last Resort, Please Help (log)

My final attempt, been running around trying to remove this attack. Can anyone make anything of this please. TIA


Logfile of HijackThis v1.99.1
Scan saved at 10:33:33 PM, on 11/14/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\AOL\1161076213\ee\AOLSoftware.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\DOCUME~1\Gary\APPLIC~1\PPPATC~1\regsvr32.exe
C:\Program Files\Common Files\?icrosoft\w?nlogon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
c:\program files\common files\aol\1161076213\ee\aim6.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\Gary\Desktop\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe

O2 - BHO: (no name) - {833E29A5-5208-472A-81E4-CB04C407924E} - C:\WINDOWS\system32\hggebxx.dll
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1161076213\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [Tsua] "C:\DOCUME~1\Gary\APPLIC~1\PPPATC~1\regsvr32.exe" -vt yazb
O4 - HKCU\..\Run: [Luvkyt] C:\Program Files\Common Files\?icrosoft\w?nlogon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: hggebxx - C:\WINDOWS\SYSTEM32\hggebxx.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

Thanks for the help Micah,

Gary - 06-11-15 20:21:17.67 Service Pack 2
ComboFix 06.11.9 - Running from: "C:\Documents and Settings\Gary\desktop"
Command switches used :: /v hggebxx

(((((((((((((((((((((((((((((((((((((((((((((((( Vundo Log )))))))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\hggebxx.dll


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *



(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\dfndrff_e57.exe
C:\drsmartload.exe
C:\drsmartload1.exe
C:\kybrdff_e57.exe
C:\MTE3NDI6ODoxNg14112006.exe
C:\MTE3NDI6ODoxNgnew.exe
C:\nwnmff_e57.exe
C:\RDFX4.exe
C:\tigen001.exe
C:\Installer5.exe
C:\Program Files\Common Files\Yazzle1281OinAdmin.exe
C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe
C:\dollarrev.exe

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

Folders Quarantined:

C:\QooBox\Purity\Documents and Settings\Gary\Application Data\PPPATC~1
C:\QooBox\Purity\Documents and Settings\Gary\Application Data\PPPATC~1\regsvr32.exe
C:\QooBox\Purity\Documents and Settings\Gary\Application Data\PPPATC~1\?ppPatch
C:\QooBox\Purity\Program Files\Common Files\ICROSO~1


((((((((((((((((((((((((((((((( Files Created from 2006-10-15 to 2006-11-15 ))))))))))))))))))))))))))))))))))


