Owner - 06-08-29 20:18:35.84
ComboFix 06.08.27BT - Running from: C:\Documents and Settings\[removed]\Desktop
((((((((((((((((((((((((((((((((((((((((((((( Look2Me's Log ))))))))))))))))))))))))))))))))))))))))))))))))))
REGISTRY ENTRIES REMOVED:
[HKEY_CLASSES_ROOT\CLSID\{6694932C-C5A2-43E6-84B8-329935084192}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{6694932C-C5A2-43E6-84B8-329935084192}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{6694932C-C5A2-43E6-84B8-329935084192}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{6694932C-C5A2-43E6-84B8-329935084192}\InprocServer32]
@="C:\\WINNT\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
[HKEY_CLASSES_ROOT\CLSID\{9FFCB1A6-5633-4F23-8B73-907DFBBD7940}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9FFCB1A6-5633-4F23-8B73-907DFBBD7940}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9FFCB1A6-5633-4F23-8B73-907DFBBD7940}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9FFCB1A6-5633-4F23-8B73-907DFBBD7940}\InprocServer32]
@="C:\\WINNT\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
[HKEY_CLASSES_ROOT\CLSID\{8198074C-81AA-4209-BF67-6179E9F40D5B}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{8198074C-81AA-4209-BF67-6179E9F40D5B}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{8198074C-81AA-4209-BF67-6179E9F40D5B}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{8198074C-81AA-4209-BF67-6179E9F40D5B}\InprocServer32]
@="C:\\WINNT\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
[HKEY_CLASSES_ROOT\CLSID\{BCFCF015-7F1A-463F-A281-FB594BCB753D}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{BCFCF015-7F1A-463F-A281-FB594BCB753D}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{BCFCF015-7F1A-463F-A281-FB594BCB753D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{BCFCF015-7F1A-463F-A281-FB594BCB753D}\InprocServer32]
@="C:\\WINNT\\system32\\dqskmon.dll"
"ThreadingModel"="Apartment"
[HKEY_CLASSES_ROOT\CLSID\{A8AE415B-047F-4DD4-8D30-CE1EF802AC01}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{A8AE415B-047F-4DD4-8D30-CE1EF802AC01}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{A8AE415B-047F-4DD4-8D30-CE1EF802AC01}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{A8AE415B-047F-4DD4-8D30-CE1EF802AC01}\InprocServer32]
@="C:\\WINNT\\system32\\SNWIUDLL.DLL"
"ThreadingModel"="Apartment"
[HKEY_CLASSES_ROOT\CLSID\{16D54B8A-0552-44CB-8274-D00C3EB9AE54}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{16D54B8A-0552-44CB-8274-D00C3EB9AE54}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{16D54B8A-0552-44CB-8274-D00C3EB9AE54}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{16D54B8A-0552-44CB-8274-D00C3EB9AE54}\InprocServer32]
@="C:\\WINNT\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
[HKEY_CLASSES_ROOT\CLSID\{27259447-AF22-4C05-8A74-E55BFE4AB51E}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{27259447-AF22-4C05-8A74-E55BFE4AB51E}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{27259447-AF22-4C05-8A74-E55BFE4AB51E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{27259447-AF22-4C05-8A74-E55BFE4AB51E}\InprocServer32]
@="C:\\WINNT\\system32\\nmtevent.dll"
"ThreadingModel"="Apartment"
