What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

HijackThis Log, spyware could be Qoologic

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi all, at first my computer was basically taken over by some unknown program. I couldn't do a system restore so I did a non destructive recovery. This seemed to get rid of the worst problems however several programs that I know were not running the other day are still running. vvdmv.exe which is in several places including the registry it looks like and fmmiv.exe. When I ran AVG anti spyware it came up with these files right away and labeled them as Qoologic. I have tried quarantining and deleting these files several times but they keep popping back up. There is a section of AVG antivirus called analysis, with an auto start tab. VVDMV.exe is in there twice. I have tried shutting it off there as well as with Security task manager. It just wont go away so any help you guys can offer is appreciated. Here is my Hijack This log:
Logfile of HijackThis v1.99.1
Scan saved at 7:02:49 PM, on 11/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\VERITAS Software\Update Manager\sgtray.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Common Files\AOL\1163248067\ee\AOLSoftware.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEA.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\hp center\137903\Shadow\ShadowBar.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Security Task Manager\TaskMan.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\My Documents\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us7.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us7.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us7.hpwis.com/
F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\system32\vvdmv.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,grkqgdo.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Freedom Popup Killer - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Zero Knowledge\Freedom\pkR.dll
O2 - BHO: Freedom BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\Zero Knowledge\Freedom\FreeBHOR.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [BlockTracker] c:\hp\bin\BlockTracker.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [AutoTBar] C:\hp\bin\autotbar.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded
O4 - HKLM\..\Run: [BCNT] C:\PROGRA~1\AWS\WEATHE~1\BCNT.EXE
O4 - HKLM\..\Run: [Zero Knowledge Freedom] C:\Program Files\Zero Knowledge\Freedom\AutoStarterR.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1163248067\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [EPSON Stylus CX4200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEA.EXE /P26 "EPSON Stylus CX4200 Series" /O6 "USB001" /M "Stylus CX4200"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: hp center UI.lnk = C:\Program Files\hp center\137903\Shadow\ShadowBar.exe
O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1163250017578
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1163250003812
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Post #2
Hello and Welcome to TomCoyote,

Please do the following:

STEP 1.
======
Combofix
  • Download this file - combofix.exe
  • Double click combofix.exe & follow the prompts.
  • When finished, it shall produce a log for you. Post that log in your next reply
Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Post #3
Thanks susan here is the log…I think combofix solved the problem as it no longer shows in msconfig, security manager, or regular task manager: Owner - 06-11-11 23:34:53.95 Service Pack 2 ComboFix 06.11.9 - Running from: "C:\Documents and Settings\Owner\Desktop" ((((((((((((((((((((((((((((((((((((((((((((( Qoologic's Log ))))))))))))))))))))))))))))))))))))))))))))))))))) * * * PRE-RUN - Filepaths extracted from the Registry * * * * * * * * * * * * * * * * * * * * * * F2 -REG:system.ini: UserInit C:\WINDOWS\system32\grkqgdo.exe * * * POST-RUN - Files in the Quarantine folder * * * * * * * * * * * * * * * * * * * * * * * * * 06-11-11 17:48 127488 kkbmh.dat.qoo 06-11-11 03:08 127488 wtxjc.exe.qoo 06-11-11 03:08 23552 grkqgdo.exe.qoo 06-11-11 03:08 52 vwbnvn.dat.qoo DO NOT DELETE ANY FILES FROM THIS DIRECTORY UNLESS INSTRUCTED TO (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\cfg32.exe C:\WINDOWS\cfg32a.exe C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\89MV8DM3\dfndrff_e_uit[1].exe C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\IXGFU5MX\kybrdff_e[1].exe C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\M5W3E1Y5\nwnmff_e[1].exe C:\WINDOWS\system32\wtssvtr.exe C:\WINDOWS\uninstall_nmon.vbs C:\Documents and Settings\LocalService\Application Data\NetMon C:\Program Files\batty2 ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\QooBox\Purity\Program Files\Common Files\CROSOF~1 C:\QooBox\Purity\Program Files\Common Files\CROSOF~1\??crosoft ((((((((((((((((((((((((((((((( Files Created from 2006-10-11 to 2006-11-11 )))))))))))))))))))))))))))))))))) 2006-11-11 20:42 765,952 –a—— C:\WINDOWS\system32\xvidcore.dll 2006-11-11 20:42 73,728 –a—— C:\WINDOWS\system32\dpl100.dll 2006-11-11 20:42 635,486 –a—— C:\WINDOWS\system32\divx.dll 2006-11-11 20:42 630,784 –a—— C:\WINDOWS\system32\vp7vfw.dll 2006-11-11 20:42 556,032 –a—— C:\WINDOWS\system32\x264vfw.dll 2006-11-11 20:42 5,120 –a—— C:\WINDOWS\system32\ff_vfw.dll 2006-11-11 20:42 438,272 –a—— C:\WINDOWS\system32\vp6vfw.dll 2006-11-11 20:42 39,936 –a—— C:\WINDOWS\system32\huffyuv.dll 2006-11-11 20:42 3,596,288 –a—— C:\WINDOWS\system32\qt-dx331.dll 2006-11-11 20:42 200,704 –a—— C:\WINDOWS\system32\ssldivx.dll 2006-11-11 20:42 196,608 –a—— C:\WINDOWS\system32\dtu100.dll 2006-11-11 20:42 180,224 –a—— C:\WINDOWS\system32\xvidvfw.dll 2006-11-11 20:42 1,415,680 –a—— C:\WINDOWS\system32\WMV9VCM.dll 2006-11-11 20:42 1,044,480 –a—— C:\WINDOWS\system32\libdivx.dll 2006-11-11 13:54 3,968 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys 2006-11-11 11:06 83,208 –a—— C:\WINDOWS\system32\S32EVNT1.DLL 2006-11-11 11:06 73,496 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2006-11-11 08:55 15,104 –a—— C:\WINDOWS\system32\drivers\usbscan.sys 2006-11-11 08:11 614,912 –a—— C:\WINDOWS\system32\h323msp.dll 2006-11-11 08:11 39,936 –a—— C:\WINDOWS\system32\mf3216.dll 2006-11-11 08:11 331,264 –a—— C:\WINDOWS\system32\ipnathlp.dll 2006-11-11 08:10 60,288 –a—— C:\WINDOWS\system32\drivers\drmk.sys 2006-11-11 08:10 48,640 –a—— C:\WINDOWS\system32\drivers\stream.sys 2006-11-11 08:10 145,792 –a—— C:\WINDOWS\system32\drivers\portcls.sys 2006-11-11 08:10 140,928 –a—— C:\WINDOWS\system32\drivers\ks.sys 2006-11-11 08:09 4,096 –a—— C:\WINDOWS\system32\ksuser.dll 2006-11-11 08:08 947,472 –a—— C:\WINDOWS\system32\msjava.dll 2006-11-11 08:08 63,248 –a—— C:\WINDOWS\system32\javaprxy.dll 2006-11-11 08:08 49,424 –a—— C:\WINDOWS\system32\clspack.exe 2006-11-11 08:08 46,352 –a—— C:\WINDOWS\setdebug.exe 2006-11-11 08:08 404,752 –a—— C:\WINDOWS\system32\javart.dll 2006-11-11 08:08 313,856 –a—— C:\WINDOWS\system32\dx3j.dll 2006-11-11 08:08 286,992 –a—— C:\WINDOWS\system32\vmhelper.dll 2006-11-11 08:08 21,264 –a—— C:\WINDOWS\system32\msjdbc10.dll 2006-11-11 08:08 187,152 –a—— C:\WINDOWS\system32\javacypt.dll 2006-11-11 08:08 172,304 –a—— C:\WINDOWS\system32\jview.exe 2006-11-11 08:08 171,792 –a—— C:\WINDOWS\system32\wjview.exe 2006-11-11 08:08 171,280 –a—— C:\WINDOWS\system32\jit.dll 2006-11-11 08:08 154,384 –a—— C:\WINDOWS\system32\msawt.dll 2006-11-11 08:08 15,120 –a—— C:\WINDOWS\system32\jdbgmgr.exe 2006-11-11 08:08 113 –a—— C:\WINDOWS\system32\zonedon.reg 2006-11-11 08:08 113 –a—— C:\WINDOWS\system32\zonedoff.reg 2006-11-11 07:55 82,944 –a—— C:\WINDOWS\system32\drivers\wdmaud.sys 2006-11-11 07:55 7,552 –a—— C:\WINDOWS\system32\drivers\mskssrv.sys 2006-11-11 07:55 60,800 –a—— C:\WINDOWS\system32\drivers\sysaudio.sys 2006-11-11 07:55 6,400 –a—— C:\WINDOWS\system32\drivers\splitter.sys 2006-11-11 07:55 52,864 –a—— C:\WINDOWS\system32\drivers\dmusic.sys 2006-11-11 07:55 5,376 –a—— C:\WINDOWS\system32\drivers\mspclock.sys 2006-11-11 07:55 4,992 –a—— C:\WINDOWS\system32\drivers\mspqm.sys 2006-11-11 07:55 31,616 –a—— C:\WINDOWS\system32\drivers\usbccgp.sys 2006-11-11 07:55 25,856 –a—— C:\WINDOWS\system32\drivers\usbprint.sys 2006-11-11 07:55 2,944 –a—— C:\WINDOWS\system32\drivers\drmkaud.sys 2006-11-11 07:55 171,776 –a—— C:\WINDOWS\system32\drivers\kmixer.sys 2006-11-11 07:54 61,056 –a—— C:\WINDOWS\system32\drivers\ohci1394.sys 2006-11-11 07:54 53,248 –a—— C:\WINDOWS\system32\drivers\1394bus.sys 2006-11-11 07:42 1,082,368 –a—— C:\WINDOWS\system32\esent.dll 2006-11-11 07:03 351,232 –a—— C:\WINDOWS\system32\winhttp.dll 2006-11-11 07:03 18,944 –a—— C:\WINDOWS\system32\qmgrprxy.dll 2006-11-11 07:02 127,208 –a—— C:\WINDOWS\system32\mucltui.dll 2006-11-11 06:29 87,040 –a—— C:\WINDOWS\system32\drmstor.dll 2006-11-11 06:29 809,984 –a—— C:\WINDOWS\system32\wmvdmod.dll 2006-11-11 06:29 759,296 –a—— C:\WINDOWS\system32\wmsdmod.dll 2006-11-11 06:29 695,296 –a—— C:\WINDOWS\system32\drmv2clt.dll 2006-11-11 06:29 670,720 –a—— C:\WINDOWS\system32\wmadmoe.dll 2006-11-11 06:29 6,656 –a—— C:\WINDOWS\system32\laprxy.dll 2006-11-11 06:29 408,064 –a—— C:\WINDOWS\system32\wmadmod.dll 2006-11-11 06:29 299,520 –a—— C:\WINDOWS\system32\drmclien.dll 2006-11-11 06:29 286,208 –a—— C:\WINDOWS\system32\blackbox.dll 2006-11-11 06:29 259,072 –a—— C:\WINDOWS\system32\msnetobj.dll 2006-11-11 06:29 240,640 –a—— C:\WINDOWS\system32\mpg4dmod.dll 2006-11-11 06:29 237,568 –a—— C:\WINDOWS\system32\qasf.dll 2006-11-11 06:29 103,936 –a—— C:\WINDOWS\system32\logagent.exe 2006-11-11 06:29 1,050,624 –a—— C:\WINDOWS\system32\wmnetmgr.dll 2006-11-11 06:02 198,424 –a—— C:\WINDOWS\system32\iuengine.dll 2006-11-11 05:59 52,736 –a—— C:\WINDOWS\system32\drivers\i8042prt.sys 2006-11-11 05:59 24,576 –a—— C:\WINDOWS\system32\drivers\kbdclass.sys 2006-11-11 03:29 32,768 –a—— C:\WINDOWS\qdjheupf.exe 2006-11-11 03:08 431 –a—— C:\WINDOWS\eispm.dll 2006-11-11 03:08 397,312 –a—— C:\WINDOWS\cfg32p.dll 2006-11-11 03:08 178,306 –a—— C:\WINDOWS\ac3_0008.exe 2006-11-11 03:07 45,056 –a—— C:\WINDOWS\system32\nrnqetwbz.exe 2006-11-11 03:07 28,672 –a—— C:\WINDOWS\system32\pfbo0yj.exe 2006-11-11 03:07 200,704 –a—— C:\WINDOWS\system32\p2jlseh8.dll 2006-11-11 03:07 135,168 –a—— C:\WINDOWS\system32\e0pnii5i6.exe 2006-11-11 03:07 1,122,304 –a—— C:\WINDOWS\system32\rnnypbw.exe 2006-11-11 03:07 0 –a—— C:\WINDOWS\system32nrnqetwbz.exe (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-11-11 23:39 ——– d——– C:\Documents and Settings\Owner\Application Data\Azureus 2006-11-11 23:36 ——– d——– C:\Program Files\Common Files 2006-11-11 23:32 ——– d——– C:\Program Files\America Online 9.0 2006-11-11 22:27 ——– d——– C:\Documents and Settings\Owner\Application Data\MSN6 2006-11-11 21:36 ——– d——– C:\Program Files\WinAVI VideoConverter 2006-11-11 21:26 ——– d——– C:\Program Files\QuickTime 2006-11-11 20:46 ——– d——– C:\Program Files\Zoom Player 2006-11-11 20:42 ——– d——– C:\Program Files\K-Lite Codec Pack 2006-11-11 20:27 ——– d——– C:\Program Files\DirectVobSub 2006-11-11 20:22 ——– d——– C:\Program Files\Java 2006-11-11 20:10 ——– d——– C:\Program Files\Common Files\Microsoft Shared 2006-11-11 19:47 ——– d——– C:\Program Files\mIRC 2006-11-11 13:54 ——– d——– C:\Program Files\Grisoft 2006-11-11 13:12 ——– d——– C:\Program Files\Common Files\AOL 2006-11-11 13:12 ——– d——– C:\Program Files\AOL 2006-11-11 13:07 ——– d——– C:\Program Files\Windows Media Player 2006-11-11 13:07 ——– d——– C:\Program Files\KaZaA Lite 2006-11-11 12:27 ——– d——– C:\Documents and Settings\Owner\Application Data\Lavasoft 2006-11-11 12:26 ——– d——– C:\Program Files\Lavasoft 2006-11-11 11:06 ——– d——– C:\Program Files\Symantec 2006-11-11 11:06 ——– d——– C:\Program Files\Common Files\Symantec Shared 2006-11-11 10:20 ——– d——– C:\Program Files\Messenger 2006-11-11 10:20 ——– d——– C:\Program Files\Internet Explorer 2006-11-11 09:23 ——– d——– C:\Program Files\Windows NT 2006-11-11 09:23 ——– d——– C:\Program Files\Outlook Express 2006-11-11 09:23 ——– d——– C:\Program Files\NetMeeting 2006-11-11 09:23 ——– d——– C:\Program Files\Movie Maker 2006-11-11 09:23 ——– d——– C:\Program Files\Common Files\System 2006-11-11 06:39 ——– d–h—– C:\Program Files\WindowsUpdate 2006-11-11 06:39 ——– d——– C:\Program Files\Common Files\Services 2006-11-11 06:31 ——– d——– C:\Program Files\America Online 7.0 2006-11-11 06:28 ——– d——– C:\Program Files\Common Files\aolshare 2006-11-11 06:09 8552 –a—— C:\WINDOWS\system32\drivers\asctrm.sys 2006-11-11 04:53 ——– d——– C:\Program Files\htmlhelp 2006-11-11 03:35 ——– d——– C:\Program Files\Google 2006-11-11 03:09 93664 –ahs—- C:\Program Files\Common Files\Y1324OU.exe 2006-11-11 03:09 ——– d——– C:\Program Files\àppPatch 2006-11-11 03:08 ——– d——– C:\Program Files\PSCastor 2006-11-11 03:07 ——– d——– C:\Program Files\Pegasys Inc 2006-11-11 01:05 ——– d——– C:\Program Files\eMule 2006-11-01 18:44 ——– d——– C:\Program Files\Trivium for AOL 2006-10-08 16:56 ——– d——– C:\Documents and Settings\Owner\Application Data\Pegasys Inc 2006-09-27 16:30 ——– d——– C:\Program Files\Microsoft Games 2006-09-12 23:01 1084416 –a—— C:\WINDOWS\system32\msxml3.dll 2006-08-25 09:45 617472 –a—— C:\WINDOWS\system32\comctl32.dll 2006-08-16 05:58 100352 –a—— C:\WINDOWS\system32\6to4svc.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "NVIEW"="rundll32.exe nview.dll,nViewLoadHook" "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "AOL Fast Start"="\"C:\\Program Files\\America Online 9.0\\AOL.EXE\" -b" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "BlockTracker"="c:\\hp\\bin\\BlockTracker.exe" "hpsysdrv"="c:\\windows\\system\\hpsysdrv.exe" "HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe" "Share-to-Web Namespace Daemon"="c:\\Program Files\\Hewlett-Packard\\HP Share-to-Web\\hpgs2wnd.exe" "CamMonitor"="c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\hpqcmon.exe" "KBD"="C:\\HP\\KBD\\KBD.EXE" "StorageGuard"="\"C:\\Program Files\\VERITAS Software\\Update Manager\\sgtray.exe\" /r" "AutoTBar"="C:\\hp\\bin\\autotbar.exe" "Recguard"="C:\\WINDOWS\\SMINST\\RECGUARD.EXE" "NvCplDaemon"="RUNDLL32.EXE NvQTwk,NvCplDaemon initialize" "nwiz"="nwiz.exe /installquiet /keeploaded" "BCNT"="C:\\PROGRA~1\\AWS\\WEATHE~1\\BCNT.EXE" "Zero Knowledge Freedom"="C:\\Program Files\\Zero Knowledge\\Freedom\\AutoStarterR.exe" "PS2"="C:\\WINDOWS\\system32\\ps2.exe" "RealTray"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER" "HostManager"="C:\\Program Files\\Common Files\\AOL\\1163248067\\ee\\AOLSoftware.exe" "AOLDialer"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe" "AOL Spyware Protection"="\"C:\\PROGRA~1\\COMMON~1\\AOL\\AOLSPY~1\\AOLSP Scheduler.exe\"" "AlcxMonitor"="ALCXMNTR.EXE" "EPSON Stylus CX4200 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATIAEA.EXE /P26 \"EPSON Stylus CX4200 Series\" /O6 \"USB001\" /M \"Stylus CX4200\"" "vptray"="C:\\PROGRA~1\\SYMANT~1\\SYMANT~1\\vptray.exe" "IPHSend"="C:\\Program Files\\Common Files\\AOL\\IPHSend\\IPHSend.exe" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,86,01,00,00,00,00,00,00,7a,02,00,00,cb,02,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,f2,01,00,00,23,00,00,00,7c,00,00,00,72,00,\ 00,00,01,00,00,00 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^wtxjc.exe] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\wtxjc.exe" "backup"="C:\\WINDOWS\\pss\\wtxjc.exeCommon Startup" "location"="Common Startup" "command"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\wtxjc.exe" "item"="wtxjc" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\bbwcw] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="fmmivx" "hkey"="HKCU" "command"="C:\\WINDOWS\\System32\\fmmivx.exe reg_run" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eeqavv] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="fmmivx" "hkey"="HKLM" "command"="C:\\WINDOWS\\system32\\fmmivx.exe reg_run" "inimapping"="0" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\Symantec NetDetect.job Completion time: 06-11-11 23:41:30.96 C:\ComboFix.txt … 06-11-11 23:41
Post #4
Hello HKDGuy,