2006-11-15 05:43 728,393 —hs—- C:\WINDOWS\system32\bdeeg.bak1
2006-11-15 05:42 692,276 —hs—- C:\WINDOWS\system32\geedb.dll
2006-11-14 21:42 448,628 –a—— C:\windows_e57.exe
2006-11-14 21:42 31,868 –a—— C:\mc44a57.exe
2006-11-14 21:41 2,657 –a—— C:\ac3_0003.exe
2006-11-14 21:38 220,932 –a—— C:\162.exe
2006-11-14 21:37 325,092 –a—— C:\165.exe
2006-11-14 21:37 294,135 –a—— C:\installerwnusnewer.exe
2006-11-06 00:26 315,392 –a—— C:\WINDOWS\system32\lexlog.dll
2006-10-18 15:22 20,640 ——— C:\WINDOWS\system32\drivers\PxHelp20.sys
2006-10-18 15:22 109,568 ——— C:\WINDOWS\system32\pxinsi64.exe
2006-10-18 15:22 108,544 ——— C:\WINDOWS\system32\pxcpyi64.exe
2006-10-17 13:46 77,903 –a—— C:\WINDOWS\system32\RAPI.DLL
2006-10-17 13:46 65,619 –a—— C:\WINDOWS\system32\PMAILEXT.DLL
2006-10-17 13:46 65,617 –a—— C:\WINDOWS\system32\PPVEXP.DLL
2006-10-17 13:46 57,427 –a—— C:\WINDOWS\system32\MSGSTRPC.DLL
2006-10-17 13:46 36,946 –a—— C:\WINDOWS\system32\PPCLOAD.DLL
2006-10-17 13:46 306,688 –a—— C:\WINDOWS\IsUninst.exe
2006-10-17 13:46 24,657 –a—— C:\WINDOWS\system32\CEUTIL.DLL
2006-10-17 13:46 24,656 –a—— C:\WINDOWS\system32\UICOM.DLL
2006-10-17 13:46 114,688 –a—— C:\WINDOWS\system32\MALSLIB.DLL
2006-10-17 13:46 104,064 –a—— C:\WINDOWS\system32\drivers\wceusbsh.sys
2006-10-17 13:26 98,304 –a—— C:\WINDOWS\system32\msir3jp.dll
2006-10-17 13:26 838,144 –a—— C:\WINDOWS\system32\chtbrkr.dll
2006-10-17 13:26 70,656 –a—— C:\WINDOWS\system32\korwbrkr.dll
2006-10-17 13:26 6,144 –a—— C:\WINDOWS\system32\kbd101a.dll
2006-10-17 13:26 218,112 –a—— C:\WINDOWS\system32\c_g18030.dll
2006-10-17 13:26 1,677,824 –a—— C:\WINDOWS\system32\chsbrkr.dll
2006-10-17 13:25 9,216 –a—— C:\WINDOWS\system32\kbdnecAT.dll
2006-10-17 13:25 811,064 –a—— C:\WINDOWS\system32\imjp81k.dll
2006-10-17 13:25 76,288 –a—— C:\WINDOWS\system32\uniime.dll
2006-10-17 13:25 7,680 –a—— C:\WINDOWS\system32\kbdnecNT.dll
2006-10-17 13:25 7,168 –a—— C:\WINDOWS\system32\kbdnec95.dll
2006-10-17 13:25 7,168 –a—— C:\WINDOWS\system32\kbdibm02.dll
2006-10-17 13:25 7,168 –a—— C:\WINDOWS\system32\f3ahvoas.dll
2006-10-17 13:25 6,656 –a—— C:\WINDOWS\system32\kbdlk41a.dll
2006-10-17 13:25 6,656 –a—— C:\WINDOWS\system32\c_is2022.dll
2006-10-17 13:25 6,144 –a—— C:\WINDOWS\system32\kbdlk41j.dll
2006-10-17 13:25 6,144 –a—— C:\WINDOWS\system32\kbdax2.dll
2006-10-17 13:25 6,144 –a—— C:\WINDOWS\system32\kbd106n.dll
2006-10-17 13:25 6,144 –a—— C:\WINDOWS\system32\kbd101.dll
2006-10-17 13:24 8,704 –a—— C:\WINDOWS\system32\kbdjpn.dll
2006-10-17 13:24 8,192 –a—— C:\WINDOWS\system32\kbdkor.dll
2006-10-17 13:24 6,144 –a—— C:\WINDOWS\system32\kbd106.dll
2006-10-17 13:24 6,144 –a—— C:\WINDOWS\system32\kbd101c.dll
2006-10-17 13:24 6,144 –a—— C:\WINDOWS\system32\kbd101b.dll
2006-10-17 13:24 5,632 –a—— C:\WINDOWS\system32\kbd103.dll
2006-10-17 13:15 91,856 –a—— C:\WINDOWS\system32\S32EVNT1.DLL
2006-10-17 13:15 123,488 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2006-10-17 13:13 26,496 –a—— C:\WINDOWS\system32\drivers\USBSTOR.SYS
2006-10-17 12:56 82,944 –a—— C:\WINDOWS\system32\drivers\wdmaud.sys
2006-10-17 12:56 6,400 –a—— C:\WINDOWS\system32\drivers\splitter.sys
2006-10-17 12:56 54,272 –a—— C:\WINDOWS\system32\drivers\swmidi.sys
2006-10-17 12:56 52,864 –a—— C:\WINDOWS\system32\drivers\DMusic.sys
