malware removal assistance

Welcome to the forum

Download combofix.exe from the link below:

Combofix.exe

Save it to your desktop.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run combofix.

When finished, it will produce a log for you.

Post that log in your next reply, along with a new HijackThis! log.


Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Michelle - 06-11-09 19:43:00.70 Service Pack 2 ComboFix 06.11.9 - Running from: "C:\Documents and Settings\Michelle\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Documents and Settings\Michelle\Application Data\Install.dat C:\WINDOWS\system32\aaa00000.sys C:\Program Files\Common Files\Yazzle1122OinAdmin.exe C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe C:\Documents and Settings\All Users\Documents\Settings C:\Program Files\Common Files\{385F2882-0512-1033-0307-030211070001} C:\Program Files\Common Files\{A85F2882-0512-1033-0307-030211070001} C:\WINDOWS\TWljaGVsbGU ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\QooBox\Purity\Documents and Settings\Michelle\Application Data\SCURIT~1 C:\QooBox\Purity\Documents and Settings\Michelle\Application Data\SMANTE~1 C:\QooBox\Purity\Program Files\Common Files\SSTEM3~1 C:\QooBox\Purity\Program Files\Common Files\YSTEM3~1 C:\QooBox\Purity\Program Files\Common Files\SSTEM3~1\dvdplay.exe C:\QooBox\Purity\Program Files\Common Files\SSTEM3~1\SSTEM3~1 C:\QooBox\Purity\Program Files\Common Files\YSTEM3~1\m?config.exe C:\QooBox\Purity\WINDOWS\CROSOF~1.NET C:\QooBox\Purity\WINDOWS\SYSTEM32\PPATCH~1 C:\QooBox\Purity\WINDOWS\SYSTEM32\SEMBLY~1 ((((((((((((((((((((((((((((((( Files Created from 2006-10-09 to 2006-11-09 )))))))))))))))))))))))))))))))))) 2006-11-08 18:21 221,184 –a—— C:\WINDOWS\SYSTEM32\wmpns.dll 2006-11-08 18:13 9,728 ——— C:\WINDOWS\SYSTEM32\comsdupd.exe 2006-11-08 18:13 40,832 ——— C:\WINDOWS\SYSTEM32\DRIVERS\irbus.sys 2006-11-08 18:12 95,424 ——— C:\WINDOWS\SYSTEM32\DRIVERS\slnthal.sys 2006-11-08 18:12 86,016 ——— C:\WINDOWS\SYSTEM32\mdmxsdk.dll 2006-11-08 18:12 81,920 ——— C:\WINDOWS\SYSTEM32\ieencode.dll 2006-11-08 18:12 78,464 ——— C:\WINDOWS\SYSTEM32\DRIVERS\usbvideo.sys 2006-11-08 18:12 73,216 ——— C:\WINDOWS\SYSTEM32\DRIVERS\atintuxx.sys 2006-11-08 18:12 71,680 ——— C:\WINDOWS\SYSTEM32\blastcln.exe 2006-11-08 18:12 7,680 ——— C:\WINDOWS\SYSTEM32\kbdsmsno.dll 2006-11-08 18:12 7,680 ——— C:\WINDOWS\SYSTEM32\kbdsmsfi.dll 2006-11-08 18:12 7,168 ——— C:\WINDOWS\SYSTEM32\kbdukx.dll 2006-11-08 18:12 7,168 ——— C:\WINDOWS\SYSTEM32\kbdno1.dll 2006-11-08 18:12 7,168 ——— C:\WINDOWS\SYSTEM32\kbdfi1.dll 2006-11-08 18:12 685,056 ——— C:\WINDOWS\SYSTEM32\DRIVERS\hsfcxts2.sys 2006-11-08 18:12 67,584 ——— C:\WINDOWS\SYSTEM32\DRIVERS\sdbus.sys 2006-11-08 18:12 63,663 ——— C:\WINDOWS\SYSTEM32\DRIVERS\ati1rvxx.sys 2006-11-08 18:12 63,488 ——— C:\WINDOWS\SYSTEM32\DRIVERS\atinxsxx.sys 2006-11-08 18:12 60,416 ——— C:\WINDOWS\SYSTEM32\fwcfg.dll 2006-11-08 18:12 6,656 ——— C:\WINDOWS\SYSTEM32\kbdinmal.dll 2006-11-08 18:12 6,656 ——— C:\WINDOWS\SYSTEM32\kbdinben.dll 2006-11-08 18:12 6,144 ——— C:\WINDOWS\SYSTEM32\kbdmlt48.dll 2006-11-08 18:12 6,144 ——— C:\WINDOWS\SYSTEM32\kbdmlt47.dll 2006-11-08 18:12 6,144 ——— C:\WINDOWS\SYSTEM32\kbdinbe1.dll 2006-11-08 18:12 6,016 ——— C:\WINDOWS\SYSTEM32\DRIVERS\smbali.sys 2006-11-08 18:12 59,648 ——— C:\WINDOWS\SYSTEM32\DRIVERS\rfcomm.sys 2006-11-08 18:12 57,856 ——— C:\WINDOWS\SYSTEM32\DRIVERS\atinbtxx.sys 2006-11-08 18:12 56,623 ——— C:\WINDOWS\SYSTEM32\DRIVERS\ati1btxx.sys 2006-11-08 18:12 52,224 ——— C:\WINDOWS\SYSTEM32\mspmsnsv.dll 2006-11-08 18:12 