[HKEY_CLASSES_ROOT\CLSID\{9EECD427-A742-480F-ADF3-A3C95EB8F3B4}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9EECD427-A742-480F-ADF3-A3C95EB8F3B4}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9EECD427-A742-480F-ADF3-A3C95EB8F3B4}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9EECD427-A742-480F-ADF3-A3C95EB8F3B4}\InprocServer32]
@="C:\\WINNT\\system32\\biowsewm.dll"
"ThreadingModel"="Apartment"
[HKEY_CLASSES_ROOT\CLSID\{E0D5300E-2B3A-4F2A-B17C-86DBCCEE8477}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E0D5300E-2B3A-4F2A-B17C-86DBCCEE8477}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E0D5300E-2B3A-4F2A-B17C-86DBCCEE8477}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E0D5300E-2B3A-4F2A-B17C-86DBCCEE8477}\InprocServer32]
@="C:\\WINNT\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
[HKEY_CLASSES_ROOT\CLSID\{772C8D39-1ECE-4948-841B-07D9C01ACF3B}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{772C8D39-1ECE-4948-841B-07D9C01ACF3B}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{772C8D39-1ECE-4948-841B-07D9C01ACF3B}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{772C8D39-1ECE-4948-841B-07D9C01ACF3B}\InprocServer32]
@="C:\\WINNT\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
FILES REMOVED:
C:\WINNT\system32\ahptif.dll
C:\WINNT\system32\apsnt.dll
C:\WINNT\system32\aumparse.dll
C:\WINNT\system32\avmparse.dll
C:\WINNT\system32\bdowsewm.dll
C:\WINNT\system32\biowsewm.dll
C:\WINNT\system32\cbmuid.dll
C:\WINNT\system32\cpmpstui.dll
C:\WINNT\system32\ctbjmon.dll
C:\WINNT\system32\cumuid.dll
C:\WINNT\system32\cuypt32.dll
C:\WINNT\system32\dhmasf.dll
C:\WINNT\system32\dnrgui.dll
C:\WINNT\system32\dxspex.dll
C:\WINNT\system32\dz32gt.dll
C:\WINNT\system32\efent97.dll
C:\WINNT\system32\enj6l11s1.dll
C:\WINNT\system32\ESBTEG.DLL
C:\WINNT\system32\fn4021hmg.dll
C:\WINNT\system32\fpnm0351e.dll
C:\WINNT\system32\g4220efoeh2c0.dll
C:\WINNT\system32\h0l2la3o1d.dll
C:\WINNT\system32\hyfcisp2.dll
C:\WINNT\system32\i242lcho1f4c.dll
C:\WINNT\system32\idnathlp.dll
C:\WINNT\system32\iFlmdev5.dll
C:\WINNT\system32\iifgnt5.dll
C:\WINNT\system32\iliimg3.dll
C:\WINNT\system32\ir0ql5d51.dll
C:\WINNT\system32\irjol5131.dll
C:\WINNT\system32\iVlmCoIn_v12.dll
C:\WINNT\system32\j8l40i3qe8.dll
C:\WINNT\system32\jt8007lme.dll
C:\WINNT\system32\kc6ul7j91.dll
C:\WINNT\system32\KOemoryC.dll
C:\WINNT\system32\kt6ul7j91.dll
C:\WINNT\system32\kwdycc.dll
C:\WINNT\system32\l06olaj31do.dll
C:\WINNT\system32\lBprxy.dll
C:\WINNT\system32\Lfrio13n.dll
C:\WINNT\system32\lv0u09d9e.dll
C:\WINNT\system32\lvn4095qe.dll
C:\WINNT\system32\mcnsspc.dll
C:\WINNT\system32\mdtime.dll
C:\WINNT\system32\MEIIpl4M5.dll
C:\WINNT\system32\mmxoci.dll
C:\WINNT\system32\mnuni11.dll
C:\WINNT\system32\MTWMDM.dll
C:\WINNT\system32\nmtevent.dll
C:\WINNT\system32\oaexl32.dll
C:\WINNT\system32\ofbcp32r.dll
C:\WINNT\system32\ogbcbcp.dll
C:\WINNT\system32\poapi.dll
C:\WINNT\system32\protowiz.dll
C:\WINNT\system32\prrfproc.dll
C:\WINNT\system32\pxapi.dll
C:\WINNT\system32\q6nulg5916.dll
C:\WINNT\system32\rdr20.dll
C:\WINNT\system32\rhgwizc.dll
C:\WINNT\system32\rqpsnd.dll
C:\WINNT\system32\smdpsrv.dll
C:\WINNT\system32\tVpiui.dll
C:\WINNT\system32\uphisapi.dll
C:\WINNT\system32\uytfs.dll
C:\WINNT\system32\vcr.dll
C:\WINNT\system32\vnmdbg.dll
C:\WINNT\system32\wdsdmoe.dll
C:\WINNT\system32\wmapi.dll
C:\WINNT\system32\wonnls.dll
C:\WINNT\system32\wun32spl.dll
C:\WINNT\system32\wxnscard.dll
C:\WINNT\system32\xnnroll.dll
Granting sedebugprivilege to Administrators … successful
((((((((((((((((((((((((((((((((((((((((((((( Qoologic's Log )))))))))))))))))))))))))))))))))))))))))))))))))))
* * * PRE-RUN - Filepaths extracted from the Registry * * * * * * * * * * * * * * * * * * * * * *
O4 - HKEY_CURRENT_USER\…\Run C:\WINNT\system32\xuftae.exe
O4 - HKEY_LOCAL_MACHINE\…\Run C:\WINNT\system32\xuftae.exe
F2 -REG:system.ini: Shell C:\WINNT\system32\oevya.exe
F2 -REG:system.ini: UserInit C:\WINNT\system32\yadckjh.exe
* * * PRE-RUN - Filepaths from Locate * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
2006-08-29 20:19 221184 –a—— C:\WINNT\system32\xeymi.dll
2006-08-29 15:04 289 –a—— C:\WINNT\wplbq.dll
2006-08-29 14:37 236491 -r–s—- C:\WINNT\system32\smdpsrv.dll
2006-08-29 14:23 236491 -r–s—- C:\WINNT\system32\apsnt.dll
2006-08-29 14:13 236491 -r–s—- C:\WINNT\system32\mdtime.dll
2006-08-29 13:26 235832 -r–s—- C:\WINNT\system32\dxspex.dll
2006-08-29 13:19 236491 -r–s—- C:\WINNT\system32\dnrgui.dll
2006-08-29 12:09 236491 -r–s—- C:\WINNT\system32\oaexl32.dll
2006-08-28 20:56 235832 -r–s—- C:\WINNT\system32\wdsdmoe.dll
2006-08-28 13:24 236491 -r–s—- C:\WINNT\system32\tVpiui.dll
2006-08-28 13:00 235832 -r–s—- C:\WINNT\system32\MTWMDM.dll
2006-08-28 00:24 235832 -r–s—- C:\WINNT\system32\pxapi.dll
2006-08-27 23:14 235832 -r–s—- C:\WINNT\system32\wmapi.dll
2006-08-27 22:47 237302 -r–s—- C:\WINNT\system32\dhmasf.dll
2006-08-27 21:26 235832 -r–s—- C:\WINNT\system32\lBprxy.dll
2006-08-27 20:55 235832 -r–s—- C:\WINNT\system32\cumuid.dll
2006-08-13 16:10 235832 -r–s—- C:\WINNT\system32\iifgnt5.dll
2006-08-13 15:07 234727 -r–s—- C:\WINNT\system32\wonnls.dll
2006-08-13 14:58 235832 -r–s—- C:\WINNT\system32\mmxoci.dll
2006-08-13 13:08 234727 -r–s—- C:\WINNT\system32\cuypt32.dll
2006-08-13 12:54 235832 -r–s—- C:\WINNT\system32\efent97.dll
2006-08-12 12:08 234727 -r–s—- C:\WINNT\system32\uytfs.dll
2006-08-12 12:00 235832 -r–s—- C:\WINNT\system32\poapi.dll
2006-08-12 12:00 127488 –a—— C:\WINNT\system32\estxl.dat
2006-08-12 11:13 234727 -r–s—- C:\WINNT\system32\rhgwizc.dll
2006-08-12 04:08 235832 -r–s—- C:\WINNT\system32\ahptif.dll
2006-08-12 00:43 235832 -r–s—- C:\WINNT\system32\mcnsspc.dll
2006-08-12 00:26 234727 -r–s—- C:\WINNT\system32\dz32gt.dll
2006-08-11 19:40 234364 -r–s—- C:\WINNT\system32\ctbjmon.dll
2006-08-11 13:03 233885 -r–s—- C:\WINNT\system32\xnnroll.dll
2006-08-11 12:08 234364 -r–s—- C:\WINNT\system32\ESBTEG.DLL
2006-08-10 10:11 234364 -r–s—- C:\WINNT\system32\rdr20.dll
2006-08-10 08:55 234364 -r–s—- C:\WINNT\system32\vnmdbg.dll
2006-08-10 04:24 233885 -r–s—- C:\WINNT\system32\cbmuid.dll
2006-08-10 02:24 234364 -r–s—- C:\WINNT\system32\iliimg3.dll
2006-08-09 21:46 234227 -r–s—- C:\WINNT\system32\mnuni11.dll
2006-08-09 15:52 159744 –a—— C:\WINNT\system32\redist.dll
2006-08-09 15:51 52 –a—— C:\WINNT\vbveon.dat
2006-08-09 15:51 51712 –a—— C:\WINNT\system32\eceuqms.dll
2006-08-09 15:51 28672 –a—— C:\WINNT\system32\oevya.exe
2006-08-09 15:51 23552 –a—— C:\WINNT\system32\yadckjh.exe
2006-08-09 15:51 127488 –a—— C:\WINNT\system32\xuftae.exe
2006-08-09 15:51 127488 –a—— C:\Documents and Settings\All Users\Start Menu\Programs\Startup\qcqug.exe
2006-07-25 13:26 139264 –a—— C:\WINNT\system32\spisp.dll
2006-07-20 16:31 36864 –a—— C:\WINNT\system32\zqskw.exe
2006-07-20 16:31 1163264 –a—— C:\WINNT\system32\wfxqhv.exe
2006-07-14 22:15 236927 -r–s—- C:\WINNT\system32\kwdycc.dll
2006-07-11 13:54 233502 -r–s—- C:\WINNT\system32\rqpsnd.dll
* * * PRE-RUN - Filepaths extracted by Memory Dump * * * * * * * * * * * * * * * * * * * * * *
2006-08-09 15:51 127488 C:\WINNT\system32\xuftae.exe
2006-08-09 15:51 51712 C:\WINNT\system32\eceuqms.dll
2006-08-09 15:51 23552 C:\WINNT\system32\yadckjh.exe
2006-08-09 15:51 127488 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\qcqug.exe
2006-08-29 15:04 289 C:\WINNT\wplbq.dll
2006-08-12 12:00 127488 C:\WINNT\system32\estxl.dat
2006-08-09 15:51 28672 C:\WINNT\system32\oevya.exe
* * * POST-RUN - Files in the Quarantine folder * * * * * * * * * * * * * * * * * * * * * * * * *
06-08-12 12:00 127488 estxl.dat.qoo
06-08-09 15:51 127488 xuftae.exe.qoo
06-08-09 15:51 127488 qcqug.exe.qoo
06-08-09 15:51 51712 eceuqms.dll.qoo
06-08-09 15:51 28672 oevya.exe.qoo
06-08-09 15:51 23552 yadckjh.exe.qoo
06-08-29 15:04 289 wplbq.dll.qoo
06-08-09 15:51 52 vbveon.dat.qoo
DO NOT DELETE ANY FILES FROM THIS DIRECTORY UNLESS INSTRUCTED TO
((((((((((((((((((((((((((((((((((((((((((( E-Give / Ssk's Log )))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINNT\pi1_36.exe
* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINNT\system32\explorer.dll
C:\WINNT\system32\ghynf.exe
C:\WINNT\system32\tsuninst.exe
C:\WINNT\system32\VSL05.exe
C:\WINNT\system32\wfxqhv.exe
C:\WINNT\system32\xeymi.dll
C:\WINNT\system32\zqskw.exe
C:\sk02.exe
C:\WINNT\ssqbn.exe
C:\WINNT\system32ghynf.exe
C:\WINNT\system32\explorer.dll
C:\WINNT\system32\wfxqhv.exe
C:\WINNT\system32\xeymi.dll
C:\WINNT\system32\zqskw.exe
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Folders Quarantined:
C:\QooBox\Purity\Documents and Settings\Owner\Application Data\SSTEM~1
C:\QooBox\Purity\Documents and Settings\Owner\Application Data\STEM~1
C:\QooBox\Purity\Documents and Settings\Owner\Application Data\SSTEM~1\smss.exe
C:\QooBox\Purity\Documents and Settings\Owner\Application Data\SSTEM~1\SSTEM~1
C:\QooBox\Purity\Documents and Settings\Owner\Application Data\SSTEM~1\SSTEM~1\!update-4220.0000
C:\QooBox\Purity\Documents and Settings\Owner\Application Data\STEM~1\r?ndll32.exe
C:\QooBox\Purity\Program Files\Common Files\CURITY~1
((((((((((((((((((((((((((((((( Files Created from 2006-07-29 to 2006-08-29 ))))))))))))))))))))))))))))))))))
2006-08-29 14:58 24,296 –a—— C:\WINNT\icont.exe
2006-08-29 14:42 405,504 –a—— C:\WINNT\system32\irsmpyse.dll
2006-08-28 20:36 657,408 –a—— C:\WINNT\is-BN9A6.exe
2006-08-27 21:51 657,408 –a—— C:\WINNT\is-V0259.exe
2006-08-27 21:09 657,408 –a—— C:\WINNT\is-RD4TI.exe
2006-08-27 20:48 234,727 -r–s—- C:\WINNT\system32\xbsp2res.dll
2006-08-27 20:32 657,408 –a—— C:\WINNT\is-2GERV.exe
2006-08-12 03:28 221,184 –a—— C:\WINNT\system32\xeymi.dll
2006-08-10 03:46 9,216 ——— C:\WINNT\system32\proxycfg.exe
2006-08-10 03:46 59,392 ——— C:\WINNT\system32\logman.exe
2006-08-10 03:45 88,064 ——— C:\WINNT\system32\p2pnetsh.dll
2006-08-10 03:45 870,784 ——— C:\WINNT\system32\ati3d1ag.dll
2006-08-10 03:45 86,016 ——— C:\WINNT\system32\p2pgasvc.dll
2006-08-10 03:45 86,016 ——— C:\WINNT\system32\mdmxsdk.dll
2006-08-10 03:45 81,920 ——— C:\WINNT\system32\ieencode.dll
2006-08-10 03:45 81,408 ——— C:\WINNT\system32\wscsvc.dll
2006-08-10 03:45 8,192 ——— C:\WINNT\system32\smbinst.exe
2006-08-10 03:45 75,776 ——— C:\WINNT\system32\strmfilt.dll
2006-08-10 03:45 73,832 ——— C:\WINNT\system32\slcoinst.dll
2006-08-10 03:45 73,796 ——— C:\WINNT\system32\slserv.exe
2006-08-10 03:45 71,680 ——— C:\WINNT\system32\blastcln.exe
2006-08-10 03:45 7,680 ——— C:\WINNT\system32\kbdsmsno.dll
2006-08-10 03:45 7,680 ——— C:\WINNT\system32\kbdsmsfi.dll
2006-08-10 03:45 7,168 ——— C:\WINNT\system32\kbdukx.dll
2006-08-10 03:45 7,168 ——— C:\WINNT\system32\kbdno1.dll
2006-08-10 03:45 7,168 ——— C:\WINNT\system32\kbdfi1.dll
2006-08-10 03:45 60,416 ——— C:\WINNT\system32\fwcfg.dll
2006-08-10 03:45 6,656 ——— C:\WINNT\system32\kbdinmal.dll
2006-08-10 03:45 6,656 ——— C:\WINNT\system32\kbdinben.dll
2006-08-10 03:45 6,144 ——— C:\WINNT\system32\kbdmlt48.dll
2006-08-10 03:45 6,144 ——— C:\WINNT\system32\kbdmlt47.dll
2006-08-10 03:45 6,144 ——— C:\WINNT\system32\kbdinbe1.dll
2006-08-10 03:45 526,848 ——— C:\WINNT\system32\p2psvc.dll
2006-08-10 03:45 516,768 ——— C:\WINNT\system32\ativvaxx.dll
2006-08-10 03:45 50,688 ——— C:\WINNT\system32\btpanui.dll
2006-08-10 03:45 50,176 ——— C:\WINNT\system32\xmlprovi.dll
2006-08-10 03:45 5,632 ——— C:\WINNT\system32\kbdmaori.dll
2006-08-10 03:45 49,152 ——— C:\WINNT\system32\powercfg.exe
2006-08-10 03:45 48,640 ——— C:\WINNT\system32\pnrpnsp.dll
2006-08-10 03:45 44,032 ——— C:\WINNT\system32\twext.dll
2006-08-10 03:45 4,274,816 ——— C:\WINNT\system32\nv4_disp.dll
2006-08-10 03:45 397,056 ——— C:\WINNT\system32\s3gnb.dll
2006-08-10 03:45 377,984 ——— C:\WINNT\system32\ati2dvaa.dll
2006-08-10 03:45 32,866 ——— C:\WINNT\system32\slrundll.exe
2006-08-10 03:45 32,866 ——— C:\WINNT\slrundll.exe
2006-08-10 03:45 32,768 ——— C:\WINNT\system32\ativtmxx.dll
2006-08-10 03:45 32,285 ——— C:\WINNT\system32\hsfcisp2.dll
2006-08-10 03:45 312,320 ——— C:\WINNT\system32\p2pgraph.dll
2006-08-10 03:45 30,208 ——— C:\WINNT\system32\bthserv.dll
2006-08-10 03:45 29,184 ——— C:\WINNT\system32\sdhcinst.dll
2006-08-10 03:45 286,792 ——— C:\WINNT\system32\slextspk.dll
2006-08-10 03:45 24,576 ——— C:\WINNT\system32\httpapi.dll
2006-08-10 03:45 229,376 ——— C:\WINNT\system32\ati2cqag.dll
2006-08-10 03:45 22,528 ——— C:\WINNT\system32\fltmc.exe
2006-08-10 03:45 201,728 ——— C:\WINNT\system32\ati2dvag.dll
2006-08-10 03:45 20,992 ——— C:\WINNT\system32\bthci.dll
2006-08-10 03:45 193,024 ——— C:\WINNT\system32\fsquirt.exe
2006-08-10 03:45 188,508 ——— C:\WINNT\system32\slgen.dll
2006-08-10 03:45 17,408 ——— C:\WINNT\system32\winshfhc.dll
2006-08-10 03:45 16,896 ——— C:\WINNT\system32\fltlib.dll
2006-08-10 03:45 15,872 ——— C:\WINNT\system32\w3ssl.dll
2006-08-10 03:45 14,336 ——— C:\WINNT\system32\auditusr.exe
2006-08-10 03:45 13,824 ——— C:\WINNT\system32\wscntfy.exe
2006-08-10 03:45 13,824 ——— C:\WINNT\system32\cmsetacl.dll
2006-08-10 03:45 129,536 ——— C:\WINNT\system32\xmlprov.dll
2006-08-10 03:45 118,784 ——— C:\WINNT\system32\msdadiag.dll
2006-08-10 03:45 116,224 ——— C:\WINNT\system32\p2p.dll
2006-08-10 03:45 108,032 ——— C:\WINNT\system32\wshbth.dll
2006-08-10 03:45 1,888,992 ——— C:\WINNT\system32\ati3duag.dll
2006-08-10 03:45 1,737,856 ——— C:\WINNT\system32\mtxparhd.dll
2006-08-09 16:11 499,712 –a—— C:\WINNT\system32\MSVCP71.DLL
2006-08-09 16:11 348,160 –a—— C:\WINNT\system32\MSVCR71.DLL
2006-08-09 16:11 1,060,864 –a—— C:\WINNT\system32\MFC71.DLL
2006-08-09 15:55 81,920 –a—— C:\WINNT\system32\explorer.dll
2006-08-09 15:55 139,264 –a—— C:\WINNT\system32\spisp.dll
2006-08-09 15:53 61,952 –a—— C:\WINNT\system32\lhpceeb7.dll
2006-08-09 15:53 1,167 –a—— C:\WINNT\system32\lhpceeb7.sys
2006-08-09 15:52 159,744 –a—— C:\WINNT\system32\redist.dll
2006-08-09 15:52 126,464 –a—— C:\WINNT\system32\redistributor.exe
2006-08-09 15:49 27,648 –a—— C:\dist13.exe
2006-08-09 15:47 36,864 –a—— C:\WINNT\system32\zqskw.exe
2006-08-09 15:47 28,672 –a—— C:\WINNT\system32\iqqr.exe
2006-08-09 15:47 1,163,264 –a—— C:\WINNT\system32\wfxqhv.exe
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2006-08-29 20:19 ——– d——– C:\Program Files\Common Files
2006-08-29 20:07 ——– d——– C:\Program Files\Common Files\Symantec Shared
2006-08-29 14:42 45993 –a—— C:\WINNT\system32\unirimon.exe
2006-08-29 14:42 36864 –a—— C:\WINNT\system32\tdopkbld.exe
2006-08-29 14:41 ——– d—s—- C:\Documents and Settings\Owner\Application Data\Microsoft
2006-08-29 14:00 ——– d——– C:\Program Files\LocalNet
2006-08-29 13:17 ——– d–h—– C:\Program Files\GLF3F.tmp
2006-08-28 12:08 ——– d–h—– C:\Program Files\InstallShield Installation Information
2006-08-28 12:08 ——– d——– C:\Program Files\MUSICMATCH
2006-08-28 12:06 ——– d——– C:\Program Files\Disney Interactive
2006-08-28 00:25 ——– d——– C:\Program Files\CallWave
2006-08-10 18:47 11648 –a—— C:\WINNT\system32\drivers\pxscrmbl.sys
2006-08-10 04:21 ——– d——– C:\Program Files\Messenger
2006-08-10 03:46 ——– d——– C:\Program Files\Internet Explorer
2006-08-10 03:46 ——– d——– C:\Program Files\Common Files\System
2006-08-10 03:45 ——– d——– C:\Program Files\Windows Media Player
2006-08-10 03:45 ——– d——– C:\Program Files\Movie Maker
2006-08-10 03:41 ——– d——– C:\Program Files\NetMeeting
2006-08-10 03:40 ——– d——– C:\Program Files\Windows NT
2006-08-10 03:40 ——– d——– C:\Program Files\Outlook Express
2006-08-09 16:39 4194441 –a—— C:\Documents and Settings\Owner\Application Data\sdi.db
2006-08-09 16:01 ——– d——– C:\Program Files\Common Files\kmim
2006-08-09 15:55 2 –a—— C:\WINNT\system32\wintsvtr.exe
2006-06-23 11:22 9216 –a—— C:\WINNT\iglqxni.dll
2006-05-30 19:09 24576 –a—— C:\WINNT\Uninstall.exe
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GWMDMMSG"="GWMDMMSG.exe"
"SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe"
"SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe"
"GWMDMpi"="C:\\WINNT\\GWMDMpi.exe"
"IgfxTray"="C:\\WINNT\\System32\\igfxtray.exe"
"HotKeysCmds"="C:\\WINNT\\System32\\hkcmd.exe"
"Gateway Ink Monitor"="\"C:\\Program Files\\Gateway Utilities\\GWInkMonitor.exe\""
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"ccRegVfy"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccRegVfy.exe\""
"AdaptecDirectCD"="\"C:\\Program Files\\Roxio\\Easy CD Creator 5\\DirectCD\\DirectCD.exe\""
"Microsoft Works Update Detection"="C:\\Program Files\\Common Files\\Microsoft Shared\\Works Shared\\WkUFind.exe"
"SSC_UserPrompt"="C:\\Program Files\\Common Files\\Symantec Shared\\Security Center\\UsrPrmpt.exe"
"Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer"
"EPSON PictureMate"="C:\\WINNT\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S4I2P1.EXE /P17 \"EPSON PictureMate\" /O6 \"USB002\" /M \"PictureMate\""
"k6mmN5IOU"="\"C:\\WINNT\\system32\\wfxqhv.exe\""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="C:\\Program Files\\Creative\\MediaSource\\Detector\\CTDetect.exe /R"
"irssyncd"="C:\\WINNT\\system32\\irssyncd.exe"
"Mphyjxnr"="C:\\Documents and Settings\\Owner\\Application Data\\??stem\\r?ndll32.exe"
"kmim"="C:\\PROGRA~1\\COMMON~1\\kmim\\kmimm.exe"
"Ltho"="\"C:\\DOCUME~1\\Owner\\APPLIC~1\\SSTEM~1\\smss.exe\" -vt yazr"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices]
"Microsoft Configuration 35"="microsotl.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,f2,01,00,00,23,00,00,00,7c,00,00,00,72,00,\
00,00,01,00,00,00
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Microsoft Features"="ms32cfg.exe"
"Message"="mpsvc.exe"
"MDN"="MDN.exe"
"Microsoft Configuration 35"="microsotl.exe"
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]
[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Microsoft Features"="ms32cfg.exe"
"Message"="mpsvc.exe"
"MDN"="MDN.exe"
"Microsoft Configuration 35"="microsotl.exe"
[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000
[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^CallWave.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\CallWave.lnk"
"backup"="C:\\WINNT\\pss\\CallWave.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\CallWave\\IAM.exe -start"
"item"="CallWave"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^qcqug.exe]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\qcqug.exe"
"backup"="C:\\WINNT\\pss\\qcqug.exeCommon Startup"
"location"="Common Startup"
"command"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\qcqug.exe"
"item"="qcqug"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\ad8rIU3s]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="cvn0"
"hkey"="HKLM"
"command"="C:\\WINNT\\System32\\cvn0.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\k6mmN5IOU]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="wfxqhv"
"hkey"="HKLM"
"command"="\"C:\\WINNT\\system32\\wfxqhv.exe\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\lhpceeb7]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="RUNDLL32"
"hkey"="HKLM"
"command"="RUNDLL32.EXE w006d730.dll,n 002ceeb500000003006d730"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Ltho]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="smss"
"hkey"="HKCU"
"command"="\"C:\\DOCUME~1\\Owner\\APPLIC~1\\SSTEM~1\\smss.exe\" -vt yazr"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Microsoft Configuration 35]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="microsotl"
"hkey"="HKCU"
"command"="microsotl.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\PrevxOne]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="PXConsole"
"hkey"="HKLM"
"command"="C:\\Program Files\\Prevx1\\PXConsole.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\tjpnb]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="xuftae"
"hkey"="HKCU"
"command"="C:\\WINNT\\system32\\xuftae.exe reg_run"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\xmjlyc]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="xuftae"
"hkey"="HKLM"
"command"="C:\\WINNT\\system32\\xuftae.exe reg_run"
"inimapping"="0"
Contents of the 'Scheduled Tasks' folder
C:\WINNT\tasks\ISP signup reminder 3.job
C:\WINNT\tasks\Norton AntiVirus - Scan my computer.job
Completion time: Tue 08/29/2006 20:26:01.00
ComboFix.txt
Logfile of HijackThis v1.99.1
Scan saved at 8:31:25 PM, on 8/29/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\System32\CTsvcCDA.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\wscntfy.exe
C:\WINNT\system32\wuauclt.exe
C:\WINNT\system32\wuauclt.exe
C:\WINNT\GWMDMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINNT\System32\hkcmd.exe
C:\Program Files\Gateway Utilities\GWInkMonitor.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S4I2P1.EXE
C:\WINNT\system32\wfxqhv.exe
C:\WINNT\system32\zqskw.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\WINNT\system32\NOTEPAD.EXE
C:\PROGRA~1\COMMON~1\kmim\kmimm.exe
C:\PROGRA~1\COMMON~1\kmim\kmima.exe
C:\WINNT\System32\msiexec.exe
C:\PROGRA~1\COMMON~1\kmim\kmiml.exe
C:\Program Files\Messenger\msmsgs.exe
C:\hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
http://www.localnet.com/adv_search.phtml
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://start.localnet.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://www.localnet.com/adv_search.phtml
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://start.localnet.com
O2 - BHO: RieMon Class - {70F6A776-579A-4C95-BA88-134253907752} - C:\WINNT\system32\irsmpyse.dll
O2 - BHO: Ozbyq Class - {D623BC2F-A58D-4A75-A10D-CC244A702A35} - C:\WINNT\system32\xeymi.dll
O2 - BHO: (no name) - {E5E2A3E7-00FE-4D31-A030-A10799DDCA66} - (no file)
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [GWMDMpi] C:\WINNT\GWMDMpi.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [Gateway Ink Monitor] "C:\Program Files\Gateway Utilities\GWInkMonitor.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [EPSON PictureMate] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S4I2P1.EXE /P17 "EPSON PictureMate" /O6 "USB002" /M "PictureMate"
O4 - HKLM\..\Run: [k6mmN5IOU] "C:\WINNT\system32\wfxqhv.exe"
O4 - HKLM\..\RunServices: [Microsoft Configuration 35] microsotl.exe
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [irssyncd] C:\WINNT\system32\irssyncd.exe
O4 - HKCU\..\Run: [Mphyjxnr] C:\Documents and Settings\Owner\Application Data\??stem\r?ndll32.exe
O4 - HKCU\..\Run: [kmim] C:\PROGRA~1\COMMON~1\kmim\kmimm.exe
O4 - HKCU\..\Run: [Ltho] "C:\DOCUME~1\Owner\APPLIC~1\SSTEM~1\smss.exe" -vt yazr
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: StickyNote.lnk = C:\Program Files\StickyNote\StickyNote.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .fpx: C:\\Program Files\\Internet Explorer\\PLUGINS\\NPRVRT32.dll
O12 - Plugin for .ivr: C:\\Program Files\\Internet Explorer\\PLUGINS\\NPRVRT32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) -
http://www.kodakgallery.com/downloads/BUM/…_1/axofupld.cab
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://download.cdn.winsoftware.com/files/…FreeInstall.cab
O18 - Filter: text/html - {B5F86455-BF18-4E12-965A-6642A0AC0549} - C:\WINNT\system32\xeymi.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\System32\CTsvcCDA.EXE
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
