What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

A Little Help Please. Computer Doesnt Compute!

33 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #32
Okay I'll try again:

here is combofix:

Tessa - 06-11-26 18:45:23.82 Service Pack 1
ComboFix 06.11.9 - Running from: "C:\Documents and Settings\Tessa\Desktop"

((((((((((((((((((((((((((((((( Files Created from 2006-10-26 to 2006-11-26 ))))))))))))))))))))))))))))))))))


2006-11-22 22:47 53,248 –a—— C:\WINNT\system32\PrxerNsp.dll
2006-11-22 22:47 53,248 –a—— C:\WINNT\system32\PrxerDrv.dll
2006-11-18 16:23 3,968 –a—— C:\WINNT\system32\drivers\AvgAsCln.sys
2006-11-16 22:11 47,104 –a—— C:\ATF-Cleaner.exe
2006-11-15 21:26 991,232 –a—— C:\WINNT\system32\esent.dll
2006-11-14 21:38 98,304 –a—— C:\WINNT\system32\oleprn.dll
2006-11-14 21:38 94,208 –a—— C:\WINNT\system32\odbccp32.dll
2006-11-14 21:38 91,136 –a—— C:\WINNT\system32\rastls.dll
2006-11-14 21:38 9,216 –a—— C:\WINNT\system32\wuauserv.dll
2006-11-14 21:38 891,711 ——— C:\WINNT\system32\drivers\nv4_mini.sys
2006-11-14 21:38 88,064 –a—— C:\WINNT\system32\tscfgwmi.dll
2006-11-14 21:38 87,304 –a—— C:\WINNT\system32\rdpdd.dll
2006-11-14 21:38 86,528 –a—— C:\WINNT\system32\wlnotify.dll
2006-11-14 21:38 86,016 –a—— C:\WINNT\system32\xactsrv.dll
2006-11-14 21:38 82,944 –a—— C:\WINNT\system32\smlogsvc.exe
2006-11-14 21:38 82,944 –a—— C:\WINNT\system32\psbase.dll
2006-11-14 21:38 81,920 –a—— C:\WINNT\system32\trkwks.dll
2006-11-14 21:38 8,192 –a—— C:\WINNT\system32\scrnsave.scr
2006-11-14 21:38 77,824 –a—— C:\WINNT\system32\wmpstub.exe
2006-11-14 21:38 77,824 –a—— C:\WINNT\system32\wmpshell.dll
2006-11-14 21:38 75,912 –a—— C:\WINNT\system32\rdpwsx.dll
2006-11-14 21:38 74,240 –a—— C:\WINNT\system32\rtcshare.exe
2006-11-14 21:38 72,192 –a—— C:\WINNT\system32\telnet.exe
2006-11-14 21:38 71,168 –a—— C:\WINNT\system32\storprop.dll
2006-11-14 21:38 71,168 –a—— C:\WINNT\system32\sdbinst.exe
2006-11-14 21:38 686,080 –a—— C:\WINNT\system32\opengl32.dll
2006-11-14 21:38 667,648 –a—— C:\WINNT\system32\ss3dfo.scr
2006-11-14 21:38 66,560 –a—— C:\WINNT\system32\spoolss.dll
2006-11-14 21:38 66,048 –a—— C:\WINNT\system32\sigverif.exe
2006-11-14 21:38 638,976 –a—— C:\WINNT\system32\sstext3d.scr
2006-11-14 21:38 63,488 –a—— C:\WINNT\system32\srclient.dll
2006-11-14 21:38 62,976 –a—— C:\WINNT\system32\shgina.dll
2006-11-14 21:38 61,952 –a—— C:\WINNT\system32\sti.dll
2006-11-14 21:38 61,440 –a—— C:\WINNT\system32\odbccu32.dll
2006-11-14 21:38 61,440 –a—— C:\WINNT\system32\odbccr32.dll
2006-11-14 21:38 60,416 –a—— C:\WINNT\system32\wextract.exe
2006-11-14 21:38 60,416 –a—— C:\WINNT\system32\shimeng.dll
2006-11-14 21:38 6,144 –a—— C:\WINNT\system32\sensapi.dll
2006-11-14 21:38 58,880 –a—— C:\WINNT\system32\pautoenr.dll
2006-11-14 21:38 57,856 –a—— C:\WINNT\system32\raschap.dll
2006-11-14 21:38 569,344 –a—— C:\WINNT\system32\sspipes.scr
2006-11-14 21:38 56,832 –a—— C:\WINNT\system32\wzcdlg.dll
2006-11-14 21:38 56,320 –a—— C:\WINNT\system32\remotepg.dll
2006-11-14 21:38 548,864 –a—— C:\WINNT\system32\rtcdll.dll
2006-11-14 21:38 534,016 –a—— C:\WINNT\system32\spider.exe
2006-11-14 21:38 53,248 –a—— C:\WINNT\system32\packager.exe
2006-11-14 21:38 53,248 –a—— C:\WINNT\system32\odbcconf.exe
2006-11-14 21:38 52,224 –a—— C:\WINNT\system32\secur32.dll
2006-11-14 21:38 511,488 –a—— C:\WINNT\system32\qedit.dll
2006-11-14 21:38 51,200 –a—— C:\WINNT\system32\wmerrenu.dll
2006-11-14 21:38 5,504 ——— C:\WINNT\system32\drivers\smbali.sys
2006-11-14 21:38 48,640 –a—— C:\WINNT\system32\vdmredir.dll
2006-11-14 21:38 48,128 –a—— C:\WINNT\system32\winsta.dll
2006-11-14 21:38 48,128 –a—— C:\WINNT\system32\reg.exe
2006-11-14 21:38 479,261 –a—— C:\WINNT\system32\vbscript.dll
2006-11-14 21:38 47,616 –a—— C:\WINNT\system32\utilman.exe
2006-11-14 21:38 446,464 –a—— C:\WINNT\system32\wmvdmoe.dll
2006-11-14 21:38 442,398 –a—— C:\WINNT\system32\wmadmoe.dll
2006-11-14 21:38 44,032 –a—— C:\WINNT\system32\regapi.dll
2006-11-14 21:38 44,032 –a—— C:\WINNT\system32\rdpclip.exe
2006-11-14 21:38 43,008 –a—— C:\WINNT\system32\ssdpsrv.dll
2006-11-14 21:38 423,424 –a—— C:\WINNT\system32\riched20.dll
2006-11-14 21:38 420,864 –a—— C:\WINNT\system32\shimgvw.dll
2006-11-14 21:38 409,088 –a—— C:\WINNT\system32\vssapi.dll
2006-11-14 21:38 40,960 –a—— C:\WINNT\system32\tscupgrd.exe
2006-11-14 21:38 392,704 –a—— C:\WINNT\system32\ntmssvc.dll
2006-11-14 21:38 385,024 –a—— C:\WINNT\system32\sqlsrv32.dll
2006-11-14 21:38 384,000 –a—— C:\WINNT\system32\themeui.dll
2006-11-14 21:38 38,912 –a—— C:\WINNT\system32\wsnmp32.dll
2006-11-14 21:38 38,400 –a—— C:\WINNT\system32\ntmsapi.dll
2006-11-14 21:38 38,400 –a—— C:\WINNT\system32\ntlanman.dll
2006-11-14 21:38 364,544 –a—— C:\WINNT\system32\ssflwbox.scr
2006-11-14 21:38 36,352 –a—— C:\WINNT\system32\sens.dll
2006-11-14 21:38 357,376 –a—— C:\WINNT\system32\qdvd.dll
2006-11-14 21:38 34,304 –a—— C:\WINNT\system32\rcimlby.exe
2006-11-14 21:38 339,456 –a—— C:\WINNT\system32\usp10.dll
2006-11-14 21:38 334,848 –a—— C:\WINNT\system32\smlogcfg.dll
2006-11-14 21:38 33,280 –a—— C:\WINNT\system32\shmgrate.exe
2006-11-14 21:38 32,768 –a—— C:\WINNT\system32\odbcad32.exe
2006-11-14 21:38 32,256 –a—— C:\WINNT\system32\umandlg.dll
2006-11-14 21:38 316,416 –a—— C:\WINNT\system32\zipfldr.dll
2006-11-14 21:38 316,416 –a—— C:\WINNT\system32\wiaservc.dll
2006-11-14 21:38 311,327 –a—— C:\WINNT\system32\wmv8dmod.dll
2006-11-14 21:38 31,744 –a—— C:\WINNT\system32\pid.dll
2006-11-14 21:38 3,494,303 ——— C:\WINNT\system32\nv4_disp.dll
2006-11-14 21:38 3,338 –a—— C:\WINNT\system32\redir.exe
2006-11-14 21:38 297,984 –a—— C:\WINNT\system32\scesrv.dll
2006-11-14 21:38 296,448 –a—— C:\WINNT\system32\wmstream.dll
2006-11-14 21:38 294,912 –a—— C:\WINNT\system32\wmvdmod.dll
2006-11-14 21:38 274,432 –a—— C:\WINNT\system32\wmasf.dll
2006-11-14 21:38 27,136 –a—— C:\WINNT\system32\ssdpapi.dll
2006-11-14 21:38 266,752 –a—— C:\WINNT\winhlp32.exe
2006-11-14 21:38 264,704 –a—— C:\WINNT\system32\wzcsvc.dll
2006-11-14 21:38 258,048 –a—— C:\WINNT\system32\webcheck.dll
2006-11-14 21:38 254,976 –a—— C:\WINNT\system32\pdh.dll
2006-11-14 21:38 253,952 –a—— C:\WINNT\system32\wmpcd.dll
2006-11-14 21:38 253,952 –a—— C:\WINNT\system32\wmnetmgr.dll
2006-11-14 21:38 251,904 –a—— C:\WINNT\system32\strmdll.dll
2006-11-14 21:38 247,808 –a—— C:\WINNT\system32\wow32.dll
2006-11-14 21:38 24,576 –a—— C:\WINNT\system32\odbcbcp.dll
2006-11-14 21:38 24,064 –a—— C:\WINNT\system32\skeys.exe
2006-11-14 21:38 231,424 –a—— C:\WINNT\system32\upnpui.dll
2006-11-14 21:38 23,552 –a—— C:\WINNT\system32\wzcsapi.dll
2006-11-14 21:38 226,816 –a—— C:\WINNT\system32\srrstr.dll
2006-11-14 21:38 22,528 –a—— C:\WINNT\system32\slayerxp.dll
2006-11-14 21:38 22,528 –a—— C:\WINNT\system32\shfolder.dll
2006-11-14 21:38 22,016 –a—— C:\WINNT\system32\udhisapi.dll
2006-11-14 21:38 212,480 –a—— C:\WINNT\system32\osk.exe
2006-11-14 21:38 203,264 –a—— C:\WINNT\system32\uxtheme.dll
2006-11-14 21:38 200,704 –a—— C:\WINNT\system32\odbc32.dll
2006-11-14 21:38 200,192 –a—— C:\WINNT\system32\termsrv.dll
2006-11-14 21:38 193,536 –a—— C:\WINNT\system32\rasppp.dll
2006-11-14 21:38 19,456 –a—— C:\WINNT\system32\ssmarque.scr
2006-11-14 21:38 184,832 –a—— C:\WINNT\system32\qcap.dll
2006-11-14 21:38 184,320 –a—— C:\WINNT\system32\wmadmod.dll
2006-11-14 21:38 18,944 –a—— C:\WINNT\system32\ssbezier.scr
2006-11-14 21:38 174,592 –a—— C:\WINNT\system32\scecli.dll
2006-11-14 21:38 172,664 –a—— C:\WINNT\system32\xenroll.dll
2006-11-14 21:38 171,520 –a—— C:\WINNT\system32\winmm.dll
2006-11-14 21:38 171,008 –a—— C:\WINNT\system32\sccsccp.dll
2006-11-14 21:38 17,408 –a—— C:\WINNT\system32\wtsapi32.dll
2006-11-14 21:38 17,408 –a—— C:\WINNT\system32\ssmyst.scr
2006-11-14 21:38 17,408 –a—— C:\WINNT\system32\psapi.dll
2006-11-14 21:38 169,984 –a—— C:\WINNT\system32\sccbase.dll
2006-11-14 21:38 168,448 –a—— C:\WINNT\system32\wldap32.dll
2006-11-14 21:38 165,888 –a—— C:\WINNT\system32\ntmsdba.dll
2006-11-14 21:38 165,376 –a—— C:\WINNT\system32\w32time.dll
2006-11-14 21:38 165,376 –a—— C:\WINNT\system32\tapi32.dll
2006-11-14 21:38 164,864 –a—— C:\WINNT\system32\upnphost.dll
2006-11-14 21:38 16,896 –a—— C:\WINNT\system32\snmpapi.dll
2006-11-14 21:38 16,384 –a—— C:\WINNT\system32\watchdog.sys
2006-11-14 21:38 16,384 –a—— C:\WINNT\system32\ups.exe
2006-11-14 21:38 16,384 –a—— C:\WINNT\system32\ping.exe
2006-11-14 21:38 16,384 –a—— C:\WINNT\system32\odbc32gt.dll
2006-11-14 21:38 159,232 –a—— C:\WINNT\system32\schedsvc.dll
2006-11-14 21:38 158,720 –a—— C:\WINNT\system32\srsvc.dll
2006-11-14 21:38 147,456 –a—— C:\WINNT\system32\odbctrac.dll
2006-11-14 21:38 14,848 –a—— C:\WINNT\system32\rdpsnd.dll
2006-11-14 21:38 137,216 –a—— C:\WINNT\system32\ntshrui.dll
2006-11-14 21:38 135,680 –a—— C:\WINNT\system32\rdchost.dll
2006-11-14 21:38 134,144 –a—— C:\WINNT\regedit.exe
2006-11-14 21:38 133,632 –a—— C:\WINNT\system32\rsaenh.dll
2006-11-14 21:38 133,120 –a—— C:\WINNT\system32\sfc_os.dll
2006-11-14 21:38 130,560 –a—— C:\WINNT\system32\sti_ci.dll
2006-11-14 21:38 13,824 –a—— C:\WINNT\system32\rassapi.dll
2006-11-14 21:38 13,312 –a—— C:\WINNT\system32\ssstars.scr
2006-11-14 21:38 128,512 –a—— C:\WINNT\system32\taskmgr.exe
2006-11-14 21:38 124,928 –a—— C:\WINNT\system32\webvw.dll
2006-11-14 21:38 122,880 –a—— C:\WINNT\system32\odbcconf.dll
2006-11-14 21:38 120,320 –a—— C:\WINNT\system32\upnp.dll
2006-11-14 21:38 12,800 –a—— C:\WINNT\system32\runonce.exe
2006-11-14 21:38 12,288 –a—— C:\WINNT\system32\rdsaddin.exe
2006-11-14 21:38 12,288 –a—— C:\WINNT\system32\odbcp32r.dll
2006-11-14 21:38 119,808 –a—— C:\WINNT\system32\wiadss.dll
2006-11-14 21:38 118,784 –a—— C:\WINNT\system32\wmsdmoe.dll
2006-11-14 21:38 117,760 –a—— C:\WINNT\system32\stobject.dll
2006-11-14 21:38 112,128 –a—— C:\WINNT\system32\ntmarta.dll
2006-11-14 21:38 110,592 –a—— C:\WINNT\system32\wmsdmod.dll
2006-11-14 21:38 11,776 –a—— C:\WINNT\system32\sigtab.dll
2006-11-14 21:38 109,568 –a—— C:\WINNT\system32\offfilt.dll
2006-11-14 21:38 106,496 –a—— C:\WINNT\system32\url.dll
2006-11-14 21:38 10,752 –a—— C:\WINNT\system32\tracert.exe
2006-11-14 21:38 10,752 –a—— C:\WINNT\hh.exe
2006-11-14 21:38 1,998,848 –a—— C:\WINNT\system32\wmploc.dll
2006-11-14 21:38 1,350,144 –a—— C:\WINNT\system32\query.dll
2006-11-14 21:38 1,298,432 –a—— C:\WINNT\system32\wmpcore.dll
2006-11-14 21:38 1,220,608 –a—— C:\WINNT\system32\wmvcore.dll
2006-11-14 21:38 1,157,632 –a—— C:\WINNT\system32\sfcfiles.dll
2006-11-14 21:37 95,744 –a—— C:\WINNT\system32\nlhtml.dll
2006-11-14 21:37 921,475 ——— C:\WINNT\system32\ati3d2ag.dll
2006-11-14 21:37 91,136 –a—— C:\WINNT\system32\MSOERT2.DLL
2006-11-14 21:37 9,728 –a—— C:\WINNT\system32\mstinit.exe
2006-11-14 21:37 857,600 –a—— C:\WINNT\system32\netplwiz.dll
2006-11-14 21:37 844,675 ——— C:\WINNT\system32\ati3d1ag.dll
2006-11-14 21:37 699,392 –a—— C:\WINNT\system32\msxml2.dll
2006-11-14 21:37 68,608 –a—— C:\WINNT\system32\mscms.dll
2006-11-14 21:37 67,584 –a—— C:\WINNT\system32\msctfp.dll
2006-11-14 21:37 65,536 –a—— C:\WINNT\system32\msconf.dll
2006-11-14 21:37 63,663 –a—— C:\WINNT\system32\drivers\atinrvxx.sys
2006-11-14 21:37 6,912 ——— C:\WINNT\system32\drivers\hidir.sys
2006-11-14 21:37 6,656 –a—— C:\WINNT\system32\laprxy.dll
2006-11-14 21:37 598,016 –a—— C:\WINNT\system32\mstscax.dll
2006-11-14 21:37 584,192 –a—— C:\WINNT\system32\netcfgx.dll
2006-11-14 21:37 57,856 –a—— C:\WINNT\system32\licwmi.dll
2006-11-14 21:37 56,591 –a—— C:\WINNT\system32\drivers\atinbtxx.sys
2006-11-14 21:37 56,320 –a—— C:\WINNT\system32\mshtmler.dll
2006-11-14 21:37 552,991 –a—— C:\WINNT\system32\msrepl40.dll
2006-11-14 21:37 512,031 –a—— C:\WINNT\system32\msexch40.dll
2006-11-14 21:37 504,832 ——— C:\WINNT\system32\msftedit.dll
2006-11-14 21:37 504,320 –a—— C:\WINNT\system32\logonui.exe
2006-11-14 21:37 5,120 ——— C:\WINNT\system32\hccoin.dll
2006-11-14 21:37 49,152 –a—— C:\WINNT\system32\npptools.dll
2006-11-14 21:37 450,176 ——— C:\WINNT\system32\drivers\ati2mtag.sys
2006-11-14 21:37 421,919 –a—— C:\WINNT\system32\msrd2x40.dll
2006-11-14 21:37 42,496 –a—— C:\WINNT\system32\ncobjapi.dll
2006-11-14 21:37 403,456 ——— C:\WINNT\system32\winbrand.dll
2006-11-14 21:37 401,462 –a—— C:\WINNT\system32\msvcp60.dll
2006-11-14 21:37 4,608 –a—— C:\WINNT\system32\msimg32.dll
2006-11-14 21:37 4,126 –a—— C:\WINNT\system32\msdxmlc.dll
2006-11-14 21:37 399,360 –a—— C:\WINNT\system32\netlogon.dll
2006-11-14 21:37 39,424 –a—— C:\WINNT\system32\net.exe
2006-11-14 21:37 388,608 –a—— C:\WINNT\system32\mstsc.exe
2006-11-14 21:37 381,440 –a—— C:\WINNT\system32\lmrt.dll
2006-11-14 21:37 377,984 –a—— C:\WINNT\system32\ati2dvaa.dll
2006-11-14 21:37 368,710 –a—— C:\WINNT\system32\msisam11.dll
2006-11-14 21:37 36,463 –a—— C:\WINNT\system32\drivers\atintuxx.sys
2006-11-14 21:37 348,195 –a—— C:\WINNT\system32\msjetoledb40.dll
2006-11-14 21:37 348,191 –a—— C:\WINNT\system32\mspbde40.dll
2006-11-14 21:37 344,095 –a—— C:\WINNT\system32\msxbde40.dll
2006-11-14 21:37 34,735 –a—— C:\WINNT\system32\drivers\atinxsxx.sys
2006-11-14 21:37 339,968 –a—— C:\WINNT\system32\mspaint.exe
2006-11-14 21:37 33,808 –a—— C:\WINNT\system32\ntio.sys
2006-11-14 21:37 327,040 –a—— C:\WINNT\system32\drivers\ati2mtaa.sys
2006-11-14 21:37 326,656 –a—— C:\WINNT\system32\netsetup.exe
2006-11-14 21:37 323,072 –a—— C:\WINNT\system32\msvcrt.dll
2006-11-14 21:37 32,256 –a—— C:\WINNT\system32\mnmdd.dll
2006-11-14 21:37 319,760 –a—— C:\WINNT\system32\msnsspc.dll
2006-11-14 21:37 319,519 –a—— C:\WINNT\system32\msexcl40.dll
2006-11-14 21:37 30,671 –a—— C:\WINNT\system32\drivers\atinraxx.sys
2006-11-14 21:37 3,584 ——— C:\WINNT\system32\dsprpres.dll
2006-11-14 21:37 29,455 –a—— C:\WINNT\system32\drivers\atinxbxx.sys
2006-11-14 21:37 266,752 –a—— C:\WINNT\system32\msctf.dll
2006-11-14 21:37 26,367 –a—— C:\WINNT\system32\drivers\atinsnxx.sys
2006-11-14 21:37 253,983 –a—— C:\WINNT\system32\mstext40.dll
2006-11-14 21:37 250,368 –a—— C:\WINNT\system32\mstask.dll
2006-11-14 21:37 241,725 –a—— C:\WINNT\system32\msuni11.dll
2006-11-14 21:37 241,695 –a—— C:\WINNT\system32\msjtes40.dll
2006-11-14 21:37 24,576 –a—— C:\WINNT\system32\nmmkcert.dll
2006-11-14 21:37 24,576 –a—— C:\WINNT\system32\logagent.exe