52,224 ——— C:\WINDOWS\SYSTEM32\DRIVERS\atinraxx.sys 2006-11-08 18:12 516,768 ——— C:\WINDOWS\SYSTEM32\ativvaxx.dll 2006-11-08 18:12 50,688 ——— C:\WINDOWS\SYSTEM32\btpanui.dll 2006-11-08 18:12 5,632 ——— C:\WINDOWS\SYSTEM32\kbdmaori.dll 2006-11-08 18:12 46,464 ——— C:\WINDOWS\SYSTEM32\DRIVERS\gagp30kx.sys 2006-11-08 18:12 452,736 ——— C:\WINDOWS\SYSTEM32\DRIVERS\mtxparhm.sys 2006-11-08 18:12 44,672 ——— C:\WINDOWS\SYSTEM32\DRIVERS\uagp35.sys 2006-11-08 18:12 404,990 ——— C:\WINDOWS\SYSTEM32\DRIVERS\slntamr.sys 2006-11-08 18:12 4,255 ——— C:\WINDOWS\SYSTEM32\DRIVERS\adv01nt5.dll 2006-11-08 18:12 38,016 ——— C:\WINDOWS\SYSTEM32\DRIVERS\bthmodem.sys 2006-11-08 18:12 377,984 ——— C:\WINDOWS\SYSTEM32\ati2dvaa.dll 2006-11-08 18:12 36,463 ——— C:\WINDOWS\SYSTEM32\DRIVERS\ati1tuxx.sys 2006-11-08 18:12 36,096 ——— C:\WINDOWS\SYSTEM32\DRIVERS\intelppm.sys 2006-11-08 18:12 35,456 ——— C:\WINDOWS\SYSTEM32\DRIVERS\bthprint.sys 2006-11-08 18:12 34,735 ——— C:\WINDOWS\SYSTEM32\DRIVERS\ati1xsxx.sys 2006-11-08 18:12 327,040 ——— C:\WINDOWS\SYSTEM32\DRIVERS\ati2mtaa.sys 2006-11-08 18:12 32,768 ——— C:\WINDOWS\SYSTEM32\ativtmxx.dll 2006-11-08 18:12 32,285 ——— C:\WINDOWS\SYSTEM32\hsfcisp2.dll 2006-11-08 18:12 31,744 ——— C:\WINDOWS\SYSTEM32\DRIVERS\atinxbxx.sys 2006-11-08 18:12 30,671 ——— C:\WINDOWS\SYSTEM32\DRIVERS\ati1raxx.sys 2006-11-08 18:12 30,208 ——— C:\WINDOWS\SYSTEM32\bthserv.dll 2006-11-08 18:12 30,080 ——— C:\WINDOWS\SYSTEM32\DRIVERS\rndismpx.sys 2006-11-08 18:12 3,967 ——— C:\WINDOWS\SYSTEM32\DRIVERS\adv02nt5.dll 2006-11-08 18:12 3,901 ——— C:\WINDOWS\SYSTEM32\DRIVERS\siint5.dll 2006-11-08 18:12 3,775 ——— C:\WINDOWS\SYSTEM32\DRIVERS\adv11nt5.dll 2006-11-08 18:12 3,711 ——— C:\WINDOWS\SYSTEM32\DRIVERS\adv09nt5.dll 2006-11-08 18:12 3,647 ——— C:\WINDOWS\SYSTEM32\DRIVERS\adv07nt5.dll 2006-11-08 18:12 3,615 ——— C:\WINDOWS\SYSTEM32\DRIVERS\adv05nt5.dll 2006-11-08 18:12 3,135 ——— C:\WINDOWS\SYSTEM32\DRIVERS\adv08nt5.dll 2006-11-08 18:12 29,455 ——— C:\WINDOWS\SYSTEM32\DRIVERS\ati1xbxx.sys 2006-11-08 18:12 29,056 ——— C:\WINDOWS\SYSTEM32\DRIVERS\ip6fw.sys 2006-11-08 18:12 28,672 ——— C:\WINDOWS\SYSTEM32\DRIVERS\atinsnxx.sys 2006-11-08 18:12 274,304 ——— C:\WINDOWS\SYSTEM32\DRIVERS\bthport.sys 2006-11-08 18:12 263,040 ——— C:\WINDOWS\SYSTEM32\DRIVERS\http.sys 2006-11-08 18:12 26,367 ——— C:\WINDOWS\SYSTEM32\DRIVERS\ati1snxx.sys 2006-11-08 18:12 25,600 ——— C:\WINDOWS\SYSTEM32\DRIVERS\hidbth.sys 2006-11-08 18:12 25,471 ——— C:\WINDOWS\SYSTEM32\DRIVERS\watv10nt.sys 2006-11-08 18:12 25,471 ——— C:\WINDOWS\SYSTEM32\DRIVERS\atv04nt5.dll 2006-11-08 18:12 24,576 ——— C:\WINDOWS\SYSTEM32\httpapi.dll 2006-11-08 18:12 229,376 ——— C:\WINDOWS\SYSTEM32\ati2cqag.dll 2006-11-08 18:12 220,032 ——— C:\WINDOWS\SYSTEM32\DRIVERS\hsfbs2s2.sys 2006-11-08 18:12 22,528 ——— C:\WINDOWS\SYSTEM32\fltmc.exe 2006-11-08 18:12 22,271 ——— C:\WINDOWS\SYSTEM32\DRIVERS\watv06nt.sys 2006-11-08 18:12 21,343 ——— C:\WINDOWS\SYSTEM32\DRIVERS\ati1ttxx.sys 2006-11-08 18:12 21,183 ——— C:\WINDOWS\SYSTEM32\DRIVERS\atv01nt5.dll 2006-11-08 18:12 20,992 ——— C:\WINDOWS\SYSTEM32\bthci.dll 2006-11-08 18:12 2,113,536 ——— C:\WINDOWS\SYSTEM32\dxdiagn.dll 2006-11-08 18:12 193,024 ——— C:\WINDOWS\SYSTEM32\fsquirt.exe 2006-11-08 18:12 180,360 ——— C:\WINDOWS\SYSTEM32\DRIVERS\ntmtlfax.sys 2006-11-08 18:12 18,944 ——— C:\WINDOWS\SYSTEM32\DRIVERS\bthusb.sys 2006-11-08 18:12 17,279 ——— C:\WINDOWS\SYSTEM32\DRIVERS\atv10nt5.dll 2006-11-08 18:12 17,024 ——— C:\WINDOWS\SYSTEM32\DRIVERS\bthenum.sys 2006-11-08 18:12 166,912 ——— C:\WINDOWS\SYSTEM32\DRIVERS\s3gnbm.sys 2006-11-08 18:12 16,896 ——— C:\WINDOWS\SYSTEM32\fltlib.dll 2006-11-08 18:12 15,488 ——— C:\WINDOWS\SYSTEM32\DRIVERS\mssmbios.sys 2006-11-08 18:12 15,423 ——— C:\WINDOWS\SYSTEM32\DRIVERS\ch7xxnt5.dll 2006-11-08 18:12 15,104 ——— C:\WINDOWS\SYSTEM32\DRIVERS\hidir.sys 2006-11-08 18:12 14,336 ——— C:\WINDOWS\SYSTEM32\DRIVERS\atinpdxx.sys 2006-11-08 18:12 14,336 ——— C:\WINDOWS\SYSTEM32\auditusr.exe 2006-11-08 18:12 14,143 ——— C:\WINDOWS\SYSTEM32\DRIVERS\atv06nt5.dll 2006-11-08 18:12 13,824 ——— C:\WINDOWS\SYSTEM32\DRIVERS\atinttxx.sys 2006-11-08 18:12 13,824 ——— C:\WINDOWS\SYSTEM32\DRIVERS\atinmdxx.sys 2006-11-08 18:12 13,824 ——— C:\WINDOWS\SYSTEM32\cmsetacl.dll 2006-11-08 18:12 13,776 ——— C:\WINDOWS\SYSTEM32\DRIVERS\recagent.sys 2006-11-08 18:12 13,568 ——— C:\WINDOWS\SYSTEM32\DRIVERS\wacompen.sys 2006-11-08 18:12 13,240 ——— C:\WINDOWS\SYSTEM32\DRIVERS\slwdmsup.sys 2006-11-08 18:12 129,535 ——— C:\WINDOWS\SYSTEM32\DRIVERS\slnt7554.sys 2006-11-08 18:12 126,686 ——— C:\WINDOWS\SYSTEM32\DRIVERS\mtlmnt5.sys 2006-11-08 18:12 124,800 ——— C:\WINDOWS\SYSTEM32\DRIVERS\fltmgr.sys 2006-11-08 18:12 12,672 ——— C:\WINDOWS\SYSTEM32\DRIVERS\usb8023x.sys 2006-11-08 18:12 12,672 ——— C:\WINDOWS\SYSTEM32\DRIVERS\mutohpen.sys 2006-11-08 18:12 12,047 ——— C:\WINDOWS\SYSTEM32\DRIVERS\ati1pdxx.sys 2006-11-08 18:12 118,784 ——— C:\WINDOWS\SYSTEM32\msdadiag.dll 2006-11-08 18:12 11,935 ——— C:\WINDOWS\SYSTEM32\DRIVERS\wadv11nt.sys 2006-11-08 18:12 11,871 ——— C:\WINDOWS\SYSTEM32\DRIVERS\wadv09nt.sys 2006-11-08 18:12 11,868 ——— C:\WINDOWS\SYSTEM32\DRIVERS\mdmxsdk.sys 2006-11-08 18:12 11,807 ——— C:\WINDOWS\SYSTEM32\DRIVERS\wadv07nt.sys 2006-11-08 18:12 11,615 ——— C:\WINDOWS\SYSTEM32\DRIVERS\ati1mdxx.sys 2006-11-08 18:12 11,359 ——— C:\WINDOWS\SYSTEM32\DRIVERS\atv02nt5.dll 2006-11-08 18:12 11,325 ——— C:\WINDOWS\SYSTEM32\DRIVERS\vchnt5.dll 2006-11-08 18:12 11,295 ——— C:\WINDOWS\SYSTEM32\DRIVERS\wadv08nt.sys 2006-11-08 18:12 11,136 ——— C:\WINDOWS\SYSTEM32\DRIVERS\sffdisk.sys 2006-11-08 18:12 104,960 ——— C:\WINDOWS\SYSTEM32\DRIVERS\atinrvxx.sys 2006-11-08 18:12 100,992 ——— C:\WINDOWS\SYSTEM32\DRIVERS\bthpan.sys 2006-11-08 18:12 10,240 ——— C:\WINDOWS\SYSTEM32\DRIVERS\sffp_sd.sys 2006-11-08 18:12 1,689,088 ——— C:\WINDOWS\SYSTEM32\d3d9.dll 2006-11-08 18:12 1,309,184 ——— C:\WINDOWS\SYSTEM32\DRIVERS\mtlstrm.sys 2006-11-08 18:12 1,041,536 ——— C:\WINDOWS\SYSTEM32\DRIVERS\hsfdpsp2.sys 2006-11-08 18:11 88,064 ——— C:\WINDOWS\SYSTEM32\p2pnetsh.dll 2006-11-08 18:11 86,016 ——— C:\WINDOWS\SYSTEM32\p2pgasvc.dll 2006-11-08 18:11 81,408 ——— C:\WINDOWS\SYSTEM32\wscsvc.dll 2006-11-08 18:11 8,192 ——— C:\WINDOWS\SYSTEM32\smbinst.exe 2006-11-08 18:11 75,776 ——— C:\WINDOWS\SYSTEM32\strmfilt.dll 2006-11-08 18:11 73,832 ——— C:\WINDOWS\SYSTEM32\slcoinst.dll 2006-11-08 18:11 73,796 ——— C:\WINDOWS\SYSTEM32\slserv.exe 2006-11-08 18:11 526,848 ——— C:\WINDOWS\SYSTEM32\p2psvc.dll 2006-11-08 18:11 50,176 ——— C:\WINDOWS\SYSTEM32\xmlprovi.dll 2006-11-08 18:11 49,152 ——— C:\WINDOWS\SYSTEM32\powercfg.exe 2006-11-08 18:11 48,640 ——— C:\WINDOWS\SYSTEM32\pnrpnsp.dll 2006-11-08 18:11 44,032 ——— C:\WINDOWS\SYSTEM32\twext.dll 2006-11-08 18:11 397,056 ——— C:\WINDOWS\SYSTEM32\s3gnb.dll 2006-11-08 18:11 32,866 ——— C:\WINDOWS\SYSTEM32\slrundll.exe 2006-11-08 18:11 32,866 ——— C:\WINDOWS\slrundll.exe 2006-11-08 18:11 312,320 ——— C:\WINDOWS\SYSTEM32\p2pgraph.dll 2006-11-08 18:11 29,184 ——— C:\WINDOWS\SYSTEM32\sdhcinst.dll 2006-11-08 18:11 286,792 ——— C:\WINDOWS\SYSTEM32\slextspk.dll 2006-11-08 18:11 233,472 ——— C:\WINDOWS\SYSTEM32\wmpdxm.dll 2006-11-08 18:11 188,508 ——— C:\WINDOWS\SYSTEM32\slgen.dll 2006-11-08 18:11 17,408 ——— C:\WINDOWS\SYSTEM32\winshfhc.dll 2006-11-08 18:11 168,448 ——— C:\WINDOWS\SYSTEM32\wmerror.dll 2006-11-08 18:11 15,872 ——— C:\WINDOWS\SYSTEM32\w3ssl.dll 2006-11-08 18:11 13,824 ——— C:\WINDOWS\SYSTEM32\wscntfy.exe 2006-11-08 18:11 129,536 ——— C:\WINDOWS\SYSTEM32\xmlprov.dll 2006-11-08 18:11 116,224 ——— C:\WINDOWS\SYSTEM32\p2p.dll 2006-11-08 18:11 114,688 ——— C:\WINDOWS\SYSTEM32\wmpasf.dll 2006-11-08 18:11 108,032 ——— C:\WINDOWS\SYSTEM32\wshbth.dll 2006-11-08 18:11 1,737,856 ——— C:\WINDOWS\SYSTEM32\mtxparhd.dll 2006-11-08 17:00 49,428 –a—— C:\WINDOWS\SYSTEM32\dfrrcamh.dll 2006-11-05 16:30 22,752 –a—— C:\WINDOWS\SYSTEM32\spupdsvc.exe 2006-11-05 16:18 18,200 –a—— C:\WINDOWS\SYSTEM32\wups2.dll 2006-11-05 16:12 49,428 –a—— C:\WINDOWS\SYSTEM32\omugmrtn.dll 2006-11-02 19:50 45,056 –a—— C:\WINDOWS\SYSTEM32\regapi.exe 2006-11-02 14:35 84,992 –a—— C:\WINDOWS\ms040158718-1472006.exe 2006-11-02 14:18 913,576 –a—— C:\WINDOWS\SYSTEM32\WinNB66.dll 2006-11-02 14:18 36,864 –a—— C:\WINDOWS\unstall.exe 2006-11-02 14:18 25,105 –a—— C:\WINDOWS\idlemg.exe 2006-11-02 14:17 45,056 –a—— C:\WINDOWS\octeltpop.exe 2006-11-02 14:17 217,346 –a—— C:\WINDOWS\Setup90.exe 2006-11-02 14:17 2,560 –a—— C:\WINDOWS\ac3_0002.exe 2006-10-31 12:22 131,072 –a—— C:\WINDOWS\SYSTEM32\vke.dll 2006-10-31 07:00 49,428 –a—— C:\WINDOWS\SYSTEM32\rmoitvyk.dll 2006-10-29 18:59 49,428 –a—— C:\WINDOWS\SYSTEM32\anccfuwt.dll 2006-10-29 05:53 1,685 –a—— C:\WINDOWS\44469581.exe 2006-10-29 05:50 1,685 –a—— C:\44469581.exe 2006-10-28 18:59 49,428 –a—— C:\WINDOWS\SYSTEM32\uekvwssu.dll 2006-10-28 05:24 5,091 –a—— C:\sstray.exe 2006-10-28 05:24 1,685 –a—— C:\WINDOWS\metasploit.exe 2006-10-28 05:23 1,685 –a—— C:\5676367.exe 2006-10-25 05:53 1,685 –a—— C:\WINDOWS\49981639.exe 2006-10-25 05:52 1,685 –a—— C:\49981639.exe 2006-10-22 02:54 160,768 –a—— C:\WINDOWS\SYSTEM32\ktyaqx.dll 2006-10-22 02:53 160,768 –a—— C:\WINDOWS\SYSTEM32\xjcyys.dll 2006-10-22 02:49 10,752 –a—— C:\WINDOWS\SYSTEM32\MZU_DRV.sys 2006-10-22 02:48 72,192 –a—— C:\WINDOWS\SYSTEM32\ewslteb.dll 2006-10-20 18:58 122,900 –a—— C:\WINDOWS\SYSTEM32\tqonupmh.dll 2006-10-18 12:23 1,639 –a—— C:\WINDOWS\SYSTEM32\winpfg32.sys 2006-10-18 06:14 96,256 –a-s—- C:\WINDOWS\SYSTEM32\druid1.exe 2006-10-18 06:14 96,256 –a—— C:\WINDOWS\SYSTEM32\durvil1.exe 2006-10-18 06:14 151,040 –a—— C:\WINDOWS\SYSTEM32\durvil1.dll 2006-10-18 05:57 122,900 –a—— C:\WINDOWS\SYSTEM32\xfvldcbn.dll 2006-10-18 05:56 53,248 –a—— C:\WINDOWS\ab_02.exe 2006-10-18 05:56 45,065 –a—— C:\WINDOWS\TIELT001.exe 2006-10-18 05:56 433,632 –a—— C:\WINDOWS\hancerdoem.exe 2006-10-18 05:56 139,264 –a—— C:\WINDOWS\MirarSetup_876057.exe 2006-10-18 05:56 1,259 –a—— C:\WINDOWS\SYSTEM32\kda25078.sys 2006-10-18 05:29 2 –a—— C:\WINDOWS\SYSTEM32\wnstssv.exe 2006-10-18 05:29 1,685 –a—— C:\WINDOWS\a.exe 2006-10-18 05:28 1,685 –a—— C:\WINDOWS\bl4ck.com (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-11-09 19:44 ——– d——– C:\Program Files\Common Files 2006-11-09 19:34 6641 –ahs—- C:\Documents and Settings\Michelle\Application Data\2C7A8CD078FA427FBF86AE333A20DC52.sta 2006-11-09 19:34 46005 –ahs—- C:\Documents and Settings\Michelle\Application Data\2C7A8CD078FA427FBF86AE333A20DC52.rul 2006-11-09 10:50 ——– d——– C:\Program Files\Common Files\Symantec Shared 2006-11-08 19:15 ——– d——– C:\Program Files\Symantec 2006-11-08 18:56 ——– d——– C:\Program Files\Internet Explorer 2006-11-08 18:21 ——– d——– C:\Program Files\Windows Media Player 2006-11-08 18:14 ——– d——– C:\Program Files\Messenger 2006-11-08 18:11 ——– d——– C:\Program Files\Movie Maker 2006-11-08 17:50 ——– d——– C:\Program Files\NetMeeting 2006-11-08 17:49 ——– d——– C:\Program Files\Windows NT 2006-11-08 17:49 ——– d——– C:\Program Files\Outlook Express 2006-11-08 17:49 ——– d——– C:\Program Files\Common Files\System 2006-11-05 16:14 ——– d——– C:\Program Files\Dynamic Toolbar 2006-11-05 14:09 ——– d——– C:\Program Files\Blubster 2006-10-27 14:53 ——– d——– C:\Program Files\AIM 2006-10-27 14:46 ——– d——– C:\Program Files\AOD 2006-10-22 04:53 ——– d—s—- C:\Documents and Settings\Michelle\Application Data\Microsoft 2006-10-18 11:54 ——– d——– C:\Program Files\Common Files\zkmz 2006-10-18 05:56 ——– d——– C:\Program Files\em 2006-10-06 18:11 65536 –a—— C:\WINDOWS\SYSTEM32\Winwcd.dll 2006-10-02 14:06 ——– d——– C:\Program Files\myTunes Redux 2006-09-12 15:14 ——– d——– C:\Program Files\iTunes 2006-09-12 15:14 ——– d——– C:\Program Files\iPod 2006-09-12 15:07 ——– d——– C:\Program Files\QuickTime 2006-09-12 15:01 ——– d——– C:\Program Files\Apple Software Update (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "DellSupport"="\"C:\\Program Files\\Dell Support\\DSAgnt.exe\" /startup" "Qzqhzgr"="C:\\Program Files\\Common Files\\?ystem32\\m?config.exe" "Ncao"="\"C:\\PROGRA~1\\COMMON~1\\SSTEM3~1\\dvdplay.exe\" -vt ndrv" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce\Setup] "WMAFile"="regsvr32.exe /s C:\\WINDOWS\\System32\\NCTWMAFile2.dll" "AudioEditor"="regsvr32.exe /s C:\\WINDOWS\\System32\\NCTAudioEditor2.dll" "MFC42"="regsvr32.exe /s mfc42.dll" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex] @="" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices] "System Clock Manager"="sysclockmsngr.exe" "_mzu_stonedrv3"="c:\\windows\\system32\\_mzu_stonedrv3.exe" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\ 00,00,01,00,00,00 [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "System Clock Manager"="sysclockmsngr.exe" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "System Clock Manager"="sysclockmsngr.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "ForceActiveDesktopOn"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 8.0 Tray Icon.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\America Online 8.0 Tray Icon.lnk" "backup"="C:\\WINDOWS\\pss\\America Online 8.0 Tray Icon.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\AMERIC~1.0\\aoltray.exe -check" "item"="America Online 8.0 Tray Icon" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AOL Companion.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\AOL Companion.lnk" "backup"="C:\\WINDOWS\\pss\\AOL Companion.lnkCommon Startup" "location"="Common Startup" "command"=" " "item"="AOL Companion" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Exif Launcher.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Exif Launcher.lnk" "backup"="C:\\WINDOWS\\pss\\Exif Launcher.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\FINEPI~1\\QuickDCF.exe " "item"="Exif Launcher" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^GStartup.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\GStartup.lnk" "backup"="C:\\WINDOWS\\pss\\GStartup.lnkCommon Startup" "location"="Common Startup" "command"="C:\\Program Files\\Common Files\\GMT\\GMT.exe /startup" "item"="GStartup" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 1000 series.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\hp psc 1000 series.lnk" "backup"="C:\\WINDOWS\\pss\\hp psc 1000 series.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\HEWLET~1\\DIGITA~1\\bin\\hpohmr08.exe " "item"="hp psc 1000 series" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hpoddt01.exe.