I am glad things have improved but please do not be too hasty. Please do the following:

STEP 1.
======
Please show all files for your system.
You will need to reverse this process when all steps are done.


Submit File to Jotti
Please click on Jotti
Use the "Browse" button and locate the following file on your computer:
C:\Program Files\Common Files\Y1324OU.exe
Click the "Submit" button.
Please copy and post (reply) with the results

If Jotti's service load is too high, you can use the following scanner instead:
http://www.virustotal.com/xhtml/index_en.html

Please also check the properties of those files (right-click and select properties from the popupmenu). Look if you can find some company information, etc.

Now run this online scan using Internet Explorer:
Kaspersky Online Scanner from http://www.kaspersky.com/virusscanner

Next Click on Launch Kaspersky Online Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  • Standard
  • Scan Options:
  • Scan Archives
  • Scan Mail Bases
  • Click OK
  • Now under select a target to scan:
  • Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button:
  • Save the file to your desktop.
Copy and paste that information from Kapersky in your next post.

Please post (reply) with the results from Jotti, the Kapersky log, and a new hijackthis log.
Post #5
Ok susan, On Jotti Y1234OU.exe came up as adware on Fortinet.
Here is the log from Kaspersky:

——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Sunday, November 12, 2006 10:21:50 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 13/11/2006
Kaspersky Anti-Virus database records: 227204
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 164715
Number of viruses found: 13
Number of infected objects: 32 / 0
Number of suspicious objects: 0
Duration of the scan process: 02:34:37

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\AOL\ACS\1.0\ph Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\ACS\1.0\variable Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0\idb\SNMaster.idx Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0\idb\TufrThanu\mydb.idx Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0\idb\TufrThanu\style.lst Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0\idb\TufrThanu\toolbar.lst Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0\organize\CACHE\tufrtha00 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0\organize\tufrthanu Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0\organize\tufrthanu.abi Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0\organize\tufrthanu.aby Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\TopSpeed\2.0\aolstderr.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\TopSpeed\2.0\aolstdout.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\TopSpeed\2.0\aoltsmon.lock Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\TopSpeed\2.0\cache.db Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\TopSpeed\2.0\server.lock Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ea563f5ed0b8ea72081a19b9b561dd25_a16433cf-83d2-44f4-9afa-ce0ae0df7cfc Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped
C:\Documents and Settings\All Users\Application Data\SecTaskMan\fmmivx.exe.q_8040_q Infected: Backdoor.Win32.Hupigon.cj skipped
C:\Documents and Settings\All Users\Application Data\SecTaskMan\vvdmv.exe.q_8040_q.old Infected: Trojan-Downloader.Win32.Qoologic.bj skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0C080000.VBN Infected: Trojan-Clicker.Win32.VB.is skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner\Application Data\AOL\C_America Online 9.0\IDB\Apps.Lst Object is locked skipped
C:\Documents and Settings\Owner\Application Data\AOL\C_America Online 9.0\IDB\art.idx Object is locked skipped
C:\Documents and Settings\Owner\Application Data\AOL\C_America Online 9.0\IDB\sap.dat Object is locked skipped
C:\Documents and Settings\Owner\Application Data\AOL\C_America Online 9.0\IDB\spool.lst Object is locked skipped
C:\Documents and Settings\Owner\Application Data\AOL\C_America Online 9.0\IDB\sysnews.lst Object is locked skipped
C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\AOL\UserProfiles\All Users\cls\common.cls Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\Chomsky the imperial presidency\01 History And The _Second Superpowe.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\Chomsky the imperial presidency\02 Controlling The _Great Beast_.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\Chomsky the imperial presidency\03 Rescinding The Geneva Convention.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\Chomsky the imperial presidency\04 Demystifying _Pre-Emptive War_.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\Chomsky the imperial presidency\05 The Principle Of Universality.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\Chomsky the imperial presidency\06 Polling The _Great Beast_ Of Publ.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\Chomsky the imperial presidency\07 The _Threat Of Terrorism_ Vs The.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\Chomsky the imperial presidency\08 What The _Great Beast_ Wants And.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\Chomsky the imperial presidency\09 What Is _Old Europe_ Anyway_.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\Chomsky the imperial presidency\10 America_S Messianic Vision Of Dem.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\Chomsky the imperial presidency\11 Making Use Of Our Freedom To Figh.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\AlbumArtSmall.jpg Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\AlbumArt_{326A3528-CFF2-4AE3-8449-0967985D4CE7}_Large.jpg Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\AlbumArt_{326A3528-CFF2-4AE3-8449-0967985D4CE7}_Small.jpg Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\desktop.ini Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\Folder.jpg Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\U.S. Iraq Policy - 01 - Just Attack.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\U.S. Iraq Policy - 02 - Favorite Monster.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\U.S. Iraq Policy - 03 - A Hard Choice.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\U.S. Iraq Policy - 04 - Meeting In Mosul.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\U.S. Iraq Policy - 05 - The Real Threat.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\U.S. Iraq Policy - 06 - Kuwait And Panama.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\U.S. Iraq Policy - 07 - Chemical War.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\U.S. Iraq Policy - 08 - Stability.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\U.S. Iraq Policy - 09 - Religious Conversion.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\U.S. Iraq Policy - 10 - Good Terror.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\U.S. Iraq Policy - 11 - Weapons Of Mass Destruction.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\U.S. Iraq Policy - 12 - Carthaginian Solution.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\u;s_iraq_policy-13-its_the_oil.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\us_iraq_policy - 16-war_crimes.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\us_iraq_policy14-saddam_as_mother_teresa.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\us_iraq_policy15-sending_a_message.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\us_iraq_policy_17-get_lost.mp3 Object is locked skipped
C:\Documents and Settings\Owner\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Owner\ntuser.dat.LOG Object is locked skipped
C:\My Music\Gotan lunatico\01-gotan_project-amor_portena.mp3 Object is locked skipped
C:\My Music\Gotan lunatico\02-gotan_project-notas.mp3 Object is locked skipped
C:\My Music\Gotan lunatico\03-gotan_project-diferente.mp3 Object is locked skipped
C:\My Music\Gotan lunatico\04-gotan_project-celos.mp3 Object is locked skipped
C:\My Music\Gotan lunatico\05-gotan_project-lunatico.mp3 Object is locked skipped
C:\My Music\Gotan lunatico\06-gotan_project-mi_confesion.mp3 Object is locked skipped
C:\My Music\Gotan lunatico\07-gotan_project-tango_cancion.mp3 Object is locked skipped
C:\My Music\Gotan lunatico\08-gotan_project-l_biguela.mp3 Object is locked skipped
C:\My Music\Gotan lunatico\09-gotan_project-criminal.mp3 Object is locked skipped
C:\My Music\Gotan lunatico\10-gotan_project-arrabal.mp3 Object is locked skipped
C:\My Music\Gotan lunatico\11-gotan_project-domingo.mp3 Object is locked skipped
C:\My Music\Gotan lunatico\12-gotan_project-paris_texas.mp3 Object is locked skipped
C:\My Music\Gotan lunatico\AlbumArtSmall.jpg Object is locked skipped
C:\My Music\Gotan lunatico\AlbumArt_{DAD0E319-4984-410C-AC45-5A61BD77051D}_Large.jpg Object is locked skipped
C:\My Music\Gotan lunatico\AlbumArt_{DAD0E319-4984-410C-AC45-5A61BD77051D}_Small.jpg Object is locked skipped
C:\My Music\Gotan lunatico\desktop.ini Object is locked skipped
C:\My Music\Gotan lunatico\Folder.jpg Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\chandir.dat Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\chandir.idx Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\chn.dat Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\chn.idx Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\D0000000.FCS Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\inuse.txt Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\L0000001.FCS Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\main.log Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\prs.dat Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\prs.idx Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\prs_die.dat Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\prs_die.idx Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\prs_dnd.dat Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\prs_dnd.idx Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\prs_ext.dat Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\prs_ext.idx Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\prs_rcv.dat Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\prs_rcv.idx Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\storydb.dat Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\storydb.idx Object is locked skipped
C:\QooBox\grkqgdo.exe.qoo Infected: Trojan-Downloader.Win32.Qoologic.bj skipped
C:\QooBox\kkbmh.dat.qoo Infected: Backdoor.Win32.Hupigon.cj skipped
C:\QooBox\wtxjc.exe.qoo Infected: Backdoor.Win32.Hupigon.cj skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0008774.exe/data0004 Infected: Trojan-Downloader.Win32.Small.ctp skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0008774.exe/data0005 Infected: Trojan-Downloader.Win32.Small.ajc skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0008774.exe NSIS: infected - 2 skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009106.exe Infected: Trojan-Downloader.Win32.Zlob.avo skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009107.exe Infected: Trojan-Downloader.Win32.Adload.fu skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009108.exe Infected: Trojan-Downloader.Win32.Agent.ala skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009109.exe Infected: Trojan.Win32.Runner.j skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009110.exe Infected: Trojan.Win32.Runner.j skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009111.exe Infected: Trojan.Win32.Runner.j skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009113.exe Infected: Trojan-Downloader.Win32.PurityScan.cq skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009115.exe Infected: Trojan-Downloader.Win32.WinShow.z skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009116.dll Infected: Trojan-Downloader.Win32.Agent.agw skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009117.exe Infected: Trojan-Downloader.Win32.Qoologic.c skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009145.exe Infected: Backdoor.Win32.Hupigon.cj skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009146.exe Infected: Trojan-Downloader.Win32.Qoologic.bj skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009151.exe Infected: Trojan-Downloader.Win32.Qoologic.bj skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009152.exe Infected: Backdoor.Win32.Hupigon.cj skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009153.dll Infected: Trojan-Downloader.Win32.Qoologic.bj skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP124\A0009181.exe Infected: Trojan-Downloader.Win32.Qoologic.bj skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP124\A0009183.exe Infected: Backdoor.Win32.Hupigon.cj skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP124\A0009208.dll Infected: Trojan-Downloader.Win32.Qoologic.bj skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP124\A0009209.exe Infected: Backdoor.Win32.Hupigon.cj skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP124\A0009210.exe Infected: Trojan-Downloader.Win32.Qoologic.bj skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP127\A0009584.exe Infected: Trojan-Downloader.Win32.Qoologic.bj skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP127\A0009585.exe Infected: Backdoor.Win32.Hupigon.cj skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP127\change.log Object is locked skipped
C:\WINDOWS\$NtUninstallKB824141$\user32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB824141$\win32k.sys Object is locked skipped
C:\WINDOWS\$NtUninstallKB828028$\msasn1.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828035$\msgsvc.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828035$\wkssvc.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\catsrv.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\catsrvut.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\clbcatex.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\clbcatq.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\colbact.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\comadmin.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\comrepl.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\comsvcs.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\comuid.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\es.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\migregdb.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\msdtcprx.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\msdtctm.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\msdtcuiu.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\mtxclu.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\mtxoci.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\ole32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\rpcrt4.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\rpcss.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\txflog.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\dao360.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\expsrv.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msexch40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msexcl40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msjet40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msjetol1.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msjetoledb40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msjint40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msjter40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msjtes40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msltus40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\mspbde40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msrd2x40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msrd3x40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msrepl40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\mstext40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\mswdat10.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\mswstr10.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msxbde40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\vbajet32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB839645$\fldrclnr.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB839645$\shell32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB839645$\shlwapi.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB839645$\sxs.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB839645$\xpsp2res.dll Object is locked skipped
C:\WINDOWS\$NtUninstallQ828026$\msdxm.ocx Object is locked skipped
C:\WINDOWS\$NtUninstallQ828026$\wmpcore.dll Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\MEMORY.DMP Object is locked skipped
C:\WINDOWS\pss\wtxjc.exeCommon Startup Infected: Backdoor.Win32.Hupigon.cj skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

And here is the HijackThis Log:

Logfile of HijackThis v1.99.1
Scan saved at 10:27:30 PM, on 11/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Common Files\AOL\1163248067\ee\AOLSoftware.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEA.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP DVD\Umbrella\DVDTray.exe
C:\Program Files\hp center\137903\Shadow\ShadowBar.exe
C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\America Online 9.0\waol.exe
C:\Program Files\America Online 9.0\shellmon.exe
C:\Documents and Settings\Owner\My Documents\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us7.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us7.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us7.hpwis.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Freedom Popup Killer - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Zero Knowledge\Freedom\pkR.dll
O2 - BHO: Freedom BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\Zero Knowledge\Freedom\FreeBHOR.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [BlockTracker] c:\hp\bin\BlockTracker.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [AutoTBar] C:\hp\bin\autotbar.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1163248067\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [EPSON Stylus CX4200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEA.EXE /P26 "EPSON Stylus CX4200 Series" /O6 "USB001" /M "Stylus CX4200"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP DVD\Umbrella\DVDTray.exe"
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0\AOL.EXE" -b
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: hp center UI.lnk = C:\Program Files\hp center\137903\Shadow\ShadowBar.exe
O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1163250017578
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1163250003812
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Post #6 last edited
You have MktBrowser entries in your logs. If you desire to keep Market Browser, don't remove.
http://www.marketbrowser.com/privacy.asp?limitted=yes

Information We Collect
General: When you register, and at other times, we will collect personally identifiable information from you that may include your name, age, address, e-mail address, credit-card number and facts about your computers, profession, investing habits and similar information.

If you checked MktBrowser then
Go to Add/Remove Programs via the Control Panel and highlight the MarketBrowser entry and click to remove or uninstall.
http://www.bleepingcomputer.com/uninstall/…ketBrowser.html
Please set your system to show all files; please see here if you're unsure how to do this.

Scan with HijackThis. Place a check against each of the following:
http://www.castlecops.com/s180-Alcxmntr_exe.html
We are checking this one to remove from start-up but you can manually start it if you desire.
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
Check to remove – unless you desire to keep it.
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
Close all windows or browsers except for Hijackthis. Click on Fix Checked when finished and exit HijackThis.

Reboot into Safe Mode: please see here if you are not sure how to do this.

Using Windows Explorer, locate the following files/folders, and delete them:
C:\Program Files\Common Files\Y1324OU.exe<=file (maybe you already deleted this one?)
C:\Documents and Settings\All Users\Application Data\SecTaskMan\fmmivx.exe.q_8040_q<=file
C:\Documents and Settings\All Users\Application Data\SecTaskMan\vvdmv.exe.q_8040_q.old<=file
C:\QooBox\grkqgdo.exe.qoo<=file
C:\QooBox\kkbmh.dat.qoo<=file
C:\WINDOWS\pss\wtxjc.exe<=file
Exit Explorer, and reboot as normal afterwards.

Empty your recycle bin.
Please run Kapersky again and post the results with another hijackthis log.
Post #7
OK susan here are the new logs:

——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Tuesday, November 14, 2006 3:39:41 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 14/11/2006
Kaspersky Anti-Virus database records: 227486
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 166445
Number of viruses found: 13
Number of infected objects: 27 / 0
Number of suspicious objects: 0
Duration of the scan process: 02:25:33

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\AOL\ACS\1.0\ph Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\ACS\1.0\variable Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0a\idb\SNMaster.idx Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0a\idb\TufrThanu\mydb.idx Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0a\idb\TufrThanu\style.lst Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0a\idb\TufrThanu\toolbar.lst Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0a\organize\CACHE\tufrtha01 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0a\organize\tufrthanu Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0a\organize\tufrthanu.abi Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0a\organize\tufrthanu.aby Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ea563f5ed0b8ea72081a19b9b561dd25_a16433cf-83d2-44f4-9afa-ce0ae0df7cfc Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0C080000.VBN Infected: Trojan-Clicker.Win32.VB.is skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner\Application Data\AOL\C_America Online 9.0a\IDB\Apps.Lst Object is locked skipped
C:\Documents and Settings\Owner\Application Data\AOL\C_America Online 9.0a\IDB\art.idx Object is locked skipped
C:\Documents and Settings\Owner\Application Data\AOL\C_America Online 9.0a\IDB\sap.dat Object is locked skipped
C:\Documents and Settings\Owner\Application Data\AOL\C_America Online 9.0a\IDB\spool.lst Object is locked skipped
C:\Documents and Settings\Owner\Application Data\AOL\C_America Online 9.0a\IDB\sysnews.lst Object is locked skipped
C:\Documents and Settings\Owner\Application Data\Azureus\ipfilter.cache Object is locked skipped
C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\AOL\UserProfiles\All Users\cls\common.cls Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\History\History.IE5\MSHist012006111320061114\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Temp\hsperfdata_Owner\3480 Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\Chomsky the imperial presidency\01 History And The _Second Superpowe.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\Chomsky the imperial presidency\02 Controlling The _Great Beast_.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\Chomsky the imperial presidency\03 Rescinding The Geneva Convention.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\Chomsky the imperial presidency\04 Demystifying _Pre-Emptive War_.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\Chomsky the imperial presidency\05 The Principle Of Universality.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\Chomsky the imperial presidency\06 Polling The _Great Beast_ Of Publ.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\Chomsky the imperial presidency\07 The _Threat Of Terrorism_ Vs The.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\Chomsky the imperial presidency\08 What The _Great Beast_ Wants And.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\Chomsky the imperial presidency\09 What Is _Old Europe_ Anyway_.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\Chomsky the imperial presidency\10 America_S Messianic Vision Of Dem.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\Chomsky the imperial presidency\11 Making Use Of Our Freedom To Figh.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\AlbumArtSmall.jpg Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\AlbumArt_{326A3528-CFF2-4AE3-8449-0967985D4CE7}_Large.jpg Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\AlbumArt_{326A3528-CFF2-4AE3-8449-0967985D4CE7}_Small.jpg Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\desktop.ini Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\Folder.jpg Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\U.S. Iraq Policy - 01 - Just Attack.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\U.S. Iraq Policy - 02 - Favorite Monster.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\U.S. Iraq Policy - 03 - A Hard Choice.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\U.S. Iraq Policy - 04 - Meeting In Mosul.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\U.S. Iraq Policy - 05 - The Real Threat.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\U.S. Iraq Policy - 06 - Kuwait And Panama.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\U.S. Iraq Policy - 07 - Chemical War.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\U.S. Iraq Policy - 08 - Stability.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\U.S. Iraq Policy - 09 - Religious Conversion.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\U.S. Iraq Policy - 10 - Good Terror.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\U.S. Iraq Policy - 11 - Weapons Of Mass Destruction.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\U.S. Iraq Policy - 12 - Carthaginian Solution.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\u;s_iraq_policy-13-its_the_oil.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\us_iraq_policy - 16-war_crimes.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\us_iraq_policy14-saddam_as_mother_teresa.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\us_iraq_policy15-sending_a_message.mp3 Object is locked skipped
C:\Documents and Settings\Owner\My Documents\My Pando Packages\US Iraq Policy\us_iraq_policy_17-get_lost.mp3 Object is locked skipped
C:\Documents and Settings\Owner\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Owner\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner\UserData\index.dat Object is locked skipped
C:\My Music\Gotan lunatico\01-gotan_project-amor_portena.mp3 Object is locked skipped
C:\My Music\Gotan lunatico\02-gotan_project-notas.mp3 Object is locked skipped
C:\My Music\Gotan lunatico\03-gotan_project-diferente.mp3 Object is locked skipped
C:\My Music\Gotan lunatico\04-gotan_project-celos.mp3 Object is locked skipped
C:\My Music\Gotan lunatico\05-gotan_project-lunatico.mp3 Object is locked skipped
C:\My Music\Gotan lunatico\06-gotan_project-mi_confesion.mp3 Object is locked skipped
C:\My Music\Gotan lunatico\07-gotan_project-tango_cancion.mp3 Object is locked skipped
C:\My Music\Gotan lunatico\08-gotan_project-l_biguela.mp3 Object is locked skipped
C:\My Music\Gotan lunatico\09-gotan_project-criminal.mp3 Object is locked skipped
C:\My Music\Gotan lunatico\10-gotan_project-arrabal.mp3 Object is locked skipped
C:\My Music\Gotan lunatico\11-gotan_project-domingo.mp3 Object is locked skipped
C:\My Music\Gotan lunatico\12-gotan_project-paris_texas.mp3 Object is locked skipped
C:\My Music\Gotan lunatico\AlbumArtSmall.jpg Object is locked skipped
C:\My Music\Gotan lunatico\AlbumArt_{DAD0E319-4984-410C-AC45-5A61BD77051D}_Large.jpg Object is locked skipped
C:\My Music\Gotan lunatico\AlbumArt_{DAD0E319-4984-410C-AC45-5A61BD77051D}_Small.jpg Object is locked skipped
C:\My Music\Gotan lunatico\desktop.ini Object is locked skipped
C:\My Music\Gotan lunatico\Folder.jpg Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\chandir.dat Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\chandir.idx Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\chn.dat Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\chn.idx Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\D0000000.FCS Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\inuse.txt Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\L0000001.FCS Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\main.log Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\prs.dat Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\prs.idx Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\prs_die.dat Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\prs_die.idx Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\prs_dnd.dat Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\prs_dnd.idx Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\prs_ext.dat Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\prs_ext.idx Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\prs_rcv.dat Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\prs_rcv.idx Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\storydb.dat Object is locked skipped
C:\Program Files\hp center\137903\Users\Default\Data\storydb.idx Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0008774.exe/data0004 Infected: Trojan-Downloader.Win32.Small.ctp skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0008774.exe/data0005 Infected: Trojan-Downloader.Win32.Small.ajc skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0008774.exe NSIS: infected - 2 skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009106.exe Infected: Trojan-Downloader.Win32.Zlob.avo skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009107.exe Infected: Trojan-Downloader.Win32.Adload.fu skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009108.exe Infected: Trojan-Downloader.Win32.Agent.ala skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009109.exe Infected: Trojan.Win32.Runner.j skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009110.exe Infected: Trojan.Win32.Runner.j skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009111.exe Infected: Trojan.Win32.Runner.j skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009113.exe Infected: Trojan-Downloader.Win32.PurityScan.cq skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009115.exe Infected: Trojan-Downloader.Win32.WinShow.z skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009116.dll Infected: Trojan-Downloader.Win32.Agent.agw skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009117.exe Infected: Trojan-Downloader.Win32.Qoologic.c skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009145.exe Infected: Backdoor.Win32.Hupigon.cj skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009146.exe Infected: Trojan-Downloader.Win32.Qoologic.bj skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009151.exe Infected: Trojan-Downloader.Win32.Qoologic.bj skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009152.exe Infected: Backdoor.Win32.Hupigon.cj skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP123\A0009153.dll Infected: Trojan-Downloader.Win32.Qoologic.bj skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP124\A0009181.exe Infected: Trojan-Downloader.Win32.Qoologic.bj skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP124\A0009183.exe Infected: Backdoor.Win32.Hupigon.cj skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP124\A0009208.dll Infected: Trojan-Downloader.Win32.Qoologic.bj skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP124\A0009209.exe Infected: Backdoor.Win32.Hupigon.cj skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP124\A0009210.exe Infected: Trojan-Downloader.Win32.Qoologic.bj skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP127\A0009584.exe Infected: Trojan-Downloader.Win32.Qoologic.bj skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP127\A0009585.exe Infected: Backdoor.Win32.Hupigon.cj skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP133\A0010263.old Infected: Trojan-Downloader.Win32.Qoologic.bj skipped
C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP133\change.log Object is locked skipped
C:\WINDOWS\$NtUninstallKB824141$\user32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB824141$\win32k.sys Object is locked skipped
C:\WINDOWS\$NtUninstallKB828028$\msasn1.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828035$\msgsvc.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828035$\wkssvc.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\catsrv.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\catsrvut.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\clbcatex.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\clbcatq.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\colbact.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\comadmin.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\comrepl.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\comsvcs.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\comuid.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\es.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\migregdb.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\msdtcprx.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\msdtctm.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\msdtcuiu.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\mtxclu.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\mtxoci.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\ole32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\rpcrt4.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\rpcss.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\txflog.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\dao360.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\expsrv.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msexch40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msexcl40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msjet40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msjetol1.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msjetoledb40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msjint40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msjter40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msjtes40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msltus40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\mspbde40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msrd2x40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msrd3x40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msrepl40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\mstext40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\mswdat10.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\mswstr10.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msxbde40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\vbajet32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB839645$\fldrclnr.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB839645$\shell32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB839645$\shlwapi.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB839645$\sxs.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB839645$\xpsp2res.dll Object is locked skipped
C:\WINDOWS\$NtUninstallQ828026$\msdxm.ocx Object is locked skipped
C:\WINDOWS\$NtUninstallQ828026$\wmpcore.dll Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\MEMORY.DMP Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP133\change.log Object is locked skipped