2006-10-17 12:56 2,944 –a—— C:\WINDOWS\system32\drivers\drmkaud.sys
2006-10-17 12:56 171,776 –a—— C:\WINDOWS\system32\drivers\kmixer.sys
2006-10-17 12:56 142,464 –a—— C:\WINDOWS\system32\drivers\aec.sys
2006-10-17 12:55 9,319,936 –a—— C:\WINDOWS\system32\RTLCPL.EXE
2006-10-17 12:55 77,824 –a—— C:\WINDOWS\SOUNDMAN.EXE
2006-10-17 12:55 7,552 –a—— C:\WINDOWS\system32\drivers\MSKSSRV.sys
2006-10-17 12:55 60,800 –a—— C:\WINDOWS\system32\drivers\sysaudio.sys
2006-10-17 12:55 60,288 –a—— C:\WINDOWS\system32\drivers\drmk.sys
2006-10-17 12:55 5,376 –a—— C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2006-10-17 12:55 40,960 ——— C:\WINDOWS\system32\ChCfg.exe
2006-10-17 12:55 4,992 –a—— C:\WINDOWS\system32\drivers\MSPQM.sys
2006-10-17 12:55 4,096 –a—— C:\WINDOWS\system32\ksuser.dll
2006-10-17 12:55 208,896 ——— C:\WINDOWS\alcupd.exe
2006-10-17 12:55 2,297,664 –a—— C:\WINDOWS\system32\drivers\ALCXWDM.SYS
2006-10-17 12:55 156,672 –a—— C:\WINDOWS\system32\RTLCPAPI.dll
2006-10-17 12:55 145,792 –a—— C:\WINDOWS\system32\drivers\portcls.sys
2006-10-17 12:55 139,264 ——— C:\WINDOWS\alcrmv.exe
2006-10-17 12:54 5,824 –a—— C:\WINDOWS\system32\drivers\ASUSHWIO.SYS
2006-10-17 04:02 112,128 –a—— C:\WINDOWS\system32\mapi32.dll
2006-10-17 04:02 0 -rahs—- C:\MSDOS.SYS
2006-10-17 04:02 0 -rahs—- C:\IO.SYS
2006-10-17 04:02 0 –a—— C:\CONFIG.SYS
2006-10-17 04:02 0 –a—— C:\AUTOEXEC.BAT
2006-10-17 04:00 8,192 –a—— C:\WINDOWS\system32\bitsprx2.dll
2006-10-17 04:00 7,168 –a—— C:\WINDOWS\system32\bitsprx3.dll
2006-10-17 04:00 64,512 –a—— C:\WINDOWS\system32\acctres.dll
2006-10-17 04:00 6,656 –a—— C:\WINDOWS\system32\wuauserv.dll
2006-10-17 04:00 465,176 –a—— C:\WINDOWS\system32\wuapi.dll
2006-10-17 04:00 41,240 –a—— C:\WINDOWS\system32\wups.dll
2006-10-17 04:00 382,464 –a—— C:\WINDOWS\system32\qmgr.dll
2006-10-17 04:00 194,328 –a—— C:\WINDOWS\system32\wuaueng1.dll
2006-10-17 04:00 18,944 –a—— C:\WINDOWS\system32\qmgrprxy.dll
2006-10-17 04:00 173,536 –a—— C:\WINDOWS\system32\wuweb.dll
2006-10-17 04:00 172,312 –a—— C:\WINDOWS\system32\wuauclt1.exe
2006-10-17 04:00 16,384 –a—— C:\WINDOWS\system32\icfgnt5.dll
2006-10-17 04:00 127,256 –a—— C:\WINDOWS\system32\wucltui.dll
2006-10-17 04:00 124,184 –a—— C:\WINDOWS\system32\wuauclt.exe
2006-10-17 04:00 12,288 –a—— C:\WINDOWS\system32\nmevtmsg.dll
2006-10-17 04:00 11,264 –a—— C:\WINDOWS\system32\atrace.dll
2006-10-17 04:00 1,343,768 –a—— C:\WINDOWS\system32\wuaueng.dll
2006-10-17 03:59 81,920 –a—— C:\WINDOWS\system32\isign32.dll
2006-10-17 03:59 81,920 –a—— C:\WINDOWS\system32\ils.dll
2006-10-17 03:59 73,728 –a—— C:\WINDOWS\system32\icwdial.dll
2006-10-17 03:59 73,472 –a—— C:\WINDOWS\system32\drivers\sr.sys
2006-10-17 03:59 69,632 –a—— C:\WINDOWS\system32\msconf.dll
2006-10-17 03:59 678,400 –a—— C:\WINDOWS\system32\inetcomm.dll
2006-10-17 03:59 67,584 –a—— C:\WINDOWS\system32\srclient.dll
2006-10-17 03:59 65,536 –a—— C:\WINDOWS\system32\icwphbk.dll
2006-10-17 03:59 48,128 –a—— C:\WINDOWS\system32\inetres.dll
2006-10-17 03:59 45,568 –a—— C:\WINDOWS\system32\safrslv.dll
2006-10-17 03:59 43,520 –a—— C:\WINDOWS\system32\safrcdlg.dll
2006-10-17 03:59 43,520 –a—— C:\WINDOWS\system32\racpldlg.dll
2006-10-17 03:59 34,560 –a—— C:\WINDOWS\system32\mnmdd.dll
2006-10-17 03:59 32,768 –a—— C:\WINDOWS\system32\mnmsrvc.exe
2006-10-17 03:59 32,768 –a—— C:\WINDOWS\system32\isrdbg32.dll
2006-10-17 03:59 29,696 –a—— C:\WINDOWS\system32\safrdm.dll
2006-10-17 03:59 28,672 –a—— C:\WINDOWS\system32\nmmkcert.dll
2006-10-17 03:59 274,944 –a—— C:\WINDOWS\system32\mstask.dll
2006-10-17 03:59 274,432 –a—— C:\WINDOWS\system32\inetcfg.dll
2006-10-17 03:59 252,928 –a—— C:\WINDOWS\system32\msoeacct.dll
2006-10-17 03:59 239,104 –a—— C:\WINDOWS\system32\srrstr.dll
2006-10-17 03:59 22,528 –a—— C:\WINDOWS\system32\fltMc.exe
2006-10-17 03:59 190,976 –a—— C:\WINDOWS\system32\schedsvc.dll
2006-10-17 03:59 170,496 –a—— C:\WINDOWS\system32\srsvc.dll
2006-10-17 03:59 16,896 –a—— C:\WINDOWS\system32\fltlib.dll
2006-10-17 03:59 124,800 –a—— C:\WINDOWS\system32\drivers\fltMgr.sys
2006-10-17 03:59 12,288 –a—— C:\WINDOWS\system32\mstinit.exe
2006-10-17 03:59 105,984 –a—— C:\WINDOWS\system32\msoert2.dll
2006-10-17 03:58 93,696 –a—— C:\WINDOWS\system32\tscfgwmi.dll
2006-10-17 03:58 90,112 –a—— C:\WINDOWS\system32\mtxoci.dll
2006-10-17 03:58 9,728 –a—— C:\WINDOWS\system32\reset.exe
2006-10-17 03:58 87,176 –a—— C:\WINDOWS\system32\rdpwsx.dll
2006-10-17 03:58 82,432 –a—— C:\WINDOWS\system32\comrepl.dll
2006-10-17 03:58 80,384 –a—— C:\WINDOWS\system32\charmap.exe
2006-10-17 03:58 73,216 –a—— C:\WINDOWS\system32\avwav.dll
2006-10-17 03:58 67,072 –a—— C:\WINDOWS\system32\rdshost.exe
2006-10-17 03:58 655,360 –a—— C:\WINDOWS\system32\mstscax.dll
2006-10-17 03:58 62,464 –a—— C:\WINDOWS\system32\rdpclip.exe
2006-10-17 03:58 605,696 –a—— C:\WINDOWS\system32\getuname.dll
2006-10-17 03:58 60,416 –a—— C:\WINDOWS\system32\remotepg.dll
2006-10-17 03:58 56,832 –a—— C:\WINDOWS\system32\sol.exe
2006-10-17 03:58 55,296 –a—— C:\WINDOWS\system32\freecell.exe
2006-10-17 03:58 54,272 –a—— C:\WINDOWS\system32\stclient.dll
2006-10-17 03:58 538,624 –a—— C:\WINDOWS\system32\spider.exe
2006-10-17 03:58 5,632 –a—— C:\WINDOWS\system32\write.exe
2006-10-17 03:58 5,120 –a—— C:\WINDOWS\system32\dcomcnfg.exe
2006-10-17 03:58 44,544 –a—— C:\WINDOWS\system32\tscupgrd.exe
2006-10-17 03:58 44,544 –a—— C:\WINDOWS\system32\hticons.dll
2006-10-17 03:58 407,552 –a—— C:\WINDOWS\system32\mstsc.exe
2006-10-17 03:58 4,096 –a—— C:\WINDOWS\system32\rdpcfgex.dll
2006-10-17 03:58 4,096 –a—— C:\WINDOWS\system32\mtxex.dll
2006-10-17 03:58 38,912 –a—— C:\WINDOWS\system32\cfgbkend.dll
2006-10-17 03:58 35,328 –a—— C:\WINDOWS\system32\winchat.exe
2006-10-17 03:58 345,088 –a—— C:\WINDOWS\system32\hypertrm.dll
2006-10-17 03:58 343,040 –a—— C:\WINDOWS\system32\mspaint.exe
2006-10-17 03:58 33,792 –a—— C:\WINDOWS\system32\regini.exe
2006-10-17 03:58 295,424 –a—— C:\WINDOWS\system32\termsrv.dll
2006-10-17 03:58 25,600 –a—— C:\WINDOWS\system32\comaddin.dll
2006-10-17 03:58 25,088 –a—— C:\WINDOWS\system32\mtxlegih.dll
2006-10-17 03:58 227,840 –a—— C:\WINDOWS\system32\avtapi.dll
2006-10-17 03:58 22,016 –a—— C:\WINDOWS\system32\qwinsta.exe
2006-10-17 03:58 21,896 –a—— C:\WINDOWS\system32\drivers\tdtcp.sys
2006-10-17 03:58 20,992 –a—— C:\WINDOWS\system32\msg.exe
2006-10-17 03:58 20,480 –a—— C:\WINDOWS\system32\qprocess.exe
2006-10-17 03:58 20,480 –a—— C:\WINDOWS\system32\mtxdm.dll
2006-10-17 03:58 19,968 –a—— C:\WINDOWS\system32\rdpsnd.dll
2006-10-17 03:58 183,808 –a—— C:\WINDOWS\system32\accwiz.exe
2006-10-17 03:58 161,280 –a—— C:\WINDOWS\system32\msdtcuiu.dll
2006-10-17 03:58 16,896 –a—— C:\WINDOWS\system32\tsshutdn.exe
2006-10-17 03:58 16,896 –a—— C:\WINDOWS\system32\qappsrv.exe
2006-10-17 03:58 16,384 –a—— C:\WINDOWS\system32\tskill.exe
2006-10-17 03:58 16,384 –a—— C:\WINDOWS\system32\avmeter.dll
2006-10-17 03:58 15,872 –a—— C:\WINDOWS\system32\rwinsta.exe
2006-10-17 03:58 15,872 –a—— C:\WINDOWS\system32\cdmodem.dll
2006-10-17 03:58 15,360 –a—— C:\WINDOWS\system32\logoff.exe
2006-10-17 03:58 147,968 –a—— C:\WINDOWS\system32\rdchost.dll
2006-10-17 03:58 147,456 –a—— C:\WINDOWS\system32\comsnap.dll
2006-10-17 03:58 140,800 –a—— C:\WINDOWS\system32\sessmgr.exe
2006-10-17 03:58 14,848 –a—— C:\WINDOWS\system32\tsdiscon.exe
2006-10-17 03:58 14,848 –a—— C:\WINDOWS\system32\tscon.exe
2006-10-17 03:58 14,848 –a—— C:\WINDOWS\system32\shadow.exe
2006-10-17 03:58 139,400 –a—— C:\WINDOWS\system32\drivers\rdpwd.sys
2006-10-17 03:58 138,752 –a—— C:\WINDOWS\system32\sndvol32.exe
2006-10-17 03:58 131,584 –a—— C:\WINDOWS\system32\sndrec32.exe
2006-10-17 03:58 13,824 –a—— C:\WINDOWS\system32\rdsaddin.exe
2006-10-17 03:58 126,976 –a—— C:\WINDOWS\system32\mshearts.exe
2006-10-17 03:58 123,392 –a—— C:\WINDOWS\system32\mplay32.exe
2006-10-17 03:58 12,040 –a—— C:\WINDOWS\system32\drivers\tdpipe.sys
2006-10-17 03:58 119,808 –a—— C:\WINDOWS\system32\winmine.exe
2006-10-17 03:58 114,688 –a—— C:\WINDOWS\system32\calc.exe
2006-10-17 03:58 11,264 –a—— C:\WINDOWS\system32\icaapi.dll
2006-10-17 03:58 102,912 –a—— C:\WINDOWS\system32\clipbrd.exe
2006-10-17 03:58 1,161 –a—— C:\WINDOWS\system32\usrlogon.cmd
2006-10-17 03:57 949,248 –a—— C:\WINDOWS\system32\msdtctm.dll
2006-10-17 03:57 85,504 –a—— C:\WINDOWS\system32\catsrvps.dll
2006-10-17 03:57 628,224 –a—— C:\WINDOWS\system32\catsrvut.dll
2006-10-17 03:57 62,464 –a—— C:\WINDOWS\system32\colbact.dll
2006-10-17 03:57 6,144 –a—— C:\WINDOWS\system32\msdtc.exe
2006-10-17 03:57 58,880 –a—— C:\WINDOWS\system32\msdtclog.dll
2006-10-17 03:57 58,880 –a—— C:\WINDOWS\system32\licwmi.dll
2006-10-17 03:57 56,320 –a—— C:\WINDOWS\system32\servdeps.dll
2006-10-17 03:57 540,160 –a—— C:\WINDOWS\system32\comuid.dll
2006-10-17 03:57 501,248 –a—— C:\WINDOWS\system32\clbcatq.dll
2006-10-17 03:57 425,472 –a—— C:\WINDOWS\system32\msdtcprx.dll
2006-10-17 03:57 40,840 –a—— C:\WINDOWS\system32\drivers\termdd.sys
2006-10-17 03:57 229,888 –a—— C:\WINDOWS\system32\catsrv.dll
2006-10-17 03:57 196,864 –a—— C:\WINDOWS\system32\drivers\rdpdr.sys
2006-10-17 03:57 185,344 –a—— C:\WINDOWS\system32\cmprops.dll
2006-10-17 03:57 17,408 –a—— C:\WINDOWS\system32\mmfutil.dll
2006-10-17 03:57 110,080 –a—— C:\WINDOWS\system32\clbcatex.dll
2006-10-17 03:57 11,776 –a—— C:\WINDOWS\system32\xolehlp.dll
2006-10-17 03:57 1,251,840 –a—— C:\WINDOWS\system32\comsvcs.dll
2006-10-16 13:37 57,472 –a—— C:\WINDOWS\system32\drivers\redbook.sys
2006-10-16 13:37 3,072 –a—— C:\WINDOWS\system32\drivers\audstub.sys
2006-10-16 13:36 870,784 –a—— C:\WINDOWS\system32\ati3d1ag.dll
2006-10-16 13:36 74,240 –a—— C:\WINDOWS\system32\usbui.dll
2006-10-16 13:36 701,440 –a—— C:\WINDOWS\system32\drivers\ati2mtag.sys
2006-10-16 13:36 516,768 –a—— C:\WINDOWS\system32\ativvaxx.dll
2006-10-16 13:36 44,672 –a—— C:\WINDOWS\system32\drivers\UAGP35.SYS
2006-10-16 13:36 32,768 –a—— C:\WINDOWS\system32\drivers\sisnic.sys
2006-10-16 13:36 3,712 –a—— C:\WINDOWS\system32\drivers\ctljystk.sys
2006-10-16 13:36 229,376 –a—— C:\WINDOWS\system32\ati2cqag.dll
2006-10-16 13:36 201,728 –a—— C:\WINDOWS\system32\ati2dvag.dll
2006-10-16 13:36 10,624 –a—— C:\WINDOWS\system32\drivers\gameenum.sys
2006-10-16 13:36 1,888,992 –a—— C:\WINDOWS\system32\ati3duag.dll
2006-10-16 13:34 85,020 –a—— C:\WINDOWS\system32\dgsetup.dll
2006-10-16 13:34 8,704 –a—— C:\WINDOWS\system32\batt.dll
2006-10-16 13:34 8,192 -ra—— C:\WINDOWS\system32\kbdhept.dll
2006-10-16 13:34 74,752 –a—— C:\WINDOWS\system32\storprop.dll
2006-10-16 13:34 7,168 -ra—— C:\WINDOWS\system32\kbdcz.dll
2006-10-16 13:34 69,120 –a—— C:\WINDOWS\NOTEPAD.EXE
2006-10-16 13:34 6,656 -ra—— C:\WINDOWS\system32\kbdycl.dll
2006-10-16 13:34 6,656 -ra—— C:\WINDOWS\system32\kbdsl1.dll
2006-10-16 13:34 6,656 -ra—— C:\WINDOWS\system32\kbdsl.dll
2006-10-16 13:34 6,656 -ra—— C:\WINDOWS\system32\kbdpl.dll
2006-10-16 13:34 6,656 -ra—— C:\WINDOWS\system32\kbdhu.dll
2006-10-16 13:34 6,656 -ra—— C:\WINDOWS\system32\kbdhela3.dll
2006-10-16 13:34 6,656 -ra—— C:\WINDOWS\system32\kbdcz2.dll
2006-10-16 13:34 6,656 -ra—— C:\WINDOWS\system32\kbdcz1.dll
2006-10-16 13:34 6,656 -ra—— C:\WINDOWS\system32\kbdcr.dll
2006-10-16 13:34 6,656 -ra—— C:\WINDOWS\system32\KBDAL.DLL
2006-10-16 13:34 6,144 -ra—— C:\WINDOWS\system32\kbdtuq.dll
2006-10-16 13:34 6,144 -ra—— C:\WINDOWS\system32\kbdtuf.dll
2006-10-16 13:34 6,144 -ra—— C:\WINDOWS\system32\kbdlv1.dll
2006-10-16 13:34 6,144 -ra—— C:\WINDOWS\system32\kbdlv.dll
2006-10-16 13:34 6,144 -ra—— C:\WINDOWS\system32\kbdhela2.dll
2006-10-16 13:34 6,144 -ra—— C:\WINDOWS\system32\kbdgkl.dll
2006-10-16 13:34 6,144 -ra—— C:\WINDOWS\system32\kbdest.dll
2006-10-16 13:34 5,632 -ra—— C:\WINDOWS\system32\kbdycc.dll
2006-10-16 13:34 5,632 -ra—— C:\WINDOWS\system32\kbduzb.dll
2006-10-16 13:34 5,632 -ra—— C:\WINDOWS\system32\kbdur.dll
2006-10-16 13:34 5,632 -ra—— C:\WINDOWS\system32\kbdtat.dll
2006-10-16 13:34 5,632 -ra—— C:\WINDOWS\system32\kbdru1.dll
2006-10-16 13:34 5,632 -ra—— C:\WINDOWS\system32\kbdru.dll
2006-10-16 13:34 5,632 -ra—— C:\WINDOWS\system32\kbdro.dll
2006-10-16 13:34 5,632 -ra—— C:\WINDOWS\system32\kbdpl1.dll
2006-10-16 13:34 5,632 -ra—— C:\WINDOWS\system32\kbdmon.dll
2006-10-16 13:34 5,632 -ra—— C:\WINDOWS\system32\kbdlt1.dll
2006-10-16 13:34 5,632 -ra—— C:\WINDOWS\system32\kbdlt.dll
2006-10-16 13:34 5,632 -ra—— C:\WINDOWS\system32\kbdkyr.dll
2006-10-16 13:34 5,632 -ra—— C:\WINDOWS\system32\kbdkaz.dll
2006-10-16 13:34 5,632 -ra—— C:\WINDOWS\system32\kbdhu1.dll
2006-10-16 13:34 5,632 -ra—— C:\WINDOWS\system32\kbdhe319.dll
2006-10-16 13:34 5,632 -ra—— C:\WINDOWS\system32\kbdhe220.dll
2006-10-16 13:34 5,632 -ra—— C:\WINDOWS\system32\kbdhe.dll
2006-10-16 13:34 5,632 -ra—— C:\WINDOWS\system32\kbdbu.dll
2006-10-16 13:34 5,632 -ra—— C:\WINDOWS\system32\kbdblr.dll
2006-10-16 13:34 5,632 -ra—— C:\WINDOWS\system32\kbdazel.dll
2006-10-16 13:34 5,632 -ra—— C:\WINDOWS\system32\kbdaze.dll
2006-10-16 13:34 24,661 –a—— C:\WINDOWS\system32\spxcoins.dll
2006-10-16 13:34 176,157 –a—— C:\WINDOWS\system32\dgrpsetu.dll
2006-10-16 13:34 15,360 –a—— C:\WINDOWS\TASKMAN.EXE
2006-10-16 13:34 13,312 –a—— C:\WINDOWS\system32\irclass.dll
2006-10-16 13:34 11,264 –a—— C:\WINDOWS\system32\drivers\irenum.sys
2006-10-16 13:34 103,424 –a—— C:\WINDOWS\system32\EqnClass.Dll


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-11-15 20:23 ——– d——– C:\Program Files\Symantec AntiVirus
2006-11-15 20:21 ——– d——– C:\Program Files\Common Files
2006-11-14 21:51 ——– d——– C:\Program Files\Lavasoft
2006-11-14 21:51 ——– d——– C:\Documents and Settings\Gary\Application Data\Lavasoft
2006-11-12 02:30 ——– d——– C:\Program Files\PokerStars
2006-11-12 00:27 ——– d——– C:\Documents and Settings\Gary\Application Data\AdobeUM
2006-11-06 00:26 ——– d——– C:\Program Files\Dell_HostCD
2006-11-04 19:41 29392 –a—— C:\WINDOWS\system32\drivers\secdrv.sys
2006-11-04 19:21 ——– d–h—– C:\Program Files\InstallShield Installation Information
2006-11-04 19:21 ——– d——– C:\Program Files\EA GAMES
2006-11-01 11:43 ——– d——– C:\Documents and Settings\Gary\Application Data\Adobe
2006-10-27 22:56 ——– d——– C:\Documents and Settings\Gary\Application Data\vlc
2006-10-27 22:55 ——– d——– C:\Documents and Settings\Gary\Application Data\dvdcss
2006-10-27 22:54 ——– d——– C:\Program Files\VideoLAN
2006-10-27 22:21 ——– d—s—- C:\Documents and Settings\Gary\Application Data\Microsoft
2006-10-22 23:40 ——– d——– C:\Program Files\QuickTime
2006-10-22 23:40 ——– d——– C:\Program Files\Google
2006-10-22 20:55 ——– d——– C:\Program Files\iTunes
2006-10-22 20:55 ——– d——– C:\Program Files\iPod
2006-10-22 20:55 ——– d——– C:\Documents and Settings\Gary\Application Data\Apple Computer
2006-10-22 13:10 ——– d——– C:\Program Files\TVUPlayer
2006-10-20 19:40 25056 –a—— C:\Documents and Settings\Gary\Application Data\GDIPFONTCACHEV1.DAT
2006-10-18 19:58 ——– d——– C:\Program Files\Microsoft ActiveSync
2006-10-18 19:52 ——– d——– C:\Program Files\Microsoft MapPoint
2006-10-18 19:49 ——– d——– C:\Program Files\Common Files\Microsoft Shared
2006-10-18 15:31 ——– d——– C:\Documents and Settings\Gary\Application Data\DivX
2006-10-18 15:28 ——– d——– C:\Program Files\DivX
2006-10-18 15:20 ——– d——– C:\Documents and Settings\Gary\Application Data\Real
2006-10-18 15:11 ——– d——– C:\Program Files\Common Files\Adobe
2006-10-18 15:09 ——– d——– C:\Program Files\Real
2006-10-18 15:09 ——– d——– C:\Program Files\Common Files\xing shared
2006-10-18 15:09 ——– d——– C:\Program Files\Common Files\Real
2006-10-18 15:09 ——– d——– C:\Program Files\Adobe
2006-10-18 14:53 ——– d——– C:\Program Files\CyberLink
2006-10-18 04:05 ——– d——– C:\Program Files\Viewpoint
2006-10-17 13:47 ——– d——– C:\Program Files\AvantGo Connect
2006-10-17 13:37 ——– dr-h—– C:\Documents and Settings\Gary\Application Data\yahoo!
2006-10-17 13:21 ——– d——– C:\Program Files\Common Files\Designer
2006-10-17 13:20 ——– d——– C:\Program Files\Microsoft Office
2006-10-17 13:20 ——– d——– C:\Program Files\Common Files\System
2006-10-17 13:17 ——– d——– C:\Program Files\Common Files\Symantec Shared
2006-10-17 13:15 ——– d——– C:\Program Files\Symantec
2006-10-17 12:55 ——– d——– C:\Program Files\Realtek Sound Manager
2006-10-17 12:55 ——– d——– C:\Program Files\Common Files\InstallShield
2006-10-17 12:55 ——– d——– C:\Program Files\AvRack
2006-10-17 12:37 ——– d——– C:\Documents and Settings\Gary\Application Data\Macromedia
2006-10-17 12:36 ——– d——– C:\Program Files\Yahoo!
2006-10-17 04:12 ——– d——– C:\Program Files\MSN Messenger
2006-10-17 04:10 ——– d——– C:\Program Files\Common Files\Nullsoft
2006-10-17 04:10 ——– d——– C:\Program Files\Common Files\aolshare
2006-10-17 04:10 ——– d——– C:\Program Files\Common Files\AOL
2006-10-17 04:10 ——– d——– C:\Program Files\AOL
2006-10-17 04:10 ——– d——– C:\Program Files\AOD
2006-10-17 04:10 ——– d——– C:\Documents and Settings\Gary\Application Data\acccore
2006-10-17 04:08 ——– d–h—– C:\Program Files\Uninstall Information
2006-10-17 04:08 ——– d——– C:\Documents and Settings\Gary\Application Data\Identities
2006-10-17 04:03 ——– d——– C:\Program Files\xerox
2006-10-17 04:03 ——– d——– C:\Program Files\microsoft frontpage
2006-10-17 04:02 ——– d——– C:\Program Files\Windows Media Player
2006-10-17 04:01 ——– d–h—– C:\Program Files\WindowsUpdate
2006-10-17 04:01 ——– d——– C:\Program Files\Online Services
2006-10-17 04:01 ——– d——– C:\Program Files\Internet Explorer
2006-10-17 04:00 ——– d——– C:\Program Files\Outlook Express
2006-10-17 04:00 ——– d——– C:\Program Files\NetMeeting
2006-10-17 04:00 ——– d——– C:\Program Files\Movie Maker
2006-10-17 04:00 ——– d——– C:\Program Files\Common Files\Services
2006-10-17 04:00 ——– d——– C:\Program Files\Common Files\MSSoap
2006-10-17 03:59 ——– d——– C:\Program Files\ComPlus Applications
2006-10-17 03:58 ——– d——– C:\Program Files\Windows NT
2006-10-17 03:58 ——– d——– C:\Program Files\MSN Gaming Zone
2006-10-17 03:58 ——– d——– C:\Program Files\MSN
2006-10-17 03:58 ——– d——– C:\Program Files\Messenger
2006-10-16 13:34 62 –ahs—- C:\Documents and Settings\Gary\Application Data\desktop.ini
2006-10-16 13:34 ——– d——– C:\Program Files\Common Files\SpeechEngines
2006-10-16 13:34 ——– d——– C:\Program Files\Common Files\ODBC
2006-10-02 14:04 806912 –a—— C:\WINDOWS\system32\divx_xx0c.dll
2006-10-02 14:04 806912 –a—— C:\WINDOWS\system32\divx_xx07.dll
2006-10-02 14:04 790528 –a—— C:\WINDOWS\system32\divx_xx11.dll
2006-10-02 14:04 635486 –a—— C:\WINDOWS\system32\DivX.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Aim6"="\"C:\\Program Files\\Common Files\\AOL\\Launch\\AOLLaunch.exe\" /d locale=en-US ee://aol/imApp"
"MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
"Yahoo! Pager"="\"C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\YAHOOM~1.EXE\" -quiet"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"H/PC Connection Agent"="\"C:\\Program Files\\Microsoft ActiveSync\\WCESCOMM.EXE\""
"Tsua"="\"C:\\DOCUME~1\\Gary\\APPLIC~1\\PPPATC~1\\regsvr32.exe\" -vt yazb"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"IPHSend"="C:\\Program Files\\Common Files\\AOL\\IPHSend\\IPHSend.exe"
"SoundMan"="SOUNDMAN.EXE"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"vptray"="C:\\PROGRA~1\\SYMANT~1\\VPTray.exe"
"IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32"
"MSPY2002"="C:\\WINDOWS\\system32\\IME\\PINTLGNT\\ImScInst.exe /SYNC"
"PHIME2002ASync"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC"
"PHIME2002A"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName"
"ViewMgr"="C:\\Program Files\\Viewpoint\\Viewpoint Manager\\ViewMgr.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000005