2006-11-14 21:37 238,080 –a—— C:\WINNT\system32\newdev.dll
2006-11-14 21:37 233,472 –a—— C:\WINNT\system32\mpg4dmod.dll
2006-11-14 21:37 230,400 –a—— C:\WINNT\system32\msieftp.dll
2006-11-14 21:37 229,376 –a—— C:\WINNT\system32\MSOEACCT.DLL
2006-11-14 21:37 22,528 –a—— C:\WINNT\system32\mslbui.dll
2006-11-14 21:37 219,648 –a—— C:\WINNT\system32\logon.scr
2006-11-14 21:37 218,112 ——— C:\WINNT\system32\sbe.dll
2006-11-14 21:37 213,023 –a—— C:\WINNT\system32\msltus40.dll
2006-11-14 21:37 210,944 –a—— C:\WINNT\system32\moricons.dll
2006-11-14 21:37 21,343 ——— C:\WINNT\system32\drivers\atinttxx.sys
2006-11-14 21:37 202,496 ——— C:\WINNT\system32\ati2dvag.dll
2006-11-14 21:37 196,096 –a—— C:\WINNT\system32\mobsync.dll
2006-11-14 21:37 192,512 –a—— C:\WINNT\system32\mswebdvd.dll
2006-11-14 21:37 19,456 –a—— C:\WINNT\system32\licmgr10.dll
2006-11-14 21:37 19,328 ——— C:\WINNT\system32\drivers\usbehci.sys
2006-11-14 21:37 187,904 ——— C:\WINNT\system32\xpsp1res.dll
2006-11-14 21:37 182,784 –a—— C:\WINNT\system32\msutb.dll
2006-11-14 21:37 18,944 ——— C:\WINNT\system32\faxpatch.exe
2006-11-14 21:37 174,592 –a—— C:\WINNT\system32\msnetobj.dll
2006-11-14 21:37 172,032 ——— C:\WINNT\system32\mssap.dll
2006-11-14 21:37 163,840 –a—— C:\WINNT\system32\mindex.dll
2006-11-14 21:37 16,384 –a—— C:\WINNT\system32\nddenb32.dll
2006-11-14 21:37 155,648 ——— C:\WINNT\system32\encdec.dll
2006-11-14 21:37 143,872 –a—— C:\WINNT\system32\msimtf.dll
2006-11-14 21:37 131,072 –a—— C:\WINNT\system32\msorcl32.dll
2006-11-14 21:37 13,056 ——— C:\WINNT\system32\drivers\wacompen.sys
2006-11-14 21:37 126,976 –a—— C:\WINNT\system32\msdart.dll
2006-11-14 21:37 12,288 –a—— C:\WINNT\system32\mscpx32r.dll
2006-11-14 21:37 12,288 ——— C:\WINNT\system32\encapi.dll
2006-11-14 21:37 12,047 ——— C:\WINNT\system32\drivers\atinpdxx.sys
2006-11-14 21:37 116,736 –a—— C:\WINNT\system32\mplay32.exe
2006-11-14 21:37 115,200 –a—— C:\WINNT\system32\net1.exe
2006-11-14 21:37 113,664 –a—— C:\WINNT\system32\msvfw32.dll
2006-11-14 21:37 110,080 ——— C:\WINNT\system32\sbeio.dll
2006-11-14 21:37 11,904 ——— C:\WINNT\system32\drivers\mutohpen.sys
2006-11-14 21:37 11,615 –a—— C:\WINNT\system32\drivers\atinmdxx.sys
2006-11-14 21:37 105,984 –a—— C:\WINNT\system32\netdde.exe
2006-11-14 21:37 10,240 –a—— C:\WINNT\system32\msrle32.dll
2006-11-14 21:37 10,240 –a—— C:\WINNT\system32\localui.dll
2006-11-14 21:37 1,677,312 ——— C:\WINNT\system32\wmvcore2.dll
2006-11-14 21:37 1,622,528 –a—— C:\WINNT\system32\netshell.dll
2006-11-14 21:37 1,503,262 –a—— C:\WINNT\system32\msjet40.dll
2006-11-14 21:37 1,220,608 –a—— C:\WINNT\system32\msvidctl.dll
2006-11-14 21:37 1,128,960 –a—— C:\WINNT\system32\mmcndmgr.dll
2006-11-14 21:36 98,816 –a—— C:\WINNT\system32\clipbrd.exe
2006-11-14 21:36 94,720 –a—— C:\WINNT\system32\dmusic.dll
2006-11-14 21:36 91,648 –a—— C:\WINNT\system32\iuctl.dll
2006-11-14 21:36 9,216 –a—— C:\WINNT\system32\icaapi.dll
2006-11-14 21:36 9,216 –a—— C:\WINNT\system32\dumprep.exe
2006-11-14 21:36 88,576 –a—— C:\WINNT\system32\mqsec.dll
2006-11-14 21:36 802,304 –a—— C:\WINNT\system32\dxmrtp.dll
2006-11-14 21:36 8,832 –a—— C:\WINNT\system32\framebuf.dll
2006-11-14 21:36 786,432 –a—— C:\WINNT\system32\dxdiag.exe
2006-11-14 21:36 77,312 –a—— C:\WINNT\system32\dmscript.dll
2006-11-14 21:36 76,830 –a—— C:\WINNT\system32\drmstor.dll
2006-11-14 21:36 76,288 –a—— C:\WINNT\system32\dfrgfat.exe
2006-11-14 21:36 73,728 –a—— C:\WINNT\system32\tlntsess.exe
2006-11-14 21:36 73,728 –a—— C:\WINNT\system32\ils.dll
2006-11-14 21:36 70,656 –a—— C:\WINNT\system32\defrag.exe
2006-11-14 21:36 70,144 –a—— C:\WINNT\system32\cryptdlg.dll
2006-11-14 21:36 7,168 –a—— C:\WINNT\system32\tlntsvrp.dll
2006-11-14 21:36 7,168 –a—— C:\WINNT\system32\fxsperf.dll
2006-11-14 21:36 7,040 –a—— C:\WINNT\system32\kd1394.dll
2006-11-14 21:36 67,584 –a—— C:\WINNT\system32\tlntsvr.exe
2006-11-14 21:36 67,584 –a—— C:\WINNT\system32\fdeploy.dll
2006-11-14 21:36 67,456 –a—— C:\WINNT\system32\drivers\mqac.sys
2006-11-14 21:36 66,560 –a—— C:\WINNT\system32\faultrep.dll
2006-11-14 21:36 61,440 –a—— C:\WINNT\system32\dbnetlib.dll
2006-11-14 21:36 608,768 –a—— C:\WINNT\system32\mqqm.dll
2006-11-14 21:36 602,112 –a—— C:\WINNT\system32\drmv2clt.dll
2006-11-14 21:36 6,656 –a—— C:\WINNT\system32\fxsres.dll
2006-11-14 21:36 596,480 –a—— C:\WINNT\system32\INETCOMM.DLL
2006-11-14 21:36 59,392 –a—— C:\WINNT\system32\iesetup.dll
2006-11-14 21:36 58,368 –a—— C:\WINNT\system32\dpvsetup.exe
2006-11-14 21:36 57,856 –a—— C:\WINNT\system32\tlntadmn.exe
2006-11-14 21:36 57,856 –a—— C:\WINNT\system32\nwwks.dll
2006-11-14 21:36 57,344 –a—— C:\WINNT\system32\dmcompos.dll
2006-11-14 21:36 56,320 –a—— C:\WINNT\system32\dpnhupnp.dll
2006-11-14 21:36 559,616 –a—— C:\WINNT\system32\fxsst.dll
2006-11-14 21:36 55,296 –a—— C:\WINNT\system32\digest.dll
2006-11-14 21:36 545,792 –a—— C:\WINNT\system32\wsecedit.dll
2006-11-14 21:36 54,272 –a—— C:\WINNT\system32\clusapi.dll
2006-11-14 21:36 53,248 –a—— C:\WINNT\system32\cryptsvc.dll
2006-11-14 21:36 51,712 –a—— C:\WINNT\system32\ipconfig.exe
2006-11-14 21:36 498,205 –a—— C:\WINNT\system32\dxmasf.dll
2006-11-14 21:36 49,664 –a—— C:\WINNT\system32\ixsso.dll
2006-11-14 21:36 49,664 –a—— C:\WINNT\system32\dpwsockx.dll
2006-11-14 21:36 49,152 –a—— C:\WINNT\system32\eventlog.dll
2006-11-14 21:36 489,984 –a—— C:\WINNT\system32\dbghelp.dll
2006-11-14 21:36 478,720 –a—— C:\WINNT\system32\mqsnap.dll
2006-11-14 21:36 471,040 –a—— C:\WINNT\system32\cryptui.dll
2006-11-14 21:36 467,456 –a—— C:\WINNT\system32\mqutil.dll
2006-11-14 21:36 45,568 –a—— C:\WINNT\system32\docprop2.dll
2006-11-14 21:36 443,392 –a—— C:\WINNT\system32\fxsapi.dll
2006-11-14 21:36 435,200 –a—— C:\WINNT\system32\ipnathlp.dll
2006-11-14 21:36 42,537 –a—— C:\WINNT\system32\keyboard.sys
2006-11-14 21:36 41,472 –a—— C:\WINNT\system32\cmdl32.exe
2006-11-14 21:36 395,264 –a—— C:\WINNT\system32\fxsxp32.dll
2006-11-14 21:36 391,168 –a—— C:\WINNT\system32\fxstiff.dll
2006-11-14 21:36 380,445 –a—— C:\WINNT\system32\expsrv.dll
2006-11-14 21:36 38,912 –a—— C:\WINNT\system32\hhsetup.dll
2006-11-14 21:36 36,922 –a—— C:\WINNT\system32\imeshare.dll
2006-11-14 21:36 35,328 –a—— C:\WINNT\system32\dfrgsnap.dll
2006-11-14 21:36 324,608 –a—— C:\WINNT\system32\cmdial32.dll
2006-11-14 21:36 318,464 –a—— C:\WINNT\system32\ippromon.dll
2006-11-14 21:36 31,744 –a—— C:\WINNT\system32\dmloader.dll
2006-11-14 21:36 307,712 –a—— C:\WINNT\system32\cscui.dll
2006-11-14 21:36 30,208 –a—— C:\WINNT\system32\imgutil.dll
2006-11-14 21:36 294,912 –a—— C:\WINNT\system32\iedkcs32.dll
2006-11-14 21:36 29,696 –a—— C:\WINNT\system32\dpnhpast.dll
2006-11-14 21:36 29,696 ——— C:\WINNT\system32\asr_pfu.exe
2006-11-14 21:36 28,672 –a—— C:\WINNT\system32\ie4uinit.exe
2006-11-14 21:36 28,672 –a—— C:\WINNT\system32\dbnmpntw.dll
2006-11-14 21:36 28,160 –a—— C:\WINNT\system32\pidgen.dll
2006-11-14 21:36 277,504 –a—— C:\WINNT\system32\appmgr.dll
2006-11-14 21:36 271,360 –a—— C:\WINNT\system32\fxscomex.dll
2006-11-14 21:36 266,240 –a—— C:\WINNT\system32\drmclien.dll
2006-11-14 21:36 263,680 –a—— C:\WINNT\system32\duser.dll
2006-11-14 21:36 263,168 –a—— C:\WINNT\system32\devmgr.dll
2006-11-14 21:36 26,112 –a—— C:\WINNT\system32\dmband.dll
2006-11-14 21:36 253,440 –a—— C:\WINNT\system32\ddraw.dll
2006-11-14 21:36 250,368 –a—— C:\WINNT\system32\fxssvc.exe
2006-11-14 21:36 25,600 –a—— C:\WINNT\system32\dfsshlex.dll
2006-11-14 21:36 249,856 –a—— C:\WINNT\system32\adsiis.dll
2006-11-14 21:36 240,640 –a—— C:\WINNT\system32\hnetcfg.dll
2006-11-14 21:36 24,576 –a—— C:\WINNT\system32\dbmsvinn.dll
2006-11-14 21:36 24,576 –a—— C:\WINNT\system32\dbmsrpcn.dll
2006-11-14 21:36 24,576 –a—— C:\WINNT\system32\conime.exe
2006-11-14 21:36 24,064 –a—— C:\WINNT\system32\fxsdrv.dll
2006-11-14 21:36 238,592 –a—— C:\WINNT\system32\compatui.dll
2006-11-14 21:36 237,056 –a—— C:\WINNT\system32\icm32.dll
2006-11-14 21:36 236,032 –a—— C:\WINNT\system32\fxst30.dll
2006-11-14 21:36 231,936 –a—— C:\WINNT\system32\tracerpt.exe
2006-11-14 21:36 227,840 –a—— C:\WINNT\system32\dsquery.dll
2006-11-14 21:36 216,064 –a—— C:\WINNT\system32\fxscover.exe
2006-11-14 21:36 206,336 –a—— C:\WINNT\system32\dpvoice.dll
2006-11-14 21:36 204,288 –a—— C:\WINNT\system32\ieaksie.dll
2006-11-14 21:36 20,992 –a—— C:\WINNT\system32\fxsext32.dll
2006-11-14 21:36 20,480 –a—— C:\WINNT\system32\dbmsadsn.dll
2006-11-14 21:36 19,456 –a—— C:\WINNT\system32\fontview.exe
2006-11-14 21:36 19,456 –a—— C:\WINNT\system32\ersvc.dll
2006-11-14 21:36 185,856 –a—— C:\WINNT\system32\fxswzrd.dll
2006-11-14 21:36 183,808 –a—— C:\WINNT\system32\gptext.dll
2006-11-14 21:36 180,224 –a—— C:\WINNT\system32\dwwin.exe
2006-11-14 21:36 178,688 –a—— C:\WINNT\system32\eudcedit.exe
2006-11-14 21:36 172,544 –a—— C:\WINNT\system32\dmime.dll
2006-11-14 21:36 17,792 ——— C:\WINNT\system32\drivers\irbus.sys
2006-11-14 21:36 168,960 –a—— C:\WINNT\system32\dinput8.dll
2006-11-14 21:36 165,888 –a—— C:\WINNT\system32\mqrt.dll
2006-11-14 21:36 165,376 –a—— C:\WINNT\system32\els.dll
2006-11-14 21:36 164,352 –a—— C:\WINNT\system32\mqtrig.dll
2006-11-14 21:36 16,384 –a—— C:\WINNT\system32\ds32gt.dll
2006-11-14 21:36 158,720 –a—— C:\WINNT\system32\credui.dll
2006-11-14 21:36 156,672 –a—— C:\WINNT\system32\dpnet.dll
2006-11-14 21:36 156,672 –a—— C:\WINNT\system32\appmgmts.dll
2006-11-14 21:36 156,544 –a—— C:\WINNT\system32\drivers\nwrdr.sys
2006-11-14 21:36 151,552 –a—— C:\WINNT\system32\dinput.dll
2006-11-14 21:36 149,504 –a—— C:\WINNT\system32\fxsui.dll
2006-11-14 21:36 143,872 –a—— C:\WINNT\system32\itircl.dll
2006-11-14 21:36 14,848 –a—— C:\WINNT\system32\mqise.dll
2006-11-14 21:36 135,680 –a—— C:\WINNT\system32\dsprop.dll
2006-11-14 21:36 130,048 –a—— C:\WINNT\system32\mqad.dll
2006-11-14 21:36 130,048 –a—— C:\WINNT\system32\fxsclnt.exe
2006-11-14 21:36 13,312 –a—— C:\WINNT\system32\ctfmon.exe
2006-11-14 21:36 128,000 –a—— C:\WINNT\system32\itss.dll
2006-11-14 21:36 126,976 –a—— C:\WINNT\system32\ieakeng.dll
2006-11-14 21:36 124,928 –a—— C:\WINNT\system32\dssenh.dll
2006-11-14 21:36 123,904 –a—— C:\WINNT\system32\imapi.exe
2006-11-14 21:36 115,200 –a—— C:\WINNT\system32\dpcdll.dll
2006-11-14 21:36 114,176 –a—— C:\WINNT\system32\input.dll
2006-11-14 21:36 113,664 –a—— C:\WINNT\system32\schtasks.exe
2006-11-14 21:36 113,152 –a—— C:\WINNT\system32\idq.dll
2006-11-14 21:36 113,152 –a—— C:\WINNT\system32\gpresult.exe
2006-11-14 21:36 113,152 –a—— C:\WINNT\system32\dfrgui.dll
2006-11-14 21:36 110,080 –a—— C:\WINNT\system32\dmstyle.dll
2006-11-14 21:36 103,936 –a—— C:\WINNT\system32\rsnotify.exe
2006-11-14 21:36 103,936 –a—— C:\WINNT\system32\imm32.dll
2006-11-14 21:36 103,424 –a—— C:\WINNT\system32\dgnet.dll
2006-11-14 21:36 10,752 ——— C:\WINNT\system32\spiisupd.exe
2006-11-14 21:36 1,180,672 –a—— C:\WINNT\system32\d3d8.dll
2006-11-14 21:36 1,004,032 –a—— C:\WINNT\explorer.exe
2006-11-14 21:35 91,648 –a—— C:\WINNT\system32\ahui.exe
2006-11-14 21:35 91,136 –a—— C:\WINNT\system32\advpack.dll
2006-11-14 21:35 8,192 –a—— C:\WINNT\system32\autolfn.exe
2006-11-14 21:35 76,288 –a—— C:\WINNT\system32\avifil32.dll
2006-11-14 21:35 74,810 –a—— C:\WINNT\system32\atl.dll
2006-11-14 21:35 71,680 –a—— C:\WINNT\system32\browsewm.dll
2006-11-14 21:35 64,512 –a—— C:\WINNT\system32\ciodm.dll
2006-11-14 21:35 62,976 –a—— C:\WINNT\system32\browselc.dll
2006-11-14 21:35 62,464 –a—— C:\WINNT\system32\adsmsext.dll
2006-11-14 21:35 6,656 –a—— C:\WINNT\system32\batt.dll
2006-11-14 21:35 59,904 –a—— C:\WINNT\system32\cabinet.dll
2006-11-14 21:35 5,120 –a—— C:\WINNT\system32\asferror.dll
2006-11-14 21:35 49,152 –a—— C:\WINNT\system32\browser.dll
2006-11-14 21:35 41,984 –a—— C:\WINNT\system32\alg.exe
2006-11-14 21:35 38,912 –a—— C:\WINNT\system32\audiosrv.dll
2006-11-14 21:35 32,768 –a—— C:\WINNT\system32\cfgbkend.dll
2006-11-14 21:35 32,512 ——— C:\WINNT\system32\drivers\amdk7.sys
2006-11-14 21:35 239,616 –a—— C:\WINNT\system32\adsnt.dll
2006-11-14 21:35 22,528 –a—— C:\WINNT\system32\at.exe
2006-11-14 21:35 186,880 –a—— C:\WINNT\system32\certcli.dll
2006-11-14 21:35 162,816 –a—— C:\WINNT\system32\adsldp.dll
2006-11-14 21:35 14,366 –a—— C:\WINNT\system32\asfsipc.dll
2006-11-14 21:35 139,776 –a—— C:\WINNT\system32\adsldpc.dll
2006-11-14 21:35 115,712 –a—— C:\WINNT\system32\apphelp.dll
2006-11-14 20:19 593,408 –a—— C:\WINNT\system32\h323msp.dll
2006-11-14 20:15 97,280 –a—— C:\WINNT\system32\txflog.dll
2006-11-14 18:51 127,208 –a—— C:\WINNT\system32\mucltui.dll
2006-11-12 00:58 2,585,872 –a—— C:\WindowsInstaller-KB893803-v2-x86.exe
2006-11-12 00:54 9,692,736 –a—— C:\nmsetup.exe
2006-11-09 02:27 51,072 –a—— C:\WINNT\system32\drivers\ikhlayer.sys
2006-11-09 02:27 30,592 –a—— C:\WINNT\system32\drivers\ikhfile.sys
2006-11-09 02:24 8,598,632 –a—— C:\WINNT\sdsetup.exe
2006-11-08 21:42 7,168 –a—— C:\WINNT\system32\wamregps.dll
2006-11-08 21:42 60,416 –a—— C:\WINNT\system32\iismap.dll
2006-11-08 21:42 59,392 –a—— C:\WINNT\system32\iisext.dll
2006-11-08 21:42 34,816 –a—— C:\WINNT\system32\admwprox.dll
2006-11-08 21:42 3,584 –a—— C:\WINNT\system32\iismui.dll
2006-11-08 21:42 19,968 –a—— C:\WINNT\system32\inetsloc.dll
2006-11-08 21:42 13,312 –a—— C:\WINNT\system32\exstrace.dll
2006-11-08 21:42 120,832 –a—— C:\WINNT\system32\iisRtl.dll
2006-11-08 21:42 11,776 –a—— C:\WINNT\system32\infoadmn.dll
2006-11-08 21:22 24,661 –a—— C:\WINNT\system32\spxcoins.dll
2006-11-08 21:22 13,312 –a—— C:\WINNT\system32\irclass.dll
2006-11-08 20:33 124,184 –a—— C:\WINNT\system32\wuauclt.exe
2006-11-08 20:33 1,343,768 –a—— C:\WINNT\system32\wuaueng.dll
2006-11-03 03:19 499,200 –a—— C:\WINNT\system32\comuid.dll
2006-11-03 03:19 150,528 –a—— C:\WINNT\system32\msdtcuiu.dll
2006-11-03 03:18 974,336 –a—— C:\WINNT\system32\msdtctm.dll
2006-11-03 03:18 368,640 –a—— C:\WINNT\system32\msdtcprx.dll
2006-11-03 03:18 110,080 –a—— C:\WINNT\system32\clbcatex.dll
2006-11-02 23:35 8,464 –a—— C:\WINNT\system32\sporder.dll
2006-11-02 01:51 7,680 ——— C:\WINNT\system32\bitsprx2.dll
2006-11-02 01:51 7,168 ——— C:\WINNT\system32\bitsprx3.dll
2006-11-02 01:51 17,408 –a—— C:\WINNT\system32\qmgrprxy.dll
2006-11-02 01:50 331,776 –a—— C:\WINNT\system32\winhttp.dll
2006-11-02 01:37 d——– C:\WINNT\McAfee.com