Scan process completed.

Logfile of HijackThis v1.99.1
Scan saved at 3:43:38 AM, on 11/14/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\AOL\1163248067\ee\AOLSoftware.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEA.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\HP DVD\Umbrella\DVDTray.exe
C:\Program Files\hp center\137903\Shadow\ShadowBar.exe
C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
C:\Program Files\America Online 9.0a\waol.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\America Online 9.0a\shellmon.exe
C:\Program Files\Azureus\Azureus.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\My Documents\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us7.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us7.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PopKill Class - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Zero Knowledge\Freedom\pkR.dll
O2 - BHO: ZKBho Class - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\Zero Knowledge\Freedom\FreeBHOR.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [BlockTracker] c:\hp\bin\BlockTracker.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [AutoTBar] C:\hp\bin\autotbar.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1163248067\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [EPSON Stylus CX4200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEA.EXE /P26 "EPSON Stylus CX4200 Series" /O6 "USB001" /M "Stylus CX4200"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP DVD\Umbrella\DVDTray.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0a\AOL.EXE" -b
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: hp center UI.lnk = C:\Program Files\hp center\137903\Shadow\ShadowBar.exe
O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1163250017578
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1163250003812
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Post #8
Hello HKDGuy,

I have been studying the ComboFix log and would like you to do the following please.

Please use Jotti to scan the following 3 files and reply with the results..
STEP 1.
======
Please show all files for your system.
You will need to reverse this process when all steps are done.


Submit File to Jotti
Please click on Jotti
Use the "Browse" button and locate the following file on your computer:
C:\WINDOWS\qdjheupf.exe
Click the "Submit" button.
Please copy and post (reply) with the results

If Jotti's service load is too high, you can use the following scanner instead:
http://www.virustotal.com/xhtml/index_en.html

Please also check the properties of those files (right-click and select properties from the popupmenu). Look if you can find some company information, etc.


Please repeat for these:
C:\WINDOWS\eispm.dll
C:\WINDOWS\system32\pfbo0yj.exe
Post #10
Those files show in the ComboFix log you first posted and I was scrutinizing it again and thought some looked suspicious. I did not see anywhere that the files were deleted but now I am wondering if files have been deleted somehow over the time span. I am glad that your computer seems to be running fine. Would you mind running the ComboFix again and posting the log so I can just check it again?
Post #11
Hey susan here is the new combofix log: Owner - 06-11-19 10:37:44.82 Service Pack 2 ComboFix 06.11.9 - Running from: "C:\Documents and Settings\Owner\My Documents" ((((((((((((((((((((((((((((((( Files Created from 2006-10-19 to 2006-11-19 )))))))))))))))))))))))))))))))))) 2006-11-16 16:31 765,952 –a—— C:\WINDOWS\system32\xvidcore.dll 2006-11-16 16:31 73,728 –a—— C:\WINDOWS\system32\dpl100.dll 2006-11-16 16:31 635,486 –a—— C:\WINDOWS\system32\divx.dll 2006-11-16 16:31 630,784 –a—— C:\WINDOWS\system32\vp7vfw.dll 2006-11-16 16:31 556,032 –a—— C:\WINDOWS\system32\x264vfw.dll 2006-11-16 16:31 5,120 –a—— C:\WINDOWS\system32\ff_vfw.dll 2006-11-16 16:31 438,272 –a—— C:\WINDOWS\system32\vp6vfw.dll 2006-11-16 16:31 39,936 –a—— C:\WINDOWS\system32\huffyuv.dll 2006-11-16 16:31 3,596,288 –a—— C:\WINDOWS\system32\qt-dx331.dll 2006-11-16 16:31 217,088 –a—— C:\WINDOWS\system32\yv12vfw.dll 2006-11-16 16:31 217,088 –a—— C:\WINDOWS\system32\i420vfw.dll 2006-11-16 16:31 200,704 –a—— C:\WINDOWS\system32\ssldivx.dll 2006-11-16 16:31 196,608 –a—— C:\WINDOWS\system32\dtu100.dll 2006-11-16 16:31 180,224 –a—— C:\WINDOWS\system32\xvidvfw.dll 2006-11-16 16:31 1,415,680 –a—— C:\WINDOWS\system32\WMV9VCM.dll 2006-11-16 16:31 1,044,480 –a—— C:\WINDOWS\system32\libdivx.dll 2006-11-16 09:46 68,888 –a—— C:\WINDOWS\system32\xinput1_3.dll 2006-11-16 09:46 62,744 –a—— C:\WINDOWS\system32\xinput1_2.dll 2006-11-16 09:46 237,848 –a—— C:\WINDOWS\system32\xactengine2_4.dll 2006-11-16 09:46 236,824 –a—— C:\WINDOWS\system32\xactengine2_3.dll 2006-11-16 09:46 2,414,360 –a—— C:\WINDOWS\system32\d3dx9_31.dll 2006-11-16 09:46 2,297,552 –a—— C:\WINDOWS\system32\d3dx9_26.dll 2006-11-16 09:46 15,128 –a—— C:\WINDOWS\system32\x3daudio1_1.dll 2006-11-14 22:00 173,184 –a—— C:\WINDOWS\system32\ygpss.scr 2006-11-11 13:54 3,968 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys 2006-11-11 11:06 83,208 –a—— C:\WINDOWS\system32\S32EVNT1.DLL 2006-11-11 11:06 73,496 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2006-11-11 08:55 15,104 –a—— C:\WINDOWS\system32\drivers\usbscan.sys 2006-11-11 08:11 614,912 –a—— C:\WINDOWS\system32\h323msp.dll 2006-11-11 08:11 39,936 –a—— C:\WINDOWS\system32\mf3216.dll 2006-11-11 08:11 331,264 –a—— C:\WINDOWS\system32\ipnathlp.dll 2006-11-11 08:10 60,288 –a—— C:\WINDOWS\system32\drivers\drmk.sys 2006-11-11 08:10 48,640 –a—— C:\WINDOWS\system32\drivers\stream.sys 2006-11-11 08:10 145,792 –a—— C:\WINDOWS\system32\drivers\portcls.sys 2006-11-11 08:10 140,928 –a—— C:\WINDOWS\system32\drivers\ks.sys 2006-11-11 08:09 4,096 –a—— C:\WINDOWS\system32\ksuser.dll 2006-11-11 08:08 947,472 –a—— C:\WINDOWS\system32\msjava.dll 2006-11-11 08:08 63,248 –a—— C:\WINDOWS\system32\javaprxy.dll 2006-11-11 08:08 49,424 –a—— C:\WINDOWS\system32\clspack.exe 2006-11-11 08:08 46,352 –a—— C:\WINDOWS\setdebug.exe 2006-11-11 08:08 404,752 –a—— C:\WINDOWS\system32\javart.dll 2006-11-11 08:08 313,856 –a—— C:\WINDOWS\system32\dx3j.dll 2006-11-11 08:08 286,992 –a—— C:\WINDOWS\system32\vmhelper.dll 2006-11-11 08:08 21,264 –a—— C:\WINDOWS\system32\msjdbc10.dll 2006-11-11 08:08 187,152 –a—— C:\WINDOWS\system32\javacypt.dll 2006-11-11 08:08 172,304 –a—— C:\WINDOWS\system32\jview.exe 2006-11-11 08:08 171,792 –a—— C:\WINDOWS\system32\wjview.exe 2006-11-11 08:08 171,280 –a—— C:\WINDOWS\system32\jit.dll 2006-11-11 08:08 154,384 –a—— C:\WINDOWS\system32\msawt.dll 2006-11-11 08:08 15,120 –a—— C:\WINDOWS\system32\jdbgmgr.exe 2006-11-11 08:08 113 –a—— C:\WINDOWS\system32\zonedon.reg 2006-11-11 08:08 113 –a—— C:\WINDOWS\system32\zonedoff.reg 2006-11-11 07:55 82,944 –a—— C:\WINDOWS\system32\drivers\wdmaud.sys 2006-11-11 07:55 7,552 –a—— C:\WINDOWS\system32\drivers\mskssrv.sys 2006-11-11 07:55 60,800 –a—— C:\WINDOWS\system32\drivers\sysaudio.sys 2006-11-11 07:55 6,400 –a—— C:\WINDOWS\system32\drivers\splitter.sys 2006-11-11 07:55 52,864 –a—— C:\WINDOWS\system32\drivers\dmusic.sys 2006-11-11 07:55 5,376 –a—— C:\WINDOWS\system32\drivers\mspclock.sys 2006-11-11 07:55 4,992 –a—— C:\WINDOWS\system32\drivers\mspqm.sys 2006-11-11 07:55 31,616 –a—— C:\WINDOWS\system32\drivers\usbccgp.sys 2006-11-11 07:55 25,856 –a—— C:\WINDOWS\system32\drivers\usbprint.sys 2006-11-11 07:55 2,944 –a—— C:\WINDOWS\system32\drivers\drmkaud.sys 2006-11-11 07:55 171,776 –a—— C:\WINDOWS\system32\drivers\kmixer.sys 2006-11-11 07:54 61,056 –a—— C:\WINDOWS\system32\drivers\ohci1394.sys 2006-11-11 07:54 53,248 –a—— C:\WINDOWS\system32\drivers\1394bus.sys 2006-11-11 07:42 1,082,368 –a—— C:\WINDOWS\system32\esent.dll 2006-11-11 07:03 351,232 –a—— C:\WINDOWS\system32\winhttp.dll 2006-11-11 07:03 18,944 –a—— C:\WINDOWS\system32\qmgrprxy.dll 2006-11-11 07:02 127,208 –a—— C:\WINDOWS\system32\mucltui.dll 2006-11-11 06:29 87,040 –a—— C:\WINDOWS\system32\drmstor.dll 2006-11-11 06:29 809,984 –a—— C:\WINDOWS\system32\wmvdmod.dll 2006-11-11 06:29 759,296 –a—— C:\WINDOWS\system32\wmsdmod.dll 2006-11-11 06:29 695,296 –a—— C:\WINDOWS\system32\drmv2clt.dll 2006-11-11 06:29 670,720 –a—— C:\WINDOWS\system32\wmadmoe.dll 2006-11-11 06:29 6,656 –a—— C:\WINDOWS\system32\laprxy.dll 2006-11-11 06:29 408,064 –a—— C:\WINDOWS\system32\wmadmod.dll 2006-11-11 06:29 299,520 –a—— C:\WINDOWS\system32\drmclien.dll 2006-11-11 06:29 286,208 –a—— C:\WINDOWS\system32\blackbox.dll 2006-11-11 06:29 259,072 –a—— C:\WINDOWS\system32\msnetobj.dll 2006-11-11 06:29 240,640 –a—— C:\WINDOWS\system32\mpg4dmod.dll 2006-11-11 06:29 237,568 –a—— C:\WINDOWS\system32\qasf.dll 2006-11-11 06:29 103,936 –a—— C:\WINDOWS\system32\logagent.exe 2006-11-11 06:29 1,050,624 –a—— C:\WINDOWS\system32\wmnetmgr.dll 2006-11-11 06:02 198,424 –a—— C:\WINDOWS\system32\iuengine.dll 2006-11-11 05:59 52,736 –a—— C:\WINDOWS\system32\drivers\i8042prt.sys 2006-11-11 05:59 24,576 –a—— C:\WINDOWS\system32\drivers\kbdclass.sys 2006-11-11 03:07 0 –a—— C:\WINDOWS\system32nrnqetwbz.exe (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-11-19 08:10 ——– d——– C:\Program Files\Zoom Player 2006-11-16 16:31 ——– d——– C:\Program Files\K-Lite Codec Pack 2006-11-16 16:26 ——– d——– C:\Documents and Settings\Owner\Application Data\Apple Computer 2006-11-16 16:22 ——– d——– C:\Program Files\QuickTime 2006-11-16 07:55 ——– d——– C:\Documents and Settings\Owner\Application Data\Azureus 2006-11-16 00:58 ——– d——– C:\Program Files\WinAVI VideoConverter 2006-11-16 00:50 ——– d——– C:\Program Files\ffdshow 2006-11-15 09:04 ——– d——– C:\Program Files\Common Files\AOL 2006-11-15 09:04 ——– d——– C:\Program Files\AOL 2006-11-15 06:55 ——– d——– C:\Program Files\America Online 9.0 2006-11-15 06:50 ——– d——– C:\Program Files\Common Files\SureThing Shared 2006-11-15 06:45 ——– d——– C:\Program Files\Common Files\Sonic Shared 2006-11-15 06:43 ——– d–h—– C:\Program Files\InstallShield Installation Information 2006-11-15 06:15 ——– d——– C:\Program Files\Hewlett-Packard 2006-11-14 22:01 ——– d——– C:\Documents and Settings\Owner\Application Data\AOL 2006-11-14 22:00 ——– d——– C:\Program Files\Common Files\aolshare 2006-11-14 21:58 ——– d——– C:\Program Files\Common Files 2006-11-14 21:54 ——– d——– C:\Program Files\Common Files\ACS 2006-11-13 09:10 ——– d——– C:\Documents and Settings\Owner\Application Data\Adobe 2006-11-13 09:06 ——– d——– C:\Program Files\Yahoo! 2006-11-13 08:50 ——– d——– C:\Program Files\Common Files\Adobe 2006-11-13 08:50 ——– d——– C:\Program Files\Adobe 2006-11-12 07:39 ——– d——– C:\Program Files\mIRC 2006-11-11 22:27 ——– d——– C:\Documents and Settings\Owner\Application Data\MSN6 2006-11-11 20:27 ——– d——– C:\Program Files\DirectVobSub 2006-11-11 20:22 ——– d——– C:\Program Files\Java 2006-11-11 20:10 ——– d——– C:\Program Files\Common Files\Microsoft Shared 2006-11-11 13:54 ——– d——– C:\Program Files\Grisoft 2006-11-11 13:07 ——– d——– C:\Program Files\Windows Media Player 2006-11-11 13:07 ——– d——– C:\Program Files\KaZaA Lite 2006-11-11 12:27 ——– d——– C:\Documents and Settings\Owner\Application Data\Lavasoft 2006-11-11 12:26 ——– d——– C:\Program Files\Lavasoft 2006-11-11 11:06 ——– d——– C:\Program Files\Symantec 2006-11-11 11:06 ——– d——– C:\Program Files\Common Files\Symantec Shared 2006-11-11 10:20 ——– d——– C:\Program Files\Messenger 2006-11-11 10:20 ——– d——– C:\Program Files\Internet Explorer 2006-11-11 09:23 ——– d——– C:\Program Files\Windows NT 2006-11-11 09:23 ——– d——– C:\Program Files\Outlook Express 2006-11-11 09:23 ——– d——– C:\Program Files\NetMeeting 2006-11-11 09:23 ——– d——– C:\Program Files\Movie Maker 2006-11-11 09:23 ——– d——– C:\Program Files\Common Files\System 2006-11-11 06:39 ——– d–h—– C:\Program Files\WindowsUpdate 2006-11-11 06:39 ——– d——– C:\Program Files\Common Files\Services 2006-11-11 04:53 ——– d——– C:\Program Files\htmlhelp 2006-11-11 03:35 ——– d——– C:\Program Files\Google 2006-11-11 03:09 ——– d——– C:\Program Files\àppPatch 2006-11-11 03:08 ——– d——– C:\Program Files\PSCastor 2006-11-11 03:07 ——– d——– C:\Program Files\Pegasys Inc 2006-11-11 01:05 ——– d——– C:\Program Files\eMule 2006-11-01 18:44 ——– d——– C:\Program Files\Trivium for AOL 2006-10-08 16:56 ——– d——– C:\Documents and Settings\Owner\Application Data\Pegasys Inc 2006-09-27 16:30 ——– d——– C:\Program Files\Microsoft Games 2006-09-12 23:01 1084416 –a—— C:\WINDOWS\system32\msxml3.dll 2006-08-25 09:45 617472 –a—— C:\WINDOWS\system32\comctl32.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "NVIEW"="rundll32.exe nview.dll,nViewLoadHook" "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "AOL Fast Start"="\"C:\\Program Files\\America Online 9.0\\AOL.EXE\" -b" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "BlockTracker"="c:\\hp\\bin\\BlockTracker.exe" "hpsysdrv"="c:\\windows\\system\\hpsysdrv.exe" "HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe" "Share-to-Web Namespace Daemon"="c:\\Program Files\\Hewlett-Packard\\HP Share-to-Web\\hpgs2wnd.exe" "CamMonitor"="c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\hpqcmon.exe" "KBD"="C:\\HP\\KBD\\KBD.EXE" "AutoTBar"="C:\\hp\\bin\\autotbar.exe" "Recguard"="C:\\WINDOWS\\SMINST\\RECGUARD.EXE" "NvCplDaemon"="RUNDLL32.EXE NvQTwk,NvCplDaemon initialize" "nwiz"="nwiz.exe /installquiet /keeploaded" "PS2"="C:\\WINDOWS\\system32\\ps2.exe" "AlcxMonitor"="ALCXMNTR.EXE" "EPSON Stylus CX4200 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATIAEA.EXE /P26 \"EPSON Stylus CX4200 Series\" /O6 \"USB001\" /M \"Stylus CX4200\"" "vptray"="C:\\PROGRA~1\\SYMANT~1\\SYMANT~1\\vptray.exe" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\"" "DVDTray"="\"C:\\Program Files\\HP DVD\\Umbrella\\DVDTray.exe\"" "Adobe Photo Downloader"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\"" "HostManager"="C:\\Program Files\\Common Files\\AOL\\1163563142\\ee\\AOLSoftware.exe" "AOLDialer"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe" "AOL Spyware Protection"="\"C:\\PROGRA~1\\COMMON~1\\AOL\\AOLSPY~1\\AOLSP Scheduler.exe\"" "ISUSPM Startup"="C:\\PROGRA~1\\COMMON~1\\INSTAL~1\\UPDATE~1\\ISUSPM.exe -startup" "IPHSend"="C:\\Program Files\\Common Files\\AOL\\IPHSend\\IPHSend.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,86,01,00,00,00,00,00,00,7a,02,00,00,cb,02,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,f2,01,00,00,23,00,00,00,7c,00,00,00,72,00,\ 00,00,01,00,00,00 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoCDBurning"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^wtxjc.exe] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\wtxjc.exe" "backup"="C:\\WINDOWS\\pss\\wtxjc.exeCommon Startup" "location"="Common Startup" "command"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\wtxjc.exe" "item"="wtxjc" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AOLDial" "hkey"="HKLM" "command"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\bbwcw] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="fmmivx" "hkey"="HKCU" "command"="C:\\WINDOWS\\System32\\fmmivx.exe reg_run" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eeqavv] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="fmmivx" "hkey"="HKLM" "command"="C:\\WINDOWS\\system32\\fmmivx.exe reg_run" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="RealPlay" "hkey"="HKLM" "command"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StorageGuard] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="sgtray" "hkey"="HKLM" "command"="\"C:\\Program Files\\VERITAS Software\\Update Manager\\sgtray.exe\" /r" "inimapping"="0" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\Symantec NetDetect.job Completion time: 06-11-19 10:39:26.45 C:\ComboFix.txt … 06-11-19 10:39 C:\ComboFix2.txt … 06-11-11 23:41
Post #12
Hello HDKguy,

Yes, those files were deleted. I just see one that needs to be deleted. Also let's clean up a few registry entries to tidy things up. You have them disabled with msconfig but let's get rid of them.

Please set your system to show all files; please see here if you're unsure how to do this.

Reboot into Safe Mode: please see here if you are not sure how to do this.

Using Windows Explorer, locate the following files/folders, and delete them:
C:\WINDOWS\system32nrnqetwbz.exe
Exit Explorer, and reboot as normal afterwards.

Backup the registry:

STEP 1.
======
Backup Your Registry with ERUNT
  • Please use the following link and scroll down to ERUNT and download it.
    • http://aumha.org/freeware/freeware.php
  • For version with the Installer:
    • Use the setup program to install ERUNT on your computer
  • For the zipped version:
    • Unzip all the files into a folder of your choice.
      Click Erunt.exe to backup your registry to the folder of your choice.

      Note: to restore your registry, go to the folder and start ERDNT.exe

      Then, go to start–>run

      and type this in:
      notepad

      Paste this into the box:

      REGEDIT4

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^wtxjc.exe]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\bbwcw]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eeqavv]

      Then click on the FILE menu and select save as
      Save the file as regfix.reg. Save the file to the desktop.
      IMPORTANT: make sure to save the file as "all types" and NOT as a text file
      **

      Now double click on regfix.reg and insert it into the registry.

      Please post the ComboFix log again and a hijackthis log. Let's me check the entries and then I will give you the final instructions.
Post #13
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI