HP_Owner - 06-12-07 21:07:25.46 Service Pack 2
ComboFix 06.11.27W - Running from: "C:\Documents and Settings\HP_Owner\Desktop"
(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINDOWS\system32\components
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Folders Quarantined:
C:\QooBox\Purity\Program Files\Common Files\SCURIT~1
C:\QooBox\Purity\WINDOWS\STEM32~1
C:\QooBox\Purity\WINDOWS\STEM32~1\STEM32~1
C:\QooBox\Purity\WINDOWS\STEM32~1\wuaclt.exe
C:\QooBox\Purity\WINDOWS\system32\SSEMBL~1
((((((((((((((((((((((((((((((( Files Created from 2006-11-07 to 2006-12-07 ))))))))))))))))))))))))))))))))))
2006-12-07 21:03 106,555 –a–c— C:\WINDOWS\system32\nwrfpawk.dll
2006-12-07 19:21 106,555 –a–c— C:\WINDOWS\system32\xkshgqls.dll
2006-12-07 19:14 106,555 –a–c— C:\WINDOWS\system32\qloxdkow.dll
2006-12-07 19:14 106,555 –a–c— C:\WINDOWS\system32\oojibwjy.dll
2006-12-07 19:05 d—-c— C:\VundoFix Backups
2006-12-07 18:53 d—-c— C:\Program Files\Lavasoft
2006-12-07 18:53 d—-c— C:\Documents and Settings\HP_Owner\Application Data\Lavasoft
2006-12-07 17:50 106,555 –a–c— C:\WINDOWS\system32\xuwlubvt.dll
2006-12-07 11:55 106,555 –a–c— C:\WINDOWS\system32\qlnwnhjo.dll
2006-12-07 11:13 dr-h-c— C:\$VAULT$.AVG
2006-12-07 09:35 816,672 –a–c— C:\WINDOWS\system32\drivers\avg7core.sys
2006-12-07 09:35 4,960 –a–c— C:\WINDOWS\system32\drivers\avgtdi.sys
2006-12-07 09:35 4,224 –a–c— C:\WINDOWS\system32\drivers\avg7rsw.sys
2006-12-07 09:35 3,968 –a–c— C:\WINDOWS\system32\drivers\avgclean.sys
2006-12-07 09:35 28,416 –a–c— C:\WINDOWS\system32\drivers\avg7rsxp.sys
2006-12-07 09:35 d—-c— C:\Program Files\Grisoft
2006-12-07 09:35 d—-c— C:\Documents and Settings\HP_Owner\Application Data\AVG7
2006-12-07 09:35 d—-c— C:\Documents and Settings\All Users\Application Data\Grisoft
2006-12-07 09:35 d—-c— C:\Documents and Settings\All Users\Application Data\avg7
2006-12-07 09:11 106,555 –a–c— C:\WINDOWS\system32\yhfktwwd.dll
2006-12-07 09:00 106,555 –a–c— C:\WINDOWS\system32\elfhktbu.dll
2006-12-07 08:59 3,486 –a–c— C:\WINDOWS\system32\tmp.reg
2006-12-07 08:45 106,555 –a–c— C:\WINDOWS\system32\grorilmh.dll
2006-12-07 06:32 106,555 –a–c— C:\WINDOWS\system32\xejcroek.dll
2006-12-07 06:18 d—-c— C:\Program Files\SpywareBlaster
2006-12-07 05:59 d—-c— C:\Program Files\Spyware Terminator
2006-12-07 05:59 d—-c— C:\Documents and Settings\HP_Owner\Application Data\Spyware Terminator
2006-12-07 05:59 d—-c— C:\Documents and Settings\All Users\Application Data\Spyware Terminator
2006-12-07 05:52 56,832 –a–c— C:\WINDOWS\system32\zcowsxv.dll
2006-12-07 05:52 d—-c— C:\Program Files\Spybot - Search & Destroy
2006-12-07 05:52 d—-c— C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2006-12-07 05:47 d—-c— C:\Program Files\Advanced Spyware Remover
2006-12-07 05:45 106,555 –a–c— C:\WINDOWS\system32\lxpedcku.dll
2006-12-07 05:41 106,555 –a–c— C:\WINDOWS\system32\rgbrrxrt.dll
2006-12-06 23:45 106,555 –a–c— C:\WINDOWS\system32\mvmkyvlb.dll
2006-12-06 23:34 d—-c— C:\Documents and Settings\HP_Owner\.housecall6.6
2006-12-06 23:20 126,996 –a–c— C:\WINDOWS\system32\uccmywjw.dll
2006-12-06 23:19 88,340 –a–c— C:\WINDOWS\system32\yqpkrgka.exe
2006-12-06 23:18 106,555 –a–c— C:\WINDOWS\system32\wdwsaolj.dll
2006-12-06 16:24 309,812 —–c— C:\WINDOWS\system32\geebc.dll
2006-12-06 16:24 106,555 –a–c— C:\WINDOWS\system32\flvxsaet.dll
2006-12-06 16:19 93,696 –a–c— C:\WINDOWS\system32\cnupiwl.dll
2006-12-06 16:19 72,704 –a–c— C:\WINDOWS\system32\drvzos.dll
2006-12-06 16:19 71,680 –a–c— C:\WINDOWS\system32\llkyzqd.dll
2006-12-06 16:19 40,973 —hsc— C:\WINDOWS\system32\wvuussp.dll
2006-12-06 16:19 2 –a–c— C:\WINDOWS\system32\wnscpsv.exe
2006-12-06 16:19 19,456 –a–c— C:\WINDOWS\system32\winbfi32.dll
2006-11-28 11:13 d—-c— C:\Temp
2006-11-28 11:01 d—-c— C:\Program Files\Azureus
2006-11-28 02:36 d—-c— C:\Program Files\ImgBurn
2006-11-28 02:33 d—-c— C:\Program Files\AviSynth 2.5
2006-11-28 02:33 d—-c— C:\Program Files\Avi2Dvd
2006-11-25 19:12 d—-c— C:\Program Files\AOE2
2006-11-25 04:00 d—-c— C:\Program Files\MTV Networks
2006-11-23 03:18 10,752 –a–c— C:\WINDOWS\system32\ntqsi32.dll
2006-11-23 03:16 d–h-c— C:\Program Files\easykeylogger
2006-11-22 15:06 d—-c— C:\Casino
2006-11-22 04:45 d—-c— C:\Program Files\Encore
2006-11-21 10:17 d—-c— C:\Program Files\RFA Platinum
2006-11-19 23:34 8 –a–c— C:\WINDOWS\system32\Mlkf.dll
2006-11-19 23:20 368,912 –a–c— C:\WINDOWS\system32\vbar332.dll
2006-11-19 23:20 36,864 –a–c— C:\WINDOWS\system32\LckFldService.exe
2006-11-19 23:20 153,088 –a–c— C:\WINDOWS\system32\fldlckun.exe
2006-11-19 23:20 d—-c— C:\Program Files\FolderAccess
2006-11-16 23:04 171,008 –a–c— C:\WINDOWS\system32\LXAESUI.DLL
2006-11-16 22:47 d—-c— C:\Documents and Settings\All Users\Application Data\NVIDIA
2006-11-16 13:58 d—-c— C:\Documents and Settings\All Users\Application Data\Age of Empires 3
2006-11-16 12:36 d—-c— C:\LXKZ33
2006-11-16 11:35 2,297,552 –a–c— C:\WINDOWS\system32\d3dx9_26.dll
2006-11-15 02:13 d—-c— C:\Program Files\Microsoft Location Finder
2006-11-15 00:35 d—-c— C:\Program Files\Virtual Earth 3D
2006-11-14 23:01 d—-c— C:\Program Files\Family Creator
2006-11-13 13:12 d—-c— C:\Program Files\Illustrate
2006-11-13 13:08 167,936 –a–c— C:\WINDOWS\system32\SpoonUninstall.exe
2006-11-13 11:44 45,056 –a–c— C:\WINDOWS\system32\WNASPI32.DLL
2006-11-13 11:44 16,512 –a–c— C:\WINDOWS\system32\drivers\ASPI32.SYS
2006-11-13 11:38 d—-c— C:\Program Files\Xilisoft
2006-11-07 23:16 d—-c— C:\Program Files\Sims 2 Categorizer
2006-11-07 23:15 73,216 –a–c— C:\WINDOWS\ST6UNST.EXE
2006-11-07 23:15 249,856 —–c— C:\WINDOWS\Setup1.exe
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2006-12-07 21:11 ——– d—-c— C:\Program Files\Common Files
2006-12-07 21:02 ——– d—-c— C:\Program Files\Internet Explorer
2006-12-07 18:49 ——– d—-c— C:\Program Files\Java
2006-12-07 18:01 ——– d—-c— C:\Documents and Settings\HP_Owner\Application Data\Azureus
2006-12-07 09:29 ——– d—sc— C:\Documents and Settings\HP_Owner\Application Data\Microsoft
2006-11-23 02:29 ——– d—-c— C:\Program Files\FreeUndelete
2006-11-16 20:20 ——– d—-c— C:\Program Files\IncrediMail
2006-11-16 13:49 ——– d–h-c— C:\Program Files\InstallShield Installation Information
2006-11-16 11:13 ——– d—-c— C:\Program Files\Microsoft Games
2006-11-15 22:40 ——– d—-c— C:\Program Files\Billeo
2006-11-15 13:59 ——– d—-c— C:\Program Files\SimPE
2006-11-14 00:15 ——– d—-c— C:\Program Files\EA GAMES
2006-11-08 07:30 ——– d—-c— C:\Program Files\Genius Move
2006-11-07 21:03 6049280 –a–c— C:\WINDOWS\system32\ieframe.dll
2006-11-07 21:03 50688 –a–c— C:\WINDOWS\system32\msfeedsbs.dll
2006-11-07 21:03 458752 –a–c— C:\WINDOWS\system32\msfeeds.dll
2006-11-07 21:03 413696 –a–c— C:\WINDOWS\system32\vbscript.dll
2006-11-07 21:03 231424 –a–c— C:\WINDOWS\system32\webcheck.dll
2006-11-07 21:03 180736 –a–c— C:\WINDOWS\system32\ieui.dll
2006-11-07 21:03 156160 –a–c— C:\WINDOWS\system32\msls31.dll
2006-11-07 03:27 382976 –a–c— C:\WINDOWS\system32\iedkcs32.dll
2006-11-07 03:27 229376 –a–c— C:\WINDOWS\system32\ieaksie.dll
2006-11-07 03:26 71680 –a–c— C:\WINDOWS\system32\admparse.dll
2006-11-07 03:26 55296 –a–c— C:\WINDOWS\system32\iesetup.dll
2006-11-07 03:26 54784 –a–c— C:\WINDOWS\system32\ie4uinit.exe
