This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Unkown Popups Winspool.exe Errors. Help!

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

I was wondering if someone could help me wiht this log. I thought I got rid of it using Virtumondobegone. But I'm still getting errors and popups especially System Doctor 2006 . Any help is greatly appreciated.

Thanks.


Logfile of HijackThis v1.99.1
Scan saved at 4:26:44 PM, on 4/19/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware Pro\aawservice.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\AvidSDMService.exe
C:\Program Files\LogMeIn\RaMaint.exe
C:\Program Files\LogMeIn\LogMeIn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\LogMeIn\LogMeInSystray.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9HA.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\xloadnet\xloadnet.exe
C:\WINDOWS\updater.exe
C:\DOCUME~1\JOSH~1.JOS\MYDOCU~1\RACLE~1\netdde.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Common Files\??sks\winspool.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Josh.JOSHDESKTOP\Desktop\New Folder\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_3_16_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1557B435-8242-4686-9AA3-9265BF7525A4} - C:\WINDOWS\System32\upgixnpq.dll
O2 - BHO: (no name) - {27E4A093-6376-618A-22E3-12833DDF9EC3} - (no file)
O2 - BHO: (no name) - {4393F137-6082-3F0B-F24B-1BE34FE6FAC9} - C:\WINDOWS\System32\ctvzoa.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: WsftpBrowserHelper Class - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\Ipswitch\WS_FTP Home\wsbho2k0.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_3_16_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [EPSON Stylus Photo RX620 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9HA.EXE /P31 "EPSON Stylus Photo RX620 Series" /O6 "USB001" /M "Stylus Photo RX620"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\LogMeInSystray.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [xloadnet] "C:\Program Files\xloadnet\xloadnet.exe"
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\updater.exe 61A847B5BBF72810329B385473F001F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Tsrm] "C:\DOCUME~1\JOSH~1.JOS\MYDOCU~1\RACLE~1\netdde.exe" -vt yazb
O4 - HKCU\..\Run: [Ccqgmij] "C:\Program Files\Common Files\??sks\winspool.exe"
O4 - HKCU\..\Run: [IpWins] C:\Program Files\Ipwindows\ipwins.exe
O4 - Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\IEExtension.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\IEExtension.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: AbsolutePoker.com - {EFFF8D47-D060-4108-B761-E8EC86622E56} - C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra 'Tools' menuitem: AbsolutePoker.com - {EFFF8D47-D060-4108-B761-E8EC86622E56} - C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe
O9 - Extra button: Royal Vegas Poker - {FA4904B4-1FAF-4afd-886C-C19D2297BA62} - C:\Program Files\royalvegasMPP\MPPoker.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O15 - Trusted Zone: *.sxload.net (HKLM)
O16 - DPF: {413D6754-BFD4-47FE-9346-319559290BFA} (HTECtrl Class) - https://www.webpcfos.com/webpcfos/websabre/HTEweb_new.cab
O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} (king.com) - http://www.king.com/ctl/kingcomie.cab
O16 - DPF: {A7ECD556-D6F6-4F41-8C6B-14AB246801A0} (Secure Delivery) - http://cdn.digitalcity.com/video/kdx.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll
O20 - Winlogon Notify: pmkhi - pmkhi.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware Pro\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Avid SDM Service (AvidSDMService) - Avid Technology, Inc. - C:\WINDOWS\system32\AvidSDMService.exe
O23 - Service: Avid Startup (AvidStartup) - Unknown owner - C:\WINDOWS\system32\AvidStartup.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\LogMeIn.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)
Hi, jrizzle77and welcome to Tom Coyote forums

I am currently looking over your log. As I am an Undergraduate, everything that I post to you must be checked by an Admin or Moderator. Thus, there may be a tiny bit of a delay between posts, but it shouldn't be too long. I will post back shortly with a potential fix.

Thanks for your patience!
dan
Hi jrizzle77

Firstly you have no protection on this machine something we will address very soon when I've cleared up this Infection

Submit a file to Jotti
Please go here : http://virusscan.jotti.org/
On top of the page there is a field to add the filepath,browse and find the file click open which will place it in the field.

C:\Program Files\xloadnet\xloadnet.exe
C:\WINDOWS\updater.exe

Then hit Submit
The scan will take a while before the result comes up so please be patient.
Then copy the result and post it here in this thread.

If Jotti's service load is too high, you can use the following scanner instead:
http://www.virustotal.com/xhtml/index_en.html
____________

1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it will produce a logfile located at C:\ComboFix.txt.
4. Post the contents of that log in your next reply with a new hijackthis log.


Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Please include new HJT log plus combofix report
in your next post
Thanks dan
Here are my two new logs First up is the Combo Fix Log :

ComboFix 07-04-22.6V - Running from: "C:\Documents and Settings\Josh.JOSHDESKTOP\Application Data\IDM\DwnlData\Josh\ComboFix_778\"


(((((((((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\ddabb.dll
C:\WINDOWS\system32\oihtwafg.dll
C:\WINDOWS\system32\upgixnpq.dll
C:\WINDOWS\system32\efcdbax.dll
C:\WINDOWS\system32\fcccyyv.dll
C:\WINDOWS\system32\bbadd.ini


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\timessquare1.dat
C:\Program Files\Common Files\Yazzle1122OinAdmin.exe
C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe
C:\Program Files\Common Files\Yazzle1281OinAdmin.exe
C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe
C:\WINDOWS\system32\atmtd.dll
C:\WINDOWS\system32\atmtd.dll._
C:\WINDOWS\uninstall_nmon.vbs
C:\WINDOWS\system32\ipv6mons.dll
C:\WINDOWS\updater.exe
C:\Program Files\ipwindows\ipwins.dll
C:\Program Files\ipwindows\ipwins.exe
C:\Program Files\ipwindows\UnInstall.exe
C:\Program Files\network monitor\netmon.exe
C:\Program Files\outerinfo\Terms.rtf
C:\Program Files\webhancer\Programs\license.txt
C:\Program Files\webhancer\Programs\readme.txt
C:\Program Files\webhancer\Programs\SET5B.tmp
C:\Program Files\webhancer\Programs\SET5D.tmp
C:\Program Files\webhancer\Programs\SET5F.tmp
C:\Program Files\webhancer\Programs\sporder.dll
C:\Program Files\webhancer\Programs\webhdll.dll
C:\Program Files\webhancer\Programs\whagent.exe
C:\Program Files\webhancer\Programs\whAgent.ini
C:\Program Files\webhancer\Programs\whiehlpr.dll
C:\Program Files\webhancer\Programs\whinstaller.exe
C:\DOCUME~1\LOCALS~1.000\APPLIC~1\netmon\domains.txt
C:\DOCUME~1\LOCALS~1.000\APPLIC~1\netmon\log.txt
C:\WINDOWS\cnViaW5z\asappsrv.dll
C:\WINDOWS\cnViaW5z\command.exe
C:\WINDOWS\cnViaW5z\wBp2uqcW.vbs
C:\DOCUME~1\JOSH~1.JOS\Desktop.\internet explorer.lnk
C:\WINDOWS\system32\tsuninst.exe
C:\WINDOWS\system32\wnstssv.exe
C:\install.log
C:\WINDOWS\scvhost.exe
C:\WINDOWS\winhp32.exe
C:\Program Files\inetget2
C:\Program Files\ipwindows
C:\Program Files\network monitor
C:\Program Files\outerinfo
C:\Program Files\webhancer
C:\DOCUME~1\LOCALS~1.000\APPLIC~1\netmon
C:\WINDOWS\cnViaW5z
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Folders Quarantined:
C:\qoobox\purity\C\DOCUME~1
C:\qoobox\purity\C\DOCUME~1\JOSH~1.JOS
C:\qoobox\purity\C\DOCUME~1\JOSH~1.JOS\MYDOCU~1
C:\qoobox\purity\C\DOCUME~1\JOSH~1.JOS\MYDOCU~1\RACLE~1
C:\qoobox\purity\C\DOCUME~1\JOSH~1.JOS\MYDOCU~1\RACLE~1\netdde.exe
C:\qoobox\purity\C\DOCUME~1\JOSH~1.JOS\MYDOCU~1\RACLE~1\?racle
C:\qoobox\purity\C\Program Files\Common Files\SKS~1


((((((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


——-\cmdService
——-\Network Monitor
——-\LEGACY_CMDSERVICE
——-\LEGACY_NETWORK_MONITOR


((((((((((((((((((((((((((((((( Files Created from 2007-03-22 to 2007-04-22 ))))))))))))))))))))))))))))))))))


2007-04-20 08:57 d——– C:\Program Files\iTunes
2007-04-20 08:53 d——– C:\Program Files\Apple Software Update
2007-04-19 20:28 d——– C:\!KillBox
2007-04-19 09:06 d——– C:\Program Files\Common Files\??sks
2007-04-19 00:44 4,440,064 –a—— C:\DOCUME~1\JOSH~1.JOS\ntuser.dat
2007-04-19 00:14 d——– C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Lavasoft
2007-04-18 15:01 281,172 –ahs—- C:\WINDOWS\system32\awtsr.dll.vir
2007-04-18 15:01 1,402,119 —hs—- C:\WINDOWS\system32\rstwa.bak1
2007-04-18 14:50 60,928 –a—— C:\WINDOWS\system32\ctvzoa.dll
2007-04-18 14:49 26,694 –a—— C:\WINDOWS\system32\jkkkhif.dll.vir
2007-04-18 14:41 d——– C:\Program Files\VisualKore
2007-04-16 17:49 d——– C:\Program Files\Southwest Airlines
2007-04-16 17:49 d——– C:\DOCUME~1\JOSH~1.JOS\APPLIC~1\Southwest Airlines
2007-04-16 17:48 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-04-11 09:49 d——– C:\DOCUME~1\JOSH~1.JOS\APPLIC~1\Joost
2007-04-06 09:05 d——– C:\Program Files\DAEMON Tools
2007-04-06 09:00 49,152 –a—— C:\WINDOWS\system32\ChCfg.exe
2007-04-06 08:59 577,536 –a—— C:\WINDOWS\soundman.exe
2007-04-06 08:59 57,344 –a—— C:\WINDOWS\system32\drivers\drmk.sys
2007-04-06 08:59 4,027,840 -ra—— C:\WINDOWS\system32\drivers\alcxwdm.sys
2007-04-06 08:59 217,088 –a—— C:\WINDOWS\Alcrmv.exe
2007-04-06 08:59 147,456 –a—— C:\WINDOWS\system32\RtlCPAPI.dll
2007-04-06 08:59 135,040 –a—— C:\WINDOWS\system32\drivers\portcls.sys
2007-04-06 08:59 10,528,768 –a—— C:\WINDOWS\system32\RTLCPL.exe
2007-04-06 08:59 d——– C:\Program Files\Realtek AC97
2007-04-06 08:57 208,896 –a—— C:\WINDOWS\system32\NVUNINST.EXE
2007-04-06 08:57 d——– C:\NVIDIA
2007-04-06 08:46 646,392 –a—— C:\WINDOWS\system32\drivers\sptd.sys
2007-04-05 14:13 d——– C:\Program Files\Joost
2007-04-04 14:51 5,632 –a—— C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-03-22 17:39 d——– C:\Program Files\Orb Networks


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-04-22 16:18 ——– d——– C:\Program Files\logmein
2007-04-20 16:52 17536 –a—— C:\WINDOWS\mozver.dat
2007-04-20 10:06 ——– d——– C:\DOCUME~1\JOSH~1.JOS\APPLIC~1\dmcache
2007-04-20 08:57 ——– d——– C:\Program Files\ipod
2007-04-20 08:55 ——– d——– C:\Program Files\quicktime
2007-04-19 09:06 ——– d——– C:\Program Files\Common Files\??sks
2007-04-19 00:14 ——– d——– C:\Program Files\lavasoft
2007-04-14 20:49 ——– d——– C:\DOCUME~1\JOSH~1.JOS\APPLIC~1\jams
2007-04-06 12:25 ——– d——– C:\Program Files\bodog poker
2007-03-19 23:31 ——– d——– C:\DOCUME~1\JOSH~1.JOS\APPLIC~1\viewpoint
2007-03-15 13:23 ——– d——– C:\DOCUME~1\JOSH~1.JOS\APPLIC~1\skype
2007-03-15 09:08 101438 –a—— C:\WINDOWS\b122.exe
2007-03-08 12:07 33592 –a—— C:\WINDOWS\system32\drivers\atwpkt264.sys
2007-03-08 12:07 103984 –a—— C:\WINDOWS\system32\aoldial.dll
2007-03-08 12:06 25136 –a—— C:\WINDOWS\system32\drivers\atwpkt2.sys
2007-03-01 18:02 ——– d——– C:\DOCUME~1\JOSH~1.JOS\APPLIC~1\command & conquer 3 tiberium wars demo
2007-02-19 06:01 252356 –a—— C:\WINDOWS\b128.exe
2007-01-24 15:25 66408 –a—— C:\WINDOWS\system32\dxdllreg.exe


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{0055C089-8582-441B-A0BF-17B458C2A3A8} C:\Program Files\Internet Download Manager\IDMIECC.dll
{02478D38-C3F9-4efb-9B51-7695ECA05670} C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_3_16_0.dll
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
{1557B435-8242-4686-9AA3-9265BF7525A4} C:\WINDOWS\System32\upgixnpq.dll [x]
{4393F137-6082-3F0B-F24B-1BE34FE6FAC9} C:\WINDOWS\System32\ctvzoa.dll
{53707962-6F74-2D53-2644-206D7942484F} C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
{601ED020-FB6C-11D3-87D8-0050DA59922B} C:\Program Files\Ipswitch\WS_FTP Home\wsbho2k0.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} c:\program files\google\googletoolbar1.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"EPSON Stylus Photo RX620 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATI9HA.EXE /P31 \"EPSON Stylus Photo RX620 Series\" /O6 \"USB001\" /M \"Stylus Photo RX620\""
"LogMeIn GUI"="\"C:\\Program Files\\LogMeIn\\LogMeInSystray.exe\""
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvMcTray.dll,NvTaskbarInit"
"SoundMan"="SOUNDMAN.EXE"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINDOWS\\System32\\ctfmon.exe"
"AIM"="C:\\Program Files\\AIM\\aim.exe -cnetwait.odl"
"Aim6"="\"C:\\Program Files\\AIM6\\aim6.exe\" /d locale=en-US ee://aol/imApp"
"DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033"
"Tsrm"="\"C:\\DOCUME~1\\JOSH~1.JOS\\MYDOCU~1\\RACLE~1\\netdde.exe\" -vt yazb"
"Ccqgmij"="\"C:\\Program Files\\Common Files\\??sks\\winspool.exe\""
"offr"="C:\\PROGRA~1\\COMMON~1\\offr\\offrm.exe"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"mprxle"="C:\\WINDOWS\\System32\\mprxle.exe"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"mprxle"="C:\\WINDOWS\\System32\\mprxle.exe"
"services32"="C:\\Program Files\\Common Files\\Windows\\mc-110-12-0000179.exe"
"offr"="C:\\PROGRA~1\\COMMON~1\\offr\\offrm.exe"
"CU1"="C:\\Program Files\\Common Files\\VCClient\\VCClient.exe"
"CU2"="C:\\Program Files\\Common Files\\VCClient\\VCMain.exe"
"Tsrm"="\"C:\\Program Files\\aoep\\tweu.exe\" -vt yazr"
"Lsqu"="C:\\WINDOWS\\System32\\n?tdde.exe"
"Spyware Doctor"=""
"MySpaceIM"="C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer\Run]
"mprxle"="C:\\WINDOWS\\System32\\mprxle.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{54D9498B-CF93-414F-8984-8CE7FDE0D391}"="ewido shell guard"
"{9EF34FF2-3396-4527-9D27-04C8C1C67806}"="Microsoft AntiSpyware Service Hook"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmkhi

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"appinit_dlls"="C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\
Security Packages REG_MULTI_SZ kerberosmsv1_0schannelwdigest\
Notification Packages REG_MULTI_SZ scecli\


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator.RUBINS-NNMJ1QKC^Start Menu^Programs^Startup^Webshots.lnk]
"path"="C:\\Documents and Settings\\Administrator.RUBINS-NNMJ1QKC\\Start Menu\\Programs\\Startup\\Webshots.lnk"
"backup"="C:\\WINDOWS\\pss\\Webshots.lnkStartup"
"location"="Startup"
"command"="C:\\PROGRA~1\\Webshots\\Launcher.exe /t"
"item"="Webshots"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
"path"="C:\\Documents and Settings\\All Users.WINDOWS\\Start Menu\\Programs\\Startup\\Adobe Gamma Loader.lnk"
"backup"="C:\\WINDOWS\\pss\\Adobe Gamma Loader.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\COMMON~1\\Adobe\\CALIBR~1\\ADOBEG~1.EXE "
"item"="Adobe Gamma Loader"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
"path"="C:\\Documents and Settings\\All Users.WINDOWS\\Start Menu\\Programs\\Startup\\America Online 9.0 Tray Icon.lnk"
"backup"="C:\\WINDOWS\\pss\\America Online 9.0 Tray Icon.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\AMERIC~1.0A\\aoltray.exe -check"
"item"="America Online 9.0 Tray Icon"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^CallPacketPhone.lnk]
"path"="C:\\Documents and Settings\\All Users.WINDOWS\\Start Menu\\Programs\\Startup\\CallPacketPhone.lnk"
"backup"="C:\\WINDOWS\\pss\\CallPacketPhone.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\CALLPA~1\\CALLPA~1.EXE "
"item"="CallPacketPhone"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Free WebSite Tools.lnk]
"path"="C:\\Documents and Settings\\All Users.WINDOWS\\Start Menu\\Programs\\Startup\\Free WebSite Tools.lnk"
"backup"="C:\\WINDOWS\\pss\\Free WebSite Tools.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\COFFEE~1\\COFFEE~1\\THIRTY~1.EXE "
"item"="Free WebSite Tools"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]
"path"="C:\\Documents and Settings\\All Users.WINDOWS\\Start Menu\\Programs\\Startup\\InterVideo WinCinema Manager.lnk"
"backup"="C:\\WINDOWS\\pss\\InterVideo WinCinema Manager.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\INTERV~1\\Common\\Bin\\WINCIN~1.EXE "
"item"="InterVideo WinCinema Manager"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Josh.JOSHDESKTOP^Start Menu^Programs^Startup^AOL OpenRide.lnk]
"path"="C:\\Documents and Settings\\Josh.JOSHDESKTOP\\Start Menu\\Programs\\Startup\\AOL OpenRide.lnk"
"backup"="C:\\WINDOWS\\pss\\AOL OpenRide.lnkStartup"
"location"="Startup"
"command"="C:\\PROGRA~1\\COMMON~1\\AOL\\Launch\\AOLLAU~1.EXE /d suiteid=OpenRideSuite_1.25.9.1 /d locale=en-US ee://aol/frontierApp /preload"
"item"="AOL OpenRide"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupregwao0o9s.dll]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="RUNDLL32"
"hkey"="HKLM"
"command"="RUNDLL32.EXE 0wao0o9s.dll,b 1921032921"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="aim"
"hkey"="HKCU"
"command"="C:\\Program Files\\AIM\\aim.exe -cnetwait.odl"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="aim6"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\AIM6\\aim6.exe\" /d locale=en-US ee://aol/imApp"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Anti Trojan Elite]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="TJEnder"
"hkey"="HKLM"
"command"="C:\\Program Files\\Anti Trojan Elite\\TJEnder.exe :NO"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="AOLDial"
"hkey"="HKLM"
"command"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ctfmon"
"hkey"="HKCU"
"command"="C:\\WINDOWS\\System32\\ctfmon.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeadAIM]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="DeadAIM"
"hkey"="HKLM"
"command"="rundll32.exe \"C:\\PROGRA~1\\AIM\\\\DeadAIM.ocm\",ExportedCheckODLs"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\farmmext]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="farmmext"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\farmmext.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="googletalk"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Google\\Google Talk\\googletalk.exe\" /autostart"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gwcaavyo]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="gwcaavyo"
"hkey"="HKLM"
"command"="c:\\windows\\system32\\gwcaavyo.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="AOLSoftware"
"hkey"="HKLM"
"command"="C:\\Program Files\\Common Files\\AOL\\1124070619\\ee\\AOLSoftware.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Io73RUiFl]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="wtshept"
"hkey"="HKCU"
"command"="wtshept.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LFM]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="LeapFrogMessenger"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\LeapFrogMessenger\\LeapFrogMessenger.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lspins]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="igps"
"hkey"="HKLM"
"command"="\"C:\\WINDOWS\\System32\\igps.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msmsgs"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msnmsgr"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="MySpaceIM"
"hkey"="HKCU"
"command"="C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NvCpl"
"hkey"="HKLM"
"command"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\oiftyvhqpom]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="gwcaavyo"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\System32\\gwcaavyo.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PopUpStopperFreeEdition]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="PSFree"
"hkey"="HKCU"
"command"="\"C:\\PROGRA~1\\PANICW~1\\POP-UP~1\\PSFree.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pure Networks Port Magic]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="PortAOL"
"hkey"="HKLM"
"command"="\"C:\\PROGRA~1\\PURENE~1\\PORTMA~1\\PortAOL.exe\" -Run"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="RealPlay"
"hkey"="HKLM"
"command"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Skype"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="TeaTimer"
"hkey"="HKCU"
"command"="C:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="jusched"
"hkey"="HKLM"
"command"="C:\\Program Files\\Java\\j2re1.4.2_04\\bin\\jusched.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SurfAccuracy]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SAcc"
"hkey"="HKLM"
"command"="C:\\Program Files\\SurfAccuracy\\SAcc.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SNDMon"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="realsched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\webHancer Survey Companion]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="whSurvey"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\webHancer\\Programs\\whSurvey.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ypager"
"hkey"="HKCU"
"command"="C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe -quiet"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZingSpooler]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ZingSpooler"
"hkey"="HKLM"
"command"="C:\\Program Files\\Common Files\\Zing\\ZingSpooler.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ewido security suite control"=dword:00000002
"AOLService"=dword:00000002
"Adobe LM Service"=dword:00000003

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ AlerterWebClientLmHostsRemoteRegistryupnphostSSDPSRV\
NetworkService REG_MULTI_SZ DnsCache\
rpcss REG_MULTI_SZ RpcSs\
imgsvc REG_MULTI_SZ StiSvc\
termsvcs REG_MULTI_SZ TermService\


[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{831b0e9e-79de-11d8-92de-806d6172696f}]
Shell\AutoRun\command D:\Info.exe folder.htt 480 480
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_IPOD_SERVICE


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\Disk Cleanup.job
C:\WINDOWS\tasks\Symantec NetDetect.job

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-04-22 23:16:28
Windows 5.1.2600 NTFS

scanning hidden processes …

scanning hidden services …

scanning hidden autostart entries …

scanning hidden files …

C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\Balletducky25\2004-07-20 [Tuesday]\josh.jpg 12288 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\Balletducky25\2004-07-20 [Tuesday]\josh2.jpg 61440 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\beachbum33o\2004-08-05 [Thursday]\josh.jpg 12288 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\beachbum33o\2004-08-05 [Thursday]\noname1091685750.bmp 454656 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\CHiCA40004\2004-07-13 [Tuesday]\josh.jpg 12288 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\CHiCA40004\2004-07-13 [Tuesday]\josh2.jpg 61440 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\cr-Chat22911706871481999005\2004-06-03 [Thursday].htm 248 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\cr-Chat22911706871481999005\fmt 32 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\cr-Chat37504090694287827358\2004-08-05 [Thursday].htm 248 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\cr-Chat37504090694287827358\fmt 32 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\CRyStLcIeR\2004-07-20 [Tuesday]\josh.jpg 12288 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\CRyStLcIeR\2004-07-20 [Tuesday]\josh2.jpg 61440 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\Flirtibabe9\2004-08-05 [Thursday]\josh.jpg 12288 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\Flirtibabe9\2004-08-05 [Thursday]\My Pic.jpg 36864 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\FoxyChica523\2004-06-27 [Sunday]\1.bmp 843776 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\FoxyChica523\2004-06-27 [Sunday]\josh.jpg 12288 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\FoxyChica523\2004-06-27 [Sunday]\josh2.jpg 61440 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\FoxyChica523\2004-06-27 [Sunday]\mandi.jpg 36864 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\GIRL1rough\2004-08-05 [Thursday]\josh.jpg 12288 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\HoTPrInCeSs2424\2004-07-14 [Wednesday]\josh.jpg 12288 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\HoTPrInCeSs2424\2004-07-14 [Wednesday]\josh2.jpg 61440 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\HoTPrInCeSs2424\2004-07-14 [Wednesday]\me n muh brother2.JPG 65536 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\L0veMe1tyme\2004-06-20 [Sunday]\bendover.jpg 61440 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\L0veMe1tyme\2004-06-20 [Sunday]\citynight.jpg 36864 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\L0veMe1tyme\2004-06-20 [Sunday]\elise morbid.jpg 57344 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\L0veMe1tyme\2004-06-20 [Sunday]\elise.bmp 573440 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\L0veMe1tyme\2004-06-20 [Sunday]\josh.jpg 12288 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\L0veMe1tyme\2004-06-20 [Sunday]\josh2.jpg 61440 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\L0veMe1tyme\2004-07-14 [Wednesday]\josh.jpg 12288 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\L0veMe1tyme\2004-07-14 [Wednesday]\josh2.jpg 61440 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\morbidpretzel58\2004-08-05 [Thursday]\noname1091685745.bmp 61440 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\morbidpretzel58\2004-08-05 [Thursday]\noname1091688086.bmp 61440 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\Rikkles270\2004-06-08 [Tuesday]\josh.jpg 12288 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\Rikkles270\2004-06-08 [Tuesday]\josh2.jpg 61440 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\rocketqueenz\2004-08-05 [Thursday]\josh.jpg 12288 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\shadyzladiixo\2004-07-20 [Tuesday]\josh.jpg 12288 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\shadyzladiixo\2004-07-20 [Tuesday]\josh2.jpg 61440 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\shadyzladiixo\2004-07-20 [Tuesday]\Jul14024.JPG 8192 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\shadyzladiixo\2004-07-20 [Tuesday]\Jul14025.JPG 8192 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\shadyzladiixo\2004-07-20 [Tuesday]\Untitled01.jpg 8192 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\shadyzladiixo\2004-07-20 [Tuesday]\Untitled02.jpg 12288 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\SnKeTwsT\2004-07-21 [Wednesday]\josh.jpg 12288 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\SnKeTwsT\2004-07-21 [Wednesday]\josh2.jpg 61440 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\SnKeTwsT\2004-07-21 [Wednesday]\kerry angel.jpg 16384 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\SnKeTwsT\2004-07-21 [Wednesday]\kerry06.jpg 40960 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\SnKeTwsT\2004-07-21 [Wednesday]\kerry08.jpg 102400 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\SnKeTwsT\2004-07-21 [Wednesday]\sarcastickerry.jpg 12288 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\SweeTiXo9\2004-08-01 [Sunday]\josh.jpg 12288 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\SweeTiXo9\2004-08-01 [Sunday]\josh2.jpg 61440 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\UwAnNaKiSsThiS85\2004-08-03 [Tuesday]\josh.jpg 12288 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\UwAnNaKiSsThiS85\2004-08-03 [Tuesday]\josh2.jpg 61440 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\xEroTiCxDrEAmSx\2004-06-03 [Thursday]\Picture 044.jpg 114688 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\xEroTiCxDrEAmSx\2004-07-20 [Tuesday]\brooke_me_heather__whatahottie.jpg 65536 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\xEroTiCxDrEAmSx\2004-07-20 [Tuesday]\josh.jpg 12288 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\xEroTiCxDrEAmSx\2004-07-20 [Tuesday]\josh2.jpg 61440 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\xobabihun69\2004-07-12 [Monday]\DSCN0845.JPG 376832 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\xobabihun69\2004-07-12 [Monday]\DSCN0850.JPG 368640 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\xobabii04\2004-06-08 [Tuesday]\Picture 007[3] 4096 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\xobabii04\2004-06-08 [Tuesday]\Picture 027[1] 4096 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\XSlimshadyzHotXx\2004-08-01 [Sunday]\60531920.jpg 73728 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\XSlimshadyzHotXx\2004-08-01 [Sunday]\60548390.jpg 98304 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\xxjulcyglrlxx\2004-06-07 [Monday]\Picture 046.jpg 118784 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\XxUniQueGrl69xX\2004-07-21 [Wednesday]\josh.jpg 12288 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\XxUniQueGrl69xX\2004-07-21 [Wednesday]\josh2.jpg 61440 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\XxUniQueGrl69xX\2004-07-21 [Wednesday]\Picture 138.jpg 57344 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\XxUniQueGrl69xX\2004-07-21 [Wednesday]\Picture 150.jpg 45056 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\XxUniQueGrl69xX\2004-07-21 [Wednesday]\Picture 159.jpg 53248 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\XxUniQueGrl69xX\2004-07-21 [Wednesday]\Picture 198.jpg 61440 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\XxUniQueGrl69xX\2004-07-21 [Wednesday]\Picture 51.jpg 65536 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\XxUniQueGrl69xX\2004-07-21 [Wednesday]\Picture 56.jpg 69632 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\XxUniQueGrl69xX\2004-07-21 [Wednesday]\Picture 90.jpg 65536 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\XxUniQueGrl69xX\2004-07-21 [Wednesday]\Picture 93.jpg 65536 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\XxUniQueGrl69xX\2004-07-21 [Wednesday]\Picture 94.jpg 65536 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\XxUniQueGrl69xX\2004-07-21 [Wednesday]\Picture 96.jpg 69632 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\XxUniQueGrl69xX\2004-07-21 [Wednesday]\Picture 97.jpg 61440 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\XxUniQueGrl69xX\2004-08-03 [Tuesday]\Picture 210.jpg 61440 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\XxUniQueGrl69xX\2004-08-03 [Tuesday]\Picture 211.jpg 45056 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\XxUniQueGrl69xX\2004-08-03 [Tuesday]\Picture 212.jpg 36864 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\XxUniQueGrl69xX\2004-08-03 [Tuesday]\Picture 213.jpg 36864 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\XxUniQueGrl69xX\2004-08-03 [Tuesday]\Picture 214.jpg 45056 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\XxUniQueGrl69xX\2004-08-03 [Tuesday]\Picture 215.jpg 49152 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\XxUniQueGrl69xX\2004-08-03 [Tuesday]\Picture 216.jpg 45056 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\xxxluck1efckxxx\2004-07-11 [Sunday]\josh.jpg 12288 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\xxxluck1efckxxx\2004-07-11 [Sunday]\josh2.jpg 61440 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\Jdawg7769\xxxluck1efckxxx\2004-07-11 [Sunday]\katrinaaaaa.jpg 139264 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\psYkoknut\DIVAMDY\2004-06-07 [Monday]\Picture 052.jpg 118784 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\psYkoknut\LILAB101\2004-07-12 [Monday]\untitled.JPG 36864 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\psYkoknut\RockStar913\2004-07-12 [Monday]\derf.jpg 86016 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\psYkoknut\RockStar913\2004-07-12 [Monday]\girls.jpg 98304 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\psYkoknut\RockStar913\2004-07-12 [Monday]\spirit1.jpg 28672 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\psYkoknut\RockStar913\2004-07-12 [Monday]\spirit2.jpg 32768 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\psYkoknut\RockStar913\2004-07-12 [Monday]\spirit3.jpg 28672 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\psYkoknut\RockStar913\2004-07-12 [Monday]\woohoo.jpg 77824 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\psYkoknut\RockStar913\2004-08-01 [Sunday]\diana.jpg 118784 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\psYkoknut\RockStar913\2004-08-01 [Sunday]\ouch.jpg 32768 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\psYkoknut\RockStar913\2004-08-01 [Sunday]\ouch2.jpg 36864 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\ZachIsBack2001\GcItAliAnMaFiA1\2004-08-07 [Saturday]\babe.jpg 4096 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\ZachIsBack2001\GcItAliAnMaFiA1\2004-08-07 [Saturday]\fat boy.jpg 20480 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\ZachIsBack2001\GcItAliAnMaFiA1\2004-08-07 [Saturday]\images.jpg 16384 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\ZachIsBack2001\GcItAliAnMaFiA1\2004-08-07 [Saturday]\jordan01.jpg 12288 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\ZachIsBack2001\sherbert626\2004-07-29 [Thursday]\JakeAWW.bmp 225280 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\ZachIsBack2001\sherbert626\2004-07-29 [Thursday]\noname1091076093.bmp 86016 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\ZachIsBack2001\sherbert626\2004-07-29 [Thursday]\RiS.mE.jpg 49152 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\ZachIsBack2001\sherbert626\2004-07-30 [Friday]\a.bmp 507904 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\ZachIsBack2001\sherbert626\2004-07-30 [Friday]\abecrombie.bmp 1368064 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\ZachIsBack2001\sherbert626\2004-07-30 [Friday]\RainbowBox.bmp 81920 bytes
C:\Documents and Settings\Josh.JOSHDESKTOP\My Documents\Asys files\Asus files\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\AIM Logs\ZachIsBack2001\sherbert626\2004-07-30 [Friday]\shirleyT.bmp 221184 bytes

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 107


********************************************************************

Completion time: 07-04-22 23:18:10
C:\ComboFix-quarantined-files.txt … 07-04-22 23:18



Hi-Jack This Log

Logfile of HijackThis v1.99.1
Scan saved at 11:22:31 PM, on 4/22/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware Pro\aawservice.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\AvidSDMService.exe
C:\Program Files\LogMeIn\RaMaint.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9HA.EXE
C:\Program Files\LogMeIn\LogMeIn.exe
C:\Program Files\LogMeIn\LogMeInSystray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\AIM6\aim6.exe
C:\DOCUME~1\JOSH~1.JOS\MYDOCU~1\RACLE~1\netdde.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\WINDOWS\cnViaW5z\command.exe
C:\PROGRA~1\COMMON~1\offr\offrm.exe
C:\PROGRA~1\COMMON~1\offr\offra.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\??sks\winspool.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Josh.JOSHDESKTOP\Desktop\New Folder\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_3_16_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1557B435-8242-4686-9AA3-9265BF7525A4} - C:\WINDOWS\System32\upgixnpq.dll (file missing)
O2 - BHO: (no name) - {27E4A093-6376-618A-22E3-12833DDF9EC3} - (no file)
O2 - BHO: (no name) - {4393F137-6082-3F0B-F24B-1BE34FE6FAC9} - C:\WINDOWS\System32\ctvzoa.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: WsftpBrowserHelper Class - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\Ipswitch\WS_FTP Home\wsbho2k0.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_3_16_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [EPSON Stylus Photo RX620 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9HA.EXE /P31 "EPSON Stylus Photo RX620 Series" /O6 "USB001" /M "Stylus Photo RX620"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\LogMeInSystray.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Tsrm] "C:\DOCUME~1\JOSH~1.JOS\MYDOCU~1\RACLE~1\netdde.exe" -vt yazb
O4 - HKCU\..\Run: [Ccqgmij] "C:\Program Files\Common Files\??sks\winspool.exe"
O4 - HKCU\..\Run: [offr] C:\PROGRA~1\COMMON~1\offr\offrm.exe
O4 - Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\IEExtension.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\IEExtension.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: AbsolutePoker.com - {EFFF8D47-D060-4108-B761-E8EC86622E56} - C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra 'Tools' menuitem: AbsolutePoker.com - {EFFF8D47-D060-4108-B761-E8EC86622E56} - C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe
O9 - Extra button: Royal Vegas Poker - {FA4904B4-1FAF-4afd-886C-C19D2297BA62} - C:\Program Files\royalvegasMPP\MPPoker.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {413D6754-BFD4-47FE-9346-319559290BFA} (HTECtrl Class) - https://www.webpcfos.com/webpcfos/websabre/HTEweb_new.cab
O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} (king.com) - http://www.king.com/ctl/kingcomie.cab
O16 - DPF: {A7ECD556-D6F6-4F41-8C6B-14AB246801A0} (Secure Delivery) - http://cdn.digitalcity.com/video/kdx.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll
O20 - Winlogon Notify: pmkhi - pmkhi.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware Pro\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Avid SDM Service (AvidSDMService) - Avid Technology, Inc. - C:\WINDOWS\system32\AvidSDMService.exe
O23 - Service: Avid Startup (AvidStartup) - Unknown owner - C:\WINDOWS\system32\AvidStartup.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\LogMeIn.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)



Not sure what the combofix is . .but it said it deleted stuff .. is that safe/correct?
Hi jrizzle77

Something we need to address firstly and I should of noticed from the start.

You are currently using an unpatched version of Microsoft XP. It is CRITICAL that you update to Service Pack 1
Please visit this link:
Microsoft Service Pack 1

and install Service Pack 1. If you run into troubles, please post them here.

IMPORTANT: DO NOT update to Service pack 2. Doing so before your computer is clean can cause Windows to become unstable.
We will update to SP2 when you are clean.



Please post back with a HJT log and your computer running with Service pack 1, or with any problems you are having updating.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI