Spyware / Malware / Virus Removal

Me again - with a slight problem

9 min read

Looking for the outcome? Ask AI

bizarrebob

Post #16January 3, 2007, 8:29 PM UTC last edited January 3, 2007, 8:30 PM UTC

Si - 07-01-03 20:10:01.90 Service Pack 2 ComboFix 06.11.27 - Running from: "C:\Documents and Settings\Si" ((((((((((((((((((((((((((((((( Files Created from 2006-12-03 to 2007-01-03 )))))))))))))))))))))))))))))))))) 2007-01-03 16:18 d——– C:\Program Files\Codemasters 2007-01-03 16:05 976,127 —hs—- C:\WINDOWS\system32\acbeg.ini2 2007-01-03 11:10 d——– C:\TournamentDemo 2007-01-03 00:13 3,968 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-01-03 00:13 d——– C:\Program Files\Grisoft 2007-01-03 00:10 985,500 —hs—- C:\WINDOWS\system32\acbeg.bak2 2007-01-02 16:24 22,541 —hs—- C:\WINDOWS\system32\opnlmli.dll 2007-01-02 16:12 d——– C:\Program Files\Rockstar Games 2007-01-02 10:15 d——– C:\Documents and Settings\Si\Application Data\Lavasoft 2007-01-02 00:10 969,417 —hs—- C:\WINDOWS\system32\acbeg.bak1 2007-01-02 00:10 81,684 –a—— C:\WINDOWS\system32\wrevhixd.dll 2007-01-02 00:10 44,060 –a—— C:\WINDOWS\system32\rawwypgu.dll 2007-01-02 00:09 277,044 —hs—- C:\WINDOWS\system32\gebca.dll 2007-01-02 00:04 22,541 —hs—- C:\WINDOWS\system32\awtqoop.dll 2007-01-02 00:04 16,896 –a—— C:\WINDOWS\system32\winghy32.dll 2007-01-02 00:01 2,319,360 –a—— C:\WINDOWS\system32\boot.exe 2007-01-01 23:59 d–h—– C:\i386 2007-01-01 23:49 d——– C:\Program Files\TGTSoft 2007-01-01 02:45 d——– C:\Program Files\MSXML 4.0 2007-01-01 00:08 d——– C:\Documents and Settings\Si\Application Data\Roxio 2007-01-01 00:03 d——– C:\Program Files\Sonic 2007-01-01 00:03 d——– C:\Documents and Settings\All Users\Application Data\InstallShield 2007-01-01 00:02 d——– C:\Program Files\Common Files\Sonic Shared 2007-01-01 00:01 d——– C:\Documents and Settings\All Users\Application Data\Sonic 2006-12-31 23:59 d——– C:\Documents and Settings\All Users\Application Data\Roxio 2006-12-31 23:57 d——– C:\Program Files\Roxio 2006-12-31 23:57 d——– C:\Program Files\Common Files\Roxio Shared 2006-12-31 16:35 d——– C:\Documents and Settings\All Users\Application Data\nView_Profiles 2006-12-31 16:26 d——– C:\WINDOWS\nview 2006-12-31 16:25 208,896 –a—— C:\WINDOWS\system32\nvudisp.exe 2006-12-31 16:23 208,896 –a—— C:\WINDOWS\system32\NVUNINST.EXE 2006-12-31 16:22 d——– C:\NVIDIA 2006-12-31 12:11 d——– C:\Downloads 2006-12-31 11:51 d——– C:\Program Files\FlashGet 2006-12-30 15:46 69,632 –a—— C:\WINDOWS\system32\lfgif13n.dll 2006-12-30 15:46 57,344 –a—— C:\WINDOWS\system32\lfbmp13n.dll 2006-12-30 15:46 462,848 –a—— C:\WINDOWS\system32\ltkrn13n.dll 2006-12-30 15:46 450,560 –a—— C:\WINDOWS\system32\ltimg13n.dll 2006-12-30 15:46 401,408 –a—— C:\WINDOWS\system32\lfcmp13n.dll 2006-12-30 15:46 299,008 –a—— C:\WINDOWS\system32\ltdis13n.dll 2006-12-30 15:46 206,336 –a—— C:\WINDOWS\system32\ltefx13n.dll 2006-12-30 15:46 163,840 –a—— C:\WINDOWS\system32\ltfil13n.dll 2006-12-30 10:58 33,792 -ra—— C:\WINDOWS\NPSExec.exe 2006-12-30 10:58 d——– C:\Program Files\Electronic Arts 2006-12-30 10:56 d——– C:\Program Files\Maxis 2006-12-30 10:54 306,688 –a—— C:\WINDOWS\IsUninst.exe 2006-12-30 10:54 d——– C:\Documents and Settings\Si\WINDOWS 2006-12-27 21:55 d——– C:\Program Files\Empire Interactive 2006-12-26 21:39 d——– C:\Documents and Settings\Si\Application Data\Nokia Multimedia Player 2006-12-26 17:51 d——– C:\Documents and Settings\All Users\Application Data\Messenger Plus! 2006-12-26 17:50 d——– C:\Program Files\MessengerPlus! 3 2006-12-26 17:04 d——– C:\Documents and Settings\Si\Application Data\FLV Extract 2006-12-26 14:42 dr–s—- C:\WINDOWS\assembly 2006-12-26 14:40 d——– C:\WINDOWS\Microsoft.NET 2006-12-25 06:05 d——– C:\Program Files\ffdshow 2006-12-25 04:51 36,528 ——— C:\WINDOWS\system32\drivers\PxHelp20.sys 2006-12-25 04:51 129,784 ——— C:\WINDOWS\system32\pxafs.dll 2006-12-25 04:51 115,880 ——— C:\WINDOWS\system32\pxinsi64.exe 2006-12-25 04:50 d——– C:\Program Files\Winamp 2006-12-25 00:06 d——– C:\Documents and Settings\Si\Application Data\Ahead 2006-12-25 00:02 d——– C:\Program Files\Nero 2006-12-25 00:02 d——– C:\Program Files\Common Files\Ahead 2006-12-24 22:07 d——– C:\Program Files\Common Files\LightScribe 2006-12-24 22:03 40,960 –a—— C:\Program Files\Uninstall_CDS.exe 2006-12-24 22:03 d——– C:\Program Files\CyberLink DVD Solution 2006-12-24 11:22 25,856 –a—— C:\WINDOWS\system32\drivers\usbprint.sys 2006-12-24 11:16 d——– C:\Program Files\EPSON 2006-12-24 11:15 d——– C:\epson 2006-12-23 17:26 d——– C:\Program Files\Intel 2006-12-23 17:24 d——– C:\WINDOWS\system32\ReinstallBackups 2006-12-23 16:25 24,064 –a—— C:\WINDOWS\system32\IntelNic.dll 2006-12-23 16:25 154,112 –a—— C:\WINDOWS\system32\drivers\e100b325.sys 2006-12-23 16:25 12,288 –a—— C:\WINDOWS\system32\e100bmsg.dll 2006-12-23 16:25 118,784 –a—— C:\WINDOWS\system32\Prounstl.exe 2006-12-23 16:25 d——– C:\drvrtmp 2006-12-23 12:11 45,568 –a—— C:\WINDOWS\UniFish3.exe 2006-12-20 22:24 38,016 –a—— C:\WINDOWS\system32\drivers\bthmodem.sys 2006-12-20 22:24 d–hs—- C:\Documents and Settings\Si\Phone Browser 2006-12-20 22:17 d——– C:\Documents and Settings\Si\Application Data\Nokia 2006-12-20 22:17 d——– C:\Documents and Settings\All Users\Application Data\PC Suite 2006-12-20 22:15 d——– C:\Program Files\DIFX 2006-12-20 22:15 d——– C:\Program Files\Common Files\PCSuite 2006-12-20 22:15 d——– C:\Program Files\Common Files\Nokia 2006-12-20 22:15 d——– C:\Documents and Settings\Si\Application Data\PC Suite 2006-12-20 22:14 d——– C:\Program Files\PC Connectivity Solution 2006-12-20 22:13 50,688 –a—— C:\WINDOWS\system32\nmwcdcls.dll 2006-12-20 22:13 d——– C:\Program Files\Nokia 2006-12-20 20:59 d——– C:\Program Files\DVD Decrypter 2006-12-19 20:37 765,952 –a—— C:\WINDOWS\system32\xvidcore.dll 2006-12-19 20:37 d——– C:\Program Files\K-Lite Codec Pack 2006-12-19 20:28 d——– C:\Program Files\LimeWire 2006-12-19 00:09 d——– C:\Program Files\NCH Swift Sound 2006-12-18 18:36 5,632 –a—— C:\WINDOWS\system32\drivers\motswch.sys 2006-12-18 18:36 40,960 –a—— C:\WINDOWS\system32\drivers\P2k.sys 2006-12-17 18:09 d——– C:\WINDOWS\Minidump 2006-12-17 17:55 d——– C:\Program Files\Motorola 2006-12-17 17:31 d——– C:\Program Files\LiveUpdate 2006-12-17 17:28 25,600 –a—— C:\WINDOWS\system32\drivers\usbser.sys 2006-12-17 17:28 d——– C:\Program Files\mobile PhoneTools 2006-12-17 17:28 d——– C:\Documents and Settings\All Users\Application Data\BVRP Software 2006-12-16 15:25 d——– C:\Documents and Settings\Si\Application Data\Apple Computer 2006-12-16 15:24 d——– C:\Program Files\iTunes 2006-12-16 15:24 d——– C:\Program Files\iPod 2006-12-16 15:22 d——– C:\Program Files\QuickTime 2006-12-16 15:22 d——– C:\Program Files\Apple Software Update 2006-12-16 15:21 d——– C:\Documents and Settings\All Users\Application Data\Apple Computer 2006-12-16 11:32 d——– C:\Program Files\Windows Live Safety Center 2006-12-16 09:57 d——– C:\WINDOWS\Sun 2006-12-16 09:57 d——– C:\Documents and Settings\Si\Application Data\Sun 2006-12-16 09:30 d——– C:\WINDOWS\CAVTemp 2006-12-15 19:06 d——– C:\Documents and Settings\Si\Incomplete 2006-12-15 19:03 d——– C:\Documents and Settings\Si\.limewire 2006-12-15 19:01 d——– C:\Program Files\Java 2006-12-15 18:59 d——– C:\Program Files\Common Files\Java 2006-12-14 21:49 d——– C:\Program Files\VirtualDJ2 2006-12-14 21:34 2,314,332 –a—— C:\WINDOWS\system32\LIBMMD.DLL 2006-12-13 23:30 d——– C:\Documents and Settings\Si\Application Data\Adobe 2006-12-13 23:30 d——– C:\Documents and Settings\All Users\Application Data\Adobe Systems 2006-12-13 23:23 d——– C:\Program Files\Common Files\Adobe Systems Shared 2006-12-13 23:21 d——– C:\Program Files\Common Files\Adobe 2006-12-13 23:21 d——– C:\Program Files\Adobe 2006-12-13 23:21 d——– C:\Documents and Settings\All Users\Application Data\Adobe 2006-12-13 21:40 348,160 –a—— C:\WINDOWS\system32\eSellerateEngine.dll 2006-12-13 21:40 d——– C:\Program Files\Acoustica MP3 Audio Mixer 2006-12-13 20:34 d——– C:\Program Files\FLVPlayer 2006-12-13 19:30 130,048 –a—— C:\WINDOWS\system32\SpoonUninstall.exe 2006-12-13 19:29 d——– C:\Program Files\Illustrate 2006-12-13 18:12 d——– C:\Program Files\Mozilla Firefox 2006-12-13 18:12 d——– C:\Documents and Settings\Si\Application Data\Mozilla 2006-12-12 19:03 d——– C:\Program Files\MP3 Player Utilities 3.57 2006-12-11 18:27 14,848 –a—— C:\WINDOWS\system32\BASSMOD.dll 2006-12-11 18:17 d——– C:\Program Files\Total Video Converter 2006-12-10 20:31 5,504 –a—— C:\WINDOWS\system32\drivers\MSTEE.sys 2006-12-10 20:31 15,360 –a—— C:\WINDOWS\system32\drivers\StreamIP.sys 2006-12-10 20:31 10,880 –a—— C:\WINDOWS\system32\drivers\NdisIP.sys 2006-12-10 20:30 85,376 –a—— C:\WINDOWS\system32\drivers\NABTSFEC.sys 2006-12-10 20:30 19,328 –a—— C:\WINDOWS\system32\drivers\WSTCODEC.SYS 2006-12-10 20:30 17,024 –a—— C:\WINDOWS\system32\drivers\CCDECODE.sys 2006-12-10 20:30 11,136 –a—— C:\WINDOWS\system32\drivers\SLIP.sys 2006-12-10 20:22 73,728 –a—— C:\WINDOWS\system32\drivers\cwApi32.dll 2006-12-10 20:22 65,536 –a—— C:\WINDOWS\system32\drivers\cwTwds32.dll 2006-12-10 20:22 53,760 –a—— C:\WINDOWS\system32\vfwwdm32.dll 2006-12-10 20:22 53,248 –a—— C:\WINDOWS\system32\drivers\cwUi32.dll 2006-12-10 20:22 40,960 –a—— C:\WINDOWS\system32\drivers\cwBmp32.dll 2006-12-10 20:22 36,864 –a—— C:\WINDOWS\system32\drivers\cwTiff32.dll 2006-12-10 20:22 153,355 –a—— C:\WINDOWS\system32\drivers\DGMAX50V.SYS 2006-12-10 20:22 12,277 –a—— C:\WINDOWS\system32\drivers\DGMAX50B.SYS 2006-12-10 17:51 135,168 –a—— C:\WINDOWS\system32\igfxres.dll 2006-12-10 15:55 d——– C:\WINDOWS\system32\PreInstall 2006-12-10 15:53 11,264 –a—— C:\WINDOWS\system32\SpOrder.dll 2006-12-10 15:53 d——– C:\WINDOWS\system32\ZoneLabs 2006-12-10 15:52 d——– C:\WINDOWS\Internet Logs 2006-12-10 15:50 d——– C:\Program Files\WinRAR 2006-12-10 14:54 d——– C:\Program Files\GameSpy Arcade 2006-12-10 14:16 d–h—– C:\WINDOWS\PIF 2006-12-10 13:59 d——– C:\WINDOWS\system32\SoftwareDistribution 2006-12-10 13:46 d——– C:\Documents and Settings\Si\Application Data\Symantec 2006-12-10 13:42 48,776 –a—— C:\WINDOWS\system32\S32EVNT1.DLL 2006-12-10 13:42 115,000 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2006-12-10 13:42 10,344 –a—— C:\WINDOWS\system32\drivers\symlcbrd.sys 2006-12-10 13:42 d——– C:\Program Files\Symantec 2006-12-10 13:42 d——– C:\Program Files\Norton AntiVirus 2006-12-10 13:42 d——– C:\Documents and Settings\All Users\Application Data\Symantec 2006-12-10 13:41 d——– C:\Program Files\Common Files\Symantec Shared 2006-12-10 13:31 d——– C:\Program Files\Trustix 2006-12-10 13:30 d——– C:\Documents and Settings\Si\Application Data\Comodo 2006-12-10 13:30 d——– C:\Documents and Settings\All Users\Application Data\Comodo 2006-12-10 13:19 d——– C:\Program Files\Spybot - Search & Destroy 2006-12-10 13:19 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2006-12-10 13:18 d——– C:\Program Files\Comodo 2006-12-10 12:45 d——– C:\Documents and Settings\Si\Application Data\Macromedia 2006-12-10 12:08 d——– C:\WINDOWS\WBEM 2006-12-10 12:08 d——– C:\WINDOWS\system32\en-US 2006-12-10 12:06 d–h-c— C:\WINDOWS\ie7 2006-12-10 12:05 121,856 ——— C:\WINDOWS\system32\xmllite.dll 2006-12-10 11:30 d——– C:\Program Files\EA Games 2006-12-10 10:58 d——– C:\Program Files\Opera 2006-12-10 10:58 d——– C:\Documents and Settings\Si\Application Data\Opera 2006-12-10 10:49 d——– C:\Program Files\Windows Media Connect 2 2006-12-10 10:48 23,856 –a—— C:\WINDOWS\system32\spupdsvc.exe 2006-12-10 10:48 d——– C:\WINDOWS\system32\LogFiles 2006-12-10 10:48 d——– C:\WINDOWS\system32\drivers\UMDF 2006-12-10 10:47 d——– C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage 2006-12-10 10:45 8,704 –a—— C:\WINDOWS\system32\kbdjpn.dll 2006-12-10 10:45 8,192 –a—— C:\WINDOWS\system32\kbdkor.dll 2006-12-10 10:45 6,144 –a—— C:\WINDOWS\system32\kbd106.dll 2006-12-10 10:45 6,144 –a—— C:\WINDOWS\system32\kbd101c.dll 2006-12-10 10:45 6,144 –a—— C:\WINDOWS\system32\kbd101b.dll 2006-12-10 10:45 5,632 –a—— C:\WINDOWS\system32\kbd103.dll 2006-12-10 10:38 d——– C:\Documents and Settings\Si\Contacts 2006-12-10 10:35 d—-c— C:\WINDOWS\system32\DRVSTORE 2006-12-10 10:34 d——– C:\Program Files\MSN Messenger 2006-12-10 10:31 94,208 –a—— C:\WINDOWS\system32\GTW32N50.dll 2006-12-10 10:31 40,960 –a—— C:\WINDOWS\system32\B11gUSB.dll 2006-12-10 10:31 232,192 –a—— C:\WINDOWS\system32\drivers\rt73.sys 2006-12-10 10:31 15,872 –a—— C:\WINDOWS\system32\GTNDIS5.sys 2006-12-10 10:31 d——– C:\Program Files\Belkin 2006-12-10 09:58 4,272 -ra—— C:\WINDOWS\system32\drivers\bvrp_pci.sys 2006-12-10 09:51 d——– C:\Program Files\BT Business Broadband 2006-12-10 09:47 368,912 –a—— C:\WINDOWS\system32\vbar332.dll 2006-12-10 09:34 d——– C:\Program Files\54M Wireless Adapter 2006-12-10 09:31 77,824 –a—— C:\WINDOWS\system32\athcfg11res.dll 2006-12-10 09:31 463,168 –a—— C:\WINDOWS\system32\ar5211.sys 2006-12-10 09:31 385,024 –a—— C:\WINDOWS\system32\athcfg11.dll 2006-12-10 09:31 36,864 –a—— C:\WINDOWS\system32\acs.exe 2006-12-10 09:31 249,856 –a—— C:\WINDOWS\system32\wgapi.dll 2006-12-10 09:31 237,568 –a—— C:\WINDOWS\system32\wcapi.dll 2006-12-10 09:31 20,747 –a—— C:\WINDOWS\system32\drivers\AegisP.sys 2006-12-10 09:31 192,512 –a—— C:\WINDOWS\system32\AegisI5.exe 2006-12-10 09:31 1,396,835 –a—— C:\WINDOWS\system32\AegisE5.dll 2006-12-10 09:31 d–h—– C:\Program Files\InstallShield Installation Information 2006-12-10 09:31 d——– C:\Program Files\Wireless 2006-12-10 09:30 d——– C:\temp 2006-12-10 09:30 d——– C:\Program Files\Common Files\InstallShield 2006-12-10 09:05 17,920 –a—— C:\WINDOWS\system32\mdimon.dll 2006-12-10 09:04 d——– C:\WINDOWS\SHELLNEW 2006-12-10 09:04 d——– C:\Program Files\Microsoft Office 2006-12-10 09:04 d——– C:\Program Files\Microsoft ActiveSync 2006-12-10 09:04 d——– C:\Program Files\Common Files\DESIGNER 2006-12-10 09:01 dr-h—– C:\MSOCache 2006-12-10 01:14 d——– C:\WINDOWS\pss 2006-12-10 01:10 d–hs—- C:\RECYCLER 2006-12-10 01:04 d——– C:\Documents and Settings\Si\Application Data\Identities 2006-12-10 01:03 dr-h—– C:\Documents and Settings\Si\SendTo 2006-12-10 01:03 dr-h—– C:\Documents and Settings\Si\Recent 2006-12-10 01:03 dr-h—– C:\Documents and Settings\Si\Application Data\. 2006-12-10 01:03 dr-h—– C:\Documents and Settings\Si\Application Data 2006-12-10 01:03 dr——- C:\Documents and Settings\Si\Start Menu 2006-12-10 01:03 dr——- C:\Documents and Settings\Si\My Documents 2006-12-10 01:03 dr——- C:\Documents and Settings\Si\Favorites 2006-12-10 01:03 d–hs—- C:\Documents and Settings\Si\Cookies 2006-12-10 01:03 d–h—– C:\Program Files\Uninstall Information 2006-12-10 01:03 d–h—– C:\Documents and Settings\Si\Templates 2006-12-10 01:03 d–h—– C:\Documents and Settings\Si\PrintHood 2006-12-10 01:03 d–h—– C:\Documents and Settings\Si\NetHood 2006-12-10 01:03 d–h—– C:\Documents and Settings\Si\Local Settings 2006-12-10 01:03 d—s—- C:\Documents and Settings\Si\Application Data\Microsoft 2006-12-10 01:03 d——– C:\Documents and Settings\Si\Desktop 2006-12-10 01:03 d——– C:\Documents and Settings\Si\Application Data\.. 2006-12-10 01:03 d——– C:\Documents and Settings\Si\.. 2006-12-10 01:03 d——– C:\Documents and Settings\Si\. 2006-12-10 01:02 d——– C:\WINDOWS\SoftwareDistribution 2006-12-10 01:02 d——– C:\WINDOWS\Prefetch 2006-12-10 01:01 d—s—- C:\WINDOWS\system32\Microsoft 2006-12-10 00:58 0 -rahs—- C:\MSDOS.SYS 2006-12-10 00:58 0 -rahs—- C:\IO.SYS 2006-12-10 00:58 0 –a—— C:\CONFIG.SYS 2006-12-10 00:58 0 –a—— C:\AUTOEXEC.BAT 2006-12-10 00:58 d–h—– C:\WINDOWS\$hf_mig$ 2006-12-10 00:58 d——– C:\WINDOWS\system32\xircom 2006-12-10 00:58 d——– C:\Program Files\xerox 2006-12-10 00:58 d——– C:\Program Files\microsoft frontpage 2006-12-10 00:58 d——– C:\DELL 2006-12-10 00:57 112,128 –a—— C:\WINDOWS\system32\mapi32.dll 2006-12-10 00:57 d–hs—- C:\Documents and Settings\All Users\DRM 2006-12-10 00:56 64,512 –a—— C:\WINDOWS\system32\acctres.dll 2006-12-10 00:56 16,384 –a—— C:\WINDOWS\system32\icfgnt5.dll 2006-12-10 00:56 12,288 –a—— C:\WINDOWS\system32\nmevtmsg.dll 2006-12-10 00:56 11,264 –a—— C:\WINDOWS\system32\atrace.dll 2006-12-10 00:56 dr——- C:\WINDOWS\Offline Web Pages 2006-12-10 00:56 d–h—– C:\Program Files\WindowsUpdate 2006-12-10 00:56 d—s—- C:\WINDOWS\Tasks 2006-12-10 00:56 d—s—- C:\WINDOWS\Downloaded Program Files 2006-12-10 00:56 d——– C:\WINDOWS\system32\DirectX 2006-12-10 00:56 d——– C:\Program Files\Common Files\Services 2006-12-10 00:56 d——– C:\Program Files\Common Files\MSSoap 2006-12-10 00:55 81,920 –a—— C:\WINDOWS\system32\isign32.dll 2006-12-10 00:55 81,920 –a—— C:\WINDOWS\system32\ils.dll 2006-12-10 00:55 8,192 –a—— C:\WINDOWS\system32\bitsprx2.dll 2006-12-10 00:55 73,728 –a—— C:\WINDOWS\system32\icwdial.dll 2006-12-10 00:55 73,472 –a—— C:\WINDOWS\system32\drivers\sr.sys 2006-12-10 00:55 7,168 –a—— C:\WINDOWS\system32\bitsprx3.dll 2006-12-10 00:55 69,632 –a—— C:\WINDOWS\system32\msconf.dll 2006-12-10 00:55 679,424 –a—— C:\WINDOWS\system32\inetcomm.dll 2006-12-10 00:55 67,584 –a—— C:\WINDOWS\system32\srclient.dll 2006-12-10 00:55 65,536 –a—— C:\WINDOWS\system32\icwphbk.dll 2006-12-10 00:55 6,656 –a—— C:\WINDOWS\system32\wuauserv.dll 2006-12-10 00:55 48,128 –a—— C:\WINDOWS\system32\inetres.dll 2006-12-10 00:55 465,176 –a—— C:\WINDOWS\system32\wuapi.dll 2006-12-10 00:55 45,568 –a—— C:\WINDOWS\system32\safrslv.dll 2006-12-10 00:55 43,520 –a—— C:\WINDOWS\system32\safrcdlg.dll 2006-12-10 00:55 43,520 –a—— C:\WINDOWS\system32\racpldlg.dll 2006-12-10 00:55 41,240 –a—— C:\WINDOWS\system32\wups.dll 2006-12-10 00:55 382,464 –a—— C:\WINDOWS\system32\qmgr.dll 2006-12-10 00:55 34,560 –a—— C:\WINDOWS\system32\mnmdd.dll 2006-12-10 00:55 32,768 –a—— C:\WINDOWS\system32\mnmsrvc.exe 2006-12-10 00:55 32,768 –a—— C:\WINDOWS\system32\isrdbg32.dll 2006-12-10 00:55 29,696 –a—— C:\WINDOWS\system32\safrdm.dll 2006-12-10 00:55 28,672 –a—— C:\WINDOWS\system32\nmmkcert.dll 2006-12-10 00:55 274,944 –a—— C:\WINDOWS\system32\mstask.dll 2006-12-10 00:55 274,432 –a—— C:\WINDOWS\system32\inetcfg.dll 2006-12-10 00:55 252,928 –a—— C:\WINDOWS\system32\msoeacct.dll 2006-12-10 00:55 239,104 –a—— C:\WINDOWS\system32\srrstr.dll 2006-12-10 00:55 23,040 –a—— C:\WINDOWS\system32\fltmc.exe 2006-12-10 00:55 194,328 –a—— C:\WINDOWS\system32\wuaueng1.dll 2006-12-10 00:55 190,976 –a—— C:\WINDOWS\system32\schedsvc.dll 2006-12-10 00:55 18,944 –a—— C:\WINDOWS\system32\qmgrprxy.dll 2006-12-10 00:55 173,536 –a—— C:\WINDOWS\system32\wuweb.dll 2006-12-10 00:55 172,312 –a—— C:\WINDOWS\system32\wuauclt1.exe 2006-12-10 00:55 170,496 –a—— C:\WINDOWS\system32\srsvc.dll 2006-12-10 00:55 16,896 –a—— C:\WINDOWS\system32\fltlib.dll 2006-12-10 00:55 128,896 –a—— C:\WINDOWS\system32\drivers\fltmgr.sys 2006-12-10 00:55 127,256 –a—— C:\WINDOWS\system32\wucltui.dll 2006-12-10 00:55 124,184 –a—— C:\WINDOWS\system32\wuauclt.exe 2006-12-10 00:55 12,288 –a—— C:\WINDOWS\system32\mstinit.exe 2006-12-10 00:55 105,984 –a—— C:\WINDOWS\system32\msoert2.dll 2006-12-10 00:55 1,343,768 –a—— C:\WINDOWS\system32\wuaueng.dll 2006-12-10 00:55 d——– C:\WINDOWS\system32\Restore 2006-12-10 00:55 d——– C:\WINDOWS\system32\Macromed 2006-12-10 00:55 d——– C:\WINDOWS\srchasst 2006-12-10 00:55 d——– C:\WINDOWS\Registration 2006-12-10 00:55 d——– C:\Program Files\Outlook Express 2006-12-10 00:55 d——– C:\Program Files\NetMeeting 2006-12-10 00:55 d——– C:\Program Files\Movie Maker 2006-12-10 00:55 d——– C:\Program Files\Internet Explorer 2006-12-10 00:55 d——– C:\Program Files\ComPlus Applications 2006-12-10 00:55 d——– C:\Program Files\Common Files\System 2006-12-10 00:54 97,792 –a—— C:\WINDOWS\system32\comrepl.dll 2006-12-10 00:54 93,696 –a—— C:\WINDOWS\system32\tscfgwmi.dll 2006-12-10 00:54 9,728 –a—— C:\WINDOWS\system32\reset.exe 2006-12-10 00:54 87,176 –a—— C:\WINDOWS\system32\rdpwsx.dll 2006-12-10 00:54 80,384 –a—— C:\WINDOWS\system32\charmap.exe 2006-12-10 00:54 73,216 –a—— C:\WINDOWS\system32\avwav.dll 2006-12-10 00:54 67,072 –a—— C:\WINDOWS\system32\rdshost.exe 2006-12-10 00:54 655,360 –a—— C:\WINDOWS\system32\mstscax.dll 2006-12-10 00:54 62,464 –a—— C:\WINDOWS\system32\rdpclip.exe 2006-12-10 00:54 605,696 –a—— C:\WINDOWS\system32\getuname.dll 2006-12-10 00:54 60,416 –a—— C:\WINDOWS\system32\remotepg.dll 2006-12-10 00:54 56,832 –a—— C:\WINDOWS\system32\sol.exe 2006-12-10 00:54 55,296 –a—— C:\WINDOWS\system32\freecell.exe 2006-12-10 00:54 54,272 –a—— C:\WINDOWS\system32\stclient.dll 2006-12-10 00:54 538,624 –a—— C:\WINDOWS\system32\spider.exe 2006-12-10 00:54 5,632 –a—— C:\WINDOWS\system32\write.exe 2006-12-10 00:54 5,120 –a—— C:\WINDOWS\system32\dcomcnfg.exe 2006-12-10 00:54 44,544 –a—— C:\WINDOWS\system32\tscupgrd.exe 2006-12-10 00:54 44,544 –a—— C:\WINDOWS\system32\hticons.dll 2006-12-10 00:54 407,552 –a—— C:\WINDOWS\system32\mstsc.exe 2006-12-10 00:54 4,096 –a—— C:\WINDOWS\system32\rdpcfgex.dll 2006-12-10 00:54 4,096 –a—— C:\WINDOWS\system32\mtxex.dll 2006-12-10 00:54 38,912 –a—— C:\WINDOWS\system32\cfgbkend.dll 2006-12-10 00:54 35,328 –a—— C:\WINDOWS\system32\winchat.exe 2006-12-10 00:54 347,136 –a—— C:\WINDOWS\system32\hypertrm.dll 2006-12-10 00:54 343,040 –a—— C:\WINDOWS\system32\mspaint.exe 2006-12-10 00:54 33,792 –a—— C:\WINDOWS\system32\regini.exe 2006-12-10 00:54 295,424 –a—— C:\WINDOWS\system32\termsrv.dll 2006-12-10 00:54 25,600 –a—— C:\WINDOWS\system32\comaddin.dll 2006-12-10 00:54 25,088 –a—— C:\WINDOWS\system32\mtxlegih.dll 2006-12-10 00:54 227,840 –a—— C:\WINDOWS\system32\avtapi.dll 2006-12-10 00:54 22,016 –a—— C:\WINDOWS\system32\qwinsta.exe 2006-12-10 00:54 21,896 –a—— C:\WINDOWS\system32\drivers\tdtcp.sys 2006-12-10 00:54 20,992 –a—— C:\WINDOWS\system32\msg.exe 2006-12-10 00:54 20,480 –a—— C:\WINDOWS\system32\qprocess.exe 2006-12-10 00:54 20,480 –a—— C:\WINDOWS\system32\mtxdm.dll 2006-12-10 00:54 19,968 –a—— C:\WINDOWS\system32\rdpsnd.dll 2006-12-10 00:54 183,808 –a—— C:\WINDOWS\system32\accwiz.exe 2006-12-10 00:54 16,896 –a—— C:\WINDOWS\system32\tsshutdn.exe 2006-12-10 00:54 16,896 –a—— C:\WINDOWS\system32\qappsrv.exe 2006-12-10 00:54 16,384 –a—— C:\WINDOWS\system32\tskill.exe 2006-12-10 00:54 16,384 –a—— C:\WINDOWS\system32\avmeter.dll 2006-12-10 00:54 15,872 –a—— C:\WINDOWS\system32\rwinsta.exe 2006-12-10 00:54 15,872 –a—— C:\WINDOWS\system32\cdmodem.dll 2006-12-10 00:54 15,360 –a—— C:\WINDOWS\system32\logoff.exe 2006-12-10 00:54 147,968 –a—— C:\WINDOWS\system32\rdchost.dll 2006-12-10 00:54 147,456 –a—— C:\WINDOWS\system32\comsnap.dll 2006-12-10 00:54 140,800 –a—— C:\WINDOWS\system32\sessmgr.exe 2006-12-10 00:54 14,848 –a—— C:\WINDOWS\system32\tsdiscon.exe 2006-12-10 00:54 14,848 –a—— C:\WINDOWS\system32\tscon.exe 2006-12-10 00:54 14,848 –a—— C:\WINDOWS\system32\shadow.exe 2006-12-10 00:54 139,528 –a—— C:\WINDOWS\system32\drivers\rdpwd.sys 2006-12-10 00:54 138,752 –a—— C:\WINDOWS\system32\sndvol32.exe 2006-12-10 00:54 131,584 –a—— C:\WINDOWS\system32\sndrec32.exe 2006-12-10 00:54 13,824 –a—— C:\WINDOWS\system32\rdsaddin.exe 2006-12-10 00:54 126,976 –a—— C:\WINDOWS\system32\mshearts.exe 2006-12-10 00:54 123,392 –a—— C:\WINDOWS\system32\mplay32.exe 2006-12-10 00:54 12,040 –a—— C:\WINDOWS\system32\drivers\tdpipe.sys 2006-12-10 00:54 119,808 –a—— C:\WINDOWS\system32\winmine.exe 2006-12-10 00:54 114,688 –a—— C:\WINDOWS\system32\calc.exe 2006-12-10 00:54 11,264 –a—— C:\WINDOWS\system32\icaapi.dll 2006-12-10 00:54 102,912 –a—— C:\WINDOWS\system32\clipbrd.exe 2006-12-10 00:54 1,161 –a—— C:\WINDOWS\system32\usrlogon.cmd 2006-12-10 00:54 d——– C:\Program Files\Windows NT 2006-12-10 00:54 d——– C:\Program Files\Windows Media Player 2006-12-10 00:54 d——– C:\Program Files\Online Services 2006-12-10 00:54 d——– C:\Program Files\MSN Gaming Zone 2006-12-10 00:54 d——– C:\Program Files\MSN 2006-12-10 00:54 d——– C:\Program Files\Messenger 2006-12-10 00:53 956,416 –a—— C:\WINDOWS\system32\msdtctm.dll 2006-12-10 00:53 91,136 –a—— C:\WINDOWS\system32\mtxoci.dll 2006-12-10 00:53 85,504 –a—— C:\WINDOWS\system32\catsrvps.dll 2006-12-10 00:53 625,152 –a—— C:\WINDOWS\system32\catsrvut.dll 2006-12-10 00:53 60,416 –a—— C:\WINDOWS\system32\colbact.dll 2006-12-10 00:53 6,144 –a—— C:\WINDOWS\system32\msdtc.exe 2006-12-10 00:53 58,880 –a—— C:\WINDOWS\system32\msdtclog.dll 2006-12-10 00:53 58,880 –a—— C:\WINDOWS\system32\licwmi.dll 2006-12-10 00:53 56,320 –a—— C:\WINDOWS\system32\servdeps.dll 2006-12-10 00:53 540,160 –a—— C:\WINDOWS\system32\comuid.dll 2006-12-10 00:53 498,688 –a—— C:\WINDOWS\system32\clbcatq.dll 2006-12-10 00:53 426,496 –a—— C:\WINDOWS\system32\msdtcprx.dll 2006-12-10 00:53 40,840 –a—— C:\WINDOWS\system32\drivers\termdd.sys 2006-12-10 00:53 225,792 –a—— C:\WINDOWS\system32\catsrv.dll 2006-12-10 00:53 196,864 –a—— C:\WINDOWS\system32\drivers\rdpdr.sys 2006-12-10 00:53 185,344 –a—— C:\WINDOWS\system32\cmprops.dll 2006-12-10 00:53 17,408 –a—— C:\WINDOWS\system32\mmfutil.dll 2006-12-10 00:53 161,280 –a—— C:\WINDOWS\system32\msdtcuiu.dll 2006-12-10 00:53 110,080 –a—— C:\WINDOWS\system32\clbcatex.dll 2006-12-10 00:53 11,776 –a—— C:\WINDOWS\system32\xolehlp.dll 2006-12-10 00:53 1,267,200 –a—— C:\WINDOWS\system32\comsvcs.dll 2006-12-10 00:53 d——– C:\WINDOWS\system32\MsDtc 2006-12-10 00:53 d——– C:\WINDOWS\system32\Com 2006-12-10 00:49 82,944 –a—— C:\WINDOWS\system32\drivers\wdmaud.sys 2006-12-10 00:49 7,552 –a—— C:\WINDOWS\system32\drivers\MSKSSRV.sys 2006-12-10 00:49 60,800 –a—— C:\WINDOWS\system32\drivers\sysaudio.sys 2006-12-10 00:49 6,400 –a—— C:\WINDOWS\system32\drivers\splitter.sys 2006-12-10 00:49 54,272 –a—— C:\WINDOWS\system32\drivers\swmidi.sys 2006-12-10 00:49 52,864 –a—— C:\WINDOWS\system32\drivers\DMusic.sys 2006-12-10 00:49 5,376 –a—— C:\WINDOWS\system32\drivers\MSPCLOCK.sys 2006-12-10 00:49 4,992 –a—— C:\WINDOWS\system32\drivers\MSPQM.sys 2006-12-10 00:49 3,072 –a—— C:\WINDOWS\system32\drivers\audstub.sys 2006-12-10 00:49 2,944 –a—— C:\WINDOWS\system32\drivers\drmkaud.sys 2006-12-10 00:49 172,416 –a—— C:\WINDOWS\system32\drivers\kmixer.sys 2006-12-10 00:49 142,464 –a—— C:\WINDOWS\system32\drivers\aec.sys 2006-12-10 00:48 98,304 –a—— C:\WINDOWS\system32\a3d.dll 2006-12-10 00:48 8,192 –a—— C:\WINDOWS\system32\wshirda.dll 2006-12-10 00:48 60,288 –a—— C:\WINDOWS\system32\drivers\drmk.sys 2006-12-10 00:48 59,648 –a—— C:\WINDOWS\system32\drivers\rfcomm.sys 2006-12-10 00:48 553,984 –a—— C:\WINDOWS\system32\drivers\adm8820.sys 2006-12-10 00:48 462,848 –a—— C:\WINDOWS\system32\a3dapi.dll 2006-12-10 00:48 4,096 –a—— C:\WINDOWS\system32\ksuser.dll 2006-12-10 00:48 274,304 –a—— C:\WINDOWS\system32\drivers\bthport.sys 2006-12-10 00:48 27,136 –a—— C:\WINDOWS\system32\irmon.dll 2006-12-10 00:48 18,944 –a—— C:\WINDOWS\system32\drivers\BTHUSB.SYS 2006-12-10 00:48 17,024 –a—— C:\WINDOWS\system32\drivers\BthEnum.sys 2006-12-10 00:48 152,576 –a—— C:\WINDOWS\system32\irftp.exe 2006-12-10 00:48 145,792 –a—— C:\WINDOWS\system32\drivers\portcls.sys 2006-12-10 00:48 100,992 –a—— C:\WINDOWS\system32\drivers\bthpan.sys 2006-12-10 00:48 10,880 –a—— C:\WINDOWS\system32\drivers\admjoy.sys 2006-12-10 00:47 57,472 –a—— C:\WINDOWS\system32\drivers\redbook.sys 2006-12-10 00:47 5,504 –a—— C:\WINDOWS\system32\drivers\intelide.sys 2006-12-10 00:47 4,527,488 –a—— C:\WINDOWS\system32\nv4_disp.dll 2006-12-10 00:46 74,240 –a—— C:\WINDOWS\system32\usbui.dll 2006-12-10 00:45 9,936 –a—— C:\WINDOWS\system\LZEXPAND.DLL 2006-12-10 00:45 9,008 –a—— C:\WINDOWS\system\VER.DLL 2006-12-10 00:45 85,020 –a—— C:\WINDOWS\system32\dgsetup.dll 2006-12-10 00:45 82,944 –a—— C:\WINDOWS\system\OLECLI.DLL 2006-12-10 00:45 8,704 –a—— C:\WINDOWS\system32\batt.dll 2006-12-10 00:45 8,192 -ra—— C:\WINDOWS\system32\kbdhept.dll 2006-12-10 00:45 74,752 –a—— C:\WINDOWS\system32\storprop.dll 2006-12-10 00:45 7,168 -ra—— C:\WINDOWS\system32\kbdcz.dll 2006-12-10 00:45 69,584 –a—— C:\WINDOWS\system\AVICAP.DLL 2006-12-10 00:45 69,120 –a—— C:\WINDOWS\NOTEPAD.EXE 2006-12-10 00:45 68,768 –a—— C:\WINDOWS\system\MMSYSTEM.DLL 2006-12-10 00:45 6,656 -ra—— C:\WINDOWS\system32\kbdycl.dll 2006-12-10 00:45 6,656 -ra—— C:\WINDOWS\system32\kbdsl1.dll 2006-12-10 00:45 6,656 -ra—— C:\WINDOWS\system32\kbdsl.dll 2006-12-10 00:45 6,656 -ra—— C:\WINDOWS\system32\kbdpl.dll 2006-12-10 00:45 6,656 -ra—— C:\WINDOWS\system32\kbdhu.dll 2006-12-10 00:45 6,656 -ra—— C:\WINDOWS\system32\kbdhela3.dll 2006-12-10 00:45 6,656 -ra—— C:\WINDOWS\system32\kbdcz2.dll 2006-12-10 00:45 6,656 -ra—— C:\WINDOWS\system32\kbdcz1.dll 2006-12-10 00:45 6,656 -ra—— C:\WINDOWS\system32\kbdcr.dll 2006-12-10 00:45 6,656 -ra—— C:\WINDOWS\system32\KBDAL.DLL 2006-12-10 00:45 6,144 -ra—— C:\WINDOWS\system32\kbdtuq.dll 2006-12-10 00:45 6,144 -ra—— C:\WINDOWS\system32\kbdtuf.dll 2006-12-10 00:45 6,144 -ra—— C:\WINDOWS\system32\kbdlv1.dll 2006-12-10 00:45 6,144 -ra—— C:\WINDOWS\system32\kbdlv.dll 2006-12-10 00:45 6,144 -ra—— C:\WINDOWS\system32\kbdhela2.dll 2006-12-10 00:45 6,144 -ra—— C:\WINDOWS\system32\kbdgkl.dll 2006-12-10 00:45 6,144 -ra—— C:\WINDOWS\system32\kbdest.dll 2006-12-10 00:45 5,632 -ra—— C:\WINDOWS\system32\kbdycc.dll 2006-12-10 00:45 5,632 -ra—— C:\WINDOWS\system32\kbduzb.dll 2006-12-10 00:45 5,632 -ra—— C:\WINDOWS\system32\kbdur.dll 2006-12-10 00:45 5,632 -ra—— C:\WINDOWS\system32\kbdtat.dll 2006-12-10 00:45 5,632 -ra—— C:\WINDOWS\system32\kbdru1.dll 2006-12-10 00:45 5,632 -ra—— C:\WINDOWS\system32\kbdru.dll 2006-12-10 00:45 5,632 -ra—— C:\WINDOWS\system32\kbdro.dll 2006-12-10 00:45 5,632 -ra—— C:\WINDOWS\system32\kbdpl1.dll 2006-12-10 00:45 5,632 -ra—— C:\WINDOWS\system32\kbdmon.dll 2006-12-10 00:45 5,632 -ra—— C:\WINDOWS\system32\kbdlt1.dll 2006-12-10 00:45 5,632 -ra—— C:\WINDOWS\system32\kbdlt.dll 2006-12-10 00:45 5,632 -ra—— C:\WINDOWS\system32\kbdkyr.dll 2006-12-10 00:45 5,632 -ra—— C:\WINDOWS\system32\kbdkaz.dll 2006-12-10 00:45 5,632 -ra—— C:\WINDOWS\system32\kbdhu1.dll 2006-12-10 00:45 5,632 -ra—— C:\WINDOWS\system32\kbdhe319.dll 2006-12-10 00:45 5,632 -ra—— C:\WINDOWS\system32\kbdhe220.dll 2006-12-10 00:45 5,632 -ra—— C:\WINDOWS\system32\kbdhe.dll 2006-12-10 00:45 5,632 -ra—— C:\WINDOWS\system32\kbdbu.dll 2006-12-10 00:45 5,632 -ra—— C:\WINDOWS\system32\kbdblr.dll 2006-12-10 00:45 5,632 -ra—— C:\WINDOWS\system32\kbdazel.dll 2006-12-10 00:45 5,632 -ra—— C:\WINDOWS\system32\kbdaze.dll 2006-12-10 00:45 5,120 –a—— C:\WINDOWS\system\SHELL.DLL 2006-12-10 00:45 32,816 –a—— C:\WINDOWS\system\COMMDLG.DLL 2006-12-10 00:45 24,661 –a—— C:\WINDOWS\system32\spxcoins.dll 2006-12-10 00:45 24,064 –a—— C:\WINDOWS\system\OLESVR.DLL 2006-12-10 00:45 19,200 –a—— C:\WINDOWS\system\TAPI.DLL 2006-12-10 00:45 176,157 –a—— C:\WINDOWS\system32\dgrpsetu.dll 2006-12-10 00:45 15,360 –a—— C:\WINDOWS\TASKMAN.EXE 2006-12-10 00:45 13,312 –a—— C:\WINDOWS\system32\irclass.dll 2006-12-10 00:45 126,912 –a—— C:\WINDOWS\system\MSVIDEO.DLL 2006-12-10 00:45 11,264 –a—— C:\WINDOWS\system32\drivers\irenum.sys 2006-12-10 00:45 109,456 –a—— C:\WINDOWS\system\AVIFILE.DLL 2006-12-10 00:45 103,424 –a—— C:\WINDOWS\system32\EqnClass.Dll 2006-12-10 00:45 dr-h—– C:\Documents and Settings\All Users\Application Data\. 2006-12-10 00:45 dr-h—– C:\Documents and Settings\All Users\Application Data 2006-12-10 00:45 dr——- C:\Program Files\Common Files\.. 2006-12-10 00:45 dr——- C:\Program Files\. 2006-12-10 00:45 dr——- C:\Program Files 2006-12-10 00:45 dr——- C:\Documents and Settings\All Users\Start Menu 2006-12-10 00:45 dr——- C:\Documents and Settings\All Users\Documents 2006-12-10 00:45 d–hs—- C:\WINDOWS\Installer 2006-12-10 00:45 d–hs—- C:\Program Files\.. 2006-12-10 00:45 d–h—– C:\Documents and Settings\All Users\Templates 2006-12-10 00:45 d—s—- C:\Documents and Settings\All Users\Application Data\Microsoft 2006-12-10 00:45 d——– C:\WINDOWS\system32\CatRoot2 2006-12-10 00:45 d——– C:\WINDOWS\system32\CatRoot 2006-12-10 00:45 d——– C:\Program Files\Common Files\SpeechEngines 2006-12-10 00:45 d——– C:\Program Files\Common Files\ODBC 2006-12-10 00:45 d——– C:\Program Files\Common Files\Microsoft Shared 2006-12-10 00:45 d——– C:\Program Files\Common Files\. 2006-12-10 00:45 d——– C:\Program Files\Common Files 2006-12-10 00:45 d——– C:\Documents and Settings\All Users\Favorites 2006-12-10 00:45 d——– C:\Documents and Settings\All Users\Desktop 2006-12-10 00:45 d——– C:\Documents and Settings\All Users\Application Data\.. 2006-12-10 00:44 d–hs—- C:\System Volume Information 2006-12-10 00:44 d——– C:\Documents and Settings\All Users\.. 2006-12-10 00:44 d——– C:\Documents and Settings\All Users\. 2006-12-10 00:44 d——– C:\Documents and Settings 2006-12-10 00:32 dr-hsc— C:\WINDOWS\system32\dllcache 2006-12-10 00:32 dr–s—- C:\WINDOWS\Fonts 2006-12-10 00:32 dr——- C:\WINDOWS\Web 2006-12-10 00:32 d–hs—- C:\WINDOWS\.. 2006-12-10 00:32 d–h—– C:\WINDOWS\inf 2006-12-10 00:32 d——– C:\WINDOWS\WinSxS 2006-12-10 00:32 d——– C:\WINDOWS\twain_32 2006-12-10 00:32 d——– C:\WINDOWS\Temp 2006-12-10 00:32 d——– C:\WINDOWS\system32\wins 2006-12-10 00:32 d——– C:\WINDOWS\system32\wbem 2006-12-10 00:32 d——– C:\WINDOWS\system32\usmt 2006-12-10 00:32 d——– C:\WINDOWS\system32\spool 2006-12-10 00:32 d——– C:\WINDOWS\system32\ShellExt 2006-12-10 00:32 d——– C:\WINDOWS\system32\Setup 2006-12-10 00:32 d——– C:\WINDOWS\system32\ras 2006-12-10 00:32 d——– C:\WINDOWS\system32\oobe 2006-12-10 00:32 d——– C:\WINDOWS\system32\npp 2006-12-10 00:32 d——– C:\WINDOWS\system32\mui 2006-12-10 00:32 d——– C:\WINDOWS\system32\inetsrv 2006-12-10 00:32 d——– C:\WINDOWS\system32\IME 2006-12-10 00:32 d——– C:\WINDOWS\system32\icsxml 2006-12-10 00:32 d——– C:\WINDOWS\system32\ias 2006-12-10 00:32 d——– C:\WINDOWS\system32\export 2006-12-10 00:32 d——– C:\WINDOWS\system32\drivers\etc 2006-12-10 00:32 d——– C:\WINDOWS\system32\drivers\disdn 2006-12-10 00:32 d——– C:\WINDOWS\system32\drivers\.. 2006-12-10 00:32 d——– C:\WINDOWS\system32\drivers\. 2006-12-10 00:32 d——– C:\WINDOWS\system32\drivers 2006-12-10 00:32 d——– C:\WINDOWS\system32\dhcp 2006-12-10 00:32 d——– C:\WINDOWS\system32\config 2006-12-10 00:32 d——– C:\WINDOWS\system32\3com_dmi 2006-12-10 00:32 d——– C:\WINDOWS\system32\3076 2006-12-10 00:32 d——– C:\WINDOWS\system32\2052 2006-12-10 00:32 d——– C:\WINDOWS\system32\1054 2006-12-10 00:32 d——– C:\WINDOWS\system32\1042 2006-12-10 00:32 d——– C:\WINDOWS\system32\1041 2006-12-10 00:32 d——– C:\WINDOWS\system32\1037 2006-12-10 00:32 d——– C:\WINDOWS\system32\1033 2006-12-10 00:32 d——– C:\WINDOWS\system32\1031 2006-12-10 00:32 d——– C:\WINDOWS\system32\1028 2006-12-10 00:32 d——– C:\WINDOWS\system32\1025 2006-12-10 00:32 d——– C:\WINDOWS\system32\.. 2006-12-10 00:32 d——– C:\WINDOWS\system32\. 2006-12-10 00:32 d——– C:\WINDOWS\system32 2006-12-10 00:32 d——– C:\WINDOWS\system\.. 2006-12-10 00:32 d——– C:\WINDOWS\system\. 2006-12-10 00:32 d——– C:\WINDOWS\system 2006-12-10 00:32 d——– C:\WINDOWS\security 2006-12-10 00:32 d——– C:\WINDOWS\Resources 2006-12-10 00:32 d——– C:\WINDOWS\repair 2006-12-10 00:32 d——– C:\WINDOWS\Provisioning 2006-12-10 00:32 d——– C:\WINDOWS\PeerNet 2006-12-10 00:32 d——– C:\WINDOWS\pchealth 2006-12-10 00:32 d——– C:\WINDOWS\mui 2006-12-10 00:32 d——– C:\WINDOWS\msapps 2006-12-10 00:32 d——– C:\WINDOWS\msagent 2006-12-10 00:32 d——– C:\WINDOWS\Media 2006-12-10 00:32 d——– C:\WINDOWS\java 2006-12-10 00:32 d——– C:\WINDOWS\ime 2006-12-10 00:32 d——– C:\WINDOWS\Help 2006-12-10 00:32 d——– C:\WINDOWS\Driver Cache 2006-12-10 00:32 d——– C:\WINDOWS\dell 2006-12-10 00:32 d——– C:\WINDOWS\Debug 2006-12-10 00:32 d——– C:\WINDOWS\Cursors 2006-12-10 00:32 d——– C:\WINDOWS\Connection Wizard 2006-12-10 00:32 d——– C:\WINDOWS\Config 2006-12-10 00:32 d——– C:\WINDOWS\AppPatch 2006-12-10 00:32 d——– C:\WINDOWS\addins 2006-12-10 00:32 d——– C:\WINDOWS\. 2006-12-10 00:32 d——– C:\WINDOWS (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"C:\\Program Files\\Common Files\\Ahead\\Lib\\NMBgMonitor.exe\"" "STYLEXP"="C:\\Program Files\\TGTSoft\\StyleXP\\StyleXP.exe -Hide" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "BluetoothAuthenticationAgent"="rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent" "TWCU"="\"C:\\Program Files\\Wireless\\TWCU\\TWCU.exe\" -nogui" "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "igfxtray"="C:\\WINDOWS\\system32\\igfxtray.exe" "igfxhkcmd"="C:\\WINDOWS\\system32\\hkcmd.exe" "igfxpers"="C:\\WINDOWS\\system32\\igfxpers.exe" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "PCSuiteTrayApplication"="C:\\Program Files\\Nokia\\Nokia PC Suite 6\\LaunchApplication.exe -startup" "EPSON Stylus C86 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S4I2R1.EXE /P23 \"EPSON Stylus C86 Series\" /O5 \"LPT1:\" /M \"Stylus C86\"" "EPSON Stylus C86 Series (Copy 1)"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S4I2R1.EXE /P32 \"EPSON Stylus C86 Series (Copy 1)\" /O6 \"USB001\" /M \"Stylus C86\"" "NeroFilterCheck"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe" "WinampAgent"="C:\\Program Files\\Winamp\\winampa.exe" "MessengerPlus3"="\"C:\\Program Files\\MessengerPlus! 3\\MsgPlus.exe\"" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit" "RoxioDragToDisc"="\"C:\\Program Files\\Roxio\\Easy Media Creator 8\\Drag to Disc\\DrgToDsc.exe\"" @="" "RoxWatchTray"="\"C:\\Program Files\\Common Files\\Roxio Shared\\SharedCOM8\\RoxWatchTray.exe\"" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,d4,01,00,00,00,00,00,00,2c,02,00,00,e2,02,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\ 00,00,01,00,00,00 [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" "PcSync"="C:\\Program Files\\Nokia\\Nokia PC Suite 6\\PcSync2.exe /NoDialog" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" "PcSync"="C:\\Program Files\\Nokia\\Nokia PC Suite 6\\PcSync2.exe /NoDialog" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{2771D8F7-933D-4D4E-B79F-DEF857511A82}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" "WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebca HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\opnlmli HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winghy32 [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\AppleSoftwareUpdate.job C:\WINDOWS\tasks\Norton AntiVirus - Run Full System Scan - Si.job Completion time: 07-01-03 20:14:51.71 C:\ComboFix.txt … 07-01-03 20:14 AND: Logfile of HijackThis v1.99.1 Scan saved at 20:21:55, on 03/01/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe C:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Progra

LDTate

Post #17January 3, 2007, 10:47 PM UTC

This one could be harder then I thought

Please download VundoFix.exe to your desktop.

Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.
Please post the contents of C:\vundofix.txt and a new HiJackThis log.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.

bizarrebob

Post #18January 3, 2007, 11:52 PM UTC

Typical me to get a hard to fix problem! Sorry about this. I thank you for helping with this.

—————————-

VundoFix V6.2.13

Checking Java version…

Java version is 1.5.0.3

Java version is 1.5.0.9

Scan started at 23:03:15 03/01/2007

Listing files found while scanning….

C:\WINDOWS\system32\winghy32.dll
C:\WINDOWS\system32\gebca.dll
C:\WINDOWS\system32\acbeg.ini
C:\WINDOWS\system32\acbeg.bak1
C:\WINDOWS\system32\acbeg.bak2
C:\WINDOWS\system32\acbeg.ini2
C:\WINDOWS\system32\acbeg.tmp

Beginning removal…

Attempting to delete C:\WINDOWS\system32\winghy32.dll
C:\WINDOWS\system32\winghy32.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\gebca.dll
C:\WINDOWS\system32\gebca.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\acbeg.ini
C:\WINDOWS\system32\acbeg.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\acbeg.bak1
C:\WINDOWS\system32\acbeg.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\acbeg.bak2
C:\WINDOWS\system32\acbeg.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\acbeg.ini2
C:\WINDOWS\system32\acbeg.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\acbeg.tmp
C:\WINDOWS\system32\acbeg.tmp Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.2.13

Checking Java version…

Java version is 1.5.0.3

Java version is 1.5.0.9

Scan started at 23:43:13 03/01/2007

Listing files found while scanning….

Logfile of HijackThis v1.99.1
Scan saved at 23:45:34, on 03/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
C:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Roxio\Easy Media Creator 8\Drag to Disc\DrgToDsc.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\CPSHelpRunner.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\PROGRA~1\NORTON~1\navw32.exe
C:\Documents and Settings\Si\Desktop\VundoFix.exe
C:\Documents and Settings\Si\Desktop\Spyware.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O1 - Hosts: 195.13.63.187 irc.westwood.com
O1 - Hosts: 195.13.63.187 servserv.westwood.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2D5AF631-3B7F-4BF8-9299-0B1C664BB396} - C:\WINDOWS\system32\gebca.dll (file missing)
O2 - BHO: Flashget Catch Url Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {67547B18-013E-4735-A1D6-34BEBC03CD7E} - C:\WINDOWS\system32\geedd.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {7DA39570-5FD2-4f18-94B4-20730CB3F727} - C:\WINDOWS\system32\rawwypgu.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [TWCU] "C:\Program Files\Wireless\TWCU\TWCU.exe" -nogui
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [EPSON Stylus C86 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.EXE /P23 "EPSON Stylus C86 Series" /O5 "LPT1:" /M "Stylus C86"
O4 - HKLM\..\Run: [EPSON Stylus C86 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.EXE /P32 "EPSON Stylus C86 Series (Copy 1)" /O6 "USB001" /M "Stylus C86"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 8\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [DllRunning] rundll32.exe "C:\WINDOWS\system32\vvwhelid.dll",setvm
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by104fd.bay104.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab53083.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: geedd - C:\WINDOWS\system32\geedd.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Wireless Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Belkin Wireless USB Network Adapter (Belkin Wireless USB Network Adapter Service) - Unknown owner - C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: LiveShare P2P Server (RoxLiveShare) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxLiveShare.exe
O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
O23 - Service: RoxUpnpRenderer (RoxUPnPRenderer) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCom\RoxUpnpRenderer.exe
O23 - Service: RoxUpnpServer - Sonic Solutions - C:\Program Files\Roxio\Easy Media Creator 8\Digital Home\RoxUpnpServer.exe
O23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

LDTate

Post #19January 4, 2007, 12:04 AM UTC

* Double-click VundoFix.exe to run it.
* Put a check next to Run VundoFix as a task.
* You will receive a message saying vundofix will close and re-open in a minute or less. Click OK
* When VundoFix re-opens,Click Scan for Vundo button.
* Once the scan is complete, Right Click inside the listbox (white box) and click add more files
* Copy&Paste the 5 entries below into the top 2 boxes

o C:\WINDOWS\system32\geedd.dll
o C:\WINDOWS\system32\ddeeg.*
o C:\WINDOWS\system32\rawwypgu.dll
o C:\WINDOWS\system32\ugpywwar.*
o C:\WINDOWS\system32\vvwhelid.dll

* Click Add Files and Click Close Window
* Click the Remove Vundo button.
* You will receive a prompt asking if you want to remove the files, click YES
* Once you click yes, your desktop will go blank as it starts removing Vundo.
* When completed, it will prompt that it will shutdown your computer, click OK.
* Turn your computer back on.

* Start HijackThis, close all open windows leaving only HijackThis running. Place a check against each of the following:

O2 - BHO: (no name) - {2D5AF631-3B7F-4BF8-9299-0B1C664BB396} - C:\WINDOWS\system32\gebca.dll (file missing)
O2 - BHO: (no name) - {67547B18-013E-4735-A1D6-34BEBC03CD7E} - C:\WINDOWS\system32\geedd.dll
O2 - BHO: (no name) - {7DA39570-5FD2-4f18-94B4-20730CB3F727} - C:\WINDOWS\system32\rawwypgu.dll
O4 - HKLM\..\Run: [DllRunning] rundll32.exe "C:\WINDOWS\system32\vvwhelid.dll",setvm
O20 - Winlogon Notify: geedd - C:\WINDOWS\system32\geedd.dll
Close ALL windows and browsers except HijackThis and click "Fix checked"

Empty Recycle Bin

Reboot

* Please post the contents of C:\vundofix.txt and a new HiJackThis log.

bizarrebob

Post #20January 4, 2007, 12:23 AM UTC last edited January 4, 2007, 12:34 AM UTC

* Double-click VundoFix.exe to run it.
* Put a check next to Run VundoFix as a task.

Sorry to be a pain but when i double click VundoFix,exe there isn't a way to run VundoFix as a task. Am i doing something wrong? When i click VundoFix.exe i just get a box saying ''Vundofix'' and underneath that it says: ''Scan for Vundo'' and ''Remove Vundo''.

EDIT: (Cheers for the reply underneath this! Thought i'd say it here instead of a new post!)

LDTate

Post #21January 4, 2007, 12:31 AM UTC

I'm checking it out. Hold on

LDTate

Post #22January 4, 2007, 12:36 AM UTC

''Remove Vundo'' again and lets see if it finds them

bizarrebob

Post #23January 4, 2007, 12:51 AM UTC

''Remove Vundo'' again and lets see if it finds them

Vundo found no infected files.

LDTate

Post #24January 4, 2007, 1:10 AM UTC

Next, launch Notepad (Start>All Programs>Accessories), and copy/paste all the BOLD REGEDIT below to it. Don't forget to include REGEDIT4.
Save in: Desktop
File Name: fixme.reg
Save as Type: All files
Click: Save

REGEDIT4

[-HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon\Notify\geedd.dll]

On the desktop, doubleclick fix.reg and allow it to run. Let it merge.

Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O2 - BHO: (no name) - {2D5AF631-3B7F-4BF8-9299-0B1C664BB396} - C:\WINDOWS\system32\gebca.dll (file missing)
O2 - BHO: (no name) - {67547B18-013E-4735-A1D6-34BEBC03CD7E} - C:\WINDOWS\system32\geedd.dll
O2 - BHO: (no name) - {7DA39570-5FD2-4f18-94B4-20730CB3F727} - C:\WINDOWS\system32\rawwypgu.dll
O4 - HKLM\..\Run: [DllRunning] rundll32.exe "C:\WINDOWS\system32\vvwhelid.dll",setvm
O20 - Winlogon Notify: geedd - C:\WINDOWS\system32\geedd.dll

Close ALL windows and browsers except HijackThis and click "Fix checked"

Delete these Files if listed:
C:\WINDOWS\system32\geedd.dll
C:\WINDOWS\system32\ddeeg.* <–all that are ddeeg
C:\WINDOWS\system32\rawwypgu.dll
C:\WINDOWS\system32\ugpywwar.* <–all that are ugpywwar
C:\WINDOWS\system32\vvwhelid.dll

Empty Recycle Bin

Restart your computer.

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.

bizarrebob

Post #25January 4, 2007, 1:25 AM UTC

Logfile of HijackThis v1.99.1
Scan saved at 01:17:39, on 04/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
C:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Roxio\Easy Media Creator 8\Drag to Disc\DrgToDsc.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\CPSHelpRunner.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Documents and Settings\Si\Desktop\Spyware.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
\?\C:\WINDOWS\system32\WBEM\WMIADAP.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O1 - Hosts: 195.13.63.187 irc.westwood.com
O1 - Hosts: 195.13.63.187 servserv.westwood.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Flashget Catch Url Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [TWCU] "C:\Program Files\Wireless\TWCU\TWCU.exe" -nogui
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [EPSON Stylus C86 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.EXE /P23 "EPSON Stylus C86 Series" /O5 "LPT1:" /M "Stylus C86"
O4 - HKLM\..\Run: [EPSON Stylus C86 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.EXE /P32 "EPSON Stylus C86 Series (Copy 1)" /O6 "USB001" /M "Stylus C86"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 8\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by104fd.bay104.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab53083.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Wireless Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Belkin Wireless USB Network Adapter (Belkin Wireless USB Network Adapter Service) - Unknown owner - C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: LiveShare P2P Server (RoxLiveShare) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxLiveShare.exe
O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
O23 - Service: RoxUpnpRenderer (RoxUPnPRenderer) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCom\RoxUpnpRenderer.exe
O23 - Service: RoxUpnpServer - Sonic Solutions - C:\Program Files\Roxio\Easy Media Creator 8\Digital Home\RoxUpnpServer.exe
O23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Computer seems to be behaving itself. I've not had any annoying pop-ups for a little while, hope i wont get any more (touch-wood)

LDTate

Post #26January 4, 2007, 1:30 AM UTC

Great job

You can remove any programs I had you install

Log looks good

You need to create a new Clean restore point.

Note: This will remove all previous Restore Points

Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Restart your computer, turn it back on.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Remove the Check Turn off System Restore.
Click Apply, and then click OK.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.

If you dont have any programs like these, I would recommend that you get them.
Spywareblaster,
Spywareguard.

Also get a FREE FIREWALL and FREE ANTI VIRUS if you need one.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.

Safe Surfing.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

bizarrebob

Post #27January 4, 2007, 1:36 AM UTC

thanks ALOT LDTate! I really am very grateful for all your help! I'm hoping to begin learning more in the 'Classroom' so i can help both myself and other users, because this thing interests me. (all the fixing/sorting problems ect). I'll do all those things you've recommended, although i do have anti-virus and am running the firewall that came with XP, i know it's not brilliant, but doesn't pop up every now and then giving me hassle! Cheers again

LDTate

Post #28January 4, 2007, 1:37 AM UTC

Great job

You're more then welcome. Glad we were able to help Peace be with you

LDTate

Post #29January 4, 2007, 2:00 AM UTC

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Me again - with a slight problem

✨ Ask AI

Ask AI