My daughters desktop Hijack logs

Ok, my notebook is now fixed. My daughters desktop does some of the same pop up and IE explorer start ups the log follows. Thanks in Advance.

Logfile of HijackThis v1.99.1
Scan saved at 1:18:28 PM, on 2/4/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\MSTask.exe
C:\WINDOWS\system32\stisvc.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\bjcrvlvA.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hor.tec.sc.us/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - C:\Program Files\DeluxeCommunications\DxcBho.dll
F2 - REG:system.ini: UserInit=userinit.exe,fkvlgce.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [{17-7B-B7-75-ZN}] C:\WINDOWS\SYSTEM32\dwdsregt.exe GID003
O4 - HKLM\..\Run: [ftexc] C:\WINDOWS\system32\mptft.exe
O4 - HKLM\..\Run: [dwcuuu] C:\WINDOWS\system32\dgxduw.exe reg_run
O4 - HKLM\..\Run: [w01569f1.dll] RUNDLL32.EXE w01569f1.dll,I2 00161fdc001569f1
O4 - HKLM\..\Run: [webHancer Survey Companion] C:\Program Files\webHancer\Programs\whsurvey.exe
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKLM\..\Run: [ntdll.dll] C:\WINDOWS\cfg32.exe
O4 - HKLM\..\Run: [Hhl7RfpJ] "C:\WINDOWS\system32\ssn6tuu.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [bjcrvlvA] C:\WINDOWS\bjcrvlvA.exe
O4 - HKLM\..\Run: [aaa00000] RUNDLL32.EXE aaa000002c.dll,n 000000000000001d
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKCU\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - Startup: hp psc 1000 series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
O4 - Startup: Zeno.lnk = C:\WINDOWS\SYSTEM32\twinoqez.exe
O4 - Startup: Z_Start.lnk = C:\ZIGID003.exe
O4 - Global Startup: hp instant support.lnk = C:\Program Files\Hewlett-Packard\hpis\bin\matcli.exe
O4 - Global Startup: hp psc 1000 series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
O4 - Global Startup: hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O9 - Extra button: (no name) - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\system32\dmonwv.dll (file missing)
O9 - Extra 'Tools' menuitem: Java - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\system32\dmonwv.dll (file missing)
O13 - WWW. Prefix: http://
O18 - Filter: text/html - {994D478A-45D0-4DB4-AE28-738B1E346F99} - C:\Program Files\Exolon\Exolon.dll
O20 - AppInit_DLLs: dxclib303562752.dll
O20 - Winlogon Notify: Time Zones - C:\WINDOWS\system32\guard.tmp (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: Net Agent - Unknown owner - C:\WINDOWS\dls0523pmw.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Procedure Call (RPC) Relocator (RPCReloc) - Unknown owner - C:\WINDOWS\rpchost.exe (file missing)
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\kjbkjsa.exe (file missing)

Here you go. Hijack this first

Logfile of HijackThis v1.99.1
Scan saved at 12:10:50 PM, on 2/5/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\MSTask.exe
C:\WINDOWS\system32\stisvc.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\bjcrvlvA.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Documents and Settings\Administrator\Desktop\HJT\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [{17-7B-B7-75-ZN}] C:\WINDOWS\SYSTEM32\dwdsregt.exe GID003
O4 - HKLM\..\Run: [ftexc] C:\WINDOWS\system32\mptft.exe
O4 - HKLM\..\Run: [w01569f1.dll] RUNDLL32.EXE w01569f1.dll,I2 00161fdc001569f1
O4 - HKLM\..\Run: [Hhl7RfpJ] "C:\WINDOWS\system32\ssn6tuu.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [bjcrvlvA] C:\WINDOWS\bjcrvlvA.exe
O4 - HKLM\..\Run: [aaa00000] RUNDLL32.EXE aaa000002c.dll,n 000000000000001d
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - Startup: hp psc 1000 series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
O4 - Global Startup: hp instant support.lnk = C:\Program Files\Hewlett-Packard\hpis\bin\matcli.exe
O4 - Global Startup: hp psc 1000 series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
O4 - Global Startup: hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O13 - WWW. Prefix: http://
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: Net Agent - Unknown owner - C:\WINDOWS\dls0523pmw.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Procedure Call (RPC) Relocator (RPCReloc) - Unknown owner - C:\WINDOWS\rpchost.exe (file missing)
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\kjbkjsa.exe (file missing)


Now Combo.

"Administrator" - Mon 02/05/2007 12:00:39 Service Pack 4
ComboFix 07.02.04 - Running from: "C:\Documents and Settings\Administrator\Desktop"

((((((((((((((((((((((((((((((((((((((((((((( Look2Me's Log ))))))))))))))))))))))))))))))))))))))))))))))))))

REGISTRY ENTRIES REMOVED:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\clsid\{1fbd4753-3998-40e8-99af-da1dbad7f490}]
@=""
"IDEx"="ADDR"

[HKEY_CLASSES_ROOT\clsid\{1fbd4753-3998-40e8-99af-da1dbad7f490}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\clsid\{1fbd4753-3998-40e8-99af-da1dbad7f490}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\clsid\{1fbd4753-3998-40e8-99af-da1dbad7f490}\InprocServer32]
@="C:\\WINDOWS\\system32\\qnvd.dll"
"ThreadingModel"="Apartment"Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\clsid\{abfb6d6a-f9ad-4b6e-8486-d261f908fe72}]
@=""
"IDEx"="ADDR"

[HKEY_CLASSES_ROOT\clsid\{abfb6d6a-f9ad-4b6e-8486-d261f908fe72}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\clsid\{abfb6d6a-f9ad-4b6e-8486-d261f908fe72}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\clsid\{abfb6d6a-f9ad-4b6e-8486-d261f908fe72}\InprocServer32]
@="C:\\WINDOWS\\system32\\owesvr.dll"
"ThreadingModel"="Apartment"Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\clsid\{56b1b6ea-a36f-4c33-bae1-8f6e68d44569}]
@=""

[HKEY_CLASSES_ROOT\clsid\{56b1b6ea-a36f-4c33-bae1-8f6e68d44569}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\clsid\{56b1b6ea-a36f-4c33-bae1-8f6e68d44569}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\clsid\{56b1b6ea-a36f-4c33-bae1-8f6e68d44569}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\clsid\{76bc2a38-7a4c-42d8-ab27-23cb7da3e61b}]Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\clsid\{d1836c57-80ba-4f1f-9da1-ac398a9f74f0}]Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\clsid\{9c1f84ac-9979-4ea3-b86f-33e1b82be597}]
@=""

[HKEY_CLASSES_ROOT\clsid\{9c1f84ac-9979-4ea3-b86f-33e1b82be597}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\clsid\{9c1f84ac-9979-4ea3-b86f-33e1b82be597}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\clsid\{9c1f84ac-9979-4ea3-b86f-33e1b82be597}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\clsid\{3ad29dd4-72ac-4cb8-a425-4546989dc2af}]
@=""
"IDEx"="ADDR"

[HKEY_CLASSES_ROOT\clsid\{3ad29dd4-72ac-4cb8-a425-4546989dc2af}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\clsid\{3ad29dd4-72ac-4cb8-a425-4546989dc2af}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\clsid\{3ad29dd4-72ac-4cb8-a425-4546989dc2af}\InprocServer32]
@="C:\\WINDOWS\\system32\\aGaamon.dll"
"ThreadingModel"="Apartment"Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\clsid\{a582d26c-1328-4a4e-bcac-4bd06f82b5aa}]
@=""

[HKEY_CLASSES_ROOT\clsid\{a582d26c-1328-4a4e-bcac-4bd06f82b5aa}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\clsid\{a582d26c-1328-4a4e-bcac-4bd06f82b5aa}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\clsid\{a582d26c-1328-4a4e-bcac-4bd06f82b5aa}\InprocServer32]
@="C:\\WINDOWS\\system32\\wapdinfo.dll"
"ThreadingModel"="Apartment"Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\clsid\{f9d0641f-c8d9-4be2-a88c-ff0bbcb807a8}]
@=""

[HKEY_CLASSES_ROOT\clsid\{f9d0641f-c8d9-4be2-a88c-ff0bbcb807a8}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\clsid\{f9d0641f-c8d9-4be2-a88c-ff0bbcb807a8}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\clsid\{f9d0641f-c8d9-4be2-a88c-ff0bbcb807a8}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\clsid\{0856f345-ac17-4436-bf32-5255912a0a47}]Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\clsid\{5d755cb8-e88d-4231-bbb9-4ce5511af606}]

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


Granting SeDebugPrivilege to Administrators … successful


((((((((((((((((((((((((((((((((((((((((((((( Qoologic's Log )))))))))))))))))))))))))))))))))))))))))))))))))))


* * * POST-RUN - Files in the Quarantine folder * * * * * * * * * * * * * * * * * * * * * * * * *


06-12-26 22:40 289 cbekm.dll.qoo

DO NOT DELETE ANY FILES FROM THIS DIRECTORY UNLESS INSTRUCTED TO


(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\ac2_0003.exe
C:\ac3_0003.exe
C:\defender26.exe
C:\deskbar_e114.exe
C:\deskbar_e60.exe
C:\deskbar_e64.exe
C:\deskbar_e65.exe
C:\dfndr.exe
C:\dfndrad_5.exe
C:\dfndra_1.exe
C:\dfndrd_5.exe
C:\dfndrff_105.exe
C:\dfndrff_114.exe
C:\dfndrff_e60.exe
C:\dfndrff_e64.exe
C:\dfndrff_e65.exe
C:\WINDOWS\keyboard1.dat
C:\kybrdad_5.exe
C:\kybrdb_3.exe
C:\kybrdd_5.exe
C:\kybrdff_e105.exe
C:\kybrdff_e60.exe
C:\kybrdff_e64.exe
C:\kybrdff_e65.exe
C:\kybrd_1.exe
C:\WINDOWS\newname.dat
C:\nwnmd_5.exe
C:\nwnm_1.exe
C:\warebundle2.exe
C:\webnexmk.exe
C:\webnexmknew.exe
C:\Program Files\TClock\tclock_install.exe
C:\WINDOWS\system32\BattyRun.dll
C:\setup.exe
C:\svchost.exe
C:\visfx500new.exe
C:\WINDOWS\start.exe
C:\WINDOWS\uni_ehhhh.exe
C:\WINDOWS\uninst104.exe
C:\Program Files\Common Files\InetGet
C:\Program Files\Common Files\misc001
C:\Program Files\Common Files\simtest
C:\Program Files\Common Files\svchostsys
C:\Program Files\cmfibula
C:\Program Files\CMFibula
C:\Program Files\DeluxeCommunications
C:\Program Files\InetGet2
C:\Program Files\PadsysAssistant
C:\Program Files\PSHope
C:\Program Files\windows
C:\Program Files\Common Files\inetget
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Folders Quarantined:
C:\qoobox\purity\Program Files\PPATCH~1
C:\qoobox\purity\Program Files\SSTEM~1
C:\qoobox\purity\Program Files\Common Files\SMANTE~1
C:\qoobox\purity\Program Files\Common Files\SMANTE~1\ntvdm.exe
C:\qoobox\purity\Program Files\Common Files\SMANTE~1\S?mantec
C:\qoobox\purity\Program Files\PPATCH~1\PPATCH~1
C:\qoobox\purity\Program Files\PPATCH~1\scanregw.exe
C:\qoobox\purity\Program Files\SSTEM~1\d?dplay.exe


((((((((((((((((((((((((((((((( Files Created from 2007-01-05 to 2007-02-05 ))))))))))))))))))))))))))))))))))


2007-02-05 12:03 d——– C:\WINDOWS\ERDNT
2007-02-04 13:09 3,151,580 –a—— C:\WINDOWS\Beerfest.scr
2007-02-04 13:09 235,072 –a—— C:\WINDOWS\uninstall Beerfest.exe
2007-02-02 18:01 215,308 –a—— C:\WINDOWS\oqazq0578.exe
2007-02-02 16:32 86,016 –a—— C:\WINDOWS\unvise32qt.exe
2007-02-02 16:31 d——– C:\WINDOWS\SYSTEM32\QuickTime
2007-02-02 16:31 d——– C:\Program Files\QuickTime
2007-02-02 16:30 64,512 –a—— C:\WINDOWS\SYSTEM32\PTPITCP.dll
2007-02-02 16:30 294,912 –a—— C:\WINDOWS\SYSTEM32\KPDPM.dll
2007-02-02 16:30 225,280 –a—— C:\WINDOWS\SYSTEM32\KPDPMUI.dll
2007-02-02 16:27 d——– C:\WINDOWS\SYSTEM32\BWKDLogs
2007-02-02 16:18 d——– C:\Program Files\Common Files\Kodak
2007-02-02 16:17 d——– C:\KPCMS
2007-02-02 16:16 d——– C:\WINDOWS\SYSTEM32\color
2007-02-02 16:07 d——– C:\Program Files\Kodak
2007-02-02 14:25 843,922 –a—— C:\WINDOWS\SYSTEM32\WinNB69.dll
2007-02-02 14:24 1,007,616 –a—— C:\WINDOWS\yuhmp0578.exe
2007-02-01 17:48 65,536 –a—— C:\WINDOWS\dls0523pmw.exe
2007-02-01 17:48 641,920 -r-hs—- C:\WINDOWS\bjcrvlvA.exe
2007-02-01 17:48 46,592 –a—— C:\WINDOWS\bjcrvlv.exe
2007-02-01 17:48 34,816 –a—— C:\WINDOWS\rau001978.exe
2007-02-01 17:48 2,560 –a—— C:\WINDOWS\ac4_0029.exe
2007-02-01 17:48 d——– C:\Program Files\Exolon
2007-02-01 16:42 3,968 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\AvgAsCln.sys
2007-02-01 16:42 d——– C:\Program Files\Grisoft


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-02-05 12:02 ——– d——– C:\Program Files\tclock
2007-02-05 11:55 ——– d-a—— C:\Program Files\mozilla firefox
2007-02-03 21:21 38 –a—— C:\Documents and Settings\Administrator\Application Data\dxcuknwrd.dll
2007-02-03 21:21 28 –a—— C:\Documents and Settings\Administrator\Application Data\dxccwrd.dll
2007-02-03 21:18 804221 –a—— C:\Documents and Settings\Administrator\Application Data\dxcknwrd.dll
2007-02-03 15:09 ——– d—s—- C:\Documents and Settings\Administrator\Application Data\microsoft
2007-02-02 18:33 ——– d-a—— C:\Program Files\internet toolkit 4.2
2007-02-02 16:34 ——– d——– C:\Documents and Settings\Administrator\Application Data\lavasoft
2007-02-02 15:37 ——– d——– C:\Documents and Settings\Administrator\Application Data\limewire
2007-02-01 17:38 ——– d——– C:\Documents and Settings\Administrator\Application Data\identities
2007-02-01 17:34 ——– d-a-s—- C:\Program Files\newdotnet
2006-12-10 16:22 832 –a—— C:\WINDOWS\SYSTEM32\winpfg32.sys


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SystemTray"="SysTray.Exe"
"Synchronization Manager"="mobsync.exe /logon"
"D-Link AirPlus G"="C:\\Program Files\\D-Link\\AirPlus G\\AirGCFG.exe"
"{17-7B-B7-75-ZN}"="C:\\WINDOWS\\SYSTEM32\\dwdsregt.exe GID003"
"ftexc"="C:\\WINDOWS\\system32\\mptft.exe"
"w01569f1.dll"="RUNDLL32.EXE w01569f1.dll,I2 00161fdc001569f1"
"Hhl7RfpJ"="\"C:\\WINDOWS\\system32\\ssn6tuu.exe\""
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
"bjcrvlvA"="C:\\WINDOWS\\bjcrvlvA.exe"
"aaa00000"="RUNDLL32.EXE aaa000002c.dll,n 000000000000001d"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex]
@=""


[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{04CDB16C-AB38-43CD-A86A-6FEB90290939}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Prpr"="\"C:\\PROGRA~1\\PPATCH~1\\scanregw.exe\" -vt yazr"
"fuio"="C:\\PROGRA~1\\COMMON~1\\fuio\\fuiom.exe"
"ytjvw"="C:\\WINDOWS\\system32\\dgxduw.exe reg_run"
"PECarlin"="\"C:\\Program Files\\PECarlin\\PECarlin.exe\""
"AXVenore"="\"C:\\Program Files\\AXVenore\\AXVenore.exe\""
"Elvjnwn"="C:\\Program Files\\s?stem\\d?dplay.exe"
"TClock.exe"="C:\\Program Files\\TClock\\tclock_install.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"CDRAutoRun"=hex:00,00,00,00

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"CDRAutoRun"=hex:00,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer\Run]
"WinUpdate.exe"="C:\\Program Files\\Windows\\WinUpdate.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
rpcss REG_MULTI_SZ RpcSs\0\0
wugroup REG_MULTI_SZ wuauserv\0\0
BITSgroup REG_MULTI_SZ BITS\0\0

HKLM\software\Microsoft\Windows NT\CurrentVersion\Svchost *netsvcs*
WmdmPmSN



Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1091300037.job
C:\WINDOWS\tasks\Tune-up Application Start.job


********************************************************************

catchme 0.1 W2K/XP - userland rootkit detector by Gmer, 17 October 2006
http://www.gmer.net

scanning hidden processes …

scanning hidden services …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

********************************************************************

Completion time: Mon 2007-02-05 12:06:54

Thanks for looking it over.