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

Rootkit driver pe386 is present. A rootkit scan is required

2006-11-26 18:46 ——– d——– C:\Documents and Settings\Tessa\Application Data\Azureus
2006-11-25 21:52 9900 –a—— C:\Program Files\BBToolBar2.INI
2006-11-25 21:52 96 –a—— C:\Program Files\Default7BBC
2006-11-25 21:52 768 –a—— C:\Program Files\MySetup.DK
2006-11-25 21:52 46823 –a—— C:\Program Files\intrface.bbw
2006-11-25 21:52 3200 –a—— C:\Program Files\DEFAULT.ALI
2006-11-24 17:44 91098 –ah-c— C:\Program Files\bbw.GID
2006-11-23 19:59 64 –a—— C:\Documents and Settings\Tessa\Application Data\Current.prx
2006-11-23 19:56 ——– d——– C:\Program Files\Java
2006-11-22 22:47 ——– d——– C:\Program Files\Proxifier
2006-11-22 12:54 ——– d——– C:\Program Files\Spyware Doctor
2006-11-20 22:16 ——– d——– C:\Program Files\Grisoft
2006-11-20 16:21 ——– d-a—— C:\Program Files\Accessories
2006-11-20 16:21 ——– d——– C:\Program Files\PSDream
2006-11-20 15:03 ——– d——– C:\Documents and Settings\Tessa\Application Data\MSN6
2006-11-20 02:25 ——– d-a—— C:\Program Files\Common Files
2006-11-20 01:53 ——– d——– C:\Program Files\HJT
2006-11-18 19:12 40 –a—— C:\Program Files\Tuner.cfg
2006-11-18 19:07 80 –a–c— C:\Program Files\BURN.TXT
2006-11-18 16:56 203 –a–c— C:\Program Files\BBWERROR.LOG
2006-11-17 09:05 ——– d——– C:\Program Files\Messenger
2006-11-16 04:45 ——– d——– C:\Program Files\TrojanHunter 4.2
2006-11-16 04:07 ——– d-a—— C:\Program Files\Windows Media Player
2006-11-16 03:24 ——– d-a—— C:\Program Files\Outlook Express
2006-11-16 03:24 ——– d-a—— C:\Program Files\Common Files\System
2006-11-14 21:58 ——– d-a—— C:\Program Files\Internet Explorer
2006-11-14 21:48 ——– d-a—— C:\Program Files\NetMeeting
2006-11-14 21:48 ——– d——– C:\Program Files\Movie Maker
2006-11-14 18:50 ——– d-ah—– C:\Program Files\WindowsUpdate
2006-11-13 22:17 ——– d——– C:\Program Files\Google
2006-11-11 22:48 ——– d——– C:\Documents and Settings\Tessa\Application Data\DriveCleaner 2006 Free
2006-11-09 04:31 ——– d—s—- C:\Documents and Settings\Tessa\Application Data\Microsoft
2006-11-09 04:28 ——– d——– C:\Program Files\SpywareBlaster
2006-11-09 02:43 ——– d——– C:\Documents and Settings\Tessa\Application Data\Google
2006-11-09 02:27 ——– d——– C:\Documents and Settings\Tessa\Application Data\PC Tools
2006-11-09 02:09 ——– d-a—— C:\Program Files\Common Files\Services
2006-11-07 20:24 ——– d——– C:\Program Files\Dantz
2006-11-07 20:21 ——– d-a—— C:\Program Files\Common Files\InstallShield
2006-11-06 01:13 48128 –ahs—- C:\Program Files\Thumbs.db
2006-11-05 23:43 ——– d——– C:\Program Files\WinRAR
2006-11-03 00:21 ——– d——– C:\Program Files\Creative
2006-11-02 23:12 ——– d——– C:\Program Files\Azureus
2006-11-02 01:16 ——– d——– C:\Program Files\Lavasoft
2006-11-02 01:16 ——– d——– C:\Documents and Settings\Tessa\Application Data\Lavasoft
2006-11-02 00:50 ——– d——– C:\Program Files\Common Files\iS3
2006-11-01 21:52 ——– d-a—— C:\Program Files\Common Files\Symantec Shared
2006-11-01 21:41 ——– d–h—– C:\Program Files\InstallShield Installation Information
2006-10-29 19:00 ——– d——– C:\Program Files\Sonic Foundry ACID Music
2006-10-28 15:37 ——– d——– C:\Program Files\QuickTime
2006-10-26 23:52 ——– d——– C:\Documents and Settings\Tessa\Application Data\Apple Computer
2006-10-13 23:07 ——– d——– C:\Documents and Settings\Tessa\Application Data\eFax Messenger
2006-10-11 08:18 ——– d——– C:\Program Files\Yahoo!
2006-10-07 15:20 192 –a—— C:\Program Files\$MIDIMON.cfg
2006-10-03 23:35 ——– d——– C:\Program Files\Citrix
2006-10-03 23:35 ——– d——– C:\Documents and Settings\Tessa\Application Data\ICAClient
2006-09-27 15:53 ——– d——– C:\Documents and Settings\Tessa\Application Data\Yahoo!
2006-09-27 07:36 ——– d——– C:\Documents and Settings\Tessa\Application Data\Image Zone Express
2006-09-27 07:35 ——– d——– C:\Program Files\DebugMode
2006-09-27 07:24 ——– d-a—— C:\Program Files\Adobe
2006-09-27 07:24 ——– d——– C:\Program Files\Sonic Foundry
2006-09-27 07:24 ——– d——– C:\Program Files\Pure Motion
2006-09-12 23:09 1110528 –a—— C:\WINNT\system32\msxml3.dll
2006-08-26 13:31 16784 —–c— C:\Documents and Settings\Tessa\Application Data\GDIPFONTCACHEV1.DAT


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"
"MSMSGS"="\"C:\\Program Files\\Messenger\\MSMSGS.EXE\" /background"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Synchronization Manager"="mobsync.exe /logon"
"AtiPTA"="atiptaxx.exe"
"POINTER"="point32.exe"
"NeroFilterCheck"="C:\\WINNT\\system32\\NeroCheck.exe"
"Zone Labs Client"="C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\""
"HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"
"THGuard"="\"C:\\Program Files\\TrojanHunter 4.2\\THGuard.exe\""
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex]
"msconfig"="C:\\WINNT\\scvhost.exe"
"Update Checker"="C:\\WINNT\\scvhost.exe"
@="C:\\WINNT\\scvhost.exe"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"=""
"FriendlyName"=""
"Flags"=dword:00000000
"Position"=hex:2c,00,00,00,00,00,00,00,01,00,00,00,dc,00,00,00,d0,00,00,00,e8,\
03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=dword:00000001
"OriginalStateInfo"=hex:18,00,00,00,00,00,00,00,00,00,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,01,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,01,00,00,00

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
"Source"="C:\\Program Files\\Common Files\\mehe.html"
"SubscribedURL"=""
"FriendlyName"=""
"Flags"=dword:00002000
"Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,ea,\
03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00
"CurrentState"=dword:40000001
"OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\
00,00,01,00,00,00
"RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Htal"="\"C:\\WINNT\\system32\\config\\SYSTEM~1\\MYDOCU~1\\ASKS~1\\msiexec.exe\" -vt yazb"
"PSDream"="\"C:\\Program Files\\PSDream\\PSDream.exe\""
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop"
"tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"Htal"="\"C:\\WINNT\\system32\\config\\SYSTEM~1\\MYDOCU~1\\ASKS~1\\msiexec.exe\" -vt yazb"
"PSDream"="\"C:\\Program Files\\PSDream\\PSDream.exe\""
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop"
"tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=dword:00000000

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=dword:00000000

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"


Contents of the 'Scheduled Tasks' folder
C:\WINNT\tasks\Backup.job
C:\WINNT\tasks\Disk Cleanup.job
C:\WINNT\tasks\Symantec NetDetect.job

Completion time: 06-11-26 18:46:48.79
C:\ComboFix.txt … 06-11-26 18:46
C:\ComboFix2.txt … 06-11-26 12:23
C:\ComboFix3.txt … 06-11-26 08:39


And here is HJT:

Logfile of HijackThis v1.99.1
Scan saved at 6:52:45 PM, on 11/26/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe



C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\System32\CTSvcCDA.exe
C:\Program Files\Dantz\Retrospect 7.0\retrorun.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\atiptaxx.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Azureus\Azureus.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINNT\System32\ping.exe
F:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Broken Internet access because of LSP provider 'prxernsp.dll' missing
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://www.rawflow.com/passion/Rawflow.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1124499090416
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1163551812568
O16 - DPF: {89242969-422B-46BF-B0D5-6A7B7DC4D0E0} (NAS Finder Helper) - file://D:\html\nafcom.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…886/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E99E132C-52F1-4ABE-8A04-D6583D60C55F}: NameServer = 24.196.64.53,68.115.71.53
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\System32\CTSvcCDA.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - EMC Dantz - C:\Program Files\Dantz\Retrospect 7.0\retrorun.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
Post #33
Please download the Gromozon Removal Tool from here:

Gromozon Removal Tool
http://info.prevx.com/download.asp?grab=GROMOZONREMTOOL

Save it where you can find it.

DO NOT RUN IT YET.



Double-click on the killbox.exe program.


Start Killbox and click on Tools->Delete Temp Files.
Then select the option labeled Delete on reboot.

Do not close killbox, and open notepad, by clicking on Start, then Run, and typing notepad.exe and pressing the OK button.


When notepad is open, copy and paste the following bolded text into the notepad screen. You do this by highlighting each of the below bolded filenames and then pressing Control-C on your keyboard. Then click on the open notepad windows and press Control-V to paste the contents into the notepad.

C:\WINNT\scvhost.exe
C:\Program Files\PSDream\PSDream.exe
C:\Program Files\BBToolBar2.INI


Return to Killbox, go to the File menu and select Paste from Clipboard.


Still in Killbox, click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click No at the Pending Operations prompt.

If your computer does not restart automatically, please restart it manually



Restart your computer in Safe Mode.

Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen.
Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.
This can take several miniutes to load.

Please run the Gromozon Removal Tool, and follow the prompts..

Boot normally.

Post a new HijackThis! log into this thread, and describe how the PC is behaving at the moment.
Post #34 last edited
Do you have your windows CD?



1. To restart the computer using the Windows Recovery Console
To remove this threat it is necessary to restart the computer and run the Windows Recovery Console. For full details on how to do this please read the Microsoft Knowledge Base article, How to install and use the Recovery Console in Windows XP.

Insert the Windows XP CD-ROM into the CD-ROM drive.
Restart the computer from the CD-ROM drive.
Press R to start the Recovery Console when the "Welcome to Setup" screen appears.
Select the installation that you want to access from the Recovery Console.
Enter the administrator password and press Enter.
Run the command "DISABLE pe386".
Type exit
Press Enter. The computer will now restart automatically.


2. To delete the value from the registry
Important: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified subkeys only. For instructions refer to the document: How to make a backup of the Windows registry.

Click Start > Run.
Type regedit
Click OK.

Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor. Security Response has developed a tool to resolve this problem. Download and run this tool, and then continue with the removal.


Navigate to and delete the subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pe386


Exit the Registry Editor.

Reboot Normal

Post a new HJT log
Post #35
Okay here is my lastest HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 10:06:15 PM, on 11/26/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\System32\CTSvcCDA.exe
C:\Program Files\Dantz\Retrospect 7.0\retrorun.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\atiptaxx.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
F:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Broken Internet access because of LSP provider 'prxernsp.dll' missing
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://www.rawflow.com/passion/Rawflow.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1124499090416
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1163551812568
O16 - DPF: {89242969-422B-46BF-B0D5-6A7B7DC4D0E0} (NAS Finder Helper) - file://D:\html\nafcom.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…886/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E99E132C-52F1-4ABE-8A04-D6583D60C55F}: NameServer = 24.196.64.53,68.115.71.53
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\System32\CTSvcCDA.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - EMC Dantz - C:\Program Files\Dantz\Retrospect 7.0\retrorun.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe


I have to search for my windows CD before I can do the rest of the stuff.
Post #36
Let me know if you find the windows CD.
In the mean time, try this.

Go HERE and Download this 28 day trial version of Prevx. Select Save to download.

Install and run. Please let me know what it finds.


Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.
Post #37
Okay,

I installed Prevxt, ran it and it said that it found malware and jailed the following programs:

C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WEB FOLDERS\IBM00001.DLL

C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WEB FOLDERS\IBM00002.DLL

C:\PROGRAM FILES\PSDREAM\UNINSTALL.EXE




And here is a copy of my latest HJT:

Logfile of HijackThis v1.99.1
Scan saved at 9:55:23 PM, on 11/27/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\System32\CTSvcCDA.exe
C:\Program Files\Prevx1\PXAgent.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\atiptaxx.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Prevx1\PXConsole.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Dantz\Retrospect 7.0\retrorun.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINNT\System32\wuauclt.exe
C:\WINNT\System32\wbem\wmiprvse.exe
F:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx1\PXConsole.exe"
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Broken Internet access because of LSP provider 'prxernsp.dll' missing
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://www.rawflow.com/passion/Rawflow.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1124499090416
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1163551812568
O16 - DPF: {89242969-422B-46BF-B0D5-6A7B7DC4D0E0} (NAS Finder Helper) - file://D:\html\nafcom.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…886/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E99E132C-52F1-4ABE-8A04-D6583D60C55F}: NameServer = 24.196.64.53,68.115.71.53
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\System32\CTSvcCDA.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing)
O23 - Service: Retrospect Launcher (RetroLauncher) - EMC Dantz - C:\Program Files\Dantz\Retrospect 7.0\retrorun.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe


The computer is running well. No pop-ups, doesn't restart on its own, good speed….
Post #39
Okay, here is a copy of the latest combofix log:

Tessa - 06-11-28 17:42:22.58 Service Pack 1
ComboFix 06.11.9 - Running from: "C:\Documents and Settings\Tessa\Desktop"

((((((((((((((((((((((((((((((( Files Created from 2006-10-28 to 2006-11-28 ))))))))))))))))))))))))))))))))))


2006-11-27 17:12 9,728 –a—— C:\WINNT\system32\drivers\pxscinst.dll
2006-11-27 17:12 7,680 –a—— C:\WINNT\system32\drivers\pxinst.dll
2006-11-27 17:12 7,552 –a—— C:\WINNT\system32\drivers\pxcom.sys
2006-11-27 17:12 272,256 –a—— C:\WINNT\system32\drivers\pxfsf.sys
2006-11-27 17:12 18,560 –a—— C:\WINNT\system32\drivers\pxtdi.sys
2006-11-27 17:12 13,568 –a—— C:\WINNT\system32\drivers\pxrd.sys
2006-11-27 17:12 11,648 –a—— C:\WINNT\system32\drivers\pxscrmbl.sys
2006-11-27 17:12 100,864 –a—— C:\WINNT\system32\drivers\PxEmu.sys
2006-11-22 22:47 53,248 –a—— C:\WINNT\system32\PrxerNsp.dll
2006-11-22 22:47 53,248 –a—— C:\WINNT\system32\PrxerDrv.dll
2006-11-18 16:23 3,968 –a—— C:\WINNT\system32\drivers\AvgAsCln.sys
2006-11-16 22:11 47,104 –a—— C:\ATF-Cleaner.exe
2006-11-15 21:26 991,232 –a—— C:\WINNT\system32\esent.dll
2006-11-14 21:38 98,304 –a—— C:\WINNT\system32\oleprn.dll
2006-11-14 21:38 94,208 –a—— C:\WINNT\system32\odbccp32.dll
2006-11-14 21:38 91,136 –a—— C:\WINNT\system32\rastls.dll
2006-11-14 21:38 9,216 –a—— C:\WINNT\system32\wuauserv.dll
2006-11-14 21:38 891,711 ——— C:\WINNT\system32\drivers\nv4_mini.sys
2006-11-14 21:38 88,064 –a—— C:\WINNT\system32\tscfgwmi.dll
2006-11-14 21:38 87,304 –a—— C:\WINNT\system32\rdpdd.dll
2006-11-14 21:38 86,528 –a—— C:\WINNT\system32\wlnotify.dll
2006-11-14 21:38 86,016 –a—— C:\WINNT\system32\xactsrv.dll
2006-11-14 21:38 82,944 –a—— C:\WINNT\system32\smlogsvc.exe
2006-11-14 21:38 82,944 –a—— C:\WINNT\system32\psbase.dll
2006-11-14 21:38 81,920 –a—— C:\WINNT\system32\trkwks.dll
2006-11-14 21:38 8,192 –a—— C:\WINNT\system32\scrnsave.scr
2006-11-14 21:38 77,824 –a—— C:\WINNT\system32\wmpstub.exe
2006-11-14 21:38 77,824 –a—— C:\WINNT\system32\wmpshell.dll
2006-11-14 21:38 75,912 –a—— C:\WINNT\system32\rdpwsx.dll
2006-11-14 21:38 74,240 –a—— C:\WINNT\system32\rtcshare.exe
2006-11-14 21:38 72,192 –a—— C:\WINNT\system32\telnet.exe
2006-11-14 21:38 71,168 –a—— C:\WINNT\system32\storprop.dll
2006-11-14 21:38 71,168 –a—— C:\WINNT\system32\sdbinst.exe
2006-11-14 21:38 686,080 –a—— C:\WINNT\system32\opengl32.dll
2006-11-14 21:38 667,648 –a—— C:\WINNT\system32\ss3dfo.scr
2006-11-14 21:38 66,560 –a—— C:\WINNT\system32\spoolss.dll
2006-11-14 21:38 66,048 –a—— C:\WINNT\system32\sigverif.exe
2006-11-14 21:38 638,976 –a—— C:\WINNT\system32\sstext3d.scr
2006-11-14 21:38 63,488 –a—— C:\WINNT\system32\srclient.dll
2006-11-14 21:38 62,976 –a—— C:\WINNT\system32\shgina.dll
2006-11-14 21:38 61,952 –a—— C:\WINNT\system32\sti.dll
2006-11-14 21:38 61,440 –a—— C:\WINNT\system32\odbccu32.dll
2006-11-14 21:38 61,440 –a—— C:\WINNT\system32\odbccr32.dll
2006-11-14 21:38 60,416 –a—— C:\WINNT\system32\wextract.exe
2006-11-14 21:38 60,416 –a—— C:\WINNT\system32\shimeng.dll
2006-11-14 21:38 6,144 –a—— C:\WINNT\system32\sensapi.dll
2006-11-14 21:38 58,880 –a—— C:\WINNT\system32\pautoenr.dll
2006-11-14 21:38 57,856 –a—— C:\WINNT\system32\raschap.dll
2006-11-14 21:38 569,344 –a—— C:\WINNT\system32\sspipes.scr
2006-11-14 21:38 56,832 –a—— C:\WINNT\system32\wzcdlg.dll
2006-11-14 21:38 56,320 –a—— C:\WINNT\system32\remotepg.dll
2006-11-14 21:38 548,864 –a—— C:\WINNT\system32\rtcdll.dll
2006-11-14 21:38 534,016 –a—— C:\WINNT\system32\spider.exe
2006-11-14 21:38 53,248 –a—— C:\WINNT\system32\packager.exe
2006-11-14 21:38 53,248 –a—— C:\WINNT\system32\odbcconf.exe
2006-11-14 21:38 52,224 –a—— C:\WINNT\system32\secur32.dll
2006-11-14 21:38 511,488 –a—— C:\WINNT\system32\qedit.dll
2006-11-14 21:38 51,200 –a—— C:\WINNT\system32\wmerrenu.dll
2006-11-14 21:38 5,504 ——— C:\WINNT\system32\drivers\smbali.sys
2006-11-14 21:38 48,640 –a—— C:\WINNT\system32\vdmredir.dll
2006-11-14 21:38 48,128 –a—— C:\WINNT\system32\winsta.dll
2006-11-14 21:38 48,128 –a—— C:\WINNT\system32\reg.exe
2006-11-14 21:38 479,261 –a—— C:\WINNT\system32\vbscript.dll
2006-11-14 21:38 47,616 –a—— C:\WINNT\system32\utilman.exe
2006-11-14 21:38 446,464 –a—— C:\WINNT\system32\wmvdmoe.dll
2006-11-14 21:38 442,398 –a—— C:\WINNT\system32\wmadmoe.dll
2006-11-14 21:38 44,032 –a—— C:\WINNT\system32\regapi.dll
2006-11-14 21:38 44,032 –a—— C:\WINNT\system32\rdpclip.exe
2006-11-14 21:38 43,008 –a—— C:\WINNT\system32\ssdpsrv.dll
2006-11-14 21:38 423,424 –a—— C:\WINNT\system32\riched20.dll
2006-11-14 21:38 420,864 –a—— C:\WINNT\system32\shimgvw.dll
2006-11-14 21:38 409,088 –a—— C:\WINNT\system32\vssapi.dll
2006-11-14 21:38 40,960 –a—— C:\WINNT\system32\tscupgrd.exe
2006-11-14 21:38 392,704 –a—— C:\WINNT\system32\ntmssvc.dll
2006-11-14 21:38 385,024 –a—— C:\WINNT\system32\sqlsrv32.dll
2006-11-14 21:38 384,000 –a—— C:\WINNT\system32\themeui.dll
2006-11-14 21:38 38,912 –a—— C:\WINNT\system32\wsnmp32.dll
2006-11-14 21:38 38,400 –a—— C:\WINNT\system32\ntmsapi.dll
2006-11-14 21:38 38,400 –a—— C:\WINNT\system32\ntlanman.dll
2006-11-14 21:38 364,544 –a—— C:\WINNT\system32\ssflwbox.scr
2006-11-14 21:38 36,352 –a—— C:\WINNT\system32\sens.dll
2006-11-14 21:38 357,376 –a—— C:\WINNT\system32\qdvd.dll
2006-11-14 21:38 34,304 –a—— C:\WINNT\system32\rcimlby.exe
2006-11-14 21:38 339,456 –a—— C:\WINNT\system32\usp10.dll
2006-11-14 21:38 334,848 –a—— C:\WINNT\system32\smlogcfg.dll
2006-11-14 21:38 33,280 –a—— C:\WINNT\system32\shmgrate.exe
2006-11-14 21:38 32,768 –a—— C:\WINNT\system32\odbcad32.exe
2006-11-14 21:38 32,256 –a—— C:\WINNT\system32\umandlg.dll
2006-11-14 21:38 316,416 –a—— C:\WINNT\system32\zipfldr.dll
2006-11-14 21:38 316,416 –a—— C:\WINNT\system32\wiaservc.dll
2006-11-14 21:38 311,327 –a—— C:\WINNT\system32\wmv8dmod.dll
2006-11-14 21:38 31,744 –a—— C:\WINNT\system32\pid.dll
2006-11-14 21:38 3,494,303 ——— C:\WINNT\system32\nv4_disp.dll
2006-11-14 21:38 3,338 –a—— C:\WINNT\system32\redir.exe
2006-11-14 21:38 297,984 –a—— C:\WINNT\system32\scesrv.dll
2006-11-14 21:38 296,448 –a—— C:\WINNT\system32\wmstream.dll
2006-11-14 21:38 294,912 –a—— C:\WINNT\system32\wmvdmod.dll
2006-11-14 21:38 274,432 –a—— C:\WINNT\system32\wmasf.dll
2006-11-14 21:38 27,136 –a—— C:\WINNT\system32\ssdpapi.dll
2006-11-14 21:38 266,752 –a—— C:\WINNT\winhlp32.exe
2006-11-14 21:38 264,704 –a—— C:\WINNT\system32\wzcsvc.dll
2006-11-14 21:38 258,048 –a—— C:\WINNT\system32\webcheck.dll
2006-11-14 21:38 254,976 –a—— C:\WINNT\system32\pdh.dll
2006-11-14 21:38 253,952 –a—— C:\WINNT\system32\wmpcd.dll
2006-11-14 21:38 253,952 –a—— C:\WINNT\system32\wmnetmgr.dll
2006-11-14 21:38 251,904 –a—— C:\WINNT\system32\strmdll.dll
2006-11-14 21:38 247,808 –a—— C:\WINNT\system32\wow32.dll
2006-11-14 21:38 24,576 –a—— C:\WINNT\system32\odbcbcp.dll
2006-11-14 21:38 24,064 –a—— C:\WINNT\system32\skeys.exe
2006-11-14 21:38 231,424 –a—— C:\WINNT\system32\upnpui.dll
2006-11-14 21:38 23,552 –a—— C:\WINNT\system32\wzcsapi.dll
2006-11-14 21:38 226,816 –a—— C:\WINNT\system32\srrstr.dll
2006-11-14 21:38 22,528 –a—— C:\WINNT\system32\slayerxp.dll
2006-11-14 21:38 22,528 –a—— C:\WINNT\system32\shfolder.dll
2006-11-14 21:38 22,016 –a—— C:\WINNT\system32\udhisapi.dll
2006-11-14 21:38 212,480 –a—— C:\WINNT\system32\osk.exe
2006-11-14 21:38 203,264 –a—— C:\WINNT\system32\uxtheme.dll
2006-11-14 21:38 200,704 –a—— C:\WINNT\system32\odbc32.dll
2006-11-14 21:38 200,192 –a—— C:\WINNT\system32\termsrv.dll
2006-11-14 21:38 193,536 –a—— C:\WINNT\system32\rasppp.dll
2006-11-14 21:38 19,456 –a—— C:\WINNT\system32\ssmarque.scr
2006-11-14 21:38 184,832 –a—— C:\WINNT\system32\qcap.dll
2006-11-14 21:38 184,320 –a—— C:\WINNT\system32\wmadmod.dll
2006-11-14 21:38 18,944 –a—— C:\WINNT\system32\ssbezier.scr
2006-11-14 21:38 174,592 –a—— C:\WINNT\system32\scecli.dll
2006-11-14 21:38 172,664 –a—— C:\WINNT\system32\xenroll.dll
2006-11-14 21:38 171,520 –a—— C:\WINNT\system32\winmm.dll
2006-11-14 21:38 171,008 –a—— C:\WINNT\system32\sccsccp.dll
2006-11-14 21:38 17,408 –a—— C:\WINNT\system32\wtsapi32.dll
2006-11-14 21:38 17,408 –a—— C:\WINNT\system32\ssmyst.scr
2006-11-14 21:38 17,408 –a—— C:\WINNT\system32\psapi.dll
2006-11-14 21:38 169,984 –a—— C:\WINNT\system32\sccbase.dll
2006-11-14 21:38 168,448 –a—— C:\WINNT\system32\wldap32.dll
2006-11-14 21:38 165,888 –a—— C:\WINNT\system32\ntmsdba.dll
2006-11-14 21:38 165,376 –a—— C:\WINNT\system32\w32time.dll
2006-11-14 21:38 165,376 –a—— C:\WINNT\system32\tapi32.dll
2006-11-14 21:38 164,864 –a—— C:\WINNT\system32\upnphost.dll
2006-11-14 21:38 16,896 –a—— C:\WINNT\system32\snmpapi.dll
2006-11-14 21:38 16,384 –a—— C:\WINNT\system32\watchdog.sys
2006-11-14 21:38 16,384 –a—— C:\WINNT\system32\ups.exe
2006-11-14 21:38 16,384 –a—— C:\WINNT\system32\ping.exe
2006-11-14 21:38 16,384 –a—— C:\WINNT\system32\odbc32gt.dll
2006-11-14 21:38 159,232 –a—— C:\WINNT\system32\schedsvc.dll
2006-11-14 21:38 158,720 –a—— C:\WINNT\system32\srsvc.dll
2006-11-14 21:38 147,456 –a—— C:\WINNT\system32\odbctrac.dll
2006-11-14 21:38 14,848 –a—— C:\WINNT\system32\rdpsnd.dll
2006-11-14 21:38 137,216 –a—— C:\WINNT\system32\ntshrui.dll
2006-11-14 21:38 135,680 –a—— C:\WINNT\system32\rdchost.dll
2006-11-14 21:38 134,144 –a—— C:\WINNT\regedit.exe
2006-11-14 21:38 133,632 –a—— C:\WINNT\system32\rsaenh.dll
2006-11-14 21:38 133,120 –a—— C:\WINNT\system32\sfc_os.dll
2006-11-14 21:38 130,560 –a—— C:\WINNT\system32\sti_ci.dll
2006-11-14 21:38 13,824 –a—— C:\WINNT\system32\rassapi.dll
2006-11-14 21:38 13,312 –a—— C:\WINNT\system32\ssstars.scr
2006-11-14 21:38 128,512 –a—— C:\WINNT\system32\taskmgr.exe
2006-11-14 21:38 124,928 –a—— C:\WINNT\system32\webvw.dll
2006-11-14 21:38 122,880 –a—— C:\WINNT\system32\odbcconf.dll
2006-11-14 21:38 120,320 –a—— C:\WINNT\system32\upnp.dll
2006-11-14 21:38 12,800 –a—— C:\WINNT\system32\runonce.exe
2006-11-14 21:38 12,288 –a—— C:\WINNT\system32\rdsaddin.exe
2006-11-14 21:38 12,288 –a—— C:\WINNT\system32\odbcp32r.dll
2006-11-14 21:38 119,808 –a—— C:\WINNT\system32\wiadss.dll
2006-11-14 21:38 118,784 –a—— C:\WINNT\system32\wmsdmoe.dll
2006-11-14 21:38 117,760 –a—— C:\WINNT\system32\stobject.dll
2006-11-14 21:38 112,128 –a—— C:\WINNT\system32\ntmarta.dll
2006-11-14 21:38 110,592 –a—— C:\WINNT\system32\wmsdmod.dll
2006-11-14 21:38 11,776 –a—— C:\WINNT\system32\sigtab.dll
2006-11-14 21:38 109,568 –a—— C:\WINNT\system32\offfilt.dll
2006-11-14 21:38 106,496 –a—— C:\WINNT\system32\url.dll
2006-11-14 21:38 10,752 –a—— C:\WINNT\system32\tracert.exe
2006-11-14 21:38 10,752 –a—— C:\WINNT\hh.exe
2006-11-14 21:38 1,998,848 –a—— C:\WINNT\system32\wmploc.dll
2006-11-14 21:38 1,350,144 –a—— C:\WINNT\system32\query.dll
2006-11-14 21:38 1,298,432 –a—— C:\WINNT\system32\wmpcore.dll
2006-11-14 21:38 1,220,608 –a—— C:\WINNT\system32\wmvcore.dll
2006-11-14 21:38 1,157,632 –a—— C:\WINNT\system32\sfcfiles.dll
2006-11-14 21:37 95,744 –a—— C:\WINNT\system32\nlhtml.dll
2006-11-14 21:37 921,475 ——— C:\WINNT\system32\ati3d2ag.dll
2006-11-14 21:37 91,136 –a—— C:\WINNT\system32\MSOERT2.DLL
2006-11-14 21:37 9,728 –a—— C:\WINNT\system32\mstinit.exe
2006-11-14 21:37 857,600 –a—— C:\WINNT\system32\netplwiz.dll
2006-11-14 21:37 844,675 ——— C:\WINNT\system32\ati3d1ag.dll
2006-11-14 21:37 699,392 –a—— C:\WINNT\system32\msxml2.dll
2006-11-14 21:37 68,608 –a—— C:\WINNT\system32\mscms.dll
2006-11-14 21:37 67,584 –a—— C:\WINNT\system32\msctfp.dll
2006-11-14 21:37 65,536 –a—— C:\WINNT\system32\msconf.dll
2006-11-14 21:37 63,663 –a—— C:\WINNT\system32\drivers\atinrvxx.sys
2006-11-14 21:37 6,912 ——— C:\WINNT\system32\drivers\hidir.sys
2006-11-14 21:37 6,656 –a—— C:\WINNT\system32\laprxy.dll
2006-11-14 21:37 598,016 –a—— C:\WINNT\system32\mstscax.dll
2006-11-14 21:37 584,192 –a—— C:\WINNT\system32\netcfgx.dll
2006-11-14 21:37 57,856 –a—— C:\WINNT\system32\licwmi.dll
2006-11-14 21:37 56,591 –a—— C:\WINNT\system32\drivers\atinbtxx.sys
2006-11-14 21:37 56,320 –a—— C:\WINNT\system32\mshtmler.dll
2006-11-14 21:37 552,991 –a—— C:\WINNT\system32\msrepl40.dll
2006-11-14 21:37 512,031 –a—— C:\WINNT\system32\msexch40.dll
2006-11-14 21:37 504,832 ——— C:\WINNT\system32\msftedit.dll
2006-11-14 21:37 504,320 –a—— C:\WINNT\system32\logonui.exe
2006-11-14 21:37 5,120 ——— C:\WINNT\system32\hccoin.dll
2006-11-14 21:37 49,152 –a—— C:\WINNT\system32\npptools.dll
2006-11-14 21:37 450,176 ——— C:\WINNT\system32\drivers\ati2mtag.sys
2006-11-14 21:37 421,919 –a—— C:\WINNT\system32\msrd2x40.dll
2006-11-14 21:37 42,496 –a—— C:\WINNT\system32\ncobjapi.dll
2006-11-14 21:37 403,456 ——— C:\WINNT\system32\winbrand.dll
2006-11-14 21:37 401,462 –a—— C:\WINNT\system32\msvcp60.dll
2006-11-14 21:37 4,608 –a—— C:\WINNT\system32\msimg32.dll
2006-11-14 21:37 4,126 –a—— C:\WINNT\system32\msdxmlc.dll
2006-11-14 21:37 399,360 –a—— C:\WINNT\system32\netlogon.dll
2006-11-14 21:37 39,424 –a—— C:\WINNT\system32\net.exe
2006-11-14 21:37 388,608 –a—— C:\WINNT\system32\mstsc.exe
2006-11-14 21:37 381,440 –a—— C:\WINNT\system32\lmrt.dll
2006-11-14 21:37 377,984 –a—— C:\WINNT\system32\ati2dvaa.dll
2006-11-14 21:37 368,710 –a—— C:\WINNT\system32\msisam11.dll
2006-11-14 21:37 36,463 –a—— C:\WINNT\system32\drivers\atintuxx.sys
2006-11-14 21:37 348,195 –a—— C:\WINNT\system32\msjetoledb40.dll
2006-11-14 21:37 348,191 –a—— C:\WINNT\system32\mspbde40.dll
2006-11-14 21:37 344,095 –a—— C:\WINNT\system32\msxbde40.dll
2006-11-14 21:37 34,735 –a—— C:\WINNT\system32\drivers\atinxsxx.sys
2006-11-14 21:37 339,968 –a—— C:\WINNT\system32\mspaint.exe
2006-11-14 21:37 33,808 –a—— C:\WINNT\system32\ntio.sys
2006-11-14 21:37 327,040 –a—— C:\WINNT\system32\drivers\ati2mtaa.sys
2006-11-14 21:37 326,656 –a—— C:\WINNT\system32\netsetup.exe
2006-11-14 21:37 323,072 –a—— C:\WINNT\system32\msvcrt.dll
2006-11-14 21:37 32,256 –a—— C:\WINNT\system32\mnmdd.dll
2006-11-14 21:37 319,760 –a—— C:\WINNT\system32\msnsspc.dll
2006-11-14 21:37 319,519 –a—— C:\WINNT\system32\msexcl40.dll
2006-11-14 21:37 30,671 –a—— C:\WINNT\system32\drivers\atinraxx.sys
2006-11-14 21:37 3,584 ——— C:\WINNT\system32\dsprpres.dll
2006-11-14 21:37 29,455 –a—— C:\WINNT\system32\drivers\atinxbxx.sys
2006-11-14 21:37 266,752 –a—— C:\WINNT\system32\msctf.dll
2006-11-14 21:37 26,367 –a—— C:\WINNT\system32\drivers\atinsnxx.sys
2006-11-14 21:37 253,983 –a—— C:\WINNT\system32\mstext40.dll
2006-11-14 21:37 250,368 –a—— C:\WINNT\system32\mstask.dll
2006-11-14 21:37 241,725 –a—— C:\WINNT\system32\msuni11.dll
2006-11-14 21:37 241,695 –a—— C:\WINNT\system32\msjtes40.dll
2006-11-14 21:37 24,576 –a—— C:\WINNT\system32\nmmkcert.dll
2006-11-14 21:37 24,576 –a—— C:\WINNT\system32\logagent.exe
2006-11-14 21:37 238,080 –a—— C:\WINNT\system32\newdev.dll
2006-11-14 21:37 233,472 –a—— C:\WINNT\system32\mpg4dmod.dll
2006-11-14 21:37 230,400 –a—— C:\WINNT\system32\msieftp.dll
2006-11-14 21:37 229,376 –a—— C:\WINNT\system32\MSOEACCT.DLL
2006-11-14 21:37 22,528 –a—— C:\WINNT\system32\mslbui.dll
2006-11-14 21:37 219,648 –a—— C:\WINNT\system32\logon.scr
2006-11-14 21:37 218,112 ——— C:\WINNT\system32\sbe.dll
2006-11-14 21:37 213,023 –a—— C:\WINNT\system32\msltus40.dll
2006-11-14 21:37 210,944 –a—— C:\WINNT\system32\moricons.dll
2006-11-14 21:37 21,343 ——— C:\WINNT\system32\drivers\atinttxx.sys
2006-11-14 21:37 202,496 ——— C:\WINNT\system32\ati2dvag.dll
2006-11-14 21:37 196,096 –a—— C:\WINNT\system32\mobsync.dll
2006-11-14 21:37 192,512 –a—— C:\WINNT\system32\mswebdvd.dll
2006-11-14 21:37 19,456 –a—— C:\WINNT\system32\licmgr10.dll
2006-11-14 21:37 19,328 ——— C:\WINNT\system32\drivers\usbehci.sys
2006-11-14 21:37 187,904 ——— C:\WINNT\system32\xpsp1res.dll
2006-11-14 21:37 182,784 –a—— C:\WINNT\system32\msutb.dll
2006-11-14 21:37 18,944 ——— C:\WINNT\system32\faxpatch.exe
2006-11-14 21:37 174,592 –a—— C:\WINNT\system32\msnetobj.dll
2006-11-14 21:37 172,032 ——— C:\WINNT\system32\mssap.dll
2006-11-14 21:37 163,840 –a—— C:\WINNT\system32\mindex.dll
2006-11-14 21:37 16,384 –a—— C:\WINNT\system32\nddenb32.dll
2006-11-14 21:37 155,648 ——— C:\WINNT\system32\encdec.dll
2006-11-14 21:37 143,872 –a—— C:\WINNT\system32\msimtf.dll
2006-11-14 21:37 131,072 –a—— C:\WINNT\system32\msorcl32.dll
2006-11-14 21:37 13,056 ——— C:\WINNT\system32\drivers\wacompen.sys
2006-11-14 21:37 126,976 –a—— C:\WINNT\system32\msdart.dll
2006-11-14 21:37 12,288 –a—— C:\WINNT\system32\mscpx32r.dll
2006-11-14 21:37 12,288 ——— C:\WINNT\system32\encapi.dll
2006-11-14 21:37 12,047 ——— C:\WINNT\system32\drivers\atinpdxx.sys
2006-11-14 21:37 116,736 –a—— C:\WINNT\system32\mplay32.exe
2006-11-14 21:37 115,200 –a—— C:\WINNT\system32\net1.exe
2006-11-14 21:37 113,664 –a—— C:\WINNT\system32\msvfw32.dll
2006-11-14 21:37 110,080 ——— C:\WINNT\system32\sbeio.dll
2006-11-14 21:37 11,904 ——— C:\WINNT\system32\drivers\mutohpen.sys
2006-11-14 21:37 11,615 –a—— C:\WINNT\system32\drivers\atinmdxx.sys
2006-11-14 21:37 105,984 –a—— C:\WINNT\system32\netdde.exe
2006-11-14 21:37 10,240 –a—— C:\WINNT\system32\msrle32.dll
2006-11-14 21:37 10,240 –a—— C:\WINNT\system32\localui.dll
2006-11-14 21:37 1,677,312 ——— C:\WINNT\system32\wmvcore2.dll
2006-11-14 21:37 1,622,528 –a—— C:\WINNT\system32\netshell.dll
2006-11-14 21:37 1,503,262 –a—— C:\WINNT\system32\msjet40.dll
2006-11-14 21:37 1,220,608 –a—— C:\WINNT\system32\msvidctl.dll
2006-11-14 21:37 1,128,960 –a—— C:\WINNT\system32\mmcndmgr.dll
2006-11-14 21:36 98,816 –a—— C:\WINNT\system32\clipbrd.exe
2006-11-14 21:36 94,720 –a—— C:\WINNT\system32\dmusic.dll
2006-11-14 21:36 91,648 –a—— C:\WINNT\system32\iuctl.dll
2006-11-14 21:36 9,216 –a—— C:\WINNT\system32\icaapi.dll
2006-11-14 21:36 9,216 –a—— C:\WINNT\system32\dumprep.exe
2006-11-14 21:36 88,576 –a—— C:\WINNT\system32\mqsec.dll
2006-11-14 21:36 802,304 –a—— C:\WINNT\system32\dxmrtp.dll
2006-11-14 21:36 8,832 –a—— C:\WINNT\system32\framebuf.dll
2006-11-14 21:36 786,432 –a—— C:\WINNT\system32\dxdiag.exe
2006-11-14 21:36 77,312 –a—— C:\WINNT\system32\dmscript.dll
2006-11-14 21:36 76,830 –a—— C:\WINNT\system32\drmstor.dll
2006-11-14 21:36 76,288 –a—— C:\WINNT\system32\dfrgfat.exe
2006-11-14 21:36 73,728 –a—— C:\WINNT\system32\tlntsess.exe
2006-11-14 21:36 73,728 –a—— C:\WINNT\system32\ils.dll
2006-11-14 21:36 70,656 –a—— C:\WINNT\system32\defrag.exe
2006-11-14 21:36 70,144 –a—— C:\WINNT\system32\cryptdlg.dll
2006-11-14 21:36 7,168 –a—— C:\WINNT\system32\tlntsvrp.dll
2006-11-14 21:36 7,168 –a—— C:\WINNT\system32\fxsperf.dll
2006-11-14 21:36 7,040 –a—— C:\WINNT\system32\kd1394.dll
2006-11-14 21:36 67,584 –a—— C:\WINNT\system32\tlntsvr.exe
2006-11-14 21:36 67,584 –a—— C:\WINNT\system32\fdeploy.dll
2006-11-14 21:36 67,456 –a—— C:\WINNT\system32\drivers\mqac.sys
2006-11-14 21:36 66,560 –a—— C:\WINNT\system32\faultrep.dll
2006-11-14 21:36 61,440 –a—— C:\WINNT\system32\dbnetlib.dll
2006-11-14 21:36 608,768 –a—— C:\WINNT\system32\mqqm.dll
2006-11-14 21:36 602,112 –a—— C:\WINNT\system32\drmv2clt.dll
2006-11-14 21:36 6,656 –a—— C:\WINNT\system32\fxsres.dll
2006-11-14 21:36 596,480 –a—— C:\WINNT\system32\INETCOMM.DLL
2006-11-14 21:36 59,392 –a—— C:\WINNT\system32\iesetup.dll
2006-11-14 21:36 58,368 –a—— C:\WINNT\system32\dpvsetup.exe
2006-11-14 21:36 57,856 –a—— C:\WINNT\system32\tlntadmn.exe
2006-11-14 21:36 57,856 –a—— C:\WINNT\system32\nwwks.dll
2006-11-14 21:36 57,344 –a—— C:\WINNT\system32\dmcompos.dll
2006-11-14 21:36 56,320 –a—— C:\WINNT\system32\dpnhupnp.dll
2006-11-14 21:36 559,616 –a—— C:\WINNT\system32\fxsst.dll
2006-11-14 21:36 55,296 –a—— C:\WINNT\system32\digest.dll
2006-11-14 21:36 545,792 –a—— C:\WINNT\system32\wsecedit.dll
2006-11-14 21:36 54,272 –a—— C:\WINNT\system32\clusapi.dll
2006-11-14 21:36 53,248 –a—— C:\WINNT\system32\cryptsvc.dll
2006-11-14 21:36 51,712 –a—— C:\WINNT\system32\ipconfig.exe
2006-11-14 21:36 498,205 –a—— C:\WINNT\system32\dxmasf.dll
2006-11-14 21:36 49,664 –a—— C:\WINNT\system32\ixsso.dll
2006-11-14 21:36 49,664 –a—— C:\WINNT\system32\dpwsockx.dll
2006-11-14 21:36 49,152 –a—— C:\WINNT\system32\eventlog.dll
2006-11-14 21:36 489,984 –a—— C:\WINNT\system32\dbghelp.dll
2006-11-14 21:36 478,720 –a—— C:\WINNT\system32\mqsnap.dll
2006-11-14 21:36 471,040 –a—— C:\WINNT\system32\cryptui.dll
2006-11-14 21:36 467,456 –a—— C:\WINNT\system32\mqutil.dll
2006-11-14 21:36 45,568 –a—— C:\WINNT\system32\docprop2.dll
2006-11-14 21:36 443,392 –a—— C:\WINNT\system32\fxsapi.dll
2006-11-14 21:36 435,200 –a—— C:\WINNT\system32\ipnathlp.dll
2006-11-14 21:36 42,537 –a—— C:\WINNT\system32\keyboard.sys
2006-11-14 21:36 41,472 –a—— C:\WINNT\system32\cmdl32.exe
2006-11-14 21:36 395,264 –a—— C:\WINNT\system32\fxsxp32.dll
2006-11-14 21:36 391,168 –a—— C:\WINNT\system32\fxstiff.dll
2006-11-14 21:36 380,445 –a—— C:\WINNT\system32\expsrv.dll
2006-11-14 21:36 38,912 –a—— C:\WINNT\system32\hhsetup.dll
2006-11-14 21:36 36,922 –a—— C:\WINNT\system32\imeshare.dll
2006-11-14 21:36 35,328 –a—— C:\WINNT\system32\dfrgsnap.dll
2006-11-14 21:36 324,608 –a—— C:\WINNT\system32\cmdial32.dll
2006-11-14 21:36 318,464 –a—— C:\WINNT\system32\ippromon.dll
2006-11-14 21:36 31,744 –a—— C:\WINNT\system32\dmloader.dll
2006-11-14 21:36 307,712 –a—— C:\WINNT\system32\cscui.dll
2006-11-14 21:36 30,208 –a—— C:\WINNT\system32\imgutil.dll
2006-11-14 21:36 294,912 –a—— C:\WINNT\system32\iedkcs32.dll
2006-11-14 21:36 29,696 –a—— C:\WINNT\system32\dpnhpast.dll
2006-11-14 21:36 29,696 ——— C:\WINNT\system32\asr_pfu.exe
2006-11-14 21:36 28,672 –a—— C:\WINNT\system32\ie4uinit.exe
2006-11-14 21:36 28,672 –a—— C:\WINNT\system32\dbnmpntw.dll
2006-11-14 21:36 28,160 –a—— C:\WINNT\system32\pidgen.dll
2006-11-14 21:36 277,504 –a—— C:\WINNT\system32\appmgr.dll
2006-11-14 21:36 271,360 –a—— C:\WINNT\system32\fxscomex.dll
2006-11-14 21:36 266,240 –a—— C:\WINNT\system32\drmclien.dll
2006-11-14 21:36 263,680 –a—— C:\WINNT\system32\duser.dll
2006-11-14 21:36 263,168 –a—— C:\WINNT\system32\devmgr.dll
2006-11-14 21:36 26,112 –a—— C:\WINNT\system32\dmband.dll
2006-11-14 21:36 253,440 –a—— C:\WINNT\system32\ddraw.dll
2006-11-14 21:36 250,368 –a—— C:\WINNT\system32\fxssvc.exe
2006-11-14 21:36 25,600 –a—— C:\WINNT\system32\dfsshlex.dll
2006-11-14 21:36 249,856 –a—— C:\WINNT\system32\adsiis.dll
2006-11-14 21:36 240,640 –a—— C:\WINNT\system32\hnetcfg.dll
2006-11-14 21:36 24,576 –a—— C:\WINNT\system32\dbmsvinn.dll
2006-11-14 21:36 24,576 –a—— C:\WINNT\system32\dbmsrpcn.dll
2006-11-14 21:36 24,576 –a—— C:\WINNT\system32\conime.exe
2006-11-14 21:36 24,064 –a—— C:\WINNT\system32\fxsdrv.dll
2006-11-14 21:36 238,592 –a—— C:\WINNT\system32\compatui.dll
2006-11-14 21:36 237,056 –a—— C:\WINNT\system32\icm32.dll
2006-11-14 21:36 236,032 –a—— C:\WINNT\system32\fxst30.dll
2006-11-14 21:36 231,936 –a—— C:\WINNT\system32\tracerpt.exe
2006-11-14 21:36 227,840 –a—— C:\WINNT\system32\dsquery.dll
2006-11-14 21:36 216,064 –a—— C:\WINNT\system32\fxscover.exe
2006-11-14 21:36 206,336 –a—— C:\WINNT\system32\dpvoice.dll
2006-11-14 21:36 204,288 –a—— C:\WINNT\system32\ieaksie.dll
2006-11-14 21:36 20,992 –a—— C:\WINNT\system32\fxsext32.dll
2006-11-14 21:36 20,480 –a—— C:\WINNT\system32\dbmsadsn.dll
2006-11-14 21:36 19,456 –a—— C:\WINNT\system32\fontview.exe
2006-11-14 21:36 19,456 –a—— C:\WINNT\system32\ersvc.dll
2006-11-14 21:36 185,856 –a—— C:\WINNT\system32\fxswzrd.dll
2006-11-14 21:36 183,808 –a—— C:\WINNT\system32\gptext.dll
2006-11-14 21:36 180,224 –a—— C:\WINNT\system32\dwwin.exe
2006-11-14 21:36 178,688 –a—— C:\WINNT\system32\eudcedit.exe
2006-11-14 21:36 172,544 –a—— C:\WINNT\system32\dmime.dll
2006-11-14 21:36 17,792 ——— C:\WINNT\system32\drivers\irbus.sys
2006-11-14 21:36 168,960 –a—— C:\WINNT\system32\dinput8.dll
2006-11-14 21:36 165,888 –a—— C:\WINNT\system32\mqrt.dll
2006-11-14 21:36 165,376 –a—— C:\WINNT\system32\els.dll
2006-11-14 21:36 164,352 –a—— C:\WINNT\system32\mqtrig.dll
2006-11-14 21:36 16,384 –a—— C:\WINNT\system32\ds32gt.dll
2006-11-14 21:36 158,720 –a—— C:\WINNT\system32\credui.dll
2006-11-14 21:36 156,672 –a—— C:\WINNT\system32\dpnet.dll
2006-11-14 21:36 156,672 –a—— C:\WINNT\system32\appmgmts.dll
2006-11-14 21:36 156,544 –a—— C:\WINNT\system32\drivers\nwrdr.sys
2006-11-14 21:36 151,552 –a—— C:\WINNT\system32\dinput.dll
2006-11-14 21:36 149,504 –a—— C:\WINNT\system32\fxsui.dll
2006-11-14 21:36 143,872 –a—— C:\WINNT\system32\itircl.dll
2006-11-14 21:36 14,848 –a—— C:\WINNT\system32\mqise.dll
2006-11-14 21:36 135,680 –a—— C:\WINNT\system32\dsprop.dll
2006-11-14 21:36 130,048 –a—— C:\WINNT\system32\mqad.dll
2006-11-14 21:36 130,048 –a—— C:\WINNT\system32\fxsclnt.exe
2006-11-14 21:36 13,312 –a—— C:\WINNT\system32\ctfmon.exe
2006-11-14 21:36 128,000 –a—— C:\WINNT\system32\itss.dll
2006-11-14 21:36 126,976 –a—— C:\WINNT\system32\ieakeng.dll
2006-11-14 21:36 124,928 –a—— C:\WINNT\system32\dssenh.dll
2006-11-14 21:36 123,904 –a—— C:\WINNT\system32\imapi.exe
2006-11-14 21:36 115,200 –a—— C:\WINNT\system32\dpcdll.dll
2006-11-14 21:36 114,176 –a—— C:\WINNT\system32\input.dll
2006-11-14 21:36 113,664 –a—— C:\WINNT\system32\schtasks.exe
2006-11-14 21:36 113,152 –a—— C:\WINNT\system32\idq.dll
2006-11-14 21:36 113,152 –a—— C:\WINNT\system32\gpresult.exe
2006-11-14 21:36 113,152 –a—— C:\WINNT\system32\dfrgui.dll
2006-11-14 21:36 110,080 –a—— C:\WINNT\system32\dmstyle.dll
2006-11-14 21:36 103,936 –a—— C:\WINNT\system32\rsnotify.exe
2006-11-14 21:36 103,936 –a—— C:\WINNT\system32\imm32.dll
2006-11-14 21:36 103,424 –a—— C:\WINNT\system32\dgnet.dll
2006-11-14 21:36 10,752 ——— C:\WINNT\system32\spiisupd.exe
2006-11-14 21:36 1,180,672 –a—— C:\WINNT\system32\d3d8.dll
2006-11-14 21:36 1,004,032 –a—— C:\WINNT\explorer.exe
2006-11-14 21:35 91,648 –a—— C:\WINNT\system32\ahui.exe
2006-11-14 21:35 91,136 –a—— C:\WINNT\system32\advpack.dll
2006-11-14 21:35 8,192 –a—— C:\WINNT\system32\autolfn.exe
2006-11-14 21:35 76,288 –a—— C:\WINNT\system32\avifil32.dll
2006-11-14 21:35 74,810 –a—— C:\WINNT\system32\atl.dll
2006-11-14 21:35 71,680 –a—— C:\WINNT\system32\browsewm.dll
2006-11-14 21:35 64,512 –a—— C:\WINNT\system32\ciodm.dll
2006-11-14 21:35 62,976 –a—— C:\WINNT\system32\browselc.dll
2006-11-14 21:35 62,464 –a—— C:\WINNT\system32\adsmsext.dll
2006-11-14 21:35 6,656 –a—— C:\WINNT\system32\batt.dll
2006-11-14 21:35 59,904 –a—— C:\WINNT\system32\cabinet.dll
2006-11-14 21:35 5,120 –a—— C:\WINNT\system32\asferror.dll
2006-11-14 21:35 49,152 –a—— C:\WINNT\system32\browser.dll
2006-11-14 21:35 41,984 –a—— C:\WINNT\system32\alg.exe
2006-11-14 21:35 38,912 –a—— C:\WINNT\system32\audiosrv.dll
2006-11-14 21:35 32,768 –a—— C:\WINNT\system32\cfgbkend.dll
2006-11-14 21:35 32,512 ——— C:\WINNT\system32\drivers\amdk7.sys
2006-11-14 21:35 239,616 –a—— C:\WINNT\system32\adsnt.dll
2006-11-14 21:35 22,528 –a—— C:\WINNT\system32\at.exe
2006-11-14 21:35 186,880 –a—— C:\WINNT\system32\certcli.dll
2006-11-14 21:35 162,816 –a—— C:\WINNT\system32\adsldp.dll
2006-11-14 21:35 14,366 –a—— C:\WINNT\system32\asfsipc.dll
2006-11-14 21:35 139,776 –a—— C:\WINNT\system32\adsldpc.dll
2006-11-14 21:35 115,712 –a—— C:\WINNT\system32\apphelp.dll
2006-11-14 20:19 593,408 –a—— C:\WINNT\system32\h323msp.dll
2006-11-14 20:15 97,280 –a—— C:\WINNT\system32\txflog.dll
2006-11-14 18:51 127,208 –a—— C:\WINNT\system32\mucltui.dll
2006-11-12 00:58 2,585,872 –a—— C:\WindowsInstaller-KB893803-v2-x86.exe
2006-11-12 00:54 9,692,736 –a—— C:\nmsetup.exe
2006-11-09 02:27 51,072 –a—— C:\WINNT\system32\drivers\ikhlayer.sys
2006-11-09 02:27 30,592 –a—— C:\WINNT\system32\drivers\ikhfile.sys
2006-11-09 02:24 8,598,632 –a—— C:\WINNT\sdsetup.exe
2006-11-08 21:42 7,168 –a—— C:\WINNT\system32\wamregps.dll
2006-11-08 21:42 60,416 –a—— C:\WINNT\system32\iismap.dll
2006-11-08 21:42 59,392 –a—— C:\WINNT\system32\iisext.dll
2006-11-08 21:42 34,816 –a—— C:\WINNT\system32\admwprox.dll
2006-11-08 21:42 3,584 –a—— C:\WINNT\system32\iismui.dll
2006-11-08 21:42 19,968 –a—— C:\WINNT\system32\inetsloc.dll
2006-11-08 21:42 13,312 –a—— C:\WINNT\system32\exstrace.dll
2006-11-08 21:42 120,832 –a—— C:\WINNT\system32\iisRtl.dll
2006-11-08 21:42 11,776 –a—— C:\WINNT\system32\infoadmn.dll
2006-11-08 21:22 24,661 –a—— C:\WINNT\system32\spxcoins.dll
2006-11-08 21:22 13,312 –a—— C:\WINNT\system32\irclass.dll
2006-11-08 20:33 124,184 –a—— C:\WINNT\system32\wuauclt.exe
2006-11-08 20:33 1,343,768 –a—— C:\WINNT\system32\wuaueng.dll
2006-11-03 03:19 499,200 –a—— C:\WINNT\system32\comuid.dll
2006-11-03 03:19 150,528 –a—— C:\WINNT\system32\msdtcuiu.dll
2006-11-03 03:18 974,336 –a—— C:\WINNT\system32\msdtctm.dll
2006-11-03 03:18 368,640 –a—— C:\WINNT\system32\msdtcprx.dll
2006-11-03 03:18 110,080 –a—— C:\WINNT\system32\clbcatex.dll
2006-11-02 23:35 8,464 –a—— C:\WINNT\system32\sporder.dll
2006-11-02 01:51 7,680 ——— C:\WINNT\system32\bitsprx2.dll
2006-11-02 01:51 7,168 ——— C:\WINNT\system32\bitsprx3.dll
2006-11-02 01:51 17,408 –a—— C:\WINNT\system32\qmgrprxy.dll
2006-11-02 01:50 331,776 –a—— C:\WINNT\system32\winhttp.dll
2006-11-02 01:37 d——– C:\WINNT\McAfee.com


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

Rootkit driver pe386 is present. A rootkit scan is required

2006-11-28 17:44 ——– d——– C:\Documents and Settings\Tessa\Application Data\Azureus
2006-11-28 17:39 ——– d——– C:\Program Files\Prevx1
2006-11-27 18:02 ——– d——– C:\Documents and Settings\Tessa\Application Data\Prevx
2006-11-27 17:45 ——– d——– C:\Program Files\PSDream
2006-11-25 21:52 96 –a—— C:\Program Files\Default7BBC
2006-11-25 21:52 768 –a—— C:\Program Files\MySetup.DK
2006-11-25 21:52 46823 –a—— C:\Program Files\intrface.bbw
2006-11-25 21:52 3200 –a—— C:\Program Files\DEFAULT.ALI
2006-11-24 17:44 91098 –ah-c— C:\Program Files\bbw.GID
2006-11-23 19:59 64 –a—— C:\Documents and Settings\Tessa\Application Data\Current.prx
2006-11-23 19:56 ——– d——– C:\Program Files\Java
2006-11-22 22:47 ——– d——– C:\Program Files\Proxifier
2006-11-22 12:54 ——– d——– C:\Program Files\Spyware Doctor
2006-11-20 22:16 ——– d——– C:\Program Files\Grisoft
2006-11-20 16:21 ——– d-a—— C:\Program Files\Accessories
2006-11-20 15:03 ——– d——– C:\Documents and Settings\Tessa\Application Data\MSN6
2006-11-20 02:25 ——– d-a—— C:\Program Files\Common Files
2006-11-20 01:53 ——– d——– C:\Program Files\HJT
2006-11-18 19:12 40 –a—— C:\Program Files\Tuner.cfg
2006-11-18 19:07 80 –a–c— C:\Program Files\BURN.TXT
2006-11-18 16:56 203 –a–c— C:\Program Files\BBWERROR.LOG
2006-11-17 09:05 ——– d——– C:\Program Files\Messenger
2006-11-16 04:45 ——– d——– C:\Program Files\TrojanHunter 4.2
2006-11-16 04:07 ——– d-a—— C:\Program Files\Windows Media Player
2006-11-16 03:24 ——– d-a—— C:\Program Files\Outlook Express
2006-11-16 03:24 ——– d-a—— C:\Program Files\Common Files\System
2006-11-14 21:58 ——– d-a—— C:\Program Files\Internet Explorer
2006-11-14 21:48 ——– d-a—— C:\Program Files\NetMeeting
2006-11-14 21:48 ——– d——– C:\Program Files\Movie Maker
2006-11-14 18:50 ——– d-ah—– C:\Program Files\WindowsUpdate
2006-11-13 22:17 ——– d——– C:\Program Files\Google
2006-11-11 22:48 ——– d——– C:\Documents and Settings\Tessa\Application Data\DriveCleaner 2006 Free
2006-11-09 04:31 ——– d—s—- C:\Documents and Settings\Tessa\Application Data\Microsoft
2006-11-09 04:28 ——– d——– C:\Program Files\SpywareBlaster
2006-11-09 02:43 ——– d——– C:\Documents and Settings\Tessa\Application Data\Google
2006-11-09 02:27 ——– d——– C:\Documents and Settings\Tessa\Application Data\PC Tools
2006-11-09 02:09 ——– d-a—— C:\Program Files\Common Files\Services
2006-11-07 20:24 ——– d——– C:\Program Files\Dantz
2006-11-07 20:21 ——– d-a—— C:\Program Files\Common Files\InstallShield
2006-11-06 01:13 48128 –ahs—- C:\Program Files\Thumbs.db
2006-11-05 23:43 ——– d——– C:\Program Files\WinRAR
2006-11-03 00:21 ——– d——– C:\Program Files\Creative
2006-11-02 23:12 ——– d——– C:\Program Files\Azureus
2006-11-02 01:16 ——– d——– C:\Program Files\Lavasoft
2006-11-02 01:16 ——– d——– C:\Documents and Settings\Tessa\Application Data\Lavasoft
2006-11-02 00:50 ——– d——– C:\Program Files\Common Files\iS3
2006-11-01 21:52 ——– d-a—— C:\Program Files\Common Files\Symantec Shared
2006-11-01 21:41 ——– d–h—– C:\Program Files\InstallShield Installation Information
2006-10-29 19:00 ——– d——– C:\Program Files\Sonic Foundry ACID Music
2006-10-28 15:37 ——– d——– C:\Program Files\QuickTime
2006-10-26 23:52 ——– d——– C:\Documents and Settings\Tessa\Application Data\Apple Computer
2006-10-13 23:07 ——– d——– C:\Documents and Settings\Tessa\Application Data\eFax Messenger
2006-10-11 08:18 ——– d——– C:\Program Files\Yahoo!
2006-10-07 15:20 192 –a—— C:\Program Files\$MIDIMON.cfg
2006-10-03 23:35 ——– d——– C:\Program Files\Citrix
2006-10-03 23:35 ——– d——– C:\Documents and Settings\Tessa\Application Data\ICAClient
2006-09-12 23:09 1110528 –a—— C:\WINNT\system32\msxml3.dll
2006-08-26 13:31 16784 —–c— C:\Documents and Settings\Tessa\Application Data\GDIPFONTCACHEV1.DAT


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"
"MSMSGS"="\"C:\\Program Files\\Messenger\\MSMSGS.EXE\" /background"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Synchronization Manager"="mobsync.exe /logon"
"AtiPTA"="atiptaxx.exe"
"POINTER"="point32.exe"
"NeroFilterCheck"="C:\\WINNT\\system32\\NeroCheck.exe"
"Zone Labs Client"="C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\""
"HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"
"THGuard"="\"C:\\Program Files\\TrojanHunter 4.2\\THGuard.exe\""
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
"PrevxOne"="\"C:\\Program Files\\Prevx1\\PXConsole.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex]
"msconfig"="C:\\WINNT\\scvhost.exe"
"Update Checker"="C:\\WINNT\\scvhost.exe"
@="C:\\WINNT\\scvhost.exe"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"=""
"FriendlyName"=""
"Flags"=dword:00000000
"Position"=hex:2c,00,00,00,00,00,00,00,01,00,00,00,dc,00,00,00,d0,00,00,00,e8,\
03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,00
"OriginalStateInfo"=hex:18,00,00,00,00,00,00,00,00,00,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,01,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,01,00,00,00

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
"Source"="C:\\Program Files\\Common Files\\mehe.html"
"SubscribedURL"=""
"FriendlyName"=""
"Flags"=dword:00002000
"Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,ea,\
03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\
00,00,01,00,00,00
"RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Htal"="\"C:\\WINNT\\system32\\config\\SYSTEM~1\\MYDOCU~1\\ASKS~1\\msiexec.exe\" -vt yazb"
"PSDream"="\"C:\\Program Files\\PSDream\\PSDream.exe\""
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop"
"tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"Htal"="\"C:\\WINNT\\system32\\config\\SYSTEM~1\\MYDOCU~1\\ASKS~1\\msiexec.exe\" -vt yazb"
"PSDream"="\"C:\\Program Files\\PSDream\\PSDream.exe\""
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop"
"tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=dword:00000000

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=dword:00000000

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"


Contents of the 'Scheduled Tasks' folder
C:\WINNT\tasks\Backup.job
C:\WINNT\tasks\Disk Cleanup.job
C:\WINNT\tasks\Symantec NetDetect.job

Completion time: 06-11-28 17:45:59.41
C:\ComboFix.txt … 06-11-28 17:45
C:\ComboFix2.txt … 06-11-26 18:46
C:\ComboFix3.txt … 06-11-26 12:23
Post #40
Backup Your Registry with ERUNT
  • Please use the following link and scroll down to ERUNT and download it.
    http://aumha.org/freeware/freeware.php
  • For version with the Installer:
    Use the setup program to install ERUNT on your computer
  • For the zipped version:
    Unzip all the files into a folder of your choice.
Click Erunt.exe to backup your registry to the folder of your choice.

Note: to restore your registry, go to the folder and start ERDNT.exe


There are two keys we need to delete if present. Even if the first one isn't there move on to the second one anyway.

Download Registrar Registry Manager from here:
http://www.resplendence.com/download/reglite.exe

Put it in its own folder. You may want to keep this program. It is an excellent free, registry editor.

Copy and paste the follow text into the address bar, then hit 'Go':
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

In the pane on the right are the values associated with that key.
We want to remove this one -> pe386

Right click on it, and select delete. If you get a confirmation question, respond OK.



Copy and paste the follow text into the address bar, then hit 'Go':
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex

In the pane on the right are the values associated with that key.
We want to remove this one -> C:\\WINNT\\scvhost.exe
If you get a confirmation question, respond OK then close out the program.

Reboot and "copy/paste" a new HijackThis log file into this thread.

Let me know how it went.
Post #41
I went fine… I think I did everything right.
Here is my latest HJT log:
Oh, by the way, are there any programs that I should delete or don't need?


Logfile of HijackThis v1.99.1
Scan saved at 10:33:47 PM, on 11/28/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\System32\CTSvcCDA.exe
C:\Program Files\Prevx1\PXAgent.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Dantz\Retrospect 7.0\retrorun.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINNT\System32\atiptaxx.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Prevx1\PXConsole.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Internet Explorer\iexplore.exe
F:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx1\PXConsole.exe"
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Broken Internet access because of LSP provider 'prxernsp.dll' missing
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://www.rawflow.com/passion/Rawflow.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1124499090416
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1163551812568
O16 - DPF: {89242969-422B-46BF-B0D5-6A7B7DC4D0E0} (NAS Finder Helper) - file://D:\html\nafcom.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…886/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E99E132C-52F1-4ABE-8A04-D6583D60C55F}: NameServer = 24.196.64.53,68.115.71.53
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\System32\CTSvcCDA.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing)
O23 - Service: Retrospect Launcher (RetroLauncher) - EMC Dantz - C:\Program Files\Dantz\Retrospect 7.0\retrorun.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
Post #42
You can use add/remove programs and remove:
Prevx1
AVG Anti-Spyware 7.5


Delete these also if you want and if listed:

combofix
!submit
killbox


Good Job :thumbup:

Log looks good :D


You need to create a new Clean restore point.

Note: This will remove all previous Restore Points

Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Restart your computer, turn it back on.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Remove the Check Turn off System Restore.
Click Apply, and then click OK.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.



If you dont have any programs like these, I would recommend that you get them.
Spywareblaster,
Spywareguard.
IE Spyads
They will add 1000's of sites to your resticted zone and block some hijacks from happening.

Also get a FREE FIREWALL and FREE ANTI VIRUS if you need one.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.

Safe Surfing. :D

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein
Post #43
So my computer is okay now? Is it okay to do fininacial things on the computer again?? If it is I'd like to make a donation because you guys totally rock!! Thank you so much!!!
Post #44

So my computer is okay now? Is it okay to do fininacial things on the computer again?? If it is I'd like to make a donation because you guys totally rock!! Thank you so much!!!

With the infection you had, you can't be 100% sure. I would make sure to change all passwords first and be sure to get any of those free programs:

If you dont have any programs like these, I would recommend that you get them.
Spywareblaster,
Spywareguard.
IE Spyads
Post #45
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI