Driver_irql_not_less_or_equal & Nuwar.n!sys Virus

Hello JCInfected,

First I need to warn you about the that file rpcc.dll. You may want to re-format and reinstall.
http://research.sunbelt-software.com/threa…;threatid=70540
I urge you to protect your personal information

Do not use this system for any transactions until you are clean.

Here are a couple of links which may provide you with additional valuable information:
When should I re-format? How should I reinstall?
http://www.dslreports.com/faq/10063

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
http://www.dslreports.com/faq/10451


If You do any online banking, ebay/paypal purchases, any other sensitive online transactions…:

You are strongly advised to do the following immediately:

1. Disconnect infected computer from the internet and from any networked computers until the computer can be cleaned.

2. Call all of your banks, credit card companies, financial institutions and inform them that you may be a victim of identity theft and to put a watch on your accounts or change all your account numbers.

3. From a clean computer, change *all* your online passwords – for email, for banks, financial accounts, PayPal, eBay, online companies, any online forums or groups you belong to.

Do NOT change passwords or do any transactions while using the infected computer because the attacker will get the new passwords and transaction information.

==================================
Let's try connecting to the Internet and running some addtional scans and tests.

Please test your firewall and make sure it is working properly.
Test Firewall

Do you tell me anything about this file?
C:\Program Files\finish\ƒvƒŠƒ“ƒZƒXƒT[ƒKI@`’pJ‚Ì•PŒN`\____.sys

Please perform an online scan with Internet Explorer at
http://www.kaspersky.com/service?chapter=161739400

Answer Yes, when prompted to install an ActiveX component.

• The program will then begin downloading the latest definition files.
• Once the files have been downloaded click on NEXT
• Locate the Scan Settings button & configure to:
  • Scan using the following Anti-Virus database:
    Extended
  • Scan Options:
    Scan Archives
    Scan Mail Bases
• Click OK & have it scan My Computer
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

**Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the license, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

======
GMER
Please create a new subfolder in the Program Files folder called GMER. If you have an older version of GMER installed, you must delete it.

• Download GMER and extract it to the C:\program files\GMER folder.
  
• Please rename the GMER file
  Note: You can rename gmer.exe to anything you like as long as you keep the .exe ending.
  Run the Gmer.exe renamed program by double-clicking the executable file (gmer.exe) in Windows Explorer.
  You may be prompted to scan immediately if GMER detects rootkit activity.
• If you are prompted to scan your system click "yes" to begin the scan.
• If you are not prompted, Click the "Rootkit" tab, then click "Scan".

DO NOT touch the PC at ALL for Whatever reason/s until it has 100% completed its scan, or attempted scan in case of some error etc !

At the end of the scan, click "Copy" to copy the scan results to the clipboard. Then paste the results in a notepad file and save for you next reply.

======
Deckard’s System Scanner

Download
Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.

• Close all applications and windows.
• Double-click on dss.exe to run it, and follow the prompts.
• When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt<-this one will be minimized
• Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and the extra.txt to your post. in your reply

Please let me know about that file and if your firewall is working. Post (reply) with the results from the the Kaspersky log, the GMER scan, and Deckard’s system scanner.

I did the firewall test and it ran fine. Howver, that was probably due to the router I have which I connect to the internet through. I only use the Windows Firewall and it seems to be enabled fine. I'll definately get a free software firewall after this is fixed. Also, about the .sys file you asked about, it's for a game.

Anyways, here's the Kap log:


——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Friday, April 20, 2007 5:34:01 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 20/04/2007
Kaspersky Anti-Virus database records: 300054
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 448023
Number of viruses found: 15
Number of infected objects: 47 / 0
Number of suspicious objects: 0
Duration of the scan process: 03:27:38

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\85IOJ7EW\3ti[1].exe Infected: Packed.Win32.Tibs.r skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\85IOJ7EW\3ti[2].exe Infected: Packed.Win32.Tibs.r skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\user\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\user\Favorites\Old Links\Send free cards to your friends at nicecards..url Infected: Trojan.JS.Logo skipped
C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\user\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\user\Local Settings\History\History.IE5\MSHist012007042020070421\index.dat Object is locked skipped
C:\Documents and Settings\user\Local Settings\Temp\~DFE727.tmp Object is locked skipped
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\M3MR69QV\aboxinst_int16[1].exe Infected: Trojan-Downloader.Win32.VB.ft skipped
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\NN09K2JI\d1[1].exe Infected: Packed.Win32.Tibs.q skipped
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\NN09K2JI\d2[1].exe Infected: Trojan-Proxy.Win32.Dlena.cn skipped
C:\Documents and Settings\user\ntuser.dat Object is locked skipped
C:\Documents and Settings\user\ntuser.dat.LOG Object is locked skipped
C:\Flashget\fgf096a.zip/setup.exe/WISE0075.BIN Infected: not-a-virus:AdWare.Win32.Aureate.a skipped
C:\Flashget\fgf096a.zip/setup.exe/WISE0076.BIN Infected: not-a-virus:AdWare.Win32.Aureate.a skipped
C:\Flashget\fgf096a.zip/setup.exe/WISE0077.BIN Infected: not-a-virus:AdWare.Win32.Aureate.a skipped
C:\Flashget\fgf096a.zip/setup.exe/WISE0078.BIN Infected: not-a-virus:AdWare.Win32.Aureate.a skipped
C:\Flashget\fgf096a.zip/setup.exe/WISE0079.BIN Infected: not-a-virus:AdWare.Win32.Aureate.a skipped
C:\Flashget\fgf096a.zip/setup.exe Infected: not-a-virus:AdWare.Win32.Aureate.a skipped
C:\Flashget\fgf096a.zip ZIP: infected - 6 skipped
C:\Flashget\setup.exe/WISE0075.BIN Infected: not-a-virus:AdWare.Win32.Aureate.a skipped
C:\Flashget\setup.exe/WISE0076.BIN Infected: not-a-virus:AdWare.Win32.Aureate.a skipped
C:\Flashget\setup.exe/WISE0077.BIN Infected: not-a-virus:AdWare.Win32.Aureate.a skipped
C:\Flashget\setup.exe/WISE0078.BIN Infected: not-a-virus:AdWare.Win32.Aureate.a skipped
C:\Flashget\setup.exe/WISE0079.BIN Infected: not-a-virus:AdWare.Win32.Aureate.a skipped
C:\Flashget\setup.exe WiseSFX: infected - 5 skipped
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsys.dll Object is locked skipped
C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2859076D Infected: Trojan-Downloader.Java.OpenConnection.v skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5C075147.htm Infected: Trojan-Downloader.JS.Weis.b skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5F1401A7 Infected: Trojan.Java.ClassLoader.ak skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6E686E85 Infected: Trojan.Java.ClassLoader.z skipped
C:\SDFix\backups\backups.zip/backups/3ti.exe.exe Infected: Packed.Win32.Tibs.r skipped
C:\SDFix\backups\backups.zip/backups/ndis.sys Infected: SpamTool.Win32.Agent.u skipped
C:\SDFix\backups\backups.zip/backups/pdp.exe.exe Infected: Packed.Win32.Tibs.r skipped
C:\SDFix\backups\backups.zip/backups/zup.exe.exe Infected: Packed.Win32.Tibs.r skipped
C:\SDFix\backups\backups.zip ZIP: infected - 4 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\Web Program Downloads\mirc614.exe/data0001.bin Infected: not-a-virus:Client-IRC.Win32.mIRC.614 skipped
C:\Web Program Downloads\mirc614.exe mIRC: infected - 1 skipped
C:\Web Program Downloads\mirc616.exe/data0001.bin Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped
C:\Web Program Downloads\mirc616.exe mIRC: infected - 1 skipped
C:\WINDOWS\3ti.exe Infected: Packed.Win32.Tibs.r skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLog.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\SYSTEM32\3ti.exe Infected: Packed.Win32.Tibs.r skipped
C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\SYSTEM32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\DEFAULT Object is locked skipped
C:\WINDOWS\SYSTEM32\config\default.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\Internet.evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SAM Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SECURITY Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\SYSTEM32\config\software.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SYSTEM Object is locked skipped
C:\WINDOWS\SYSTEM32\config\system.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\h323log.txt Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
C:\WINDOWS\winsock64.dll Infected: Trojan-Proxy.Win32.Agent.ji skipped
D:\Jason'sMpeg\Web Program Dls\getrgt.exe/WISE0031.BIN Infected: not-a-virus:AdWare.Win32.Aureate.a skipped
D:\Jason'sMpeg\Web Program Dls\getrgt.exe/WISE0032.BIN Infected: not-a-virus:AdWare.Win32.Aureate.a skipped
D:\Jason'sMpeg\Web Program Dls\getrgt.exe/WISE0033.BIN Infected: not-a-virus:AdWare.Win32.Aureate.a skipped
D:\Jason'sMpeg\Web Program Dls\getrgt.exe/WISE0034.BIN Infected: not-a-virus:AdWare.Win32.Aureate.a skipped
D:\Jason'sMpeg\Web Program Dls\getrgt.exe/WISE0035.BIN Infected: not-a-virus:AdWare.Win32.Aureate.a skipped
D:\Jason'sMpeg\Web Program Dls\getrgt.exe WiseSFX: infected - 5 skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

Scan process completed.




The GMER log:

GMER 1.0.12.12244 - http://www.gmer.net
Rootkit scan 2007-04-20 19:05:33
Windows 5.1.2600 Service Pack 2


—- System - GMER 1.0.12 —-

SSDT d347bus.sys ZwClose
SSDT 866484A0 ZwConnectPort
SSDT d347bus.sys ZwCreateKey
SSDT d347bus.sys ZwCreatePagingFile
SSDT d347bus.sys ZwEnumerateKey
SSDT d347bus.sys ZwEnumerateValueKey
SSDT d347bus.sys ZwOpenKey
SSDT \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys ZwOpenProcess
SSDT d347bus.sys ZwQueryKey
SSDT d347bus.sys ZwQueryValueKey
SSDT d347bus.sys ZwSetSystemPowerState
SSDT \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys ZwTerminateProcess

—- Kernel code sections - GMER 1.0.12 —-

? C:\WINDOWS\System32\DRIVERS\update.sys

—- User code sections - GMER 1.0.12 —-

.text C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!DialogBoxParamW 7E42555F 5 Bytes JMP 00ACF205 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!DialogBoxIndirectParamW 7E432032 5 Bytes JMP 00C5FEBF C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!MessageBoxIndirectA 7E43A04A 5 Bytes JMP 00C5FE40 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!DialogBoxParamA 7E43B10C 5 Bytes JMP 00C5FE84 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!MessageBoxExW 7E4505D8 5 Bytes JMP 00C5FDCC C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!MessageBoxExA 7E4505FC 5 Bytes JMP 00C5FE06 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!DialogBoxIndirectParamA 7E456B50 5 Bytes JMP 00C5FEFA C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!MessageBoxIndirectW 7E4662AB 5 Bytes JMP 00AF15DA C:\WINDOWS\system32\IEFRAME.dll

—- Devices - GMER 1.0.12 —-

Device \FileSystem\Ntfs \Ntfs IRP_MJ_READ 86F855B8
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_READ 85F05530
Device \Driver\nvatabus \Device000070 IRP_MJ_CREATE 86DDD008
Device \Driver\nvatabus \Device000070 IRP_MJ_CREATE_NAMED_PIPE 86DDD008
Device \Driver\nvatabus \Device000070 IRP_MJ_CLOSE 86DDD008
Device \Driver\nvatabus \Device000070 IRP_MJ_READ 86DDD008
Device \Driver\nvatabus \Device000070 IRP_MJ_WRITE 86DDD008
Device \Driver\nvatabus \Device000070 IRP_MJ_QUERY_INFORMATION 86DDD008
Device \Driver\nvatabus \Device000070 IRP_MJ_SET_INFORMATION 86DDD008
Device \Driver\nvatabus \Device000070 IRP_MJ_QUERY_EA 86DDD008
Device \Driver\nvatabus \Device000070 IRP_MJ_SET_EA 86DDD008
Device \Driver\nvatabus \Device000070 IRP_MJ_FLUSH_BUFFERS 86DDD008
Device \Driver\nvatabus \Device000070 IRP_MJ_QUERY_VOLUME_INFORMATION 86DDD008
Device \Driver\nvatabus \Device000070 IRP_MJ_SET_VOLUME_INFORMATION 86DDD008
Device \Driver\nvatabus \Device000070 IRP_MJ_DIRECTORY_CONTROL 86DDD008
Device \Driver\nvatabus \Device000070 IRP_MJ_FILE_SYSTEM_CONTROL 86DDD008
Device \Driver\nvatabus \Device000070 IRP_MJ_DEVICE_CONTROL 86DDD008
Device \Driver\nvatabus \Device000070 IRP_MJ_INTERNAL_DEVICE_CONTROL 86DDD008
Device \Driver\nvatabus \Device000070 IRP_MJ_SHUTDOWN 86DDD008
Device \Driver\nvatabus \Device000070 IRP_MJ_LOCK_CONTROL 86DDD008
Device \Driver\nvatabus \Device000070 IRP_MJ_CLEANUP 86DDD008
Device \Driver\nvatabus \Device000070 IRP_MJ_CREATE_MAILSLOT 86DDD008
Device \Driver\nvatabus \Device000070 IRP_MJ_QUERY_SECURITY 86DDD008
Device \Driver\nvatabus \Device000070 IRP_MJ_SET_SECURITY 86DDD008
Device \Driver\nvatabus \Device000070 IRP_MJ_POWER 86DDD008
Device \Driver\nvatabus \Device000070 IRP_MJ_SYSTEM_CONTROL 86DDD008
Device \Driver\nvatabus \Device000070 IRP_MJ_DEVICE_CHANGE 86DDD008
Device \Driver\nvatabus \Device000070 IRP_MJ_QUERY_QUOTA 86DDD008
Device \Driver\nvatabus \Device000070 IRP_MJ_SET_QUOTA 86DDD008
Device \Driver\nvatabus \Device000070 IRP_MJ_PNP 86DDD008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE 86DDBA18
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE_NAMED_PIPE 86DDBA18
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLOSE 86DDBA18
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_READ 86DDBA18
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_WRITE 86DDBA18
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_INFORMATION 86DDBA18
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_INFORMATION 86DDBA18
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_EA 86DDBA18
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_EA 86DDBA18
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FLUSH_BUFFERS 86DDBA18
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_VOLUME_INFORMATION 86DDBA18
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_VOLUME_INFORMATION 86DDBA18
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DIRECTORY_CONTROL 86DDBA18
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FILE_SYSTEM_CONTROL 86DDBA18
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CONTROL 86DDBA18
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_INTERNAL_DEVICE_CONTROL 86DDBA18
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SHUTDOWN 86DDBA18
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_LOCK_CONTROL 86DDBA18
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLEANUP 86DDBA18
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE_MAILSLOT 86DDBA18
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_SECURITY 86DDBA18
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_SECURITY 86DDBA18
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_POWER 86DDBA18
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SYSTEM_CONTROL 86DDBA18
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CHANGE 86DDBA18
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_QUOTA 86DDBA18
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_QUOTA 86DDBA18
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_PNP 86DDBA18
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_READ 8666F410
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE 86DDBA18
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE_NAMED_PIPE 86DDBA18
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLOSE 86DDBA18
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_READ 86DDBA18
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_WRITE 86DDBA18
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_INFORMATION 86DDBA18
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_INFORMATION 86DDBA18
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_EA 86DDBA18
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_EA 86DDBA18
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FLUSH_BUFFERS 86DDBA18
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_VOLUME_INFORMATION 86DDBA18
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_VOLUME_INFORMATION 86DDBA18
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DIRECTORY_CONTROL 86DDBA18
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FILE_SYSTEM_CONTROL 86DDBA18
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CONTROL 86DDBA18
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_INTERNAL_DEVICE_CONTROL 86DDBA18
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SHUTDOWN 86DDBA18
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_LOCK_CONTROL 86DDBA18
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLEANUP 86DDBA18
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE_MAILSLOT 86DDBA18
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_SECURITY 86DDBA18
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_SECURITY 86DDBA18
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_POWER 86DDBA18
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SYSTEM_CONTROL 86DDBA18
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CHANGE 86DDBA18
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_QUOTA 86DDBA18
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_QUOTA 86DDBA18
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_PNP 86DDBA18
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_CREATE 86DDD008
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_CREATE_NAMED_PIPE 86DDD008
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_CLOSE 86DDD008
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_READ 86DDD008
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_WRITE 86DDD008
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_QUERY_INFORMATION 86DDD008
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_SET_INFORMATION 86DDD008
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_QUERY_EA 86DDD008
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_SET_EA 86DDD008
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_FLUSH_BUFFERS 86DDD008
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_QUERY_VOLUME_INFORMATION 86DDD008
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_SET_VOLUME_INFORMATION 86DDD008
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_DIRECTORY_CONTROL 86DDD008
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_FILE_SYSTEM_CONTROL 86DDD008
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_DEVICE_CONTROL 86DDD008
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_INTERNAL_DEVICE_CONTROL 86DDD008
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_SHUTDOWN 86DDD008
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_LOCK_CONTROL 86DDD008
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_CLEANUP 86DDD008
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_CREATE_MAILSLOT 86DDD008
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_QUERY_SECURITY 86DDD008
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_SET_SECURITY 86DDD008
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_POWER 86DDD008
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_SYSTEM_CONTROL 86DDD008
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_DEVICE_CHANGE 86DDD008
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_QUERY_QUOTA 86DDD008
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_SET_QUOTA 86DDD008
Device \Driver\nvatabus \Device\NvAta0 IRP_MJ_PNP 86DDD008
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_READ 866378B0
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_READ 866378B0
Device \Driver\nvatabus \Device00006f IRP_MJ_CREATE 86DDD008
Device \Driver\nvatabus \Device00006f IRP_MJ_CREATE_NAMED_PIPE 86DDD008
Device \Driver\nvatabus \Device00006f IRP_MJ_CLOSE 86DDD008
Device \Driver\nvatabus \Device00006f IRP_MJ_READ 86DDD008
Device \Driver\nvatabus \Device00006f IRP_MJ_WRITE 86DDD008
Device \Driver\nvatabus \Device00006f IRP_MJ_QUERY_INFORMATION 86DDD008
Device \Driver\nvatabus \Device00006f IRP_MJ_SET_INFORMATION 86DDD008
Device \Driver\nvatabus \Device00006f IRP_MJ_QUERY_EA 86DDD008
Device \Driver\nvatabus \Device00006f IRP_MJ_SET_EA 86DDD008
Device \Driver\nvatabus \Device00006f IRP_MJ_FLUSH_BUFFERS 86DDD008
Device \Driver\nvatabus \Device00006f IRP_MJ_QUERY_VOLUME_INFORMATION 86DDD008
Device \Driver\nvatabus \Device00006f IRP_MJ_SET_VOLUME_INFORMATION 86DDD008
Device \Driver\nvatabus \Device00006f IRP_MJ_DIRECTORY_CONTROL 86DDD008
Device \Driver\nvatabus \Device00006f IRP_MJ_FILE_SYSTEM_CONTROL 86DDD008
Device \Driver\nvatabus \Device00006f IRP_MJ_DEVICE_CONTROL 86DDD008
Device \Driver\nvatabus \Device00006f IRP_MJ_INTERNAL_DEVICE_CONTROL 86DDD008
Device \Driver\nvatabus \Device00006f IRP_MJ_SHUTDOWN 86DDD008
Device \Driver\nvatabus \Device00006f IRP_MJ_LOCK_CONTROL 86DDD008
Device \Driver\nvatabus \Device00006f IRP_MJ_CLEANUP 86DDD008
Device \Driver\nvatabus \Device00006f IRP_MJ_CREATE_MAILSLOT 86DDD008
Device \Driver\nvatabus \Device00006f IRP_MJ_QUERY_SECURITY 86DDD008
Device \Driver\nvatabus \Device00006f IRP_MJ_SET_SECURITY 86DDD008
Device \Driver\nvatabus \Device00006f IRP_MJ_POWER 86DDD008
Device \Driver\nvatabus \Device00006f IRP_MJ_SYSTEM_CONTROL 86DDD008
Device \Driver\nvatabus \Device00006f IRP_MJ_DEVICE_CHANGE 86DDD008
Device \Driver\nvatabus \Device00006f IRP_MJ_QUERY_QUOTA 86DDD008
Device \Driver\nvatabus \Device00006f IRP_MJ_SET_QUOTA 86DDD008
Device \Driver\nvatabus \Device00006f IRP_MJ_PNP 86DDD008
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_READ 8668BAB0
Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_READ 86676380
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_CREATE 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_CREATE_NAMED_PIPE 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_CLOSE 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_READ 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_WRITE 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_QUERY_INFORMATION 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_SET_INFORMATION 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_QUERY_EA 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_SET_EA 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_FLUSH_BUFFERS 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_QUERY_VOLUME_INFORMATION 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_SET_VOLUME_INFORMATION 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_DIRECTORY_CONTROL 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_FILE_SYSTEM_CONTROL 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_DEVICE_CONTROL 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_INTERNAL_DEVICE_CONTROL 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_SHUTDOWN 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_LOCK_CONTROL 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_CLEANUP 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_CREATE_MAILSLOT 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_QUERY_SECURITY 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_SET_SECURITY 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_POWER 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_SYSTEM_CONTROL 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_DEVICE_CHANGE 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_QUERY_QUOTA 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_SET_QUOTA 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_PNP 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1Port1Path0Target0Lun0 IRP_MJ_CREATE 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1Port1Path0Target0Lun0 IRP_MJ_CREATE_NAMED_PIPE 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1Port1Path0Target0Lun0 IRP_MJ_CLOSE 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1Port1Path0Target0Lun0 IRP_MJ_READ 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1Port1Path0Target0Lun0 IRP_MJ_WRITE 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1Port1Path0Target0Lun0 IRP_MJ_QUERY_INFORMATION 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1Port1Path0Target0Lun0 IRP_MJ_SET_INFORMATION 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1Port1Path0Target0Lun0 IRP_MJ_QUERY_EA 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1Port1Path0Target0Lun0 IRP_MJ_SET_EA 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1Port1Path0Target0Lun0 IRP_MJ_FLUSH_BUFFERS 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1Port1Path0Target0Lun0 IRP_MJ_QUERY_VOLUME_INFORMATION 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1Port1Path0Target0Lun0 IRP_MJ_SET_VOLUME_INFORMATION 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1Port1Path0Target0Lun0 IRP_MJ_DIRECTORY_CONTROL 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1Port1Path0Target0Lun0 IRP_MJ_FILE_SYSTEM_CONTROL 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1Port1Path0Target0Lun0 IRP_MJ_DEVICE_CONTROL 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1Port1Path0Target0Lun0 IRP_MJ_INTERNAL_DEVICE_CONTROL 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1Port1Path0Target0Lun0 IRP_MJ_SHUTDOWN 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1Port1Path0Target0Lun0 IRP_MJ_LOCK_CONTROL 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1Port1Path0Target0Lun0 IRP_MJ_CLEANUP 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1Port1Path0Target0Lun0 IRP_MJ_CREATE_MAILSLOT 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1Port1Path0Target0Lun0 IRP_MJ_QUERY_SECURITY 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1Port1Path0Target0Lun0 IRP_MJ_SET_SECURITY 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1Port1Path0Target0Lun0 IRP_MJ_POWER 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1Port1Path0Target0Lun0 IRP_MJ_SYSTEM_CONTROL 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1Port1Path0Target0Lun0 IRP_MJ_DEVICE_CHANGE 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1Port1Path0Target0Lun0 IRP_MJ_QUERY_QUOTA 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1Port1Path0Target0Lun0 IRP_MJ_SET_QUOTA 86DD1720
Device \Driver\d347prt \Device\Scsi\d347prt1Port1Path0Target0Lun0 IRP_MJ_PNP 86DD1720
Device \FileSystem\Fastfat \Fat IRP_MJ_READ 85F05530
Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer IRP_MJ_READ 86EF3368
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer IRP_MJ_READ 86EF3368
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer IRP_MJ_READ 86EF3368
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer IRP_MJ_READ 86EF3368
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer IRP_MJ_READ 86EF3368
Device \FileSystem\Cdfs \Cdfs IRP_MJ_READ 86648F48

—- Files - GMER 1.0.12 —-

ADS C:\Documents and Settings\user\Favorites\Custom Reido\:favicon
ADS C:\Documents and Settings\user\Favorites\Tenjo Tenge\Anime\[:favicon
ADS C:\Documents and Settings\user\Favorites\Tenjo Tenge\Games\ALICE:favicon
ADS C:\Documents and Settings\user\Favorites\Tenjo Tenge\Games\[ Vitamin-Soft ] :favicon
ADS C:\Documents and Settings\user\Favorites\Tenjo Tenge\Games\[03-05-30][:favicon
ADS C:\Documents and Settings\user\Favorites\Tenjo Tenge\Games\[060224][:favicon
ADS C:\Documents and Settings\user\Favorites\Tenjo Tenge\Games\[070223] [BLACK LiLiTH] :favicon
ADS C:\Documents and Settings\user\Favorites\Tenjo Tenge\Games\[2007-02-23][:favicon
ADS C:\Documents and Settings\user\Favorites\Tenjo Tenge\Games\[2007-03-23][Anime Lilith] :favicon
ADS C:\Documents and Settings\user\Favorites\Tenjo Tenge\Games\[:favicon
ADS D:\Overflow\:SummaryInformation
ADS D:\Overflow\:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
File D:\RECYCLER\NPROTECT
File D:\RECYCLER\NPROTECT\NPROTECT.LOG

—- EOF - GMER 1.0.12 —-



DSS Main Log:


Deckard's System Scanner v20070411.38
Run by [removed] on 2007-04-20 at 19:13:49
Computer is in Normal Mode.
——————————————————————————–

– System Restore ————————————————————–

System Restore is disabled; attempting to re-enable…success.


– Last 1 Restore Point(s) –
1: 2007-04-21 02:13:51 UTC - RP2 - System Checkpoint


Performed disk cleanup.


– HijackThis (run as user.exe) ————————————————

Logfile of HijackThis v1.99.1
Scan saved at 7:14:07 PM, on 4/20/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\NORTON~2\NORTON~4\GHOSTS~2.EXE
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
C:\Program Files\PopUp Killer\PopUpKiller.EXE
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\Program Files\D-Tools\daemon.exe
C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\GetRight\Getright.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\user\Desktop\dss.exe
C:\WINDOWS\system32\conime.exe
C:\HIJACK~1\user.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRAM FILES\FLASHGET\JCCATCH.DLL
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [PopUpKiller] C:\Program Files\PopUp Killer\PopUpKiller.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\System32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Start GetRight.lnk = C:\Program Files\GetRight\GETRIGHT.EXE
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Download with GetRight - C:\PROGRA~1\GETRIGHT\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\PROGRA~1\GETRIGHT\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES12031.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES12031.DLL
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRAM FILES\FLASHGET\JETCAR.EXE
O9 - Extra 'Tools' menuitem: &FlashGet; - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRAM FILES\FLASHGET\JETCAR.EXE
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .csm: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .csml: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .cub: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .cube: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .dx: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .emb: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .embl: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .gau: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .jdx: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .mol: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .mop: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .pdb: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .rxn: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .scr: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .skc: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .spt: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .tgf: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .xyz: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1120209053671
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1160072345984
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab34246.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://zone.msn.com/bingame/zuma/default/popcaploader_v6.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~4\GHOSTS~2.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe


– HijackThis Fixed Entries (C:\HIJACK~1\backups\) —————————–

backup-20070418-100923-178 O20 - Winlogon Notify: mszsrn32 - C:\WINDOWS\system32\mszsrn32.dll (file missing)
backup-20070418-100923-532 O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll (file missing)
backup-20070419-010134-254 O16 - DPF: {68253470-5D4F-4CDF-8D9C-353C14A2F013} (SVPorsche Control) - http://seevideo.co.kr/pub/seevideo2003/svporsche.cab

– File Associations ———————————————————–

.vbs - unable to read key
.vbs - unable to read key


– Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ———————

R1 FsVga - c:\windows\system32\drivers\fsvga.sys
R1 GhPciScan (GhostPciScanner) - c:\program files\norton systemworks\norton ghost\ghpciscan.sys
R2 ElbyCDIO (ElbyCDIO Driver) - c:\windows\system32\drivers\elbycdio.sys
R2 NwlnkIpx (NWLink IPX/SPX/NetBIOS Compatible Transport Protocol) - c:\windows\system32\drivers\nwlnkipx.sys
R2 NwlnkNb (NWLink NetBIOS) - c:\windows\system32\drivers\nwlnknb.sys
R2 NwlnkSpx (NWLink SPX/SPXII Protocol) - c:\windows\system32\drivers\nwlnkspx.sys
R2 STEC3 - c:\windows\system32\stec3.sys
R3 ElbyCDFL - c:\windows\system32\drivers\elbycdfl.sys
R3 RadProbe (Radeon Probe Driver) - c:\windows\system32\drivers\radprobe.sys

S2 windev-1a33-45b0 - c:\windows\system32\windev-1a33-45b0.sys (file missing)
S3 npkcrypt - c:\program files\gravity\ro\npkcrypt.sys (file missing)
S3 SDdriver - c:\windows\system32\drivers\sddriver.sys


– Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ——————–

R2 GhostStartService - c:\progra~1\norton~2\norton~4\ghosts~2.exe
R2 Speed Disk service - c:\progra~1\norton~2\norton~2\speedd~1\nopdb.exe

S2 RadClock - c:\windows\system32\radclock.exe


– Scheduled Tasks ————————————————————-

2007-04-20 18:57:00 258 –a—— C:\WINDOWS\Tasks\Uninstall Expiration Reminder.job
2007-04-07 23:00:00 502 –a—— C:\WINDOWS\Tasks\Tune-up Application Start.job
2005-01-31 20:32:08 366 –a—— C:\WINDOWS\Tasks\Symantec NetDetect.job


– Files created between 2007-03-20 and 2007-04-20 —————————–

2007-04-20 19:10:00 0 d——– C:\ScanLogs
2007-04-20 17:39:36 0 d——– C:\Program Files\GMER
2007-04-20 13:54:01 0 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-04-20 13:54:01 0 d——– C:\WINDOWS\LastGood
2007-04-19 00:59:33 0 d——– C:\LSPFix
2007-04-18 09:56:44 260272 -r-hs—- C:\cmldr
2007-04-18 09:56:28 0 dr-hs—- C:\cmdcons
2007-04-18 09:56:27 0 d——– C:\WINDOWS\setup.pss
2007-04-15 10:52:15 0 d——– C:\HijackThis
2007-04-14 17:27:03 3968 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-04-14 16:47:34 0 d–hs—- C:\WINDOWS\CSC
2007-04-14 16:33:07 1835008 –ah—– C:\Documents and Settings\Administrator\ntuser.dat
2007-04-14 16:11:25 91920 –a—— C:\WINDOWS\system32\3ti.exe
2007-04-14 16:07:13 49152 –a—— C:\WINDOWS\3ti.exe
2007-04-14 16:06:05 8704 –a—— C:\WINDOWS\system32\sporder.dll
2007-04-14 16:06:03 16896 –a—— C:\WINDOWS\winsock64.dll
2007-04-04 16:41:17 0 d——– C:\Program Files\SDP Multimedia
2007-04-03 11:00:47 196616 –a—— C:\WINDOWS\system32\SARCheck.dll



– Find3M Report —————————————————————

2007-04-20 13:47:44 0 d——– C:\Program Files\GetRight
2007-04-19 01:38:00 0 d——– C:\Program Files\PopUp Killer
2007-04-14 16:06:25 0 d——– C:\Program Files\FlashGet
2007-04-06 16:38:50 0 d——– C:\Program Files\Warcraft III
2007-03-08 08:36:28 577536 –a—— C:\WINDOWS\system32\user32.dll
2007-03-08 08:36:28 40960 –a—— C:\WINDOWS\system32\mf3216.dll
2007-03-08 08:36:28 281600 –a—— C:\WINDOWS\system32\gdi32.dll
2007-03-08 06:47:48 1843584 –a—— C:\WINDOWS\system32\win32k.sys
2007-02-23 11:31:15 0 d——– C:\Program Files\finish
2007-01-22 21:40:08 78532 –a—— C:\WINDOWS\War3Unin.dat


– Registry Dump —————————————————————


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32"
"MSPY2002"="C:\\WINDOWS\\System32\\IME\\PINTLGNT\\ImScInst.exe /SYNC"
"PHIME2002ASync"="C:\\WINDOWS\\System32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC"
"PHIME2002A"="C:\\WINDOWS\\System32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName"
"PopUpKiller"="C:\\Program Files\\PopUp Killer\\PopUpKiller.EXE"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"QD FastAndSafe"=""
"DAEMON Tools-1033"="\"C:\\Program Files\\D-Tools\\daemon.exe\" -lang 1033"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer"
"AtiPTA"="atiptaxx.exe"
"QuickTime Task"="\"C:\\WINDOWS\\System32\\qttask.exe\" -atboottime"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"Printing Migration"="rundll32.exe C:\\WINDOWS\\System32\\spool\\migrate.dll,ProcessWin9xNetworkPrinters"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Attune Download"="C:\\PROGRA~1\\AVEO\\ATTUNE\\UPDATER1\\ATTUNEL.EXE"
"Mirabilis ICQ"="C:\\Program Files\\ICQ\\icq.exe -minimize"
"NVIEW"="rundll32.exe nview.dll,nViewLoadHook"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NewsUpd"="C:\\Program Files\\Creative\\News\\NewsUpd.EXE /q"
"ReproGDAGD"="C:\\WINDOWS\\SYSTEM\\GDPadAn.exe"
"DigitalGamePadUSB"="C:\\WINDOWS\\SYSTEM32\\dpad.exe"
"ReproGDAGU"="C:\\WINDOWS\\SYSTEM32\\dpusb.exe"
"CC2KUI"=""
"TaskMonitor"="C:\\WINDOWS\\taskmon.exe"
"QuickTime Task"="\"C:\\WINDOWS\\SYSTEM32\\qttask.exe\" -atboottime"
"TkBellExe"="C:\\Program Files\\Common Files\\Real\\Update_OB\\evntsvc.exe -osboot"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\SYSTEM\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"Mirabilis ICQ"="C:\\Program Files\\ICQ\\NDetect.exe"
"InCD"="C:\\Program Files\\Ahead\\InCD\\InCD.exe"
"CreateCD50"="\"C:\\Program Files\\Common Files\\Adaptec Shared\\CreateCD\\CreateCD50.exe\" -r"
"AdaptecDirectCD"="\"C:\\Program Files\\Adaptec\\Easy CD Creator 5\\DirectCD\\DirectCD.exe\""
"eDonkey2000"="C:\\Program Files\\eDonkey2000\\eDonkey2000.exe -t"
"GhostStartTrayApp"="C:\\Program Files\\Symantec\\Norton Ghost 2003\\GhostStartTrayApp.exe"
"Tau Monitor"="C:\\PROGRAM FILES\\AGNITUM\\TAUSCAN 1.5\\TAUMON.EXE"
"PopUpKiller"="C:\\PROGRAM FILES\\POPUP KILLER\\POPUPKILLER.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"QuickTime Task"="\"C:\\WINDOWS\\SYSTEM32\\qttask.exe\" -atboottime"
"LoadQM"="loadqm.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices-]
"TVWatch"="C:\\WINDOWS\\SYSTEM32\\TVWATCH.EXE"
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"SchedulingAgent"="mstask.exe"
"GhostStartService"="C:\\PROGRAM FILES\\SYMANTEC\\NORTON GHOST 2003\\GHOSTSTARTSERVICE.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Acrobat Assistant.lnk"
"backup"="C:\\WINDOWS\\pss\\Acrobat Assistant.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Distillr\\acrotray.exe "
"item"="Acrobat Assistant"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKLM"
"command"=""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AcctMgr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="AcctMgr"
"hkey"="HKLM"
"command"="C:\\Program Files\\Norton SystemWorks\\Password Manager\\AcctMgr.exe /startup"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="atiptaxx"
"hkey"="HKLM"
"command"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDElbyCDFL]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ElbyCheck"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Elaborate Bytes\\CloneCD\\ElbyCheck.exe\" /L ElbyCDFL"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="iTunesHelper"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="dumprep 0 -k"
"hkey"="HKLM"
"command"="%systemroot%\\system32\\dumprep 0 -k"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mirabilis ICQ]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ICQNet"
"hkey"="HKLM"
"command"="C:\\Program Files\\ICQ\\ICQNet.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msmsgs"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVMixerTray]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NVMixerTray"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\NVIDIA Corporation\\NvMixer\\NVMixerTray.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\spoolsvv]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="spoolsvv"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\spoolsvv.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="TeaTimer"
"hkey"="HKCU"
"command"="C:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="jusched"
"hkey"="HKLM"
"command"="C:\\Program Files\\Java\\jre1.5.0_01\\bin\\jusched.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SNDMon"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="AdobeUpdateManager"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe\" AcRdB7_0_7 -reboot 1"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ViewMgr"
"hkey"="HKLM"
"command"="C:\\Program Files\\Viewpoint\\Viewpoint Manager\\ViewMgr.exe"
"inimapping"="0"


[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{35B2861B-2B26-4691-9FF0-09083722C736}"="RadExe Extension"
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"CDRAutoRun"=hex:00,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"CDRAutoRun"=hex:00,00,00,00

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"CDRAutoRun"=hex:00,00,00,00

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
Source REG_SZ 131A6951-7F78-11D0-A979-00C04FD705A2

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ AlerterWebClientLmHostsRemoteRegistryupnphostSSDPSRV\
NetworkService REG_MULTI_SZ DnsCache\
rpcss REG_MULTI_SZ RpcSs\
imgsvc REG_MULTI_SZ StiSvc\
termsvcs REG_MULTI_SZ TermService\
HTTPFilter REG_MULTI_SZ HTTPFilter\
DcomLaunch REG_MULTI_SZ DcomLaunchTermService\



– End of Deckard's System Scanner: finished at 2007-04-20 at 19:14:38 ———



DSS Extra Log:


Deckard's System Scanner v20070411.38
Extra logfile - please post this as an attachment with your post.
——————————————————————————–

– System Information ———————————————————-

Microsoft Windows XP Professional (build 2600) SP 2.0
Architecture: X86; Language: English

CPU 0: AMD Athlon™ XP 2500+
Percentage of Memory in Use: 73%
Physical Memory (total/avail): 1023.48 MiB / 270.37 MiB
Pagefile Memory (total/avail): 2463.02 MiB / 2149.76 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1994.66 MiB

A: is Removable (No Media)
C: is Fixed (NTFS) - 208.68 GiB total, 2.46 GiB free.
D: is Fixed (NTFS) - 89.41 GiB total, 0.07 GiB free.
E: is CDROM (No Media)
F: is CDROM (No Media)


– Security Center ————————————————————-

AUOptions is disabled.
Windows Internal Firewall is enabled.

AV: Norton AntiVirus v2004 (Symantec Corporation) Disabled Outdated


– Environment Variables ——————————————————-

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\user\Application Data
CLASSPATH=.;C:\Program Files\Java\jre1.5.0_01\lib\ext\QTJava.zip
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=JC2500
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\user
include=C:\Program Files\Microsoft Visual Studio\VC98\atl\include;C:\Program Files\Microsoft Visual Studio\VC98\mfc\include;C:\Program Files\Microsoft Visual Studio\VC98\include
lib=C:\Program Files\Microsoft Visual Studio\VC98\mfc\lib;C:\Program Files\Microsoft Visual Studio\VC98\lib
LOGONSERVER=\\JC2500
MSDevDir=C:\Program Files\Microsoft Visual Studio\Common\MSDev98
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\COMMAND;C:\WINDOWS\system32\WBEM;"C:\j2sdk1.4.2_01\bin";"C:\Program Files\Norton SystemWorks\Norton Ghost\";C:\Program Files\UltraEdit;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Microsoft Visual Studio\Common\Tools\WinNT;C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin;C:\Program Files\Microsoft Visual Studio\Common\Tools;C:\Program Files\Microsoft Visual Studio\VC98\bin
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 10 Stepping 0, AuthenticAMD
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0a00
ProgramFiles=C:\Program Files
PROMPT=$p$g
QTJAVA=C:\Program Files\Java\jre1.5.0_01\lib\ext\QTJava.zip
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\user\LOCALS~1\Temp
TMP=C:\DOCUME~1\user\LOCALS~1\Temp
USERDOMAIN=JC2500
USERNAME=user
USERPROFILE=C:\Documents and Settings\user
winbootdir=C:\WINDOWS
windir=C:\WINDOWS


– User Profiles —————————————————————

user (admin)
Administrator (admin)


– Add/Remove Programs ———————————————————

–> "C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:IE50 /UNINSTALL /PROMPT
–> C:\Program Files\Common Files\Real\Update_OB\rnuninst.exe RealNetworks|RealPlayer|6.0
–> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\News\CTNews.isu"
–> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\Uninstall\Installer.isu"
–> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
?r?c?????r?[?` –> MsiExec.exe /I{E9F98D12-1588-4626-9B5C-9308DCD27E60}
7-Zip 4.42 –> "C:\Program Files\7-Zip\Uninstall.exe"
AC3Filter (remove only) –> C:\Program Files\AC3Filter\uninstall.exe
AccessDiver v4.110 –> "C:\Program Files\Accessdiver\unins001.exe"
Ad-Aware SE Personal –> C:\PROGRA~1\LAVASOFT\AD-AWA~2\UNWISE.EXE C:\PROGRA~1\LAVASOFT\AD-AWA~2\INSTALL.LOG
Adobe Acrobat 6.0 Professional –> MsiExec.exe /I{AC76BA86-1033-0000-7760-000000000001}
Adobe Atmosphere Player for Acrobat and Adobe Reader –> C:\WINDOWS\atmoUn.exe
Adobe Download Manager 2.0 (íœ‚Ì‚Ý) –> "C:\Program Files\Common Files\Adobe\ESD\uninst.exe"
Adobe Flash Player 9 ActiveX –> C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
Adobe Reader 7.0.7 –> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70500000002}
AOL Instant Messenger –> C:\Program Files\AIM95\uninstll.exe -LOG= C:\Program Files\AIM95\install.log -OEM=
ATI Display Driver (Omega 3.8.205) –> rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
AVG Anti-Spyware 7.5 –> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe
Biko 's I Love View (DownLoad.Ver) –> C:\Program Files\Illusion\ho?s3_?L???ñ?N?^?r?c?A?[(?_?E?g???[?h.Ver)\LSUin000.exe "C:\Program Files\Illusion\ho?s3_?L???ñ?N?^?r?c?A?[(?_?E?g???[?h.Ver)\LSUin000.lil"
BitComet 0.70 –> C:\Program Files\BitComet\uninst.exe
BitTornado 0.3.7 –> C:\Program Files\BitTornado\uninst.exe
CC_ccStart –> MsiExec.exe /I{D6414CC7-F215-467F-88B1-546ED863F35B}
ccCommon –> MsiExec.exe /I{DC367608-64A7-4BF7-92F4-8BAA25BA02DB}
ChainSlave –> C:\Program Files\Parthenon\ChainSlave\_uninst.exe EDGIGBGJGOFDGMGBHGGF
CircuitMaker 6 Student –> C:\WINDOWS\IsUninst.exe -fC:\CM60S\Uninst.isu
CloneCD –> "C:\Program Files\Elaborate Bytes\CloneCD\ccd-uninst.exe" /D="C:\Program Files\Elaborate Bytes\CloneCD"
Combined Community Codec Pack 2006-05-01 (Remove Only) –> C:\Program Files\Combined Community Codec Pack\Uninstall.exe
Creative LAVA! –> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\LAVA\LAVA2.isu"
DAEMON Tools –> MsiExec.exe /I{3DED3A72-61A8-4B87-98A5-EF0BC8038AA0}
DivX –> C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Player –> C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
Easy CD Creator 5 Basic –> MsiExec.exe /I{609F7AC8-C510-11D4-A788-009027ABA5D0}
eDonkey2000 –> "C:\Program Files\eDonkey2000\uninstall_eDonkey2000.exe"
eMule –> "C:\Program Files\eMule\Uninstall.exe"
FileZilla (remove only) –> "C:\Program Files\FileZilla\uninstall.exe"
FireBurner –> MsiExec.exe /I{850C4C12-57E2-43E4-B66B-B08B120C55F3}
FlashGet(JetCar) –> C:\PROGRA~1\FLASHGET\UNWISE.EXE C:\PROGRA~1\FLASHGET\INSTALL.LOG
GetBot –> C:\Program Files\GetBot\GetBot.exe /addremove
GetRight –> C:\Program Files\GetRight\GETRIGHT.EXE /UNINSTALL
Haali Media Splitter –> "C:\Program Files\Matroska Pack\haali\uninstall.exe"
HijackThis 1.99.1 –> G:\HijackThis.exe /uninstall
HP LaserJet 1100 –> C:\WINDOWS\HPSETUP\1100un32.exe
ICQ –> C:\PROGRA~1\ICQ\ICQUninstall.EXE
IrfanView (remove only) –> C:\Program Files\IrfanView\iv_uninstall.exe
iTunes –> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{59C4F14F-7590-45FC-BE9F-A67AB3590709} /l1033
iView –> C:\WINDOWS\uninst.exe -f"C:\Program Files\iView\DeIsL1.isu" -c"C:\Program Files\iView\_ISREG32.DLL"
J2SE Development Kit 5.0 Update 1 –> MsiExec.exe /I{32A3A4F4-B792-11D6-A78A-00B0D0150010}
J2SE Runtime Environment 5.0 Update 1 –> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150010}
Java 2 Runtime Environment, SE v1.4.1 –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CD0159C9-17FB-11D6-A76A-00B0D079AF64}\setup.exe" Anytext
Java Web Start –> "C:\Program Files\Java Web Start\uninst-javaws.exe"
JograData iView 3.0 –> "C:\Program Files\iView\unins000.exe"
K-Lite Mega Codec Pack 1.01 –> "C:\Program Files\K-Lite Codec Pack\unins000.exe"
Kaspersky Online Scanner –> C:\WINDOWS\system32\KASPER~1\KASPER~1\kavuninstall.exe
KaZaA Lite v2.0.2 [K++ v2.0.3 Edition] –> "C:\Program Files\Kazaa Lite\unins000.exe"
LiveReg (Symantec Corporation) –> C:\Program Files\Common Files\Symantec Shared\LiveReg\VcSetup.exe /REMOVE
LiveUpdate 2.6 (Symantec Corporation) –> C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE /U
LPL Software 2.2 –> "C:\Program Files\LPL Software\unins000.exe"
MAME32k (remove only) –> "C:\Program Files\MAME32k\uninst.exe"
MDL Chime/Chime Pro for Internet Explorer –> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Internet Explorer\Plugins\chime26.isu"
Microsoft Assembler Version 6.15 –> C:\WINDOWS\IsUninst.exe -fC:\Masm615\Uninst.isu
Microsoft Data Access Components KB870669 –> C:\WINDOWS\muninst.exe C:\WINDOWS\INF\KB870669.inf
Microsoft Office 2000 Premium –> MsiExec.exe /I{00000409-78E1-11D2-B60F-006097C998E7}
Microsoft Office Visio Professional 2003 –> MsiExec.exe /I{90510409-6000-11D3-8CFE-0150048383C9}
Microsoft Visual Studio 6.0 Enterprise Edition –> "C:\Program Files\Microsoft Visual Studio\Common\Setup\1033\Setup.exe"
Microsoft Web Publishing Wizard 1.53 –> RunDll32 ADVPACK.DLL,LaunchINFSection C:\WINDOWS\INF\wpie3x86.inf,WebPostUninstall
mIRC –> "C:\Program Files\mIRC\mirc.exe" -uninstall
MSN Messenger 7.5 –> MsiExec.exe /I{CEB3A11A-03EA-11DA-BFBD-00065BBDC0B5}
MSRedist –> MsiExec.exe /I{FC37ABD0-2108-4beb-B010-1254E0662B5A}
MultiRes (remove only) –> C:\Program Files\MultiRes\uninstal.exe
Nero 6 Ultra Edition –> C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
NetBeans IDE 4.0 –> C:\Program Files\netbeans-4.0\_uninst\uninstaller.exe
NJStar Communicator –> "C:\Program Files\NJStar Communicator\Remove.exe" /U:"C:\Program Files\NJStar Communicator\Remove.log"
Norton AntiVirus –> MsiExec.exe /X{C6F5B6CF-609C-428E-876F-CA83176C021B}
Norton AntiVirus Parent MSI –> MsiExec.exe /I{E5EE9939-259F-4DE2-8023-5C49E16A4F43}
Norton CleanSweep –> MsiExec.exe /I{634B01DF-A45B-4623-80E1-E15FF82A4979}
Norton Ghost –> MsiExec.exe /I{BBAAACFA-B012-4367-ADDA-4DDCDFD48F96}
Norton Password Manager –> MsiExec.exe /I{8315D4B0-9BF2-4D63-8654-74B89D288D6E}
Norton SystemWorks 2004 Professional –> MsiExec.exe /I{B9807C3D-B3DD-41b7-8321-53DDB3A3A888}
Norton SystemWorks 2004 Professional (Symantec Corporation) –> C:\Program Files\Common Files\Symantec Shared\SymSetup\{B9807C3D-B3DD-41b7-8321-53DDB3A3A888}.exe /X
Norton Utilities –> MsiExec.exe /I{6A7867BA-B7CA-4CC9-ACAB-85BA46865EE5}
Norton WMI Update –> MsiExec.exe /X{1526D87C-A955-4FAB-BF18-697BA457E352}
NSW_DRM_COLLECTION –> MsiExec.exe /I{900B1884-2D6F-4a70-A3C7-C3F4DA873FDB}
NVIDIA Drivers –> C:\WINDOWS\System32\NVUNINST.EXE UninstallGUI
NvMixer –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D7A6C517-11F2-419F-B5BB-27772B939698}\Setup.exe" -uninstall
Overnet –> "C:\Program Files\Overnet\uninstall_Overnet.exe"
PerformanceTest v4.0 –> "C:\Program Files\PerformanceTest\unins000.exe"
PixMaker –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\ENGINE\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A37161C1-F990-11D3-BE64-00104B229E8F}\SETUP.EXE"
PixScreen_CE –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\ENGINE\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2A6E3140-FF44-11D3-BE64-00104B229E8F}\SETUP.EXE"
PLT Scheme –> C:\PROGRA~1\PLT\Uninstall.exe
PopUp Killer –> C:\WINDOWS\iun6002.exe "C:\Program Files\PopUp Killer\irunin.ini"
QuickTime –> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{C21D5524-A970-42FA-AC8A-59B8C7CDCA31} /l1041
Radeon Omega Drivers v2.6.12 Setup Files –> C:\WINDOWS\iun6002.exe "C:\Program Files\Radeon Omega Drivers\v2.6.12\Omega.ini"
Radeon Omega Drivers v3.8.205 Setup Files and Tools –> "C:\WINDOWS\Radeon Omega Drivers v3.8.205 Uninstall.exe" "/U:C:\Program Files\Radeon Omega Drivers\v3.8.205\Omega Uninstall.xml"
RadLinker –> MsiExec.exe /I{238ABEB6-42D2-4DD7-9928-DE8431519C61}
RealOne Player –> C:\Program Files\Common Files\Real\Update_OB\rnuninst.exe RealNetworks|RealPlayer|6.0
SDP Downloader –> MsiExec.exe /I{B547CB8D-549A-436E-97B5-E79F911B11E2}
Shockwave –> C:\WINDOWS\SYSTEM32\MACROMED\SHOCKW~1\UNWISE.EXE C:\WINDOWS\SYSTEM32\MACROMED\SHOCKW~1\Install.log
Spybot - Search & Destroy 1.3 –> "C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Starcraft –> C:\WINDOWS\SCunin.exe C:\WINDOWS\SCunin.dat
STATGRAPHICS Plus 4.1 –> C:\WINDOWS\uninst.exe -f"C:\Program Files\Statgraphics\STATGRAPHICS Plus 4.1\DeIsL1.isu" -c"C:\Program Files\Statgraphics\STATGRAPHICS Plus 4.1\_ISREG32.DLL"
SWF Extractor 2.2 –> "C:\Program Files\GlobFX Technologies\SWF Extractor\unins000.exe"
Swiff Player 1.1 –> "C:\Program Files\GlobFX Technologies\Swiff Player\unins000.exe"
Symantec Script Blocking Installer –> MsiExec.exe /I{D327AFC9-7BAA-473A-8319-6EB7A0D40138}
SymNet –> MsiExec.exe /I{E47EE8FB-ACC0-4608-859C-4E2851B18A6A}
TeamSpeak 2 RC2 –> "C:\Program Files\Teamspeak2_RC2\unins000.exe"
The Playa –> "C:\Program Files\The Playa\uninstall.exe"
Trillian –> C:\Program Files\Trillian\trillian.exe /uninstall
Tweak UI –> "C:\WINDOWS\system32\mshta.exe" "res://C:\WINDOWS\system32\TweakUI.exe/uninstall.hta"
UltraEdit-32 –> "C:\Program Files\UltraEdit\Uninstall.exe" "C:\Program Files\UltraEdit\ueinstall.log"
Van Dyke Technologies SecureCRT 3.2 –> C:\PROGRA~1\SECURE~1.0\UNINSTAL.EXE C:\PROGRA~1\SECURE~1.0\INSTALL.LOG
Ventrilo Client –> MsiExec.exe /I{789289CA-F73A-4A16-A331-54D498CE069F}
Viewpoint Manager (Remove Only) –> C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgrInstaller.exe /u /k
VobSub v2.23 (Remove Only) –> "C:\Program Files\Gabest\VobSub\uninstall.exe"
Warcraft III: All Products –> C:\WINDOWS\War3Unin.exe C:\WINDOWS\War3Unin.dat
WinAce Archiver 2.0 –> D:\WINACE\SXUNINST.EXE D:\WINACE\SXUNINST.INI
WinProxy Lite –> C:\WINDOWS\uninst.exe -f"C:\Program Files\Ositis Software\WinProxy Lite\DeIsL1.isu" -c"C:\Program Files\Ositis Software\WinProxy Lite\_ISREG32.DLL"
WinRAR archiver –> C:\Program Files\WinRAR\uninstall.exe
WinZip –> "C:\PROGRAM FILES\WINZIP\WINZIP32.EXE" /uninstall
World of Warcraft –> C:\Program Files\Common Files\Blizzard Entertainment\World of Warcraft (2)\Uninstall.exe
X-Win32 6.0 –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{584A5F1C-1A1C-4005-96DA-D4D77DA684F9}\Setup.exe" -l0x9
XviD Media Codec 1.1.0 –> C:\Program Files\XviD\uninst.exe
Yahoo! Messenger –> C:\PROGRA~1\YAHOO!\MESSEN~1\UNWISE.EXE C:\PROGRA~1\YAHOO!\MESSEN~1\INSTALL.LOG
Yahoo! Messenger Explorer Bar –> C:\WINDOWS\SYSTEM\regsvr32 /u /s C:\PROGRA~1\YAHOO!\MESSEN~1\YHEXBM~1.DLL


– End of Deckard's System Scanner: finished at 2007-04-20 at 19:14:38 ———




Sorry it took so long to get back but the scans took a whlie and I didn't get a chance to start them till early afternoon. Thanks a lot Susan for your effort and help!

Backup the registry:

STEP 1.
======
Backup Your Registry with ERUNT

• Please use the following link and scroll down to ERUNT and download it.
  http://aumha.org/freeware/freeware.php
• For version with the Installer:
  Use the setup program to install ERUNT on your computer
• For the zipped version:
  Unzip all the files into a folder of your choice.

Click Erunt.exe to backup your registry to the folder of your choice.

Note: to restore your registry, go to the folder and start ERDNT.exe

Then, go to start–>run

and type this in:
notepad

Paste this into the box:

REGEDIT4

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\spoolsvv]

Then click on the FILE menu and select save as
Save the file as regfix.reg. Save the file to the desktop.
IMPORTANT: make sure to save the file as "all types" and NOT as a text file
**

Now double click on regfix.reg and insert it into the registry.

If you do not still have Deckard’s System Scanner on your desktop ,download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.

• Close all applications and windows.
• Go to start =>run => copy the following bold text into the box and click OK
  ”%userprofile%\desktop\dss.exe” /config
  A box will pop-up and then check the Extra log and Security Center and then Scan.
• When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt<-this one will be minimized
• Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and the extra.txt to your post. in your reply

I will review this and give you final instructions if everything looks fine.

Here are the scans you requested. By the way, I didn't re-enabled Norton Antivirus because I assumed that it wasn't gonna help me since it's outdated and I have AVG for now to help protect me for now before I go and get a new anti-virus. Also, looking at the scan, I'm a bit worried about the stuff created on Apr 14, which was the day I got the virus from visiting a website. Particularly these entries:

2007-04-14 16:47:34 0 d–hs—- C:\WINDOWS\CSC
2007-04-14 16:33:07 1835008 –ah—– C:\Documents and Settings\Administrator\ntuser.dat
2007-04-14 16:06:05 8704 –a—— C:\WINDOWS\system32\sporder.dll

That adminstrator account nntuser.dat creation might explain why I never saw it before until I entered safe mode that day and initialized with no password. Just thought I'd point that out just in case.


Anyways here are the logs:


Main.txt:


Deckard's System Scanner v20070411.38
Run by [removed] on 2007-04-23 at 11:47:58
Computer is in Normal Mode.
——————————————————————————–



– HijackThis (run as user.exe) ————————————————

Logfile of HijackThis v1.99.1
Scan saved at 11:48:02 AM, on 4/23/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\PopUp Killer\PopUpKiller.EXE
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\NORTON~2\NORTON~4\GHOSTS~2.EXE
C:\Program Files\GetRight\Getright.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\user\desktop\dss.exe
C:\WINDOWS\system32\conime.exe
C:\HIJACK~1\user.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRAM FILES\FLASHGET\JCCATCH.DLL
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [PopUpKiller] C:\Program Files\PopUp Killer\PopUpKiller.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\System32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Start GetRight.lnk = C:\Program Files\GetRight\GETRIGHT.EXE
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Download with GetRight - C:\PROGRA~1\GETRIGHT\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\PROGRA~1\GETRIGHT\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES12031.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES12031.DLL
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRAM FILES\FLASHGET\JETCAR.EXE
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRAM FILES\FLASHGET\JETCAR.EXE
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .csm: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .csml: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .cub: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .cube: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .dx: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .emb: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .embl: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .gau: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .jdx: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .mol: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .mop: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .pdb: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .rxn: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .scr: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .skc: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .spt: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .tgf: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .xyz: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1120209053671
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1160072345984
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab34246.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://zone.msn.com/bingame/zuma/default/popcaploader_v6.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~4\GHOSTS~2.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe


– Files created between 2007-03-23 and 2007-04-23 —————————–

2007-04-23 11:38:22 0 d——– C:\Erunt
2007-04-21 09:18:50 0 d——– C:\ATF Cleaner
2007-04-20 19:10:00 0 d——– C:\ScanLogs
2007-04-20 17:39:36 0 d——– C:\Program Files\GMER
2007-04-20 13:54:01 0 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-04-19 00:59:33 0 d——– C:\LSPFix
2007-04-18 09:56:44 260272 -r-hs—- C:\cmldr
2007-04-18 09:56:28 0 dr-hs—- C:\cmdcons
2007-04-18 09:56:27 0 d——– C:\WINDOWS\setup.pss
2007-04-15 10:52:15 0 d——– C:\HijackThis
2007-04-14 17:27:03 3968 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-04-14 16:47:34 0 d–hs—- C:\WINDOWS\CSC
2007-04-14 16:33:07 1835008 –ah—– C:\Documents and Settings\Administrator\ntuser.dat
2007-04-14 16:06:05 8704 –a—— C:\WINDOWS\system32\sporder.dll
2007-04-04 16:41:17 0 d——– C:\Program Files\SDP Multimedia
2007-04-03 11:00:47 196616 –a—— C:\WINDOWS\system32\SARCheck.dll


– Find3M Report —————————————————————

2007-04-23 11:44:02 0 d——– C:\Program Files\PopUp Killer
2007-04-23 11:41:54 0 d——– C:\Program Files\GetRight
2007-04-21 09:10:46 0 d——– C:\Program Files\mIRC
2007-04-14 16:06:25 0 d——– C:\Program Files\FlashGet
2007-04-06 16:38:50 0 d——– C:\Program Files\Warcraft III
2007-03-08 08:36:28 577536 –a—— C:\WINDOWS\system32\user32.dll
2007-03-08 08:36:28 40960 –a—— C:\WINDOWS\system32\mf3216.dll
2007-03-08 08:36:28 281600 –a—— C:\WINDOWS\system32\gdi32.dll
2007-03-08 06:47:48 1843584 –a—— C:\WINDOWS\system32\win32k.sys
2007-02-23 11:31:15 0 d——– C:\Program Files\finish


– Registry Dump —————————————————————


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32"
"MSPY2002"="C:\\WINDOWS\\System32\\IME\\PINTLGNT\\ImScInst.exe /SYNC"
"PHIME2002ASync"="C:\\WINDOWS\\System32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC"
"PHIME2002A"="C:\\WINDOWS\\System32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName"
"PopUpKiller"="C:\\Program Files\\PopUp Killer\\PopUpKiller.EXE"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"QD FastAndSafe"=""
"DAEMON Tools-1033"="\"C:\\Program Files\\D-Tools\\daemon.exe\" -lang 1033"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer"
"AtiPTA"="atiptaxx.exe"
"QuickTime Task"="\"C:\\WINDOWS\\System32\\qttask.exe\" -atboottime"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"Printing Migration"="rundll32.exe C:\\WINDOWS\\System32\\spool\\migrate.dll,ProcessWin9xNetworkPrinters"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Attune Download"="C:\\PROGRA~1\\AVEO\\ATTUNE\\UPDATER1\\ATTUNEL.EXE"
"Mirabilis ICQ"="C:\\Program Files\\ICQ\\icq.exe -minimize"
"NVIEW"="rundll32.exe nview.dll,nViewLoadHook"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NewsUpd"="C:\\Program Files\\Creative\\News\\NewsUpd.EXE /q"
"ReproGDAGD"="C:\\WINDOWS\\SYSTEM\\GDPadAn.exe"
"DigitalGamePadUSB"="C:\\WINDOWS\\SYSTEM32\\dpad.exe"
"ReproGDAGU"="C:\\WINDOWS\\SYSTEM32\\dpusb.exe"
"CC2KUI"=""
"TaskMonitor"="C:\\WINDOWS\\taskmon.exe"
"QuickTime Task"="\"C:\\WINDOWS\\SYSTEM32\\qttask.exe\" -atboottime"
"TkBellExe"="C:\\Program Files\\Common Files\\Real\\Update_OB\\evntsvc.exe -osboot"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\SYSTEM\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"Mirabilis ICQ"="C:\\Program Files\\ICQ\\NDetect.exe"
"InCD"="C:\\Program Files\\Ahead\\InCD\\InCD.exe"
"CreateCD50"="\"C:\\Program Files\\Common Files\\Adaptec Shared\\CreateCD\\CreateCD50.exe\" -r"
"AdaptecDirectCD"="\"C:\\Program Files\\Adaptec\\Easy CD Creator 5\\DirectCD\\DirectCD.exe\""
"eDonkey2000"="C:\\Program Files\\eDonkey2000\\eDonkey2000.exe -t"
"GhostStartTrayApp"="C:\\Program Files\\Symantec\\Norton Ghost 2003\\GhostStartTrayApp.exe"
"Tau Monitor"="C:\\PROGRAM FILES\\AGNITUM\\TAUSCAN 1.5\\TAUMON.EXE"
"PopUpKiller"="C:\\PROGRAM FILES\\POPUP KILLER\\POPUPKILLER.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"QuickTime Task"="\"C:\\WINDOWS\\SYSTEM32\\qttask.exe\" -atboottime"
"LoadQM"="loadqm.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices-]
"TVWatch"="C:\\WINDOWS\\SYSTEM32\\TVWATCH.EXE"
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"SchedulingAgent"="mstask.exe"
"GhostStartService"="C:\\PROGRAM FILES\\SYMANTEC\\NORTON GHOST 2003\\GHOSTSTARTSERVICE.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Acrobat Assistant.lnk"
"backup"="C:\\WINDOWS\\pss\\Acrobat Assistant.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Distillr\\acrotray.exe "
"item"="Acrobat Assistant"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKLM"
"command"=""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AcctMgr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="AcctMgr"
"hkey"="HKLM"
"command"="C:\\Program Files\\Norton SystemWorks\\Password Manager\\AcctMgr.exe /startup"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="atiptaxx"
"hkey"="HKLM"
"command"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDElbyCDFL]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ElbyCheck"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Elaborate Bytes\\CloneCD\\ElbyCheck.exe\" /L ElbyCDFL"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="iTunesHelper"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="dumprep 0 -k"
"hkey"="HKLM"
"command"="%systemroot%\\system32\\dumprep 0 -k"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mirabilis ICQ]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ICQNet"
"hkey"="HKLM"
"command"="C:\\Program Files\\ICQ\\ICQNet.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msmsgs"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVMixerTray]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NVMixerTray"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\NVIDIA Corporation\\NvMixer\\NVMixerTray.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="TeaTimer"
"hkey"="HKCU"
"command"="C:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="jusched"
"hkey"="HKLM"
"command"="C:\\Program Files\\Java\\jre1.5.0_01\\bin\\jusched.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SNDMon"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="AdobeUpdateManager"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe\" AcRdB7_0_7 -reboot 1"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ViewMgr"
"hkey"="HKLM"
"command"="C:\\Program Files\\Viewpoint\\Viewpoint Manager\\ViewMgr.exe"
"inimapping"="0"


[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{35B2861B-2B26-4691-9FF0-09083722C736}"="RadExe Extension"
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"CDRAutoRun"=hex:00,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"CDRAutoRun"=hex:00,00,00,00

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"CDRAutoRun"=hex:00,00,00,00

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
Source REG_SZ 131A6951-7F78-11D0-A979-00C04FD705A2

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ AlerterWebClientLmHostsRemoteRegistryupnphostSSDPSRV\
NetworkService REG_MULTI_SZ DnsCache\
rpcss REG_MULTI_SZ RpcSs\
imgsvc REG_MULTI_SZ StiSvc\
termsvcs REG_MULTI_SZ TermService\
HTTPFilter REG_MULTI_SZ HTTPFilter\
DcomLaunch REG_MULTI_SZ DcomLaunchTermService\



– End of Deckard's System Scanner: finished at 2007-04-23 at 11:48:29 ———





Extra.txt:

Deckard's System Scanner v20070411.38
Extra logfile - please post this as an attachment with your post.
——————————————————————————–

– Security Center ————————————————————-

AUOptions is disabled.
Windows Internal Firewall is enabled.

AV: Norton AntiVirus v2004 (Symantec Corporation) Disabled Outdated


– End of Deckard's System Scanner: finished at 2007-04-23 at 11:48:29 ———



Thanks a lot Susan!

Hi JCInfected,

I got tied up helping my daughter with MS-Word and scanning pictures last night! Why do they wait until the last minute?

I've decided to return BitDefender 10 and purchase Kaspersky Internet Security which includes the firewall as well.

Good!

You can delete the tools we used like:
Deckards System Scanner
SDFix
GMER

I would change all my passwords and go ahead and set a password for the Administrator user profile. Be sure and update your Java!


STEP 1.
Reset hidden/system files and folders

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View tab.
• Deselect the Show hidden files and folders option.
• Select the Hide file extensions for known types option.
• Select the Hide protected operating system files option.
• Click Yes to confirm.
• Click OK.

STEP 2.
System Restore for Windows XP
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected)

• Turn off System Restore.
• On the Desktop, right-click My Computer.
• Click Properties.
• Click the System Restore tab.
• Check Turn off System Restore.
• Click Apply, and then click OK.

Reboot.

Turn ON System Restore.

• On the Desktop, right-click My Computer.
• Click Properties.
• Click the System Restore tab.
• UN-Check *Turn off System Restore*.
• Click Apply, and then click OK.

STEP 3.
======
DON’T BECOME OVERCONFIDENT WITH ANTIVIRUS APPLICATIONS INSTALLED!!!

http://forum.malwareremoval.com/viewtopic….39eba6ea0b5e8ee

Stay up to date on security patches and be extremely wary of clicking on links and attachments that arrive unbidden in instant messages and e-mail.

"The number one thing the majority of the malicious code we're seeing now does is disable or delete anti-virus and other security software," Dunham said. "In a lot of cases, once the user clicks on that attachment, it's already too late."

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

• Kasperky Internet Security is important!
  
  
• Visit Microsoft's Update Site Frequently - It is important that you visit Windows Updates regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  
• Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.
  A tutorial on installing & using this product can be found here:
  Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer
  
  
• Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
  A tutorial on installing & using this product can be found here:
  Using SpywareBlaster to protect your computer from Spyware and Malware
  
  
• Updating Java
  • Download the latest version of Java Runtime Environment (JRE) 6u1.
  • Scroll down to where it says "The Java SE Runtime Environment (JRE) allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • Check the box that says: "Accept License Agreement".
  • The page will refresh.
  • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u1-windows-i586-p.exe to install the newest version.
• Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
  
  
• More info on how to prevent malware you can also find here (By Tony Klein)

Follow this list and your potential for being infected again will reduce dramatically.

Thank you for allowing me to assist you.

Susan