Spyware / Malware / Virus Removal

Hijack This Log... Help Please

17 min read

Looking for the outcome? Ask AI

shrimper Topic Starter

Post #1May 14, 2007, 6:31 PM UTC

I think I see some of the problems here but I'm not absolutely sure.. Please help.

Logfile of HijackThis v1.99.1
Scan saved at 12:28:17 PM, on 5/14/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
L:\PROGRA~1\CACHEM~1\CachemanXP.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
c:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\vptray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe
C:\Program Files\ClipMate7\ClipMate.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Aw2000\AW2000.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\\vptray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SManager] smanager.7.exe
O4 - HKLM\..\Run: [WindowsUpdate] rundll32.exe "C:\WINDOWS\system32\eoskciik.dll",realset
O4 - HKCU\..\Run: [ClipMate7] C:\Program Files\ClipMate7\ClipMate.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Voh] C:\WINDOWS\system32\M?crosoft.NET\rundll32.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: hp psc 1000 series.lnk.disabled
O4 - Global Startup: hpoddt01.exe.lnk.disabled
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O4 - Global Startup: NkbMonitor.exe.lnk.disabled
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Add To Compaq Organize… - C:\PROGRA~1\HEWLET~1\COMPAQ~1\bin\core.hp.main\SendTo.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Copy plain text for WhizFolders - L:\Program Files\WhizFolders Organizer Deluxe\copytool.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIC273~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: iSiloX Clipper - {C86027A6-12A1-4298-B6EA-A42AC6EE6C7C} - C:\Program Files\iSilo\iSiloX\iSiloXIE.dll (HKCU)
O9 - Extra 'Tools' menuitem: iSiloX Clipper… - {C86027A6-12A1-4298-B6EA-A42AC6EE6C7C} - C:\Program Files\iSilo\iSiloX\iSiloXIE.dll (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.yahoo.com
O15 - Trusted Zone: http://www.cdhm.org
O15 - Trusted Zone: http://www.macromedia.com
O15 - Trusted Zone: http://widget-f7.slide.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} (Java Plug-in 1.4.2) -
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: CachemanXP (CachemanXPService) - OuterTechnologies - L:\PROGRA~1\CACHEM~1\CachemanXP.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

Susan528

Post #2May 14, 2007, 7:03 PM UTC last edited May 14, 2007, 7:04 PM UTC

Hi shrimper and Welcome to TomCoyote,

Please do the following:

STEP 1.
======
Please download VundoFix.exe to your desktop.

Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will shutdown your computer, click OK.
Turn your computer back on.
Please post the contents of C:\vundofix.txt

STEP 2.
======
Deckardâ€™s System Scanner

Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.

Close all applications and windows.
Double-click on dss.exe to run it, and follow the prompts.
When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt<-this one will be minimized
Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and the extra.txt to your post. in your reply

shrimper

Post #3May 14, 2007, 9:56 PM UTC

Hi Susan.. Thank you for assisting me.

I followed your instructions and here are the results:

(1- Contents of Vundofix.txt)

VundoFix V6.3.21

Checking Java version…

Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.3
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.

Scan started at 1:53:00 PM 5/14/2007

Listing files found while scanning….

C:\WINDOWS\system32\awvtq.dll
C:\WINDOWS\system32\qtvwa.bak1
C:\WINDOWS\system32\qtvwa.bak2
C:\WINDOWS\system32\qtvwa.ini
C:\WINDOWS\system32\qtvwa.ini2
C:\WINDOWS\system32\qtvwa.tmp

Beginning removal…

Attempting to delete C:\WINDOWS\system32\awvtq.dll
C:\WINDOWS\system32\awvtq.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\qtvwa.bak1
C:\WINDOWS\system32\qtvwa.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\qtvwa.bak2
C:\WINDOWS\system32\qtvwa.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\qtvwa.ini
C:\WINDOWS\system32\qtvwa.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\qtvwa.ini2
C:\WINDOWS\system32\qtvwa.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\qtvwa.tmp
C:\WINDOWS\system32\qtvwa.tmp Has been deleted!

Performing Repairs to the registry.
Done!

(2- Contents of Main.txt)

Deckard's System Scanner v20070426.43
Run by [removed] on 2007-05-14 at 14:55:31
Computer is in Normal Mode.
——————————————————————————–

– System Restore ————————————————————–

System Restore is disabled; attempting to re-enable…success.

– Last 1 Restore Point(s) –
1: 2007-05-14 20:55:42 UTC - RP1 - System Checkpoint

Backed up registry hives.

Performed disk cleanup.

– HijackThis (run as Owner.exe) ———————————————–

Logfile of HijackThis v1.99.1
Scan saved at 3:04:47 PM, on 5/14/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
L:\PROGRA~1\CACHEM~1\CachemanXP.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
c:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\vptray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\ClipMate7\ClipMate.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe
C:\Documents and Settings\Owner\Desktop\dss.exe
C:\DOCUME~1\Owner\Desktop\Owner.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {33CFFA79-4678-49F1-82A7-F1E8FBB4FBC8} - C:\WINDOWS\system32\mlljj.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {539825C7-49B2-404B-B930-058E06465B9D} - C:\WINDOWS\system32\xxyvspo.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {709A8799-D4FC-4D08-9CE9-7A1E61F82CE7} - C:\WINDOWS\system32\awvtq.dll (file missing)
O2 - BHO: (no name) - {7c1ce531-09e9-4fc5-9803-1c2956615786} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST1.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-us\msntb.dll
O2 - BHO: (no name) - {E2EE5C44-C66D-499d-BEAE-A2A79189A63A} - C:\WINDOWS\system32\pylktuis.dll (file missing)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\\vptray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SManager] smanager.7.exe
O4 - HKLM\..\Run: [WindowsUpdate] rundll32.exe "C:\WINDOWS\system32\eoskciik.dll",realset
O4 - HKCU\..\Run: [ClipMate7] C:\Program Files\ClipMate7\ClipMate.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Voh] C:\WINDOWS\system32\M?crosoft.NET\rundll32.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: hp psc 1000 series.lnk.disabled
O4 - Global Startup: hpoddt01.exe.lnk.disabled
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O4 - Global Startup: NkbMonitor.exe.lnk.disabled
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Add To Compaq Organize… - C:\PROGRA~1\HEWLET~1\COMPAQ~1\bin\core.hp.main\SendTo.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Copy plain text for WhizFolders - L:\Program Files\WhizFolders Organizer Deluxe\copytool.htm
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIC273~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: iSiloX Clipper - {C86027A6-12A1-4298-B6EA-A42AC6EE6C7C} - C:\Program Files\iSilo\iSiloX\iSiloXIE.dll (HKCU)
O9 - Extra 'Tools' menuitem: iSiloX Clipper… - {C86027A6-12A1-4298-B6EA-A42AC6EE6C7C} - C:\Program Files\iSilo\iSiloX\iSiloXIE.dll (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.yahoo.com
O15 - Trusted Zone: http://www.cdhm.org
O15 - Trusted Zone: http://www.macromedia.com
O15 - Trusted Zone: http://widget-f7.slide.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} -
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: ebbacadccfed - C:\WINDOWS\system32\ebbacadccfed.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: mlljj - C:\WINDOWS\system32\mlljj.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winjrs32 - C:\WINDOWS\SYSTEM32\winjrs32.dll
O20 - Winlogon Notify: xxyvspo - C:\WINDOWS\SYSTEM32\xxyvspo.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: CachemanXP (CachemanXPService) - OuterTechnologies - L:\PROGRA~1\CACHEM~1\CachemanXP.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

– File Associations ———————————————————–

.js - unable to read key
.js - unable to read key
.scr - AutoCADScriptFile - shell\open\command - "C:\WINDOWS\notepad.exe" "%1"

– Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ———————

R1 SCDEmu - c:\windows\system32\drivers\scdemu.sys

Susan528

Post #4May 15, 2007, 2:19 AM UTC last edited May 15, 2007, 2:26 AM UTC

Please set your system to show all files; please see here if you're unsure how to do this.

Reboot into Safe Mode: please see here if you are not sure how to do this.

Using Windows Explorer, locate the following files/folders, and delete them:
smanager.7.exe<=file
C:\WINDOWS\system32\jjllm.bak1<=file
Be sure next one is in the C:\WINDOWS\system32\M?crosoft.NET path (? May be another char)
C:\WINDOWS\system32\M?crosoft.NET\rundll32.exe<=file
C:\WINDOWS\system32\mlljj.dll<=file
C:\WINDOWS\system32\pmnlkki.dll<=file
C:\WINDOWS\system32\eoskciik.dll<=file
C:\WINDOWS\system32\xxyvspo.dll<=file
C:\WINDOWS\system32\ebbacadccfed.dll<=file
C:\WINDOWS\system32\winjrs32.dll<=file
Exit Explorer, and reboot as normal afterwards.

Run hijackthis. Click Do a System Scan Only. Put a Check in the box on the left side on these:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {33CFFA79-4678-49F1-82A7-F1E8FBB4FBC8} - C:\WINDOWS\system32\mlljj.dll
O2 - BHO: (no name) - {539825C7-49B2-404B-B930-058E06465B9D} - C:\WINDOWS\system32\xxyvspo.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {709A8799-D4FC-4D08-9CE9-7A1E61F82CE7} - C:\WINDOWS\system32\awvtq.dll (file missing)
O2 - BHO: (no name) - {7c1ce531-09e9-4fc5-9803-1c2956615786} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {E2EE5C44-C66D-499d-BEAE-A2A79189A63A} - C:\WINDOWS\system32\pylktuis.dll (file missing)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [SManager] smanager.7.exe
O4 - HKLM\..\Run: [WindowsUpdate] rundll32.exe "C:\WINDOWS\system32\eoskciik.dll",realset
O4 - HKCU\..\Run: [Voh] C:\WINDOWS\system32\M?crosoft.NET\rundll32.exe
O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} -
O20 - Winlogon Notify: ebbacadccfed - C:\WINDOWS\system32\ebbacadccfed.dll
O20 - Winlogon Notify: mlljj - C:\WINDOWS\system32\mlljj.dll
O20 - Winlogon Notify: winjrs32 - C:\WINDOWS\SYSTEM32\winjrs32.dll
O20 - Winlogon Notify: xxyvspo - C:\WINDOWS\SYSTEM32\xxyvspo.dll
Close ALL windows and browsers except HijackThis and click Fix checked and exit.

======
Please download AVG Anti-Spyware from HERE
and save that file to your
desktop.
This is a 30 day trial of the program

Once you have downloaded ewido anti-spyware, locate the icon on the desktop
and double-click it to launch the set up program.
Once the setup is complete you will need run ewido and update the definition files.
On the main screen
- select the icon "Update"
- then select the "Update now" link.
- Next select the "Start Update" button,
the update will start and a progress bar will show the updates being installed.
Once the update has completed select the "Scanner" icon at the top of
the screen, then select the "Settings" tab.
Once in the Settings screen click on "Recommended actions" and then
select ""Quarantine".".
Under "Reports"
- Select "Automatically generate report after every scan"
- Un-Select "Only if threats were found
"

Close AVG Anti-Spyware, Do Not run a scan just yet, we will shortly.

Reboot your computer into SafeMode. You can do this by restarting
your computer and continually tapping the F8 key until a menu appears.
Use your up arrow key to highlight SafeMode then hit enter.
IMPORTANT: Do not open any other windows or
programs while ewido is scanning, it may interfere with the scanning proccess:
Lauch ewido-anti-spyware by double-clicking the icon on your desktop.
Select the "Scanner" icon at the top and then the "Scan" tab
then click on "Complete System Scan".
AVG Anti-Spyware will now begin the scanning process, be patient this may take a little time.
Once the scan is complete do the following:
If you have any infections you will prompted, then select "Apply all
actions"
Next select the "Reports" icon at the top.
Select the "Save report as" button in the lower left hand of the
screen and save it to a text file on your system (make sure to remember where
you saved that file, this is important).
Close AVG Anti-Spyware and reboot your system back into Normal Mode.

Please post (reply) with a the AVG Anti-spyware report and a fresh hijackthis log.

shrimper

Post #5May 15, 2007, 1:33 PM UTC

Hi Susan,

I followed the lastest instructions as best as I could. I could not find the file smanager.7.exe to delete
I couldn't delete the following files:

C:\WINDOWS\system32\xxyvspo.dll
C:\WINDOWS\system32\ebbacadccfed.dll

I kept getting the error that they were being used by another process.

With C:WINDOWS\system32\winjrs32.dll I also got an error. I went back into safe mode with the CMD prompt and was able to rename this one and then delete it but not the above two files.

As soon as I went online to come to the forum here I was was redirected to two other webpages.

shrimper

AVG Antil Spyware Log follows:

———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 6:46:55 AM 5/15/2007

+ Scan result:

C:\WINDOWS\system32\lhknbvdh.dll -> Adware.BHO : Cleaned.
C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\omfg.class-3157a8e7-4bfdd967.class -> Downloader.OpenStream.y : Cleaned.
C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\omfg.class-352f55f0-10001586.class -> Downloader.OpenStream.y : Cleaned.
C:\Documents and Settings\Owner\Cookies\owner@2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Owner\Cookies\owner@paypal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Owner\Cookies\owner@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned.
C:\Documents and Settings\Owner\Cookies\[removed][1].txt -> TrackingCookie.Hitslink : Cleaned.
C:\Deckard\System Scanner\backup\WINDOWS\temp\Cookies\owner@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\Owner\Cookies\owner@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\Owner\Cookies\owner@statcounter[2].txt -> TrackingCookie.Statcounter : Cleaned.
C:\Deckard\System Scanner\backup\WINDOWS\temp\Cookies\[removed][2].txt -> TrackingCookie.Webtrends : Cleaned.
C:\Documents and Settings\Owner\Cookies\[removed][2].txt -> TrackingCookie.Webtrends : Cleaned.
C:\Documents and Settings\admin\Cookies\[removed][1].txt -> TrackingCookie.Webtrends : Cleaned.
C:\Deckard\System Scanner\backup\WINDOWS\temp\winEE.tmp.exe -> Trojan.Agent.qt : Cleaned.
C:\Deckard\System Scanner\backup\WINDOWS\temp\winF15.tmp.exe -> Trojan.Agent.qt : Cleaned.
C:\System Volume Information\_restore{8153ACA8-C727-4835-A7D4-A3A2B949B296}\RP1\A0000035.exe -> Trojan.Agent.qt : Cleaned.
C:\System Volume Information\_restore{8153ACA8-C727-4835-A7D4-A3A2B949B296}\RP1\A0000104.exe -> Trojan.Agent.qt : Cleaned.
C:\System Volume Information\_restore{8153ACA8-C727-4835-A7D4-A3A2B949B296}\RP1\A0000200.dll -> Trojan.Agent.qt : Cleaned.

::Report end

Hijack This log Follows:

Logfile of HijackThis v1.99.1
Scan saved at 7:30:55 AM, on 5/15/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
l:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
L:\PROGRA~1\CACHEM~1\CachemanXP.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
c:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\vptray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe
L:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\ClipMate7\ClipMate.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Symantec AntiVirus\DoScan.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\\vptray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "L:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [WindowsUpdate] rundll32.exe "C:\WINDOWS\system32\npfuontl.dll",realset
O4 - HKCU\..\Run: [ClipMate7] C:\Program Files\ClipMate7\ClipMate.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: hp psc 1000 series.lnk.disabled
O4 - Global Startup: hpoddt01.exe.lnk.disabled
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O4 - Global Startup: NkbMonitor.exe.lnk.disabled
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Add To Compaq Organize… - C:\PROGRA~1\HEWLET~1\COMPAQ~1\bin\core.hp.main\SendTo.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Copy plain text for WhizFolders - L:\Program Files\WhizFolders Organizer Deluxe\copytool.htm
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIC273~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: iSiloX Clipper - {C86027A6-12A1-4298-B6EA-A42AC6EE6C7C} - C:\Program Files\iSilo\iSiloX\iSiloXIE.dll (HKCU)
O9 - Extra 'Tools' menuitem: iSiloX Clipper… - {C86027A6-12A1-4298-B6EA-A42AC6EE6C7C} - C:\Program Files\iSilo\iSiloX\iSiloXIE.dll (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.yahoo.com
O15 - Trusted Zone: http://www.cdhm.org
O15 - Trusted Zone: http://www.macromedia.com
O15 - Trusted Zone: http://widget-f7.slide.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - l:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CachemanXP (CachemanXPService) - OuterTechnologies - L:\PROGRA~1\CACHEM~1\CachemanXP.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

Susan528

Post #6May 15, 2007, 1:51 PM UTC

Please do this:

STEP 1.
======
Combofix

Download this file - combofix.exe
Double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you. Post that log in your next reply

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Please post the ComboFix log and a new hijackthis log.

shrimper

Post #7May 15, 2007, 5:07 PM UTC

Thanks again Susan,

Completed both tasks - below are the logs.

Combo Fix Log:

"Owner" - 2007-05-15 10:27:00 Service Pack 2
ComboFix 07-05.13.V - Running from: "C:\Documents and Settings\Owner\Desktop\"

(((((((((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\awtqo.dll
C:\WINDOWS\system32\llnmp.ini
C:\WINDOWS\system32\npfuontl.dll
C:\WINDOWS\system32\llnmp.bak1
C:\WINDOWS\system32\llnmp.ini
C:\WINDOWS\system32\ltnoufpn.ini
C:\WINDOWS\system32\pmnll.dll
C:\WINDOWS\system32\xxyvspo.dll

* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Folders Quarantined:
C:\qoobox\purity\C\Program Files\ICROSO~1.NET
C:\qoobox\purity\C\Program Files\Common Files\CROSOF~1
C:\qoobox\purity\C\WINDOWS\system32\ICROSO~1.NET

((((((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

——-\LEGACY_IPRIP
——-\Iprip
——-\nm

((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-15 ))))))))))))))))))))))))))))))))))

2007-05-14 23:25 3,968 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-05-14 20:08 262,708 —hs—- C:\WINDOWS\system32\ddayw.dll
2007-05-14 14:54 d——– C:\Deckard
2007-05-14 13:53 d——– C:\VundoFix Backups
2007-05-13 12:05 d——– C:\DOCUME~1\Owner\APPLIC~1\Lavasoft
2007-05-12 22:52 336 –a—— C:\WINDOWS\system32\d3d8caps.dat
2007-05-10 01:13 d——– C:\Program Files\Common Files\Fonts
2007-05-09 22:06 d——– C:\DOCUME~1\LOCALS~1\APPLIC~1\Yahoo!
2007-05-09 22:06 d——– C:\DOCUME~1\LOCALS~1\APPLIC~1\Google
2007-05-09 22:02 23,040 ——— C:\WINDOWS\system32\ebbacadccfed.dll
2007-05-04 13:03 d——– C:\DOCUME~1\Owner\APPLIC~1\Yahoo!
2007-05-02 08:31 d——– C:\Program Files\Windows Media Connect 2
2007-05-02 08:27 d——– C:\WINDOWS\system32\drivers\UMDF
2007-05-01 09:53 d——– C:\Program Files\USPS

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-15 12:59:16 ——– d—–w C:\Program Files\Symantec AntiVirus
2007-05-14 15:55:13 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Opera
2007-05-13 22:18:57 ——– d—–w C:\Program Files\GameSpy Arcade
2007-05-13 22:18:18 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-05-13 22:09:19 41 —-a-w C:\WINDOWS\system32\eccedfcbcb_d.dll
2007-05-13 17:59:51 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\uTorrent
2007-05-10 02:57:31 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Autodesk
2007-04-12 05:09:22 ——– d—–w C:\Program Files\Microsoft Works
2007-04-12 05:09:19 ——– d—–w C:\Program Files\Microsoft Visual Studio 8
2007-04-12 05:08:46 ——– d—–w C:\Program Files\Microsoft Expression
2007-04-12 04:55:04 58 —-a-w C:\WINDOWS\system32\Anderson Hu_MobysaurusThesaurus_InstallInfo.dat
2007-04-12 04:54:39 131,584 —-a-w C:\WINDOWS\system32\SpoonUninstall.exe
2007-04-12 04:54:39 1,028 —-a-w C:\WINDOWS\system32\SpoonUninstall-Mobysaurus Thesaurus.dat
2007-03-22 16:55:25 ——– d—–w C:\Program Files\MSN Messenger
2007-03-17 13:43:01 292,864 —-a-w C:\WINDOWS\system32\winsrv.dll
2007-03-12 07:49:25 ——– d—–w C:\Program Files\PayPal
2007-03-10 16:38:08 ——– d—–w C:\Program Files\Common Files\Ulead Systems
2007-03-08 15:36:28 577,536 —-a-w C:\WINDOWS\system32\user32.dll
2007-03-08 15:36:28 40,960 —-a-w C:\WINDOWS\system32\mf3216.dll
2007-03-08 15:36:28 281,600 —-a-w C:\WINDOWS\system32\gdi32.dll
2007-03-08 14:25:36 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\GlobalSCAPE
2007-03-08 13:47:48 1,843,584 —-a-w C:\WINDOWS\system32\win32k.sys
2007-03-07 12:37:18 ——– d—–w C:\Program Files\Google
2007-03-06 13:59:42 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Google
2007-03-05 19:34:28 676,224 —-a-w C:\WINDOWS\system32\OGACheckControl.DLL
2007-02-05 20:17:02 185,344 —-a-w C:\WINDOWS\system32\upnphost.dll

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{02478D38-C3F9-4EFB-9B51-7695ECA05670}=C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll [2007-03-20 15:39]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2005-09-23 23:12]
{53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2005-05-31 00:04]
{709A8799-D4FC-4D08-9CE9-7A1E61F82CE7}=C:\WINDOWS\system32\awvtq.dll []
{8DF4FA7A-D836-4FD6-A15F-48BA6B0002Dd}=C:\WINDOWS\system32\lhknbvdh.dll []
{9394EDE7-C8B5-483E-8773-474BF36AF6E4}=C:\Program Files\MSN Apps\ST1.03.0000.1005\en-xu\stmain.dll [2004-08-13 15:42]
{AA58ED58-01DD-4d91-8333-CF10577473F7}=c:\program files\google\googletoolbar1.dll [2007-01-20 00:55]
{AE7CD045-E861-484f-8273-0445EE161910}=C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2005-09-23 23:41]
{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}=C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-us\msntb.dll [2006-01-17 15:04]
{C364E524-7059-4F0D-98A9-3531C3BBBEBA}=C:\WINDOWS\system32\mlljj.dll []

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"vptray"="C:\\PROGRA~1\\SYMANT~1\\\\vptray.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"!AVG Anti-Spyware"="\"L:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-10-04 11:42]
"vptray"="C:\PROGRA~1\SYMANT~1\\vptray.exe" [2006-06-14 09:47]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2004-04-02 16:11]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-05-26 17:19]
"!AVG Anti-Spyware"="L:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2006-10-07 06:20]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ClipMate7"="C:\Program Files\ClipMate7\ClipMate.exe" [2006-12-18 18:12]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-03-06 07:32]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ClipMate7"="C:\\Program Files\\ClipMate7\\ClipMate.exe"
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.5462\\GoogleToolbarNotifier.exe"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
Source REG_SZ http://search.ebay.com/_W0QQsassZncshrimpe…1QQfsooZ1QQrdZ0?

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\2]
Source REG_SZ http://cgi6.ebay.com/ws/eBayISAPI.dll?View…erid=ncshrimper

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="l:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2006-09-28 08:13]

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ebbacadccfed
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winjrs32

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages msv1_0\
Security Packages kerberosmsv1_0schannelwdigest\
Notification Packages scecli\

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\clonecdelbycdfl
"C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer"="C:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"DW4"=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"iTunesHelper"="C:\\Program Files\\iTunes\\iTunesHelper.exe"
"IgfxTray"="C:\\WINDOWS\\system32\\igfxtray.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"DAEMON Tools-1033"="\"C:\\Program Files\\D-Tools\\daemon.exe\" -lang 1033"
"mmtask"="\"C:\\Program Files\\Musicmatch\\Musicmatch Jukebox\\mmtask.exe\""
"AGRSMMSG"="AGRSMMSG.exe"
"Recguard"="C:\\WINDOWS\\SMINST\\RECGUARD.EXE"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\""
"HP Component Manager"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\""
"Ulead AutoDetector v2"="C:\\Program Files\\Common Files\\Ulead Systems\\AutoDetector\\monitor.exe"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService AlerterWebClientLmHostsRemoteRegistryupnphostSSDPSRV\
NetworkService DnsCache\
rpcss RpcSs\
imgsvc StiSvc\
termsvcs TermService\
HTTPFilter HTTPFilter\
DcomLaunch DcomLaunchTermService\
WudfServiceGroup WUDFSvc\

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\C]
Shell\AutoRun\command install.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D]
Shell\AutoRun\command D:\Info.exe folder.htt 480 480

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\O]
Shell\AutoRun\command O:\SETUP.EXE
Shell\configure\command O:\SETUP.EXE
Shell\install\command O:\SETUP.EXE

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{967dfc66-653c-11db-b1d3-001109123d53}]
Shell\AutoRun\command H:\wd_windows_tools\setup.exe

~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

backup-20070514-232407-542
O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} -
backup-20070514-232407-362
O4 - HKCU\..\Run: [Voh] C:\WINDOWS\system32\M?crosoft.NET\rundll32.exe
backup-20070514-232407-286
O4 - HKLM\..\Run: [WindowsUpdate] rundll32.exe "C:\WINDOWS\system32\eoskciik.dll",realset
backup-20070514-232407-289
O4 - HKLM\..\Run: [SManager] smanager.7.exe
backup-20070514-232407-467
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
backup-20070514-232407-466
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
backup-20070514-232407-884
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
backup-20070514-232407-839
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\MP Scheduled Scan.job

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-15 10:43:52
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden services …

scanning hidden autostart entries …

scanning hidden files …

C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Carving\Decoys\Ducks\antiques from Ebay\Bluebill.bak 135168 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Carving\Decoys\Ducks\antiques from Ebay\Bluebill.dwg 135168 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Carving\Decoys\Ducks\antiques from Ebay\Ebay crow.dwg 135168 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Carving\Decoys\Ducks\antiques from Ebay\Humpback Canvasback Decoy.bak 135168 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Carving\Decoys\Ducks\antiques from Ebay\Humpback Canvasback Decoy.dwg 135168 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Carving\Decoys\Ducks\antiques from Ebay\Mason Redhead from Ebay.dwg 131072 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Carving\Decoys\Ducks\antiques from Ebay\Old Canvasback wing duck.bak 1470464 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Carving\Decoys\Ducks\antiques from Ebay\Old Canvasback wing duck.dwg 1470464 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Carving\Decoys\Ducks\Upper Bay Styles\Upperbay Canvasback Miniatures 7and 9 in LOA 2 styles\UpperBay CBBody 7 inches long.bak 40960 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Carving\Decoys\Ducks\Upper Bay Styles\Upperbay Canvasback Miniatures 7and 9 in LOA 2 styles\UpperBay CBBody 7 inches long.dwg 40960 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Carving\Decoys\Ducks\Upper Bay Styles\Upperbay Canvasback Miniatures 7and 9 in LOA 2 styles\UpperBay CBBody 9 inches long High Head.bak 40960 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Carving\Decoys\Ducks\Upper Bay Styles\Upperbay Canvasback Miniatures 7and 9 in LOA 2 styles\UpperBay CBBody 9 inches long High Head.dwg 40960 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Carving\Decoys\Ducks\Upper Bay Styles\Upperbay Canvasback Miniatures 7and 9 in LOA 2 styles\UpperBay CBBody 9 inches long.bak 45056 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Carving\Decoys\Ducks\Upper Bay Styles\Upperbay Canvasback Miniatures 7and 9 in LOA 2 styles\UpperBay CBBody 9 inches long.dwg 40960 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Carving\My Old Patterns From Paper Scans\standing goose.dwg 32768 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Completed\Completion Process\Cache Mallard\Cache Carvers Mallard (Modified Neck).bak 40960 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Completed\Completion Process\Cache Mallard\Cache Carvers Mallard (Modified Neck).dwg 61440 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Completed\Completion Process\Cache Mallard\Cache Carvers Mallard Both Views.dwg 45056 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Completed\Completion Process\Cache Mallard\Cache Carvers Mallard.dwg 45056 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Completed\Completion Process\Cache Mallard\Cache Mallard Small Final.bak 69632 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Completed\Completion Process\Cache Mallard\Cache Mallard Small Final.bmp 2117632 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Completed\Completion Process\Cache Mallard\Cache Mallard Small Final.dwg 69632 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Completed\Completion Process\Cache Mallard\Cache Mallard.cdc 12288 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Completed\Completion Process\Cache Mallard\CacheCarver Mallard Iso.dwg 49152 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Completed\Completion Process\Cache Mallard\CacheCarver Mallard Iso14.dwg 53248 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Completed\Completion Process\Cache Mallard\new block.dwg 36864 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Completed\Completion Process\Cache Mallard\pspbrwse.jbf 4096 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Woodturning\lathe work\Jean Martin patterns\varigrind.dwg 143360 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Woodworking\Boats and Fishing\Marine Items\Lobster Pot bouy.dwg 40960 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Woodworking\Boats and Fishing\Marine Items\Skiff bailer.bak 40960 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Woodworking\Boats and Fishing\Marine Items\Skiff bailer.dwg 40960 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Woodworking\Scroll Saw Patterns\Letters\Alphabet 1.dwg 114688 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Woodworking\Scroll Saw Patterns\Letters\Alphabet 9 scaled.bak 1597440 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Woodworking\Scroll Saw Patterns\Letters\Alphabet 9 scaled.dwg 1597440 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Woodworking\Scroll Saw Patterns\Letters\Alphabet 9.bak 81920 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Woodworking\Scroll Saw Patterns\Puzzles\Pig.bak 32768 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Woodworking\Scroll Saw Patterns\Puzzles\Pig.dwg 32768 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Drawing Darkside\From Utah\Woodworking\Scroll Saw Patterns\Puzzles\Squirrel Puzzle.dwg 36864 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\BUZZSAW\PLANS & SPEC DRIVERS\DATA1.CAB 446464 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\BUZZSAW\PLANS & SPEC DRIVERS\DATA1.HDR 61440 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\BUZZSAW\PLANS & SPEC DRIVERS\DATA2.CAB 3612672 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\BUZZSAW\PLANS & SPEC DRIVERS\IKERNEL.EX_ 339968 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\BUZZSAW\PLANS & SPEC DRIVERS\LAYOUT.BIN 456 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\BUZZSAW\PLANS & SPEC DRIVERS\SETUP.BMP 548864 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\BUZZSAW\PLANS & SPEC DRIVERS\SETUP.EXE 57344 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\BUZZSAW\PLANS & SPEC DRIVERS\SETUP.INI 104 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\BUZZSAW\PLANS & SPEC DRIVERS\SETUP.INX 167936 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\ACAD_NETGUIDE.CHM 389120 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\ACAD_NETGUIDE.HTM 296 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\FLEXUSER
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\FLEXUSER\ALL.HTM 294912 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\FLEXUSER\ALLIX.HTM 36864 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\FLEXUSER\ALLTOC.HTM 16384 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\FLEXUSER\GRAPHICS
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\FLEXUSER\GRAPHICS\ARRWRITE.GIF 4096 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\FLEXUSER\GRAPHICS\BACKGRND.GIF 216 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\FLEXUSER\GRAPHICS\FLEXLMSCRIPT.GIF 440 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\FLEXUSER\GRAPHICS\NAVIDX.GIF 480 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\FLEXUSER\GRAPHICS\NAVIDXX.GIF 392 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\FLEXUSER\GRAPHICS\NAVNEXT.GIF 456 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\FLEXUSER\GRAPHICS\NAVNEXTX.GIF 376 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\FLEXUSER\GRAPHICS\NAVPREV.GIF 448 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\FLEXUSER\GRAPHICS\NAVPREVX.GIF 352 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\FLEXUSER\GRAPHICS\NAVTOC.GIF 416 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\FLEXUSER\GRAPHICS\NAVTOCX.GIF 352 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\IMAGES
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\IMAGES\BANNER.GIF 53248 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\IMAGES\MAINBACK.GIF 20480 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\NAG_01.HTML 24576 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\NAG_02.HTML 53248 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\NAG_03.HTML 61440 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\NAG_04.HTML 40960 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\NAG_IE.CSS 96 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\NAG_INTRO.HTML 4096 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\NAG_IX.HTML 106496 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\NAG_NS.CSS 88 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\DOCS\NAG_TOC.HTML 8192 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\SAMREPORT-LITE\JRE1_2_2-001-WIN.EXE 5283840 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\SAMREPORT-LITE\JRE1_2_2_007-WIN-I.EXE 7499776 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\SAMREPORT-LITE\SAMLITE-STARTGUIDE.CHM 311296 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\NETSETUP\SUPPORT\ADLM\SAMREPORT-LITE\SAMREPORT.EXE 3743744 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\NT_WIN2000
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\NT_WIN2000\HPGLRTL2.HL_ 167936 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\NT_WIN2000\HPGLRTL2.HP_ 49152 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\NT_WIN2000\HPGLRTL3.HL_ 8192 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\NT_WIN2000\HPGLRTL4.HP_ 225280 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\NT_WIN2000\HPGLRTL8.HP_ 131072 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\NT_WIN2000\HPLTCAL4.DL_ 32768 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\NT_WIN2000\HPLTCOL1.EX_ 53248 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\NT_WIN2000\HPLTDRV1.DL_ 167936 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\NT_WIN2000\HPLTLNK.EX_ 20480 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\NT_WIN2000\HPLTSAM1.SP_ 102400 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\NT_WIN2000\HPLTSAM2.SP_ 98304 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\NT_WIN2000\HPLTUI.DL_ 110592 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\NT_WIN2000\HPLTUINT.DL_ 53248 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\NT_WIN2000\HPLTUMPD.DL_ 36864 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\NT_WIN2000\OEMSETUP.INF 8192 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\NT_WIN2000\README.TXT 12288 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\WIN9X
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\WIN9X\DESIGNJT.INF 8192 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\WIN9X\HPGLCAL4.DL_ 36864 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\WIN9X\HPGLRTL2.DR_ 348160 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\WIN9X\HPGLRTL2.HL_ 262144 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\WIN9X\HPGLRTL2.HP_ 57344 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\WIN9X\HPGLRTL3.HL_ 8192 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\WIN9X\HPGLRTL4.HP_ 270336 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\WIN9X\HPGLRTL8.HP_ 151552 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\WIN9X\HPLOTCHG.EX_ 20480 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\WIN9X\HPLTLNK.EX_ 24576 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\WIN9X\HPLTUI.DL_ 139264 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\acad2002\WINDOWS SYSTEM DRIVERS\HP\ENU\WIN9X\README.TXT 12288 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\drivers from gateway for this pc\98 ati rage pro gateway.exe 8970240 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\drivers from gateway for this pc\bios update.exe 655360 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\Bertie's Documents from F\Proggies from Desktop\Autocad 2002\drivers from gateway for this pc\creative.exe 17256448 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\to dvd then delete\Discovery Of Ancient Civilizations, The - Brian Fagan - Audio Book - Teaching Company\Discovery of Ancient Civilizations - Brian Fagan
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\to dvd then delete\Discovery Of Ancient Civilizations, The - Brian Fagan - Audio Book - Teaching Company\Discovery of Ancient Civilizations - Brian Fagan\Lectuer 01 - The Quest for Civilization.mp3 15908864 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\to dvd then delete\Discovery Of Ancient Civilizations, The - Brian Fagan - Audio Book - Teaching Company\Discovery of Ancient Civilizations - Brian Fagan\Lectuer 02 - Search for the Pharaohs.mp3 14516224 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\to dvd then delete\Discovery Of Ancient Civilizations, The - Brian Fagan - Audio Book - Teaching Company\Discovery of Ancient Civilizations - Brian Fagan\Lectuer 03 - Tomb Robbers and Hieroglyphs.mp3 14573568 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\to dvd then delete\Discovery Of Ancient Civilizations, The - Brian Fagan - Audio Book - Teaching Company\Discovery of Ancient Civilizations - Brian Fagan\Lectuer 04 - Mysteries by Tigris and Euphrates.mp3 14544896 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\to dvd then delete\Discovery Of Ancient Civilizations, The - Brian Fagan - Audio Book - Teaching Company\Discovery of Ancient Civilizations - Brian Fagan\Lectuer 05 - Nineveh and Its Remains.mp3 14569472 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\to dvd then delete\Discovery Of Ancient Civilizations, The - Brian Fagan - Audio Book - Teaching Company\Discovery of Ancient Civilizations - Brian Fagan\Lectuer 06 - The Decipherment of Cuneiform.mp3 14532608 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\to dvd then delete\Discovery Of Ancient Civilizations, The - Brian Fagan - Audio Book - Teaching Company\Discovery of Ancient Civilizations - Brian Fagan\Lectuer 07 - The Flood Tablets.mp3 14569472 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\to dvd then delete\Discovery Of Ancient Civilizations, The - Brian Fagan - Audio Book - Teaching Company\Discovery of Ancient Civilizations - Brian Fagan\Lectuer 08 - Temples in the Rain Forest.mp3 14585856 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\to dvd then delete\Discovery Of Ancient Civilizations, The - Brian Fagan - Audio Book - Teaching Company\Discovery of Ancient Civilizations - Brian Fagan\Lectuer 09 - Maya Travelers.mp3 14598144 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\to dvd then delete\Discovery Of Ancient Civilizations, The - Brian Fagan - Audio Book - Teaching Company\Discovery of Ancient Civilizations - Brian Fagan\Lectuer 10 - Underground Jerusalem.mp3 14573568 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\to dvd then delete\Discovery Of Ancient Civilizations, The - Brian Fagan - Audio Book - Teaching Company\Discovery of Ancient Civilizations - Brian Fagan\Lectuer 11 - The Quest for Troy.mp3 14585856 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\to dvd then delete\Discovery Of Ancient Civilizations, The - Brian Fagan - Audio Book - Teaching Company\Discovery of Ancient Civilizations - Brian Fagan\Lectuer 12 - Agamemnon's Grave.mp3 14585856 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\to dvd then delete\Discovery Of Ancient Civilizations, The - Brian Fagan - Audio Book - Teaching Company\Discovery of Ancient Civilizations - Brian Fagan\Lectuer 13 - A Revolution in Archaeology.mp3 14741504 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\to dvd then delete\Discovery Of Ancient Civilizations, The - Brian Fagan - Audio Book - Teaching Company\Discovery of Ancient Civilizations - Brian Fagan\Lectuer 14 - Flinders Petrie and the Small Artifact.mp3 14589952 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\to dvd then delete\Discovery Of Ancient Civilizations, The - Brian Fagan - Audio Book - Teaching Company\Discovery of Ancient Civilizations - Brian Fagan\Lectuer 15 - Lords of the Labyrinth.mp3 14577664 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\to dvd then delete\Discovery Of Ancient Civilizations, The - Brian Fagan - Audio Book - Teaching Company\Discovery of Ancient Civilizations - Brian Fagan\Lectuer 16 - Hittites.mp3 14565376 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\to dvd then delete\Discovery Of Ancient Civilizations, The - Brian Fagan - Audio Book - Teaching Company\Discovery of Ancient Civilizations - Brian Fagan\Lectuer 17 - Lords of the Andes.mp3 14700544 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\to dvd then delete\Discovery Of Ancient Civilizations, The - Brian Fagan - Audio Book - Teaching Company\Discovery of Ancient Civilizations - Brian Fagan\Lectuer 18 - Nubian Neighbors.mp3 14577664 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\to dvd then delete\Discovery Of Ancient Civilizations, The - Brian Fagan - Audio Book - Teaching Company\Discovery of Ancient Civilizations - Brian Fagan\Lectuer 19 - The Tomb of Tutankhamun.mp3 14606336 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\to dvd then delete\Discovery Of Ancient Civilizations, The - Brian Fagan - Audio Book - Teaching Company\Discovery of Ancient Civilizations - Brian Fagan\Lectuer 20 - Woolley at Ur.mp3 14544896 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\to dvd then delete\Discovery Of Ancient Civilizations, The - Brian Fagan - Audio Book - Teaching Company\Discovery of Ancient Civilizations - Brian Fagan\Lectuer 21 - Legendary Dynasties of China.mp3 14610432 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\to dvd then delete\Discovery Of Ancient Civilizations, The - Brian Fagan - Audio Book - Teaching Company\Discovery of Ancient Civilizations - Brian Fagan\Lectuer 22 - Cities of the Indus.mp3 14536704 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\to dvd then delete\Discovery Of Ancient Civilizations, The - Brian Fagan - Audio Book - Teaching Company\Discovery of Ancient Civilizations - Brian Fagan\Lectuer 23 - Maya Decipherment.mp3 14610432 bytes
C:\Documents and Settings\Owner\Desktop\Right Bar\Desktop Shortcuts Darkside\Desktop folder to check and store\check these old programs out to see if we need them\to dvd then delete\Discovery Of Ancient Civilizations, The - Brian Fagan - Audio Book - Teaching Company\Discovery of Ancient Civilizations - Brian Fagan\Lectuer 24 - Epilogue.mp3 14766080 bytes

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 141

********************************************************************

Completion time: 2007-05-15 10:49:12 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-05-15 10:49

Hijack This Log:

Logfile of HijackThis v1.99.1
Scan saved at 10:58:28 AM, on 5/15/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
l:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
L:\PROGRA~1\CACHEM~1\CachemanXP.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
c:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {709A8799-D4FC-4D08-9CE9-7A1E61F82CE7} - C:\WINDOWS\system32\awvtq.dll (file missing)
O2 - BHO: (no name) - {7c1ce531-09e9-4fc5-9803-1c2956615786} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8DF4FA7A-D836-4FD6-A15F-48BA6B0002Dd} - C:\WINDOWS\system32\lhknbvdh.dll (file missing)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST1.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-us\msntb.dll
O2 - BHO: (no name) - {C364E524-7059-4F0D-98A9-3531C3BBBEBA} - C:\WINDOWS\system32\mlljj.dll (file missing)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\\vptray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "L:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ClipMate7] C:\Program Files\ClipMate7\ClipMate.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: hp psc 1000 series.lnk.disabled
O4 - Global Startup: hpoddt01.exe.lnk.disabled
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O4 - Global Startup: NkbMonitor.exe.lnk.disabled
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: Add To Compaq Organize… - C:\PROGRA~1\HEWLET~1\COMPAQ~1\bin\core.hp.main\SendTo.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Copy plain text for WhizFolders - L:\Program Files\WhizFolders Organizer Deluxe\copytool.htm
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIC273~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: iSiloX Clipper - {C86027A6-12A1-4298-B6EA-A42AC6EE6C7C} - C:\Program Files\iSilo\iSiloX\iSiloXIE.dll (HKCU)
O9 - Extra 'Tools' menuitem: iSiloX Clipper… - {C86027A6-12A1-4298-B6EA-A42AC6EE6C7C} - C:\Program Files\iSilo\iSiloX\iSiloXIE.dll (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.yahoo.com
O15 - Trusted Zone: http://www.cdhm.org
O15 - Trusted Zone: http://www.macromedia.com
O15 - Trusted Zone: http://widget-f7.slide.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: ebbacadccfed - C:\WINDOWS\system32\ebbacadccfed.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winjrs32 - winjrs32.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - l:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CachemanXP (CachemanXPService) - OuterTechnologies - L:\PROGRA~1\CACHEM~1\CachemanXP.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

shrimper

Post #8May 15, 2007, 5:16 PM UTC

Susan, Here's a copy of the combo fixes quarentine file that it also generated. I wasn't sure if you needed it or not. shrimper

shrimper

Post #9May 15, 2007, 6:23 PM UTC

opps.. I forgot to paste the copy of the text file in the last post.

Combofix quarenting files:

2007-05-12 13:40	  29206	–a——	C:\Qoobox\Quarantine\C\WINDOWS\system32\xxyvspo.dll.vir
2007-05-14 19:08	  262708	–a——	C:\Qoobox\Quarantine\C\WINDOWS\system32\awtqo.dll.vir
2007-05-14 21:04	  1466609	–a——	C:\Qoobox\Quarantine\C\WINDOWS\system32\llnmp.bak1.vir
2007-05-14 21:04	  262708	–a——	C:\Qoobox\Quarantine\C\WINDOWS\system32\pmnll.dll.vir
2007-05-14 23:25	  132660	–a——	C:\Qoobox\Quarantine\C\WINDOWS\system32\npfuontl.dll.vir
2007-05-15 10:25	  1428917	–a——	C:\Qoobox\Quarantine\C\WINDOWS\system32\ltnoufpn.ini.vir
2007-05-15 10:34	  1016	–a——	C:\Qoobox\Quarantine\Registry_backups\LEGACY_IPRIP.reg.cf
2007-05-15 10:34	  1479296	–a——	C:\Qoobox\Quarantine\C\WINDOWS\system32\llnmp.ini.vir
2007-05-15 10:34	  352	–a——	C:\Qoobox\Quarantine\Registry_backups\services_nm.reg.cf
2007-05-15 10:34	  3674	–a——	C:\Qoobox\Quarantine\Registry_backups\services_Iprip.reg.cf


Folder PATH listing for volume PRESARIO
Volume serial number is 0CFB-2073
C:\QOOBOX
+—purity
|   \—C
|	   +—Program Files
|	   |   +—Common Files
|	   |   |   \—CROSOF~1
|	   |   \—ICROSO~1.NET
|	   \—WINDOWS
|		   \—system32
|			   \—ICROSO~1.NET
\—Quarantine
	+—C
	|   \—WINDOWS
	|	   \—system32
	|			   awtqo.dll.vir
	|			   llnmp.bak1.vir
	|			   llnmp.ini.vir
	|			   ltnoufpn.ini.vir
	|			   npfuontl.dll.vir
	|			   pmnll.dll.vir
	|			   xxyvspo.dll.vir
	|			   
	\—Registry_backups
			LEGACY_IPRIP.reg.cf
			services_Iprip.reg.cf
			services_nm.reg.cf

Susan528

Post #10May 15, 2007, 7:50 PM UTC

STEP 1.
======
Please show all files for your system.
You will need to reverse this process when all steps are done.

Submit File to Jotti
Please click on Jotti
Use the "Browse" button and locate the following file on your computer:
C:\WINDOWS\system32\ebbacadccfed.dll
Click the "Submit" button.
Please copy and post (reply) with the results

If Jotti's service load is too high, you can use the following scanner instead:
http://www.virustotal.com/xhtml/index_en.html

Please also check the properties of those files (right-click and select properties from the popupmenu). Look if you can find some company information, etc.

STEP 2.
======
Please set your system to show all files; please see here if you're unsure how to do this.

Run hijackthis. Click Do a System Scan Only. Put a Check in the box on the left side on these:
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {709A8799-D4FC-4D08-9CE9-7A1E61F82CE7} - C:\WINDOWS\system32\awvtq.dll (file missing)
O2 - BHO: (no name) - {7c1ce531-09e9-4fc5-9803-1c2956615786} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8DF4FA7A-D836-4FD6-A15F-48BA6B0002Dd} - C:\WINDOWS\system32\lhknbvdh.dll (file missing)
O2 - BHO: (no name) - {C364E524-7059-4F0D-98A9-3531C3BBBEBA} - C:\WINDOWS\system32\mlljj.dll (file missing)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O20 - Winlogon Notify: winjrs32 - winjrs32.dll (file missing)
Close ALL windows and browsers except HijackThis and click Fix checked and exit.

Please reply with the results from Jotti and a fresh hijackthis log.

shrimper

Post #11May 15, 2007, 10:06 PM UTC

Hi Susan,

I tried to up load the file to Jotti but it wouldn't upload. I got this reply back from Jotti - " The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file". I turned off my firewall and tried again with the same results.

I then tried to upload it to the Virustotal site and got an error saying the file I was trying to up load is zero bytes. I read the info about emailing a file to scan and tried that but Outlook wouldn't send the file either.

I tried to rename it, copy it, move it… I get the error that the file is in use and to close the program that is using it.

I checked the properties and there isn't any information there. It only had the general tab with sizes, dates of creation, accessed, modification…etc. The is not a Summary tab when the company information should be.

I did step 2 anyway and here is the updated Hijack this Logfile:

Logfile of HijackThis v1.99.1
Scan saved at 3:37:48 PM, on 5/15/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
l:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
L:\PROGRA~1\CACHEM~1\CachemanXP.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
c:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\vptray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
L:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\ClipMate7\ClipMate.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST1.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-us\msntb.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\\vptray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "L:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ClipMate7] C:\Program Files\ClipMate7\ClipMate.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: Add To Compaq Organize… - C:\PROGRA~1\HEWLET~1\COMPAQ~1\bin\core.hp.main\SendTo.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Copy plain text for WhizFolders - L:\Program Files\WhizFolders Organizer Deluxe\copytool.htm
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIC273~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: iSiloX Clipper - {C86027A6-12A1-4298-B6EA-A42AC6EE6C7C} - C:\Program Files\iSilo\iSiloX\iSiloXIE.dll (HKCU)
O9 - Extra 'Tools' menuitem: iSiloX Clipper… - {C86027A6-12A1-4298-B6EA-A42AC6EE6C7C} - C:\Program Files\iSilo\iSiloX\iSiloXIE.dll (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.yahoo.com
O15 - Trusted Zone: http://www.cdhm.org
O15 - Trusted Zone: http://www.macromedia.com
O15 - Trusted Zone: http://widget-f7.slide.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: ebbacadccfed - C:\WINDOWS\system32\ebbacadccfed.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - l:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CachemanXP (CachemanXPService) - OuterTechnologies - L:\PROGRA~1\CACHEM~1\CachemanXP.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

Susan528

Post #12May 16, 2007, 11:26 AM UTC

Let's try this:

Start Hijackthis
Click on the Config button
Click on the Misc Tools button
Click on the button labeled Delete a file on reboot…
A new window will open asking you to select the file that you would like to delete on reboot. Navigate to the file
C:\WINDOWS\system32\ebbacadccfed.dll
and click on it once, and then click on the Open button.
You will now be asked if you would like to reboot your computer to delete the file. Click on the Yes button to reboot now.

Please post (reply) with another hijackthis log.

shrimper

Post #13May 16, 2007, 6:56 PM UTC

Hi Again Susan,

I did it twice (trying to have it deleted on reboot) with HJT.

That file is a mean one! Looks to me like its still there.

copy of latest HJT logfile follows:

Logfile of HijackThis v1.99.1
Scan saved at 12:45:54 PM, on 5/16/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
l:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
L:\PROGRA~1\CACHEM~1\CachemanXP.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
c:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\vptray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
L:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\ClipMate7\ClipMate.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST1.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-us\msntb.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\\vptray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "L:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ClipMate7] C:\Program Files\ClipMate7\ClipMate.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: Add To Compaq Organize… - C:\PROGRA~1\HEWLET~1\COMPAQ~1\bin\core.hp.main\SendTo.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Copy plain text for WhizFolders - L:\Program Files\WhizFolders Organizer Deluxe\copytool.htm
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIC273~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: iSiloX Clipper - {C86027A6-12A1-4298-B6EA-A42AC6EE6C7C} - C:\Program Files\iSilo\iSiloX\iSiloXIE.dll (HKCU)
O9 - Extra 'Tools' menuitem: iSiloX Clipper… - {C86027A6-12A1-4298-B6EA-A42AC6EE6C7C} - C:\Program Files\iSilo\iSiloX\iSiloXIE.dll (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.yahoo.com
O15 - Trusted Zone: http://www.cdhm.org
O15 - Trusted Zone: http://www.macromedia.com
O15 - Trusted Zone: http://widget-f7.slide.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: ebbacadccfed - C:\WINDOWS\system32\ebbacadccfed.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - l:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CachemanXP (CachemanXPService) - OuterTechnologies - L:\PROGRA~1\CACHEM~1\CachemanXP.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

Susan528

Post #14May 16, 2007, 9:33 PM UTC

1. Please download The Avenger by Swandog46 to your Desktop.

Click on Avenger.zip to open the file
Extract avenger.exe to your desktop

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Files to delete:
C:\WINDOWS\system32\ebbacadccfed.dll
C:\WINDOWS\system32\ddayw.dll

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.

Under "Script file to execute" choose "Input Script Manually".
Now click on the Magnifying Glass icon which will open a new window titled "View/edit script"
Paste the text copied to clipboard into this window by pressing (Ctrl+V).
Click Done
Now click on the Green Light to begin execution of the script
Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please copy/paste the content of c:\avenger.txt into your reply along with a fresh HJT log by using Add/Reply
===============

shrimper

Post #15May 17, 2007, 1:11 AM UTC

Susan,

Here are the results.

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\njvyiupq

*******************

Script file located at: \??\C:\WINDOWS\ufueiwgl.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\system32\ebbacadccfed.dll deleted successfully.
File C:\WINDOWS\system32\ddayw.dll deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Latestet HJT logfile:

Logfile of HijackThis v1.99.1
Scan saved at 7:03:49 PM, on 5/16/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
l:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
L:\PROGRA~1\CACHEM~1\CachemanXP.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
c:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\vptray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe
L:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\ClipMate7\ClipMate.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST1.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-us\msntb.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\\vptray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "L:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ClipMate7] C:\Program Files\ClipMate7\ClipMate.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: Add To Compaq Organize… - C:\PROGRA~1\HEWLET~1\COMPAQ~1\bin\core.hp.main\SendTo.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Copy plain text for WhizFolders - L:\Program Files\WhizFolders Organizer Deluxe\copytool.htm
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIC273~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: iSiloX Clipper - {C86027A6-12A1-4298-B6EA-A42AC6EE6C7C} - C:\Program Files\iSilo\iSiloX\iSiloXIE.dll (HKCU)
O9 - Extra 'Tools' menuitem: iSiloX Clipper… - {C86027A6-12A1-4298-B6EA-A42AC6EE6C7C} - C:\Program Files\iSilo\iSiloX\iSiloXIE.dll (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.yahoo.com
O15 - Trusted Zone: http://www.cdhm.org
O15 - Trusted Zone: http://www.macromedia.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: ebbacadccfed - C:\WINDOWS\system32\ebbacadccfed.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - l:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CachemanXP (CachemanXPService) - OuterTechnologies - L:\PROGRA~1\CACHEM~1\CachemanXP.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Hijack This Log... Help Please

✨ Ask AI

Ask AI