2006-11-07 03:26 43008 –a–c— C:\WINDOWS\system32\iernonce.dll
2006-11-07 03:26 152064 –a–c— C:\WINDOWS\system32\ieakeng.dll
2006-11-07 03:26 13312 –a–c— C:\WINDOWS\system32\ieudinit.exe
2006-11-07 03:26 123904 –a–c— C:\WINDOWS\system32\advpack.dll
2006-11-07 03:25 161792 –a–c— C:\WINDOWS\system32\ieakui.dll
2006-11-06 14:14 ——– d—-c— C:\Program Files\GetData
2006-11-06 14:11 ——– d—-c— C:\Program Files\FDRLab
2006-11-06 03:04 ——– d—-c— C:\Program Files\parentalcontrol
2006-11-06 02:59 ——– d—-c— C:\Program Files\Windows Media Player
2006-11-06 02:59 ——– d—-c— C:\Program Files\Windows Media Connect 2
2006-11-06 00:33 ——– d—-c— C:\Documents and Settings\HP_Owner\Application Data\Transparent
2006-11-06 00:33 ——– d—-c— C:\Documents and Settings\HP_Owner\Application Data\InstallShield Installation Information
2006-11-05 16:05 ——– d—-c— C:\Program Files\Microsoft Office
2006-11-05 16:05 ——– d—-c— C:\Program Files\Common Files\Microsoft Shared
2006-11-05 16:04 ——– d—-c— C:\Program Files\MSECache
2006-11-02 04:00 ——– d—-c— C:\Program Files\Vodei
2006-11-02 02:24 ——– d—-c— C:\Program Files\Active Data Recovery Software
2006-11-02 01:03 86232 –a–c— C:\WINDOWS\v030166.exe
2006-10-22 15:06 208896 –a–c— C:\WINDOWS\system32\NVUNINST.EXE
2006-10-22 15:06 208896 –a–c— C:\WINDOWS\system32\nvudisp.exe
2006-10-22 12:22 888832 –a–c— C:\WINDOWS\system32\nvmobls.dll
2006-10-22 12:22 86016 –a–c— C:\WINDOWS\system32\nvmctray.dll
2006-10-22 12:22 81920 –a–c— C:\WINDOWS\system32\nvwddi.dll
2006-10-22 12:22 794624 –a–c— C:\WINDOWS\system32\nvcplui.exe
2006-10-22 12:22 7700480 –a–c— C:\WINDOWS\system32\nvcpl.dll
2006-10-22 12:22 581632 –a–c— C:\WINDOWS\system32\nvhwvid.dll
2006-10-22 12:22 5644288 –a–c— C:\WINDOWS\system32\nvoglnt.dll
2006-10-22 12:22 5619712 –a–c— C:\WINDOWS\system32\nvdisps.dll
2006-10-22 12:22 5255168 –a–c— C:\WINDOWS\system32\nvdispsr.dll
2006-10-22 12:22 466944 –a–c— C:\WINDOWS\system32\nvshell.dll
2006-10-22 12:22 458752 –a–c— C:\WINDOWS\system32\nvmccssr.dll
2006-10-22 12:22 4527488 –a–c— C:\WINDOWS\system32\nv4_disp.dll
2006-10-22 12:22 45056 –a–c— C:\WINDOWS\system32\nvmccsrs.dll
2006-10-22 12:22 442368 –a–c— C:\WINDOWS\system32\nvappbar.exe
2006-10-22 12:22 425984 –a–c— C:\WINDOWS\system32\keystone.exe
2006-10-22 12:22 3994624 –a–c— C:\WINDOWS\system32\drivers\nv4_mini.sys
2006-10-22 12:22 35840 –a–c— C:\WINDOWS\system32\nvcodins.dll
2006-10-22 12:22 35840 –a–c— C:\WINDOWS\system32\nvcod.dll
2006-10-22 12:22 3203072 –a–c— C:\WINDOWS\system32\nvgamesr.dll
2006-10-22 12:22 311296 –a–c— C:\WINDOWS\system32\nvexpbar.dll
2006-10-22 12:22 3047424 –a–c— C:\WINDOWS\system32\nvgames.dll
2006-10-22 12:22 2973696 –a–c— C:\WINDOWS\system32\nvvitvsr.dll
2006-10-22 12:22 2924544 –a–c— C:\WINDOWS\system32\nvvitvs.dll
2006-10-22 12:22 286720 –a–c— C:\WINDOWS\system32\nvnt4cpl.dll
2006-10-22 12:22 2859008 –a–c— C:\WINDOWS\system32\nvmoblsr.dll
2006-10-22 12:22 229376 –a–c— C:\WINDOWS\system32\nvmccs.dll
2006-10-22 12:22 212992 –a–c— C:\WINDOWS\system32\nvapi.dll
2006-10-22 12:22 188416 –a–c— C:\WINDOWS\system32\nvmccss.dll
2006-10-22 12:22 1732608 –a–c— C:\WINDOWS\system32\nvwssr.dll
2006-10-22 12:22 1662976 –a–c— C:\WINDOWS\system32\nvwdmcpl.dll
2006-10-22 12:22 1622016 –a–c— C:\WINDOWS\system32\nwiz.exe
2006-10-22 12:22 159810 –a–c— C:\WINDOWS\system32\nvsvc32.exe
2006-10-22 12:22 147456 –a–c— C:\WINDOWS\system32\nvcolor.exe
2006-10-22 12:22 1470464 –a–c— C:\WINDOWS\system32\nview.dll
2006-10-22 12:22 1339392 –a–c— C:\WINDOWS\system32\nvdspsch.exe
2006-10-22 12:22 1236992 –a–c— C:\WINDOWS\system32\nvwss.dll
