C:\WINDOWS\cfg32o.dll 2006-07-13 18:54 578560 –a—— C:\Installer.exe 2006-07-13 18:54 102400 –a—— C:\WINDOWS\cfg32r.dll 2006-07-13 18:53 96768 ——— C:\WINDOWS\SYSTEM32\repairs303169590.dll 2006-07-13 18:52 110592 –a—— C:\WINDOWS\v1201.exe 2006-07-13 18:51 36864 –a—— C:\WINDOWS\SYSTEM32\tdophzoi.exe 2006-07-13 18:51 30208 –a—— C:\SS1001new.exe 2006-07-09 18:33 ——– d——– C:\Program Files\Cowabanga 2006-07-09 14:54 143360 –a—— C:\WINDOWS\win320748060491.exe 2006-07-08 16:16 32768 –a—— C:\WINDOWS\qxunjaza.exe 2006-07-08 13:21 32768 –a—— C:\WINDOWS\xromraku.exe 2006-07-08 13:18 380928 –a—— C:\WINDOWS\SYSTEM32\WinNB58.dll 2006-07-08 13:18 ——– d——– C:\Program Files\PartyPoker 2006-07-08 13:15 290816 –a—— C:\installerwnusnew.exe 2006-07-05 07:06 27648 –a—— C:\23100247.exe 2006-07-05 07:06 16167 –a—— C:\WINDOWS\SYSTEM32\ordermas2.dll 2006-07-04 18:53 24296 –a—— C:\WINDOWS\icont.exe 2006-07-04 09:58 81920 –a—— C:\WINDOWS\SYSTEM32\ati2evxx.dll 2006-07-04 09:57 61440 –a—— C:\WINDOWS\SYSTEM32\aaa00000.dll 2006-07-04 09:57 1063 –a—— C:\WINDOWS\SYSTEM32\aaa00000.sys 2006-07-04 09:56 405504 –a—— C:\WINDOWS\SYSTEM32\irsmsleu.dll 2006-07-04 09:56 29696 –a—— C:\WINDOWS\SYSTEM32\w4532dfd.dll 2006-07-04 09:56 2560 –a—— C:\ac3_0003.exe 2006-07-04 09:56 20480 –a—— C:\stub_sca3.exe 2006-07-03 01:50 143360 –a—— C:\WINDOWS\win3207480604912006.exe 2006-07-03 01:11 ——– d——– C:\Program Files\Radio@Netscape 2006-07-03 00:38 405504 –a—— C:\WINDOWS\SYSTEM32\irsmjbhn.dll 2006-07-03 00:38 32976 –a—— C:\WINDOWS\SYSTEM32\uninstIcn.exe 2006-07-03 00:38 24576 –a—— C:\WINDOWS\SYSTEM32\msxml3a.dll 2006-07-03 00:38 114688 –a—— C:\WINDOWS\SYSTEM32\irssyncd.exe 2006-07-03 00:34 359616 –a—— C:\WINDOWS\justin_bundle.exe 2006-07-02 21:03 ——– d——– C:\Program Files\TikGames 2006-07-02 07:38 0 –ah—– C:\Program Files\Internet Optimizer 2006-07-02 07:38 0 –ah—– C:\Program Files\Common Files\qiwq 2006-07-02 07:37 183296 –a-s—- C:\WINDOWS\NDNuninstall7_22.exe 2006-07-02 07:36 51712 –a—— C:\WINDOWS\SYSTEM32\w3d5ead9.dll 2006-07-02 07:35 48167 –a—— C:\WINDOWS\SYSTEM32\VSL05.exe 2006-07-02 07:35 20480 –a—— C:\stub_sca3new.exe 2006-07-02 07:35 111104 –a—— C:\numbsoftnew.exe 2006-07-02 07:34 389632 –a—— C:\webnexmknew.exe 2006-07-02 07:34 29696 –a—— C:\WINDOWS\SYSTEM32\w3d42164.dll 2006-07-02 07:33 8464 –a—— C:\WINDOWS\SYSTEM32\sporder.dll 2006-07-02 07:33 587776 –a—— C:\626_101new.exe 2006-07-02 07:33 45056 –a—— C:\WINDOWS\System32tfthot.exe 2006-07-02 07:33 28672 –a—— C:\WINDOWS\System32ftuninst.exe 2006-07-02 07:32 50688 –a-s—- C:\WINDOWS\NDNuninstall6_38.exe 2006-07-02 07:31 45056 –a—— C:\wd7gi8nnew.exe 2006-07-02 07:31 266240 –a—— C:\NNSCAA638.EXE 2006-07-02 07:31 25105 –a—— C:\WINDOWS\idlemg.exe 2006-07-02 07:31 232749 –a—— C:\WINDOWS\pf78.exe 2006-07-02 07:30 23552 –a—— C:\WINDOWS\SYSTEM32\winkvwk.exe 2006-07-02 07:30 234248 –a—— C:\WINDOWS\Tagasuarus2.exe 2006-07-02 07:26 14617 –a—— C:\WINDOWS\xload.exe 2006-06-29 05:24 83456 –a—— C:\WINDOWS\SYSTEM32\nsx255.dll 2006-06-29 05:24 83456 –a—— C:\WINDOWS\SYSTEM32\nsh254.dll 2006-06-24 02:37 ——– d——– C:\Program Files\Trymedia 2006-06-21 19:44 235228 –a—— C:\WINDOWS\SYSTEM32\icon_justin.exe 2006-06-21 19:44 115245 –a—— C:\WINDOWS\SYSTEM32\ts_justin.exe 2006-06-20 20:55 389120 –a—— C:\WINDOWS\SYSTEM32\nodeipproc.dll 2006-06-19 16:39 139264 –a—— C:\WINDOWS\876056.exe 2006-06-19 14:38 53248 –a—— C:\WINDOWS\uni_ehhhh.exe 2006-06-19 14:38 49152 –a—— C:\WINDOWS\uninst104.exe 2006-05-30 19:09 24576 –a—— C:\WINDOWS\Uninstall.exe 2006-05-17 02:20 17 –a—— C:\Program Files\d.bat (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe" "HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe" "SunJavaUpdateSched"="C:\\Program Files\\Java\\j2re1.4.2_03\\bin\\jusched.exe" "PRISMSVR.EXE"="\"C:\\WINDOWS\\System32\\PRISMSVR.EXE\" /APPLY" "DVDLauncher"="\"C:\\Program Files\\CyberLink\\PowerDVD\\DVDLauncher.exe\"" "UpdateManager"="\"C:\\Program Files\\Common Files\\Sonic\\Update Manager\\sgtray.exe\" /r" "PCMService"="\"C:\\Program Files\\Dell\\Media Experience\\PCMService.exe\"" "URLLSTCK.exe"="C:\\Program Files\\Norton Internet Security\\UrlLstCk.exe" "MMTray"="C:\\Program Files\\MUSICMATCH\\Musicmatch Jukebox\\mm_tray.exe" "Dell AIO Printer A920"="\"C:\\Program Files\\Dell AIO Printer A920\\dlbkbmgr.exe\"" "ViewMgr"="C:\\Program Files\\Viewpoint\\Viewpoint Manager\\ViewMgr.exe" "Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe" "SSC_UserPrompt"="C:\\Program Files\\Common Files\\Symantec Shared\\Security Center\\UsrPrmpt.exe" "mmtask"="C:\\Program Files\\MUSICMATCH\\Musicmatch Jukebox\\mmtask.exe" "HP Software Update"="\"C:\\Program Files\\HP\\HP Software Update\\HPWuSchd.exe\"" "HP Component Manager"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\"" "DIGStream"="C:\\Program Files\\DIGStream\\digstream.exe" "DIGServices"="C:\\Program Files\\ESPNRunTime\\DIGServices.exe /brand=ESPN /priority=0 /poll=24" "Uksxhqo"="C:\\Program Files\\Fzbog\\Evoystt.exe" "BearShare"="\"C:\\Program Files\\BearShare\\BearShare.exe\" /pause" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "gcasServ"="\"C:\\Program Files\\Microsoft AntiSpyware\\gcasServ.exe\"" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "xload"="\"C:\\WINDOWS\\xload.exe\"" "wve942e1"="RUNDLL32.EXE w3d42164.dll,n 001942e0000000033d42164" "w3d5ead9.dll"="RUNDLL32.EXE w3d5ead9.dll,I2 001942e003d5ead9" "orderShell"="C:\\Documents and Settings\\John\\ordergvbk.exe" "win320748060491"="C:\\WINDOWS\\win320748060491.exe" "ACTX1"="C:\\WINDOWS\\v1201.exe" "14295a63.exe"="C:\\WINDOWS\\System32\\14295a63.exe" "ÿ_zskJBKFM[DAK"="C:\\WINDOWS\\System32\\_zskwrkni05EQ^EP[\\KAD[MFKBJ.exe" "Explorer 2238"="C:\\DOCUME~1\\Dan\\LOCALS~1\\Temp\\27431\\explorer.exe" "ad8rIU3s"="C:\\WINDOWS\\System32\\cvn0.exe" "k6mmN5IOU"="\"C:\\WINDOWS\\System32\\wfxqhv.exe\"" "ecjnnyoA"="C:\\WINDOWS\\ecjnnyoA.exe" "ALUAlert"="C:\\Program Files\\Symantec\\LiveUpdate\\ALUNOTIFY.EXE" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "ctfmon.exe"="C:\\WINDOWS\\System32\\ctfmon.exe" "AIM"="C:\\progra~1\\aim\\aim.exe -cnetwait.odl" "DellSupport"="\"C:\\Program Files\\Dell Support\\DSAgnt.exe\" /startup" "14295a63.exe"="C:\\Documents and Settings\\Dad\\Local Settings\\Application Data\\14295a63.exe" "PSLister"="\"C:\\Program Files\\PSLister\\PSLister.exe\"" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices] "ÿ_zskJBKFM[DAK"="C:\\WINDOWS\\System32\\_zskwrkni05EQ^EP[\\KAD[MFKBJ.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000000 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="C:\\Program Files\\MSN\\xumyju.html" "SubscribedURL"="" "FriendlyName"="" "Flags"=dword:00002000 "Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,e8,\ 03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00 "CurrentState"=hex:01,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\ 00,00,01,00,00,00 "RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\1] "Source"="C:\\Program Files\\Windows Media Player\\vikogite.html" "SubscribedURL"="" "FriendlyName"="" "Flags"=dword:00002000 "Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,ea,\ 03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00 "CurrentState"=hex:01,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\ 00,00,01,00,00,00 "RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\2] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,80,00,00,00,00,00,00,00,00,02,00,00,c2,01,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,f2,01,00,00,23,00,00,00,7c,00,00,00,72,00,\ 00,00,01,00,00,00 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" "{2C1CD3D7-86AC-4068-93BC-A02304BB2238}"="DCOM Server 2238" "{3F143C3A-1457-6CCA-03A7-7AA23B61E40F}"="OLE Automation Module" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{9EF34FF2-3396-4527-9D27-04C8C1C67806}"="Microsoft AntiSpyware Service Hook" Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer.job C:\WINDOWS\tasks\Symantec NetDetect.job Completion time: Mon 08/21/2006 18:26:17.98 ComboFix.txt

Hi, can you let me know if your ran combofix in safe mode or not? also, is your latest hijackthis log from safe mode? if it is, can you reboot back into normal mode and post another hijackthis log?

Sorry about that, they were in safe mood. I'll redo it and post them again!

yes, please run both combofix and hijackthis in normal mode and post the logs again thanks!

Here is it, run in normal mode, the combo fix log first Dad - 06-08-21 20:28:29.25 ComboFix 06.08.18 - Running from: C:\Documents and Settings\[removed]\Desktop ((((((((((((((((((((((((((((((((((((((((((( E-Give / Ssk's Log ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\repairs303169590.dll C:\Documents and Settings\Dad\Application Data\Sskcwrd.dll C:\Documents and Settings\Dad\Application Data\Sskknwrd.dll C:\Documents and Settings\Dad\Application Data\Sskuknwrd.dll C:\Program Files\surfsidekick 3\Ssk.exe C:\Program Files\surfsidekick 3\SskBho.dll C:\Program Files\surfsidekick 3\SskCore.dll * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\xeymi.dll C:\WINDOWS\system32\xeymi.dll ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\QooBox\Purity\WINDOWS\FNTS~1 C:\QooBox\Purity\WINDOWS\FNTS~1\FNTS~1 C:\QooBox\Purity\WINDOWS\FNTS~1\wuaclt.exe ((((((((((((((((((((((((((((((( Files Created from 2006-07-21 to 2006-08-21 )))))))))))))))))))))))))))))))))) 2006-08-21 20:26 221,184 C:\WINDOWS\system32\xeymi.dll 2006-08-21 17:51 214,752 C:\Setup100.exe 2006-08-21 17:50 48,190 C:\WINDOWS\RDFX4.exe 2006-08-17 12:17 186,223 C:\WINDOWS\srvowpxjfn.exe 2006-08-17 12:16 353,280 C:\803_104.exe 2006-08-17 12:16 27,648 C:\dist13.exe 2006-08-17 12:16 21,504 C:\WINDOWS\offun.exe 2006-08-17 12:16 1,054,816 C:\WINDOWS\ecjnnyoA.exe 2006-08-17 12:15 57,344 C:\fym9bvo.exe 2006-08-17 12:15 45,056 C:\WINDOWS\System32ghynf.exe 2006-08-17 12:15 45,056 C:\WINDOWS\system32\ghynf.exe 2006-08-17 12:15 36,864 C:\WINDOWS\System32n9nyb.exe 2006-08-17 12:15 36,864 C:\WINDOWS\system32\zqskw.exe 2006-08-17 12:15 36,864 C:\WINDOWS\system32\n9nyb.exe 2006-08-17 12:15 30,208 C:\SS1001newer.exe 2006-08-17 12:15 28,672 C:\WINDOWS\System32bez6n4r21.exe 2006-08-17 12:15 28,672 C:\WINDOWS\system32\iqqr.exe 2006-08-17 12:15 28,672 C:\WINDOWS\system32\bez6n4r21.exe 2006-08-17 12:15 159,744 C:\WINDOWS\system32\cvn0.exe 2006-08-17 12:15 1,163,264 C:\WINDOWS\system32\wfxqhv.exe 2006-08-11 12:05 155,648 C:\WINDOWS\vSg21-d.exe (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-08-21 20:31 221184 –a—— C:\WINDOWS\SYSTEM32\xeymi.dll 2006-08-21 20:28 ——– d——– C:\Program Files\Microsoft AntiSpyware 2006-08-21 20:25 1167 –a—— C:\WINDOWS\SYSTEM32\wve942e1.sys 2006-08-21 20:25 ——– d——– C:\Program Files\Common Files 2006-08-21 17:53 ——– d——– C:\Program Files\Windows Media Player 2006-08-21 17:53 ——– d——– C:\Program Files\MSN 2006-08-21 17:53 ——– d——– C:\Program Files\Messenger 2006-08-21 17:51 214752 –a—— C:\Setup100.exe 2006-08-21 17:50 48190 –a—— C:\WINDOWS\RDFX4.exe 2006-08-18 14:34 ——– d——– C:\Program Files\Common Files\Symantec Shared 2006-08-17 12:31 ——– d——– C:\Program Files\whInstall 2006-08-17 12:17 186223 –a—— C:\WINDOWS\srvowpxjfn.exe 2006-08-17 12:17 ——– d——– C:\Program Files\PSLister 2006-08-17 12:16 353280 –a—— C:\803_104.exe 2006-08-17 12:16 27648 –a—— C:\dist13.exe 2006-08-17 12:16 ——– d——– C:\Program Files\Cas2Stub 2006-08-17 12:15 57344 –a—— C:\fym9bvo.exe 2006-08-17 12:15 45056 –a—— C:\WINDOWS\System32ghynf.exe 2006-08-17 12:15 45056 –a—— C:\WINDOWS\SYSTEM32\ghynf.exe 2006-08-17 12:15 36864 –a—— C:\WINDOWS\System32n9nyb.exe 2006-08-17 12:15 36864 –a—— C:\WINDOWS\SYSTEM32\n9nyb.exe 2006-08-17 12:15 30208 –a—— C:\SS1001newer.exe 2006-08-17 12:15 28672 –a—— C:\WINDOWS\System32bez6n4r21.exe 2006-08-17 12:15 28672 –a—— C:\WINDOWS\SYSTEM32\iqqr.exe 2006-08-17 12:15 28672 –a—— C:\WINDOWS\SYSTEM32\bez6n4r21.exe 2006-08-11 12:05 155648 –a—— C:\WINDOWS\vSg21-d.exe 2006-08-05 22:23 ——– d——– C:\Program Files\Common Files\32vegas 2006-08-05 21:11 61952 –a—— C:\WINDOWS\SYSTEM32\wve942e1.dll 2006-08-05 21:05 81920 –a—— C:\WINDOWS\SYSTEM32\wuauboot.dll 2006-08-05 21:05 2 –a—— C:\WINDOWS\SYSTEM32\wnstscc.exe 2006-08-05 20:42 ——– d——– C:\Program Files\PokerStars 2006-07-26 15:49 159744 –a—— C:\WINDOWS\SYSTEM32\cvn0.exe 2006-07-20 16:31 36864 –a—— C:\WINDOWS\SYSTEM32\zqskw.exe 2006-07-20 16:31 1163264 –a—— C:\WINDOWS\SYSTEM32\wfxqhv.exe 2006-07-14 02:15 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwyxsn.exe 2006-07-14 02:05 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwdahx.exe 2006-07-14 01:54 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwjxxn.exe 2006-07-14 01:44 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwfeev.exe 2006-07-14 01:34 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwnkiu.exe 2006-07-14 01:23 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwkzji.exe 2006-07-14 01:13 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwgxep.exe 2006-07-14 01:03 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwzssu.exe 2006-07-14 00:53 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwywtx.exe 2006-07-14 00:42 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwaequ.exe 2006-07-14 00:32 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwuuds.exe 2006-07-14 00:22 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwpdnx.exe 2006-07-14 00:12 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwdyho.exe 2006-07-14 00:02 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwzmak.exe 2006-07-13 23:51 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwzwxy.exe 2006-07-13 23:41 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwlggm.exe 2006-07-13 23:31 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwjyjl.exe 2006-07-13 23:21 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwmzyo.exe 2006-07-13 23:10 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwites.exe 2006-07-13 23:00 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwziqc.exe 2006-07-13 22:50 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwjfme.exe 2006-07-13 22:39 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwmaxh.exe 2006-07-13 22:29 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwmgmw.exe 2006-07-13 22:19 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwntct.exe 2006-07-13 22:09 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwwrip.exe 2006-07-13 21:59 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwqkbp.exe 2006-07-13 21:48 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwbdaf.exe 2006-07-13 21:38 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwxyfa.exe 2006-07-13 21:31 1632 –a—— C:\WINDOWS\SYSTEM32\qvxgamet4.exe 2006-07-13 21:28 49880 –a—— C:\WINDOWS\SYSTEM32\ipv6mons.dll 2006-07-13 21:27 9266 –a—— C:\WINDOWS\SYSTEM32\taskdir~.exe 2006-07-13 21:27 46592 –a—— C:\WINDOWS\SYSTEM32\zlbw.dll 2006-07-13 21:27 1313 –a—— C:\svhost.exe 2006-07-13 21:26 84480 –a—— C:\WINDOWS\SYSTEM32\mscdaux.dll 2006-07-13 21:26 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwoygu.exe 2006-07-13 21:26 63562 –a—— C:\WINDOWS\SYSTEM32\taskdir.exe 2006-07-13 21:26 63562 –a—— C:\WINDOWS\SYSTEM32\ipod.raw.exe 2006-07-13 21:26 4608 –a—— C:\WINDOWS\SYSTEM32\taskdir.dll 2006-07-13 21:25 4608 –a—— C:\WINDOWS\SYSTEM32\qvxgamet3.exe 2006-07-13 21:25 1632 –a—— C:\WINDOWS\SYSTEM32\qvxgamet2.exe 2006-07-13 21:24 7051 –a—— C:\WINDOWS\SYSTEM32\dlh9jkdq7.exe 2006-07-13 21:24 6630 –a—— C:\WINDOWS\SYSTEM32\dlh9jkdq5.exe 2006-07-13 21:24 6539 –a—— C:\WINDOWS\SYSTEM32\dlh9jkdq6.exe 2006-07-13 21:24 5744 –a—— C:\WINDOWS\SYSTEM32\testtestt.exe 2006-07-13 21:24 2518 –a—— C:\WINDOWS\SYSTEM32\dlh9jkdq1.exe 2006-07-13 21:24 21504 –a—— C:\WINDOWS\SYSTEM32\14295a63.exe 2006-07-13 21:24 17894 –a—— C:\WINDOWS\SYSTEM32\dlh9jkdq2.exe 2006-07-13 21:24 15 –a—— C:\WINDOWS\SYSTEM32\dlh9jkdq8.exe 2006-07-13 21:24 ——– d——– C:\Program Files\BraveSentry 2006-07-13 19:01 32768 –a—— C:\WINDOWS\dzzoxdxh.exe 2006-07-13 18:55 45056 –a—— C:\WINDOWS\cfg32s.dll 2006-07-13 18:55 397312 –a—— C:\WINDOWS\cfg32p.dll 2006-07-13 18:55 110592 –a—— C:\WINDOWS\cfg32o.dll 2006-07-13 18:54 578560 –a—— C:\Installer.exe 2006-07-13 18:54 102400 –a—— C:\WINDOWS\cfg32r.dll 2006-07-13 18:52 110592 –a—— C:\WINDOWS\v1201.exe 2006-07-13 18:51 36864 –a—— C:\WINDOWS\SYSTEM32\tdophzoi.exe 2006-07-13 18:51 30208 –a—— C:\SS1001new.exe 2006-07-09 18:33 ——– d——– C:\Program Files\Cowabanga 2006-07-09 14:54 143360 –a—— C:\WINDOWS\win320748060491.exe 2006-07-08 16:16 32768 –a—— C:\WINDOWS\qxunjaza.exe 2006-07-08 13:21 32768 –a—— C:\WINDOWS\xromraku.exe 2006-07-08 13:18 380928 –a—— C:\WINDOWS\SYSTEM32\WinNB58.dll 2006-07-08 13:18 ——– d——– C:\Program Files\PartyPoker 2006-07-08 13:15 290816 –a—— C:\installerwnusnew.exe 2006-07-05 07:06 27648 –a—— C:\23100247.exe 2006-07-05 07:06 16167 –a—— C:\WINDOWS\SYSTEM32\ordermas2.dll 2006-07-04 18:53 24296 –a—— C:\WINDOWS\icont.exe 2006-07-04 09:58 81920 –a—— C:\WINDOWS\SYSTEM32\ati2evxx.dll 2006-07-04 09:57 61440 –a—— C:\WINDOWS\SYSTEM32\aaa00000.dll 2006-07-04 09:57 1063 –a—— C:\WINDOWS\SYSTEM32\aaa00000.sys 2006-07-04 09:56 405504 –a—— C:\WINDOWS\SYSTEM32\irsmsleu.dll 2006-07-04 09:56 29696 –a—— C:\WINDOWS\SYSTEM32\w4532dfd.dll 2006-07-04 09:56 2560 –a—— C:\ac3_0003.exe 2006-07-04 09:56 20480 –a—— C:\stub_sca3.exe 2006-07-03 01:50 143360 –a—— C:\WINDOWS\win3207480604912006.exe 2006-07-03 01:11 ——– d——– C:\Program Files\Radio@Netscape 2006-07-03 00:38 405504 –a—— C:\WINDOWS\SYSTEM32\irsmjbhn.dll 2006-07-03 00:38 32976 –a—— C:\WINDOWS\SYSTEM32\uninstIcn.exe 2006-07-03 00:38 24576 –a—— C:\WINDOWS\SYSTEM32\msxml3a.dll 2006-07-03 00:38 114688 –a—— C:\WINDOWS\SYSTEM32\irssyncd.exe 2006-07-03 00:34 359616 –a—— C:\WINDOWS\justin_bundle.exe 2006-07-02 21:03 ——– d——– C:\Program Files\TikGames 2006-07-02 07:38 0 –ah—– C:\Program Files\Internet Optimizer 2006-07-02 07:38 0 –ah—– C:\Program Files\Common Files\qiwq 2006-07-02 07:37 183296 –a-s—- C:\WINDOWS\NDNuninstall7_22.exe 2006-07-02 07:36 51712 –a—— C:\WINDOWS\SYSTEM32\w3d5ead9.dll 2006-07-02 07:35 48167 –a—— C:\WINDOWS\SYSTEM32\VSL05.exe 2006-07-02 07:35 20480 –a—— C:\stub_sca3new.exe 2006-07-02 07:35 111104 –a—— C:\numbsoftnew.exe 2006-07-02 07:34 389632 –a—— C:\webnexmknew.exe 2006-07-02 07:34 29696 –a—— C:\WINDOWS\SYSTEM32\w3d42164.dll 2006-07-02 07:33 8464 –a—— C:\WINDOWS\SYSTEM32\sporder.dll 2006-07-02 07:33 587776 –a—— C:\626_101new.exe 2006-07-02 07:33 45056 –a—— C:\WINDOWS\System32tfthot.exe 2006-07-02 07:33 28672 –a—— C:\WINDOWS\System32ftuninst.exe 2006-07-02 07:32 50688 –a-s—- C:\WINDOWS\NDNuninstall6_38.exe 2006-07-02 07:31 45056 –a—— C:\wd7gi8nnew.exe 2006-07-02 07:31 266240 –a—— C:\NNSCAA638.EXE 2006-07-02 07:31 25105 –a—— C:\WINDOWS\idlemg.exe 2006-07-02 07:31 232749 –a—— C:\WINDOWS\pf78.exe 2006-07-02 07:30 23552 –a—— C:\WINDOWS\SYSTEM32\winkvwk.exe 2006-07-02 07:30 234248 –a—— C:\WINDOWS\Tagasuarus2.exe 2006-07-02 07:26 14617 –a—— C:\WINDOWS\xload.exe 2006-06-29 05:24 83456 –a—— C:\WINDOWS\SYSTEM32\nsx255.dll 2006-06-29 05:24 83456 –a—— C:\WINDOWS\SYSTEM32\nsh254.dll 2006-06-24 02:37 ——– d——– C:\Program Files\Trymedia 2006-06-21 19:44 235228 –a—— C:\WINDOWS\SYSTEM32\icon_justin.exe 2006-06-21 19:44 115245 –a—— C:\WINDOWS\SYSTEM32\ts_justin.exe 2006-06-20 20:55 389120 –a—— C:\WINDOWS\SYSTEM32\nodeipproc.dll 2006-06-19 16:39 139264 –a—— C:\WINDOWS\876056.exe 2006-06-19 14:38 53248 –a—— C:\WINDOWS\uni_ehhhh.exe 2006-06-19 14:38 49152 –a—— C:\WINDOWS\uninst104.exe 2006-05-30 19:09 24576 –a—— C:\WINDOWS\Uninstall.exe 2006-05-17 02:20 17 –a—— C:\Program Files\d.bat (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe" "HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe" "SunJavaUpdateSched"="C:\\Program Files\\Java\\j2re1.4.2_03\\bin\\jusched.exe" "PRISMSVR.EXE"="\"C:\\WINDOWS\\System32\\PRISMSVR.EXE\" /APPLY" "DVDLauncher"="\"C:\\Program Files\\CyberLink\\PowerDVD\\DVDLauncher.exe\"" "UpdateManager"="\"C:\\Program Files\\Common Files\\Sonic\\Update Manager\\sgtray.exe\" /r" "PCMService"="\"C:\\Program Files\\Dell\\Media Experience\\PCMService.exe\"" "URLLSTCK.exe"="C:\\Program Files\\Norton Internet Security\\UrlLstCk.exe" "MMTray"="C:\\Program Files\\MUSICMATCH\\Musicmatch Jukebox\\mm_tray.exe" "Dell AIO Printer A920"="\"C:\\Program Files\\Dell AIO Printer A920\\dlbkbmgr.exe\"" "ViewMgr"="C:\\Program Files\\Viewpoint\\Viewpoint Manager\\ViewMgr.exe" "Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe" "SSC_UserPrompt"="C:\\Program Files\\Common Files\\Symantec Shared\\Security Center\\UsrPrmpt.exe" "mmtask"="C:\\Program Files\\MUSICMATCH\\Musicmatch Jukebox\\mmtask.exe" "HP Software Update"="\"C:\\Program Files\\HP\\HP Software Update\\HPWuSchd.exe\"" "HP Component Manager"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\"" "DIGStream"="C:\\Program Files\\DIGStream\\digstream.exe" "DIGServices"="C:\\Program Files\\ESPNRunTime\\DIGServices.exe /brand=ESPN /priority=0 /poll=24" "Uksxhqo"="C:\\Program Files\\Fzbog\\Evoystt.exe" "BearShare"="\"C:\\Program Files\\BearShare\\BearShare.exe\" /pause" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "gcasServ"="\"C:\\Program Files\\Microsoft AntiSpyware\\gcasServ.exe\"" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "xload"="\"C:\\WINDOWS\\xload.exe\"" "wve942e1"="RUNDLL32.EXE w3d42164.dll,n 001942e0000000033d42164" "w3d5ead9.dll"="RUNDLL32.EXE w3d5ead9.dll,I2 001942e003d5ead9" "orderShell"="C:\\Documents and Settings\\John\\ordergvbk.exe" "win320748060491"="C:\\WINDOWS\\win320748060491.exe" "ACTX1"="C:\\WINDOWS\\v1201.exe" "14295a63.exe"="C:\\WINDOWS\\System32\\14295a63.exe" "ÿ_zskJBKFM[DAK"="C:\\WINDOWS\\System32\\_zskwrkni05EQ^EP[\\KAD[MFKBJ.exe" "Explorer 2238"="C:\\DOCUME~1\\Dan\\LOCALS~1\\Temp\\27431\\explorer.exe" "ad8rIU3s"="C:\\WINDOWS\\System32\\cvn0.exe" "k6mmN5IOU"="\"C:\\WINDOWS\\System32\\wfxqhv.exe\"" "ecjnnyoA"="C:\\WINDOWS\\ecjnnyoA.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "ctfmon.exe"="C:\\WINDOWS\\System32\\ctfmon.exe" "AIM"="C:\\progra~1\\aim\\aim.exe -cnetwait.odl" "DellSupport"="\"C:\\Program Files\\Dell Support\\DSAgnt.exe\" /startup" "14295a63.exe"="C:\\Documents and Settings\\Dad\\Local Settings\\Application Data\\14295a63.exe" "PSLister"="\"C:\\Program Files\\PSLister\\PSLister.exe\"" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices] "ÿ_zskJBKFM[DAK"="C:\\WINDOWS\\System32\\_zskwrkni05EQ^EP[\\KAD[MFKBJ.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="C:\\Program Files\\MSN\\xumyju.html" "SubscribedURL"="" "FriendlyName"="" "Flags"=dword:00002000 "Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,e8,\ 03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00 "CurrentState"=hex:01,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\ 00,00,01,00,00,00 "RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\1] "Source"="C:\\Program Files\\Windows Media Player\\vikogite.html" "SubscribedURL"="" "FriendlyName"="" "Flags"=dword:00002000 "Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,ea,\ 03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00 "CurrentState"=hex:01,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\ 00,00,01,00,00,00 "RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\2] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,f2,01,00,00,23,00,00,00,7c,00,00,00,72,00,\ 00,00,01,00,00,00 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" "{2C1CD3D7-86AC-4068-93BC-A02304BB2238}"="DCOM Server 2238" "{3F143C3A-1457-6CCA-03A7-7AA23B61E40F}"="OLE Automation Module" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{9EF34FF2-3396-4527-9D27-04C8C1C67806}"="Microsoft AntiSpyware Service Hook" Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer.job C:\WINDOWS\tasks\Symantec NetDetect.job Completion time: Mon 08/21/2006 20:33:23.06 ComboFix.txt ComboFix2.txt

Please print out or copy these instructions/tutorial to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below. If there's anything that you don't understand, ask your question(s) before moving on with the fixes.

Please download Ewido to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/

• Install Ewido by double clicking the installer.
• Follow the prompts. Make sure that Launch Ewido is checked.
• On the main screen under Your Computer's security.
• Click on Change state next to Resident shield. It should now change to inactive.
• Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
• Wait until you see the Update succesfull message.
  Note: If the Update now option is grayed out, follow the steps below.
• Click on Update on the toolbar.
• Under Manual update, click on the Start Update button.
• Wait until you see the Update succesfull message.

[*]Right-click the Ewido Tray Icon and select Exit. Confirm by clicking Yes.

If you are having problems with the updater, you can use this link to manually update ewido.
Ewido manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that Ewido is closed before installing the update.

Please download Brute Force Uninstaller to your desktop.

• Right click the BFU folder on your desktop, and choose Extract All
• Click "Next"
• In the box to choose where to extract the files to,
• Click "Browse"
• Click on the + sign next to "My Computer"
• Click on "Local Disk (C:) or whatever your primary drive is
• Click "Make New Folder"
• Type in BFU
• Click "Next", and Uncheck the "Show Extracted Files" box and then click "Finish".

RIGHT-CLICK HERE and choose "Save As" (in IE it's "Save Target As") in order to download Alcra PLUS Remover.
Save it in the same folder you made earlier (c:\BFU).

Do not do anything with these yet!

***************************************

Go to Start > Control Panel > Add or Remove Programs and uninstall the following programs (if they exist):
**Take care when answering any questions posed by an uninstaller. Some questions may be worded to deceive you into keeping the program**

BraveSentry
Forethought
Java 2 Runtime Environment, SE v1.4.2_03
Quicklinks
UCmore - The Search Accelerator
Viewpoint Manager (Remove Only)
Viewpoint Media Player
Windows Overlay Components

The following are optional; however, any time your are running any type of P2P application, you are FAR more prone to infection by malware. Your current infections are likely due to P2P use. At the VERY LEAST, please refrain from using any p2p programs while we are cleaning your computer.

BitTorrent 4.4.1

(A list compiled by Nexus7 of clean and infected P2P programs can be found here

These poker programs are sometimes installed without consent. If you did not install these programs intentionally, please also remove:

Full Tilt Poker
Pacific Poker
Paradise Poker
PartyPoker
PartyPoker.net
PokerStars

Please note any other programs that you dont recognize in that list in your next response

***************************************

Next, please reboot your computer in SafeMode by doing the following:

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
• Instead of Windows loading as normal, a menu should appear
• Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.com/support/safemode.shtml

***************************************

Navigate to C:\Windows\Temp
Click Edit, click Select All, press the DELETE key, and then click Yes to confirm that you want to send all the items to the Recycle Bin.

Navigate to C:\Documents and Settings\(EVERY LISTED USER)\Local Settings\Temp
Click Edit, click Select All, press the DELETE key, and then click Yes to confirm that you want to send all the items to the Recycle Bin.

Clean out your Temporary Internet files. Proceed like this:

• Quit Internet Explorer and quit any instances of Windows Explorer.
• Click Start, click Control Panel, and then double-click Internet Options.
• On the General tab, click Delete Files under Temporary Internet Files.
• In the Delete Files dialog box, tick the Delete all offline content check box , and then click OK.
• On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
• Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
• Click OK.

Next Click Start, click Control Panel and then double-click Display. Click on the Desktop tab, then click the Customize Desktop button. Click on the Web tab. Under Web Pages you should see a checked entry called Security info or something similar. If it is there, select that entry and click the Delete button. Click Ok then Apply and Ok.

Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.
______________________________

Please go to Start > My Computer and navigate to the C:\BFU folder.

• Start the Brute Force Uninstaller by doubleclicking BFU.exe
• Behind the scriptline to execute field click the folder icon [external image: Posted Image] and select alcanshorty.bfu
• Press Execute and let the program do it’s job. (You ought to see a progress bar if you did this correctly.)
• Wait for the complete script execution box to pop up and press OK.
• Press exit to terminate the BFU program.

Then, Close ALL open Windows / Programs / Folders. Please start Ewido and run a full scan.

• Click on Scanner on the toolbar.
• Click on the Settings tab.
  • Under How to act?
    • Click on Recommended Action and choose Quarantine from the popup menu.
  • Under How to scan?
    • All checkboxes should be ticked.
  • Under Possibly unwanted software:
    • All checkboxes should be ticked.
  • Under Reports:
    • Select Automatically generate report after every scan and uncheck Only if threats were found.
  • Under What to scan?
    • Select Scan every file.
• Click on the Scan tab.
• Click on Complete System Scan to start the scan process.
• Let the program scan the machine.
• When the scan has finished, follow the instructions below.
  IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
  • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
  • At the bottom of the window click on the Apply all Actions button. (3)
    [external image: Posted Image]
• When done, click the Save Scan Report button.
  • Click the Save Report as button.
  • Save the report to your Desktop.
• Right-click the Ewido Tray Icon and select Exit. Confirm by clicking Yes.

***************************************

reboot your system back into Normal Mode

Please go HERE to run Panda's ActiveScan

• Once you are on the Panda site click the Scan your PC button
• A new window will open…click the Check Now button
• Enter your Country
• Enter your State/Province
• Enter your e-mail address and click send
• Select either Home User or Company
• Click the big Scan Now button
• If it wants to install an ActiveX component allow it
• It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
• When download is complete, click on My Computer to start the scan
• When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report

then run combofix again and post the generated log.

Download and install the newest version of Java (Java Runtime Environment (JRE) 5.0 Update 8) from here.

in your next post, please include

• ewido log
• panda log
• combofix log
• new hijackthis log

Your may need several replies to post the requested logs, otherwise they might get cut off.

First off, here is the Panda Active SCan Log Incident Status Location Adware:Adware/SystemDoctor Not disinfected c:\windows\system32\14295a63.exe Adware:adware/adsmart Not disinfected c:\windows\system32\dlh9jkdq8.exe Spyware:spyware/surfsidekick Not disinfected C:\Documents and Settings\Dad\Local Settings\Temporary Internet Files\Ssk.log Adware:adware/mediatickets Not disinfected Windows Registry Adware:adware/bookedspace Not disinfected Windows Registry Adware:adware/ucmore Not disinfected Windows Registry Adware:adware/powerstrip Not disinfected Windows Registry Adware:adware/savenow Not disinfected Windows Registry Adware:adware/adrotator Not disinfected Windows Registry Adware:adware/cws.aboutblank Not disinfected Windows Registry Adware:adware/secure32 Not disinfected C:\WINDOWS\System32\drivers\etc\hosts Adware:adware/stiebar Not disinfected Windows Registry Adware:adware/navhelper Not disinfected Windows Registry Adware:adware/ist.istbar Not disinfected Windows Registry Adware:adware/xplugin Not disinfected Windows Registry Adware:adware/dyfuca Not disinfected Windows Registry Adware:adware/gator Not disinfected Windows Registry Spyware:Cookie/FortuneCity Not disinfected C:\Documents and Settings\Dad\Application Data\Mozilla\Firefox\Profiles\f56xd6vs.default\cookies.txt[.fortunecity.com/] Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Dad\Application Data\Mozilla\Firefox\Profiles\f56xd6vs.default\cookies.txt[.realmedia.com/] Spyware:Cookie/Seeq Not disinfected C:\Documents and Settings\Dad\Application Data\Mozilla\Firefox\Profiles\f56xd6vs.default\cookies.txt[www48.seeq.com/] Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Dad\Application Data\Mozilla\Firefox\Profiles\f56xd6vs.default\cookies.txt[searchportal.information.com/] Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Dad\Application Data\Mozilla\Firefox\Profiles\f56xd6vs.default\cookies.txt[.drivecleaner.com/] Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Dad\Application Data\Mozilla\Firefox\Profiles\f56xd6vs.default\cookies.txt[.go.com/] Spyware:Cookie/Maxserving Not disinfected C:\Documents and Settings\Dad\Application Data\Mozilla\Firefox\Profiles\f56xd6vs.default\cookies.txt[.maxserving.com/] Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Dad\Application Data\Mozilla\Firefox\Profiles\f56xd6vs.default\cookies.txt[.ath.belnk.com/] Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Dad\Application Data\Mozilla\Firefox\Profiles\f56xd6vs.default\cookies.txt[.belnk.com/] Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Dad\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-3ed9b923-2701b7da.zip[BlackBox.class] Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Dad\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-3ed9b923-2701b7da.zip[VerifierBug.class] Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Dad\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-3ed9b923-2701b7da.zip[Dummy.class] Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Dad\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-3ed9b923-2701b7da.zip[Beyond.class] Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Dad\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-7a36a6bf-70f54da5.zip[BlackBox.class] Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Dad\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-7a36a6bf-70f54da5.zip[VerifierBug.class] Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Dad\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-7a36a6bf-70f54da5.zip[Dummy.class] Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Dad\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-7a36a6bf-70f54da5.zip[Beyond.class] Adware:Adware/SystemDoctor Not disinfected C:\Documents and Settings\Dad\Local Settings\Application Data\14295a63.exe Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Dan\Cookies\dan@atwola[1].txt Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Dan\Cookies\dan@belnk[1].txt Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Dan\Cookies\[removed][2].txt Spyware:Cookie/Entrepreneur Not disinfected C:\Documents and Settings\Dan\Cookies\dan@entrepreneur[2].txt Spyware:Cookie/ErrorSafe Not disinfected C:\Documents and Settings\Dan\Cookies\dan@errorsafe[1].txt Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Dan\Cookies\dan@go[2].txt Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Dan\Cookies\dan@go[3].txt Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Dan\Cookies\dan@go[5].txt Spyware:Cookie/Media-motor Not disinfected C:\Documents and Settings\Dan\Cookies\[removed]-motor[2].txt Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Dan\Cookies\dan@realmedia[1].txt Adware:Adware/SystemDoctor Not disinfected C:\Documents and Settings\Dan\Local Settings\Application Data\14295a63.exe Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Dan\Local Settings\Temp\Cookies\dan@atwola[1].txt Adware:Adware/PurityScan Not disinfected C:\Documents and Settings\Dan\Local Settings\Temp\recife.exe

Dad - 06-08-22 12:46:36.64 ComboFix 06.08.18 - Running from: C:\Documents and Settings\[removed]\Desktop (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\QooBox\Purity\WINDOWS\FNTS~1 C:\QooBox\Purity\WINDOWS\FNTS~1\FNTS~1 ((((((((((((((((((((((((((((((( Files Created from 2006-07-21 to 2006-08-21 )))))))))))))))))))))))))))))))))) 2006-08-21 17:51 214,752 C:\Setup100.exe 2006-08-21 17:50 48,190 C:\WINDOWS\RDFX4.exe 2006-08-17 12:17 186,223 C:\WINDOWS\srvowpxjfn.exe (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-08-22 12:43 ——– d——– C:\Program Files\Microsoft AntiSpyware 2006-08-22 12:38 ——– d——– C:\Program Files\ewido anti-spyware 4.0 2006-08-22 12:35 ——– d——– C:\Program Files\Common Files 2006-08-21 22:50 ——– d——– C:\Program Files\Java 2006-08-21 22:48 ——– d——– C:\Program Files\Common Files\Java 2006-08-21 22:40 ——– d——– C:\Program Files\Windows Media Player 2006-08-21 22:40 ——– d——– C:\Program Files\QuickTime 2006-08-21 22:40 ——– d——– C:\Program Files\Norton Internet Security 2006-08-21 22:40 ——– d——– C:\Program Files\Mozilla Firefox 2006-08-21 22:40 ——– d——– C:\Program Files\iTunes 2006-08-21 22:40 ——– d——– C:\Program Files\Internet Explorer 2006-08-21 22:40 ——– d——– C:\Program Files\ESPNRunTime 2006-08-21 22:40 ——– d——– C:\Program Files\Digital Line Detect 2006-08-21 22:40 ——– d——– C:\Program Files\Dell Support 2006-08-21 22:40 ——– d——– C:\Program Files\Dell AIO Printer A920 2006-08-21 22:40 ——– d——– C:\Program Files\Common Files\Symantec Shared 2006-08-21 22:40 ——– d——– C:\Program Files\America Online 9.0 2006-08-21 22:40 ——– d——– C:\Program Files\AIM 2006-08-21 22:28 ——– d——– C:\Program Files\PSLister 2006-08-21 22:28 ——– d——– C:\Program Files\Messenger 2006-08-21 22:28 ——– d——– C:\Program Files\Fzbog 2006-08-21 21:14 ——– d——– C:\Program Files\PartyPoker.net 2006-08-21 21:14 ——– d——– C:\Program Files\PartyPoker 2006-08-21 21:12 ——– d——– C:\Program Files\PacificPoker 2006-08-21 21:10 ——– d——– C:\Program Files\Viewpoint 2006-08-21 20:34 1167 –a—— C:\WINDOWS\SYSTEM32\wve942e1.sys 2006-08-21 17:53 ——– d——– C:\Program Files\MSN 2006-08-21 17:51 214752 –a—— C:\Setup100.exe 2006-08-21 17:50 48190 –a—— C:\WINDOWS\RDFX4.exe 2006-08-17 12:17 186223 –a—— C:\WINDOWS\srvowpxjfn.exe 2006-08-05 22:23 ——– d——– C:\Program Files\Common Files\32vegas 2006-08-05 21:11 61952 –a—— C:\WINDOWS\SYSTEM32\wve942e1.dll 2006-08-05 21:05 2 –a—— C:\WINDOWS\SYSTEM32\wnstscc.exe 2006-08-05 20:42 ——– d——– C:\Program Files\PokerStars 2006-07-14 02:15 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwyxsn.exe 2006-07-14 02:05 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwdahx.exe 2006-07-14 01:54 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwjxxn.exe 2006-07-14 01:44 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwfeev.exe 2006-07-14 01:34 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwnkiu.exe 2006-07-14 01:23 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwkzji.exe 2006-07-14 01:13 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwgxep.exe 2006-07-14 01:03 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwzssu.exe 2006-07-14 00:53 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwywtx.exe 2006-07-14 00:42 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwaequ.exe 2006-07-14 00:32 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwuuds.exe 2006-07-14 00:22 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwpdnx.exe 2006-07-14 00:12 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwdyho.exe 2006-07-14 00:02 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwzmak.exe 2006-07-13 23:51 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwzwxy.exe 2006-07-13 23:41 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwlggm.exe 2006-07-13 23:31 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwjyjl.exe 2006-07-13 23:21 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwmzyo.exe 2006-07-13 23:10 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwites.exe 2006-07-13 23:00 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwziqc.exe 2006-07-13 22:50 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwjfme.exe 2006-07-13 22:39 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwmaxh.exe 2006-07-13 22:29 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwmgmw.exe 2006-07-13 22:19 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwntct.exe 2006-07-13 22:09 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwwrip.exe 2006-07-13 21:59 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwqkbp.exe 2006-07-13 21:48 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwbdaf.exe 2006-07-13 21:38 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwxyfa.exe 2006-07-13 21:28 49880 –a—— C:\WINDOWS\SYSTEM32\ipv6mons.dll 2006-07-13 21:27 46592 –a—— C:\WINDOWS\SYSTEM32\zlbw.dll 2006-07-13 21:26 80896 –a—— C:\WINDOWS\SYSTEM32\dxvwoygu.exe 2006-07-13 21:24 21504 –a—— C:\WINDOWS\SYSTEM32\14295a63.exe 2006-07-13 21:24 15 –a—— C:\WINDOWS\SYSTEM32\dlh9jkdq8.exe 2006-07-13 18:51 36864 –a—— C:\WINDOWS\SYSTEM32\tdophzoi.exe 2006-07-09 18:33 ——– d——– C:\Program Files\Cowabanga 2006-07-04 09:57 1063 –a—— C:\WINDOWS\SYSTEM32\aaa00000.sys 2006-07-04 09:56 405504 –a—— C:\WINDOWS\SYSTEM32\irsmsleu.dll 2006-07-03 01:11 ——– d——– C:\Program Files\Radio@Netscape 2006-07-03 00:38 405504 –a—— C:\WINDOWS\SYSTEM32\irsmjbhn.dll 2006-07-03 00:38 32976 –a—— C:\WINDOWS\SYSTEM32\uninstIcn.exe 2006-07-03 00:38 24576 –a—— C:\WINDOWS\SYSTEM32\msxml3a.dll 2006-07-03 00:38 114688 –a—— C:\WINDOWS\SYSTEM32\irssyncd.exe 2006-07-03 00:34 359616 –a—— C:\WINDOWS\justin_bundle.exe 2006-07-02 21:03 ——– d——– C:\Program Files\TikGames 2006-07-02 07:38 0 –ah—– C:\Program Files\Common Files\qiwq 2006-07-02 07:35 48167 –a—— C:\WINDOWS\SYSTEM32\VSL05.exe 2006-07-02 07:33 8464 –a—— C:\WINDOWS\SYSTEM32\sporder.dll 2006-07-02 07:31 232749 –a—— C:\WINDOWS\pf78.exe 2006-07-02 07:30 234248 –a—— C:\WINDOWS\Tagasuarus2.exe 2006-06-24 02:37 ——– d——– C:\Program Files\Trymedia 2006-06-21 19:44 235228 –a—— C:\WINDOWS\SYSTEM32\icon_justin.exe 2006-06-21 19:44 115245 –a—— C:\WINDOWS\SYSTEM32\ts_justin.exe 2006-05-30 19:09 24576 –a—— C:\WINDOWS\Uninstall.exe 2006-05-17 02:20 17 –a—— C:\Program Files\d.bat (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe" "HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe" "PRISMSVR.EXE"="\"C:\\WINDOWS\\System32\\PRISMSVR.EXE\" /APPLY" "DVDLauncher"="\"C:\\Program Files\\CyberLink\\PowerDVD\\DVDLauncher.exe\"" "UpdateManager"="\"C:\\Program Files\\Common Files\\Sonic\\Update Manager\\sgtray.exe\" /r" "PCMService"="\"C:\\Program Files\\Dell\\Media Experience\\PCMService.exe\"" "URLLSTCK.exe"="C:\\Program Files\\Norton Internet Security\\UrlLstCk.exe" "MMTray"="C:\\Program Files\\MUSICMATCH\\Musicmatch Jukebox\\mm_tray.exe" "Dell AIO Printer A920"="\"C:\\Program Files\\Dell AIO Printer A920\\dlbkbmgr.exe\"" "Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe" "SSC_UserPrompt"="C:\\Program Files\\Common Files\\Symantec Shared\\Security Center\\UsrPrmpt.exe" "mmtask"="C:\\Program Files\\MUSICMATCH\\Musicmatch Jukebox\\mmtask.exe" "HP Software Update"="\"C:\\Program Files\\HP\\HP Software Update\\HPWuSchd.exe\"" "HP Component Manager"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\"" "DIGStream"="C:\\Program Files\\DIGStream\\digstream.exe" "DIGServices"="C:\\Program Files\\ESPNRunTime\\DIGServices.exe /brand=ESPN /priority=0 /poll=24" "Uksxhqo"="C:\\Program Files\\Fzbog\\Evoystt.exe" "BearShare"="\"C:\\Program Files\\BearShare\\BearShare.exe\" /pause" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "gcasServ"="\"C:\\Program Files\\Microsoft AntiSpyware\\gcasServ.exe\"" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "wve942e1"="RUNDLL32.EXE w3d42164.dll,n 001942e0000000033d42164" "w3d5ead9.dll"="RUNDLL32.EXE w3d5ead9.dll,I2 001942e003d5ead9" "orderShell"="C:\\Documents and Settings\\John\\ordergvbk.exe" "14295a63.exe"="C:\\WINDOWS\\System32\\14295a63.exe" "ÿ_zskJBKFM[DAK"="C:\\WINDOWS\\System32\\_zskwrkni05EQ^EP[\\KAD[MFKBJ.exe" "!ewido"="\"C:\\Program Files\\ewido anti-spyware 4.0\\ewido.exe\" /minimized" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_08\\bin\\jusched.exe\"" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "ctfmon.exe"="C:\\WINDOWS\\System32\\ctfmon.exe" "AIM"="C:\\progra~1\\aim\\aim.exe -cnetwait.odl" "DellSupport"="\"C:\\Program Files\\Dell Support\\DSAgnt.exe\" /startup" "14295a63.exe"="C:\\Documents and Settings\\Dad\\Local Settings\\Application Data\\14295a63.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices] "ÿ_zskJBKFM[DAK"="C:\\WINDOWS\\System32\\_zskwrkni05EQ^EP[\\KAD[MFKBJ.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000000 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="C:\\Program Files\\MSN\\xumyju.html" "SubscribedURL"="" "FriendlyName"="" "Flags"=dword:00002000 "Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,e8,\ 03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00 "CurrentState"=hex:01,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\ 00,00,01,00,00,00 "RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\1] "Source"="C:\\Program Files\\Windows Media Player\\vikogite.html" "SubscribedURL"="" "FriendlyName"="" "Flags"=dword:00002000 "Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,ea,\ 03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00 "CurrentState"=hex:01,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\ 00,00,01,00,00,00 "RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\2] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,38,01,00,00,00,00,00,00,c8,02,00,00,e2,02,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,f2,01,00,00,23,00,00,00,7c,00,00,00,72,00,\ 00,00,01,00,00,00 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" "{2C1CD3D7-86AC-4068-93BC-A02304BB2238}"="DCOM Server 2238" "{3F143C3A-1457-6CCA-03A7-7AA23B61E40F}"="OLE Automation Module" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{9EF34FF2-3396-4527-9D27-04C8C1C67806}"="Microsoft AntiSpyware Service Hook" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0" Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer.job C:\WINDOWS\tasks\Symantec NetDetect.job Completion time: Tue 08/22/2006 12:48:23.96 ComboFix.txt ComboFix2.txt ComboFix3.txt

I did everything that was listed in your last post but I cant seem to find any report file for Ewido. THe only thing I ahve been able to find is the quarantine list so far, it does not list any reports saved under the reports tab, should I just post the quarantine log or run the program again?

quarantine log will be fine