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,e2,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,d2,03,00,00,23,00,00,00,1c,01,00,00,27,01,\
00,00,01,00,00,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\geedb

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Completion time: 06-11-15 20:24:52.18
C:\ComboFix.txt … 06-11-15 20:24





Hijackthis Log:


Logfile of HijackThis v1.99.1
Scan saved at 8:30:38 PM, on 11/15/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\conime.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Common Files\AOL\1161076213\ee\aolsoftware.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
c:\program files\common files\aol\1161076213\ee\aim6.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
c:\program files\common files\aol\1161076213\ee\anotify.exe
C:\Documents and Settings\Gary\Desktop\HijackThis.exe

O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [Tsua] "C:\DOCUME~1\Gary\APPLIC~1\PPPATC~1\regsvr32.exe" -vt yazb
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe



Hijackthis log:

Once again, Thanks.




Logfile of HijackThis v1.99.1
Scan saved at 8:29:04 PM, on 11/16/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Common Files\AOL\1161076213\ee\aolsoftware.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
c:\program files\common files\aol\1161076213\ee\aim6.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Gary\Desktop\HijackThis.exe

O2 - BHO: (no name) - {5C1850D4-D127-4627-B385-4DBE42C91ABE} - C:\WINDOWS\system32\geedb.dll (file missing)
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe






VundoFix V6.2.8

Checking Java version…

Sun Java not detected
Scan started at 8:15:30 PM 11/16/2006

Listing files found while scanning….

C:\WINDOWS\system32\geedb.dll
C:\WINDOWS\system32\bdeeg.ini
C:\WINDOWS\system32\bdeeg.bak1
C:\WINDOWS\system32\bdeeg.bak2
C:\WINDOWS\system32\bdeeg.ini2
C:\WINDOWS\system32\bdeeg.tmp

Beginning removal…

Attempting to delete C:\WINDOWS\system32\geedb.dll
C:\WINDOWS\system32\geedb.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\bdeeg.ini
C:\WINDOWS\system32\bdeeg.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\bdeeg.bak1
C:\WINDOWS\system32\bdeeg.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\bdeeg.bak2
C:\WINDOWS\system32\bdeeg.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\bdeeg.ini2
C:\WINDOWS\system32\bdeeg.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\bdeeg.tmp
C:\WINDOWS\system32\bdeeg.tmp Has been deleted!

Performing Repairs to the registry.
Done!