2006-10-22 12:22 1019904 –a–c— C:\WINDOWS\system32\nvwimg.dll
2006-10-22 12:22 1011712 –a–c— C:\WINDOWS\system32\nvcpluir.dll
2006-10-18 22:58 8704 –a–c— C:\WINDOWS\system32\wdfmgr.exe
2006-10-18 22:58 8704 –a–c— C:\WINDOWS\system32\uwdf.exe
2006-10-18 22:47 99840 –a–c— C:\WINDOWS\system32\wmpshell.dll
2006-10-18 22:47 991744 –a–c— C:\WINDOWS\system32\drmv2clt.dll
2006-10-18 22:47 937984 –a–c— C:\WINDOWS\system32\WMNetMgr.dll
2006-10-18 22:47 8231936 –a–c— C:\WINDOWS\system32\wmploc.dll
2006-10-18 22:47 767488 —–c— C:\WINDOWS\system32\WMVSENCD.dll
2006-10-18 22:47 757248 –a–c— C:\WINDOWS\system32\WMADMOD.dll
2006-10-18 22:47 7168 –a–c— C:\WINDOWS\system32\asferror.dll
2006-10-18 22:47 656896 —–c— C:\WINDOWS\system32\WMVXENCD.dll
2006-10-18 22:47 63488 –a–c— C:\WINDOWS\system32\wpdmtpus.dll
2006-10-18 22:47 629760 –a–c— C:\WINDOWS\system32\wpd_ci.dll
2006-10-18 22:47 613376 —–c— C:\WINDOWS\system32\wmpmde.dll
2006-10-18 22:47 603648 –a–c— C:\WINDOWS\system32\WMSPDMOD.dll
2006-10-18 22:47 542720 –a–c— C:\WINDOWS\system32\blackbox.dll
2006-10-18 22:47 535040 —–c— C:\WINDOWS\system32\wmdrmsdk.dll
2006-10-18 22:47 429056 –a–c— C:\WINDOWS\system32\wmdrmdev.dll
2006-10-18 22:47 414208 –a–c— C:\WINDOWS\system32\msscp.dll
2006-10-18 22:47 4096 –a–c— C:\WINDOWS\system32\wmvdmoe2.dll
2006-10-18 22:47 4096 –a–c— C:\WINDOWS\system32\wmvdmod.dll
2006-10-18 22:47 4096 –a–c— C:\WINDOWS\system32\WMVADVE.DLL
2006-10-18 22:47 4096 –a–c— C:\WINDOWS\system32\WMVADVD.dll
2006-10-18 22:47 4096 –a–c— C:\WINDOWS\system32\wmsdmoe2.dll
2006-10-18 22:47 4096 –a–c— C:\WINDOWS\system32\wmsdmod.dll
2006-10-18 22:47 4096 –a–c— C:\WINDOWS\system32\wdfapi.dll
2006-10-18 22:47 4096 –a–c— C:\WINDOWS\system32\MPG4DMOD.dll
2006-10-18 22:47 4096 –a–c— C:\WINDOWS\system32\MP4SDMOD.dll
2006-10-18 22:47 4096 –a–c— C:\WINDOWS\system32\MP43DMOD.dll
2006-10-18 22:47 38400 —–c— C:\WINDOWS\system32\wpdshextres.dll
2006-10-18 22:47 37376 –a–c— C:\WINDOWS\system32\wmdmps.dll
2006-10-18 22:47 35840 –a–c— C:\WINDOWS\system32\wpdconns.dll
2006-10-18 22:47 356352 –a–c— C:\WINDOWS\system32\wpdsp.dll
2006-10-18 22:47 348672 –a–c— C:\WINDOWS\system32\wmdrmnet.dll
2006-10-18 22:47 33792 –a–c— C:\WINDOWS\system32\wmdmlog.dll
2006-10-18 22:47 321536 –a–c— C:\WINDOWS\system32\mswmdm.dll
2006-10-18 22:47 317440 —–c— C:\WINDOWS\system32\MP4SDECD.dll
2006-10-18 22:47 314880 –a–c— C:\WINDOWS\system32\wmpdxm.dll
2006-10-18 22:47 295936 —–c— C:\WINDOWS\system32\wmpeffects.dll
2006-10-18 22:47 284160 —–c— C:\WINDOWS\system32\PortableDeviceApi.dll
2006-10-18 22:47 276992 –a–c— C:\WINDOWS\system32\audiodev.dll
2006-10-18 22:47 27136 –a–c— C:\WINDOWS\system32\mspmsnsv.dll
2006-10-18 22:47 2603008 —–c— C:\WINDOWS\system32\WpdShext.dll
2006-10-18 22:47 259072 —–c— C:\WINDOWS\system32\MPG4DECD.dll
2006-10-18 22:47 259072 —–c— C:\WINDOWS\system32\MP43DECD.dll
2006-10-18 22:47 2450944 –a–c— C:\WINDOWS\system32\wmvcore.dll
2006-10-18 22:47 242688 –a–c— C:\WINDOWS\system32\wmpasf.dll
2006-10-18 22:47 229376 –a–c— C:\WINDOWS\system32\cewmdm.dll
2006-10-18 22:47 227328 –a–c— C:\WINDOWS\system32\wmerror.dll
2006-10-18 22:47 222208 –a–c— C:\WINDOWS\system32\WMASF.dll
2006-10-18 22:47 212992 —–c— C:\WINDOWS\system32\MFPLAT.dll
2006-10-18 22:47 211456 –a–c— C:\WINDOWS\system32\qasf.dll
2006-10-18 22:47 204288 –a–c— C:\WINDOWS\system32\wmpsrcwp.dll
2006-10-18 22:47 199168 —–c— C:\WINDOWS\system32\PortableDeviceWMDRM.dll
2006-10-18 22:47 179712 –a–c— C:\WINDOWS\system32\msnetobj.dll
2006-10-18 22:47 175616 –a–c— C:\WINDOWS\system32\mspmsp.dll
2006-10-18 22:47 166912 —–c— C:\WINDOWS\system32\PortableDeviceTypes.dll
2006-10-18 22:47 1661440 –a–c— C:\WINDOWS\system32\wmpencen.dll
2006-10-18 22:47 1574912 —–c— C:\WINDOWS\system32\WMVENCOD.dll
2006-10-18 22:47 157184 –a–c— C:\WINDOWS\system32\wmidx.dll
2006-10-18 22:47 154624 –a–c— C:\WINDOWS\system32\wpdmtp.dll
2006-10-18 22:47 1543680 —–c— C:\WINDOWS\system32\WMVDECOD.dll
2006-10-18 22:47 1382912 —–c— C:\WINDOWS\system32\WMVSDECD.dll
2006-10-18 22:47 133632 —–c— C:\WINDOWS\system32\WPDShServiceObj.dll
2006-10-18 22:47 1329152 –a–c— C:\WINDOWS\system32\WMSPDMOE.dll
2006-10-18 22:47 132096 —–c— C:\WINDOWS\system32\PortableDeviceWiaCompat.dll
2006-10-18 22:47 130048 —–c— C:\WINDOWS\system32\wmpps.dll
2006-10-18 22:47 11264 –a–c— C:\WINDOWS\system32\LAPRXY.dll
2006-10-18 22:47 1117696 –a–c— C:\WINDOWS\system32\WMADMOE.dll
2006-10-18 22:47 101888 —–c— C:\WINDOWS\system32\PortableDeviceClassExtension.dll
2006-10-18 21:03 100864 –a–c— C:\WINDOWS\system32\logagent.exe
2006-10-18 21:00 38528 –a–c— C:\WINDOWS\system32\drivers\wpdusb.sys
2006-10-18 21:00 249856 —–c— C:\WINDOWS\system32\drmupgds.exe
2006-10-18 21:00 17408 —–c— C:\WINDOWS\system32\wpdshextautoplay.exe
2006-10-17 13:06 78336 –a–c— C:\WINDOWS\system32\ieencode.dll
2006-10-17 13:05 40960 –a–c— C:\WINDOWS\system32\licmgr10.dll
2006-10-17 13:05 206336 —–c— C:\WINDOWS\system32\WinFXDocObj.exe
2006-10-17 13:05 105984 –a–c— C:\WINDOWS\system32\url.dll
2006-10-17 13:04 101376 –a–c— C:\WINDOWS\system32\occache.dll
2006-10-17 13:03 17408 –a–c— C:\WINDOWS\system32\corpol.dll
2006-10-17 12:58 61952 —–c— C:\WINDOWS\system32\icardie.dll
2006-10-17 12:58 12288 —–c— C:\WINDOWS\system32\msfeedssync.exe
2006-10-17 12:57 36352 –a–c— C:\WINDOWS\system32\imgutil.dll
2006-10-17 12:57 266752 —–c— C:\WINDOWS\system32\iertutil.dll
2006-10-17 12:56 45568 –a–c— C:\WINDOWS\system32\mshta.exe
2006-10-17 12:28 48128 –a–c— C:\WINDOWS\system32\mshtmler.dll
2006-10-17 12:27 380928 —–c— C:\WINDOWS\system32\ieapfltr.dll
2006-10-04 14:39 98304 –a–c— C:\WINDOWS\system32\CmdLineExt.dll
2006-10-02 15:28 312128 —–c— C:\WINDOWS\system32\msdelta.dll
2006-09-28 20:13 95344 —–c— C:\WINDOWS\system32\WUDFCoinstaller.dll
2006-09-28 18:56 55808 —–c— C:\WINDOWS\system32\WudfSvc.dll
2006-09-28 18:56 316416 —–c— C:\WINDOWS\system32\WUDFx.dll
2006-09-28 18:56 165376 —–c— C:\WINDOWS\system32\WudfPlatform.dll
2006-09-28 18:56 146432 —–c— C:\WINDOWS\system32\WudfHost.exe
2006-09-25 17:58 23856 –a–c— C:\WINDOWS\system32\spupdsvc.exe
2006-09-13 00:01 1084416 –a–c— C:\WINDOWS\system32\msxml3.dll
2006-09-12 16:51 1245184 –a–c— C:\WINDOWS\system32\msxml4.dll
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries are not shown
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"SkinClock"="C:\\Program Files\\Clock Tray Skins\\ClockTraySkins.exe"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"Microsoft Location Finder"="\"C:\\Program Files\\Microsoft Location Finder\\LocationFinder.exe\""
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"LXSUPMON"="C:\\WINDOWS\\system32\\LXSUPMON.EXE RUN"
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"
"SpySweeper"="\"C:\\Program Files\\Webroot\\Spy Sweeper\\SpySweeper.exe\" /startintray"
"QuickTime Task"="\"C:\\Program Files\\K-Lite Codec Pack\\QuickTime\\qttask.exe\" -atboottime"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"Adobe Photo Downloader"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\""
"parentalcontrol"="\"C:\\Program Files\\parentalcontrol\\parentalcontrol.exe\" \"C:\\Program Files\\parentalcontrol\\parentalcontrol.dll\" \"parentalcontrol\""