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\hpoddt01.exe.lnk" "backup"="C:\\WINDOWS\\pss\\hpoddt01.exe.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\HEWLET~1\\DIGITA~1\\bin\\hpotdd01.exe " "item"="hpoddt01.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Kodak EasyShare software.lnk" "backup"="C:\\WINDOWS\\pss\\Kodak EasyShare software.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\KODAK\\KODAKE~1\\bin\\EASYSH~1.EXE -h" "item"="Kodak EasyShare software" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\KODAK Software Updater.lnk" "backup"="C:\\WINDOWS\\pss\\KODAK Software Updater.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\KODAK\\KODAKS~1\\7288971\\Program\\BACKWE~1.EXE " "item"="KODAK Software Updater" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Microsoft Office.lnk" "backup"="C:\\WINDOWS\\pss\\Microsoft Office.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\MICROS~3\\Office10\\OSA.EXE -b -l" "item"="Microsoft Office" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Michelle^Start Menu^Programs^Startup^TA_Start.lnk] "path"="C:\\Documents and Settings\\Michelle\\Start Menu\\Programs\\Startup\\TA_Start.lnk" "backup"="C:\\WINDOWS\\pss\\TA_Start.lnkStartup" "location"="Startup" "command"="C:\\WINDOWS\\SYSTEM32\\ordsrego.exe ELT001" "item"="TA_Start" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="" "hkey"="HKLM" "command"="" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\1pop06apelt3] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="octeltpop" "hkey"="HKLM" "command"="C:\\WINDOWS\\octeltpop.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="DirectCD" "hkey"="HKLM" "command"="\"C:\\Program Files\\Roxio\\Easy CD Creator 5\\DirectCD\\DirectCD.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="aim" "hkey"="HKCU" "command"="C:\\PROGRA~1\\AIM\\aim.exe -cnetwait.odl" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Apoint" "hkey"="HKLM" "command"="C:\\Program Files\\Apoint\\Apoint.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIModeChange] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Ati2mdxx" "hkey"="HKLM" "command"="Ati2mdxx.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="atiptaxx" "hkey"="HKLM" "command"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Blubster] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Blubster" "hkey"="HKLM" "command"="C:\\Program Files\\Blubster\\Blubster.exe SILENT" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ccApp" "hkey"="HKLM" "command"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccRegVfy] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ccRegVfy" "hkey"="HKLM" "command"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccRegVfy.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ctfmon" "hkey"="HKCU" "command"="C:\\WINDOWS\\System32\\ctfmon.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="quickset" "hkey"="HKLM" "command"="C:\\Program Files\\Dell\\QuickSet\\quickset.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDSentry] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="DSentry" "hkey"="HKLM" "command"="C:\\WINDOWS\\System32\\DSentry.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AOLHostManager" "hkey"="HKLM" "command"="C:\\Program Files\\Common Files\\AOL\\1127000592\\ee\\AOLHostManager.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IpWins] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ipwins" "hkey"="HKLM" "command"="C:\\Program Files\\ipwins\\ipwins.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kda25078] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="RUNDLL32" "hkey"="HKLM" "command"="RUNDLL32.EXE w35fa7e3.dll,n 006250720000000235fa7e3" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="dumprep 0 -k" "hkey"="HKLM" "command"="%systemroot%\\system32\\dumprep 0 -k" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="mmtask" "hkey"="HKLM" "command"="C:\\Program Files\\MUSICMATCH\\MUSICMATCH Jukebox\\mmtask.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="mm_tray" "hkey"="HKLM" "command"="C:\\Program Files\\MUSICMATCH\\MUSICMATCH Jukebox\\mm_tray.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ms0658718-14701] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ms0658718-14701" "hkey"="HKLM" "command"="C:\\WINDOWS\\ms0658718-14701.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msmsgs" "hkey"="HKCU" "command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ncao] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="dvdplay" "hkey"="HKCU" "command"="\"C:\\PROGRA~1\\COMMON~1\\SSTEM3~1\\dvdplay.exe\" -vt ndrv" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCTVOICE] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="pctspk" "hkey"="HKLM" "command"="pctspk.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Popup Ad Filter] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="PopFilter" "hkey"="HKCU" "command"="C:\\Program Files\\Meaya\\Popup Ad Filter\\PopFilter.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PRONoMgr.exe] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="PRONoMgr" "hkey"="HKLM" "command"="C:\\Program Files\\Intel\\NCS\\PROSet\\PRONoMgr.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\REGSHAVE] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="REGSHAVE" "hkey"="HKLM" "command"="C:\\Program Files\\REGSHAVE\\REGSHAVE.EXE /AUTORUN" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\syihlwcmnpb] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="uaiovo" "hkey"="HKLM" "command"="C:\\WINDOWS\\System32\\uaiovo.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\System Clock Manager] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="sysclockmsngr" "hkey"="HKLM" "command"="sysclockmsngr.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="realsched" "hkey"="HKLM" "command"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ViewMgr" "hkey"="HKLM" "command"="C:\\Program Files\\Viewpoint\\Viewpoint Manager\\ViewMgr.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wcmdmgr] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="wcmdmgrl" "hkey"="HKLM" "command"="C:\\WINDOWS\\wt\\updater\\wcmdmgrl.exe -launch" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zkmz] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="zkmzm" "hkey"="HKCU" "command"="C:\\PROGRA~1\\COMMON~1\\zkmz\\zkmzm.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\_mzu_stonedrv3] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="_mzu_stonedrv3" "hkey"="HKCU" "command"="c:\\windows\\system32\\_mzu_stonedrv3.exe" "inimapping"="0" HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pcvb HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rpcc HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winsys2freg [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\AppleSoftwareUpdate.job C:\WINDOWS\tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1062084292.job C:\WINDOWS\tasks\Symantec NetDetect.job Completion time: 06-11-09 19:46:22.48 C:\ComboFix.txt … 06-11-09 19:46

I'm going to need a new HijackThis! log before I can continue.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.begin2search.com/sidesearch.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.begin2search.com/sidesearch.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.begin2search.com/sidesearch.html

R3 - URLSearchHook: (no name) - {7BEA7BB8-B471-9DF7-2C20-BDCE64E9EAC6} - C:\WINDOWS\System32\vke.dll

O4 - HKLM\..\RunServices: [System Clock Manager] sysclockmsngr.exe

O4 - HKLM\..\RunServices: [_mzu_stonedrv3] c:\windows\system32\_mzu_stonedrv3.exe

O4 - HKCU\..\Run: [Qzqhzgr] C:\Program Files\Common Files\?ystem32\m?config.exe

O4 - HKCU\..\Run: [Ncao] "C:\PROGRA~1\COMMON~1\SSTEM3~1\dvdplay.exe" -vt ndrv

O15 - Trusted Zone: *.elitemediagroup.net

O16 - DPF: {5526B4C6-63D6-41A1-9783-0FABF529859A} - http://cabs.elitemediagroup.net/cabs/eliteview.cab

O16 - DPF: {E4C29FDC-F547-4219-ACFD-571F2A7A564A} (WebCamTest Class) - http://awbeta.net-nucleus.com/CABUPDATES/winwcd.cab

O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab

O23 - Service: LCKDURFQIRO - Unknown owner - C:\DOCUME~1\Michelle\LOCALS~1\Temp\LCKDURFQIRO.exe (file missing)

O23 - Service: WGMKF - Unknown owner - C:\DOCUME~1\Michelle\LOCALS~1\Temp\WGMKF.exe (file missing)

O23 - Service: ZNU - Unknown owner - C:\DOCUME~1\Michelle\LOCALS~1\Temp\ZNU.exe (file missing)

Then click "Fix checked" and close HijackThis!

Reboot in "safe" mode.

Find and delete:

C:\WINDOWS\System32\vke.dll <— file

C:\WINDOWS\System32\sysclockmsngr.exe <— file

c:\windows\system32\_mzu_stonedrv3.exe <— file

C:\Program Files\Common Files\?ystem32 <— FOLDER

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new HijackThis! log file into this thread.

Give me 5 or 10 minutes and I should have this done…

I think I have a nickel or a dime to spare….

Looks "hijack free" to me.

Things working OK for you?


Securing Your PC After An Attack

yeah its much better. thanks for your help.

Thank you for choosing TomCoyote for your malware removal solutions.

M68

Please read:
Securing Your PC After An Attack

This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.