"rfagent"="\"C:\\Program Files\\RFA Platinum\\rfagent.exe\""
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"SpywareTerminator"="\"C:\\Program Files\\Spyware Terminator\\SpywareTerminatorShield.exe\""
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\""
"Free Key Logger"="\"C:\\Program Files\\easykeylogger\\free\\FreeKeyLogger.exe\" minimized"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"="Microsoft AntiMalware ShellExecuteHook"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"NoSecurityTab"=dword:00000001
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
"backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Adobe\\ACROBA~2.0\\Reader\\READER~1.EXE "
"item"="Adobe Reader Speed Launch"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Event Planner Reminder.lnk]
"backup"="C:\\WINDOWS\\pss\\Event Planner Reminder.lnkCommon Startup"
"location"="Common Startup"
"item"="Event Planner Reminder"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Photo Software\\Kodak\\Kodak EasyShare\\Kodak EasyShare software.lnk"
"backup"="C:\\WINDOWS\\pss\\Kodak EasyShare software.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Kodak\\KODAKE~1\\bin\\EASYSH~1.EXE -h"
"item"="Kodak EasyShare software"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak software updater.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Kodak software updater.lnk"
"backup"="C:\\WINDOWS\\pss\\Kodak software updater.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Kodak\\KODAKS~1\\7288971\\Program\\KODAKS~1.EXE "
"item"="Kodak software updater"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates from HP.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\PC Help & Tools\\Updates from HP\\Updates from HP.lnk"
"backup"="C:\\WINDOWS\\pss\\Updates from HP.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\UPDATE~1\\309731\\Program\\UPDATE~1.EXE -startup"
"item"="Updates from HP"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^HP_Owner^Start Menu^Programs^Startup^StripSaver2.lnk]
"backup"="C:\\WINDOWS\\pss\\StripSaver2.lnkStartup"
"location"="Startup"
"item"="StripSaver2"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^HP_Owner^Start Menu^Programs^Startup^VirtuaGirl2.lnk]
"backup"="C:\\WINDOWS\\pss\\VirtuaGirl2.lnkStartup"
"location"="Startup"
"command"="C:\\DOCUME~1\\HP_Owner\\Desktop\\Other\\SAFEDI~1.1EN\\SD4HID~1\\VIRTUA~1.EXE "
"item"="VirtuaGirl2"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKLM"
"command"=""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="apdproxy"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="AGRSMMSG"
"hkey"="HKLM"
"command"="AGRSMMSG.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcxMonitor]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ALCXMNTR"
"hkey"="HKLM"
"command"="ALCXMNTR.EXE"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AutoTBar]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="AUTOTBAR"
"hkey"="HKLM"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NMBgMonitor"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Common Files\\Ahead\\lib\\NMBgMonitor.exe\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Client Server Runtime Process]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="smmss"
"hkey"="HKLM"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gcasServ]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="gcasServ"
"hkey"="HKLM"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="hpsysdrv"
"hkey"="HKLM"
"command"="c:\\windows\\system\\hpsysdrv.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\I downloaded pirated Software from P2P and now I post my Hijack log whining]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Sims 2 Nightlife crack"
"hkey"="HKLM"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="igfxtray"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\igfxtray.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IncrediMail]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="IncMail"
"hkey"="HKCU"
"command"="C:\\Program Files\\IncrediMail\\bin\\IncMail.exe /c"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ISUSPM"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\COMMON~1\\INSTAL~1\\UPDATE~1\\ISUSPM.exe -startup"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="issch"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="KBD"
"hkey"="HKLM"
"command"="C:\\HP\\KBD\\KBD.EXE"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LSBWatcher]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="lsburnwatcher"
"hkey"="HKLM"
"command"="c:\\hp\\drivers\\hplsbwatcher\\lsburnwatcher.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="MotiveSB"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\VERIZO~1\\SMARTB~1\\MotiveSB.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msmsgs"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NvCpl"
"hkey"="HKLM"
"command"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NvMcTray"
"hkey"="HKLM"
"command"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="nwiz"
"hkey"="HKLM"
"command"="nwiz.exe /install"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PeerGuardian]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="pg2"
"hkey"="HKCU"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PS2]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ps2"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\ps2.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="RECGUARD"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\SMINST\\RECGUARD.EXE"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\shell32]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="wuauclt10"
"hkey"="HKLM"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkinClock]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ClockTraySkins"
"hkey"="HKCU"
"command"="C:\\Program Files\\Clock Tray Skins\\ClockTraySkins.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SP2 Connection Patcher]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SP2ConnPatcher"
"hkey"="HKCU"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="jusched"
"hkey"="HKLM"
"command"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="realsched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="sgtray"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\Sonic\\Update Manager\\sgtray.exe\" /r"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="VTTimer"
"hkey"="HKLM"
"command"="VTTimer.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinLoad]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Winload"
"hkey"="HKLM"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinLoad32]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Winload32"
"hkey"="HKLM"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ypager"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe\" -quiet"
"inimapping"="0"
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\flvxsaet
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\geebc
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winbfi32
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\MP Scheduled Scan.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{8E3A8806-5F15-4F4A-9879-47A95E10A5FC}.job
C:\WINDOWS\tasks\wrSpySweeper20060512134839.job
Completion time: 06-12-07 21:13:41.62
C:\ComboFix.txt … 06-12-07 21:13
Logfile of HijackThis v1.99.1
Scan saved at 9:14:59 PM, on 12/7/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LckFldService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\System32\dmadmin.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\LXSUPMON.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\parentalcontrol\parentalcontrol.exe
C:\Program Files\RFA Platinum\rfagent.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Clock Tray Skins\ClockTraySkins.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Location Finder\LocationFinder.exe
C:\Program Files\Billeo\billeo.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\HP_Owner\Desktop\Spyware.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://dslstart.verizon.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {35F7813A-AF74-4474-B1DC-7EE6FB6C43C6} - C:\WINDOWS\system32\sgsnpymh.dll (file missing)
O2 - BHO: Billeo - {465E08E7-F005-4389-980F-1D8764B3486C} - C:\Program Files\Billeo\billeo.dll
O2 - BHO: Parental Control Toolbar - {4E7BD74F-2B8D-469E-9FA5-A33DE8DBE931} - C:\PROGRA~1\PARENT~1\PARENT~1.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {648592A3-44B7-9AF8-BACA-02859776A1CD} - C:\WINDOWS\system32\llkyzqd.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {FFBA9E1D-C3DF-491B-B20E-8AC41B0B4E86} - C:\WINDOWS\system32\geebc.dll
O3 - Toolbar: Parental Control Toolbar - {4E7BD74F-2B8D-469E-9FA5-A33DE8DBE931} - C:\PROGRA~1\PARENT~1\PARENT~1.DLL
O3 - Toolbar: Billeo - {6ADB0F93-1AA5-4BCF-9DF4-CEA689A3C111} - C:\Program Files\Billeo\billeo.dll
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [parentalcontrol] "C:\Program Files\parentalcontrol\parentalcontrol.exe" "C:\Program Files\parentalcontrol\parentalcontrol.dll" "parentalcontrol"
O4 - HKLM\..\Run: [rfagent] "C:\Program Files\RFA Platinum\rfagent.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [Free Key Logger] "C:\Program Files\easykeylogger\free\FreeKeyLogger.exe" minimized
O4 - HKCU\..\Run: [SkinClock] C:\Program Files\Clock Tray Skins\ClockTraySkins.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Microsoft Location Finder] "C:\Program Files\Microsoft Location Finder\LocationFinder.exe"
O4 - Global Startup: billeo.lnk = C:\Program Files\Billeo\billeo.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Billeo - {97ED3A9F-CD6F-473A-8FE1-7505C1B844C3} - C:\Program Files\Billeo\billeo.dll (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} -
http://ipgweb.cce.hp.com/rdqcpc/downloads/sysinfo.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsoftupdat…b?1133035970421
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) -
http://javadl-esd.sun.com/update/1.5.0/jin…ows-i586-jc.cab
O16 - DPF: {C52439A0-2693-4E40-B141-9F9AD5257241} (Lexmark eDiagnostics Class) -
https://ediagnostics.lexmark.com/serval.cab
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://www.verizon.net/checkmypc/includes/MotivePreQual.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F83DA36A-EF6B-45E0-8DE0-B094F9D8C23A}: NameServer = 192.168.1.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: flvxsaet - c:\windows\system32\flvxsaet.dll
O20 - Winlogon Notify: geebc - C:\WINDOWS\system32\geebc.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winbfi32 - C:\WINDOWS\SYSTEM32\winbfi32.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGE
