My Hijack Log File

Again you haven't sent me the logs I asked for, the Kaspersky scan is missing. Please don't post until you have all the logs I asked for.

It really is frustrating to answer your posts and find only half the information I need present. if you don't want my help just tell me, otherwise send me ALL the information I ask for.

Also I still see no signs of a Firewall in your latest HJT log, you really must install one. This is not optional.

Without a fully functioning 2 way firewall your computer is wide open to being re-infected. Please fit one at once.

Dear Gary, I'm sorry to disappoint. Please try and be patient. Each time I try to run some programs, it takes forever. I'm almost ready to get rid of this computer. The Kapersky program takes the longest by far. By the time I get the results, the other stuff is outdated. I will install the firewall and rerun the HiJack program but it'll have to be tomorrow. Thanks for whatever patience you have remaining.

Hi Hatsuko,

Don't worry my patience is pretty flexible, it's just that I haven't seen anything on your logs so far to explain why your computer should run so slowly (are you still getting pop-ups).

Can you run a further scan for me please, this one checks for something quite different to the others.

Download FindAWF by noahdfear and save it to your Desktop.

• Double click FindAWF.exe and follow the instructions.
• When the tool has finished scanning, the results will be saved as awf.txt on your Desktop.
• Copy and paste them into your next reply please, along with the Kaspersky log.

KASPERSKY ONLINE SCANNER REPORTKASPERSKY ONLINE SCANNER REPORT Thursday, June 28, 2007 9:16:31 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.93.0 Kaspersky Anti-Virus database last update: 28/06/2007 Kaspersky Anti-Virus database records: 355159 Scan Settings Scan using the following antivirus databaseextended Scan Archivestrue Scan Mail Basestrue Scan TargetMy Computer A:\ C:\ D:\ E:\ Scan Statistics Total number of scanned objects125235 Number of viruses found11 Number of infected objects40 Number of suspicious objects0 Duration of the scan process03:31:53 Infected Object NameVirus NameLast Action C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Broderbund Software\Print\Business Card Creator\PMWPRINT.INI Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\AOL OCP\AIM\Storage\All Users\localStorage\common.cls Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\AOL OCP\AIM\Storage\data\mandiasphyxiat3d\localStorage\common.cls Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temp\~DF18FE.tmp Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Owner\ntuser.dat.LOG Object is locked skipped C:\hp\bin\KillWind.exe Infected: not-a-virus:RiskTool.Win32.PsKill.p skipped C:\Program Files\HP\hpcoretech\hpcmerr.log Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP82\A0041962.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP82\A0041971.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP82\A0041971.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP82\A0041971.exe RarSFX: infected - 2 skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP82\A0041972.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP82\A0041972.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP82\A0041972.exe RarSFX: infected - 2 skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP85\A0042369.exe/stream/data0002/data0002 Infected: Trojan-Downloader.Win32.PurityScan.eh skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP85\A0042369.exe/stream/data0002 Infected: Trojan-Downloader.Win32.PurityScan.eh skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP85\A0042369.exe/stream/data0004 Infected: not-a-virus:AdWare.Win32.Softomate.u skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP85\A0042369.exe/stream Infected: not-a-virus:AdWare.Win32.Softomate.u skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP85\A0042369.exe NSIS: infected - 4 skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP85\A0042370.exe/stream/data0002 Infected: Trojan-Downloader.Win32.TSUpdate.o skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP85\A0042370.exe/stream/data0004 Infected: not-a-virus:AdWare.Win32.Softomate.u skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP85\A0042370.exe/stream Infected: not-a-virus:AdWare.Win32.Softomate.u skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP85\A0042370.exe NSIS: infected - 3 skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP85\A0042371.exe/stream/data0002 Infected: Trojan-Downloader.Win32.Small.buy skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP85\A0042371.exe/stream/data0004 Infected: not-a-virus:AdWare.Win32.Softomate.u skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP85\A0042371.exe/stream Infected: not-a-virus:AdWare.Win32.Softomate.u skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP85\A0042371.exe NSIS: infected - 3 skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP85\A0042372.exe/data0002 Infected: not-a-virus:AdWare.Win32.PurityScan.fk skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP85\A0042372.exe/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.bu skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP85\A0042372.exe NSIS: infected - 2 skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP85\A0042373.exe/stream/data0002 Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP85\A0042373.exe/stream/data0005 Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP85\A0042373.exe/stream/data0006 Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP85\A0042373.exe/stream/data0008 Infected: not-a-virus:AdWare.Win32.Softomate.u skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP85\A0042373.exe/stream Infected: not-a-virus:AdWare.Win32.Softomate.u skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP85\A0042373.exe NSIS: infected - 5 skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP90\A0042868.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP90\A0042868.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP90\A0042868.exe RarSFX: infected - 2 skipped C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP91\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{524AA9BC-6C92-4E0A-B8A7-EFC6F15AC1B6}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\drivers\core.cache.dsk Object is locked skipped C:\WINDOWS\system32\drivers\core.sys Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped C:\_OTMoveIt\MovedFiles\Program Files\Sofeting\ace.dll Infected: Trojan.Win32.Crypt.t skipped C:\_OTMoveIt\MovedFiles\Program Files\Sofeting\distmadm.exe Infected: Trojan.Win32.Crypt.t skipped C:\_OTMoveIt\MovedFiles\Program Files\Sofeting\hneomuid.exe Infected: Trojan.Win32.Crypt.t skipped C:\_OTMoveIt\MovedFiles\Program Files\Sofeting\WinGenerics.dll Infected: Trojan.Win32.Crypt.t skipped C:\_OTMoveIt\MovedFiles\WINDOWS\whCC-GIANT.exe/data.rar/WhAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.351 skipped C:\_OTMoveIt\MovedFiles\WINDOWS\whCC-GIANT.exe/data.rar Infected: not-a-virus:AdWare.Win32.WebHancer.351 skipped C:\_OTMoveIt\MovedFiles\WINDOWS\whCC-GIANT.exe RarSFX: infected - 2 skipped Scan process completed.

Find AWF report by noahdfear ©2006 bak folders found ~~~~~~~~~~~ Directory of C:\HP\BIN\BAK 06/18/2003 09:19 PM 53,248 AUTOTKIT.EXE 1 File(s) 53,248 bytes Directory of C:\HP\KBD\BAK 02/11/2003 10:02 PM 61,440 KBD.EXE 1 File(s) 61,440 bytes Directory of C:\PROGRA~1\ITUNES\BAK 10/06/2005 06:03 PM 278,528 iTunesHelper.exe 1 File(s) 278,528 bytes Directory of C:\PROGRA~1\LEXMAR~1\BAK 08/19/2003 05:43 AM 57,344 lxbkbmgr.exe 1 File(s) 57,344 bytes Directory of C:\PROGRA~1\MESSEN~1\BAK 08/21/2002 12:08 AM 1,511,453 msmsgs.exe 1 File(s) 1,511,453 bytes Directory of C:\PROGRA~1\NORTON~1\BAK 11/15/2002 09:08 AM 476,792 Cfgwiz.exe 1 File(s) 476,792 bytes Directory of C:\PROGRA~1\QUICKT~1\BAK 06/16/2006 01:51 AM 155,648 qttask.exe 1 File(s) 155,648 bytes Directory of C:\WINDOWS\SMINST\BAK 09/13/2002 11:42 PM 212,992 RECGUARD.EXE 1 File(s) 212,992 bytes Directory of C:\WINDOWS\SYSTEM\BAK 05/07/1998 06:04 PM 52,736 hpsysdrv.exe 1 File(s) 52,736 bytes Directory of C:\PROGRA~1\COMMON~1\SYMANT~1\BAK 11/15/2002 04:29 AM 54,976 ccApp.exe 11/15/2002 04:29 AM 59,072 ccRegVfy.exe 2 File(s) 114,048 bytes Directory of C:\PROGRA~1\HEWLET~1\{45B61~1\BAK 05/23/2003 05:03 AM 49,152 hphupd05.exe 1 File(s) 49,152 bytes Directory of C:\PROGRA~1\HP\HPCORE~1\BAK 12/22/2003 07:38 AM 241,664 hpcmpmgr.exe 1 File(s) 241,664 bytes Directory of C:\PROGRA~1\HP\HPSOFT~1\BAK 08/04/2003 04:28 PM 49,152 HPWuSchd.exe 1 File(s) 49,152 bytes Directory of C:\PROGRA~1\MUSICM~1\MUSICM~1\BAK 02/24/2003 08:51 PM 53,248 mmtask.exe 1 File(s) 53,248 bytes Directory of C:\PROGRA~1\MYSPACE\IM\BAK 06/14/2006 06:58 PM 1,159,168 MySpaceIM.exe 1 File(s) 1,159,168 bytes Directory of C:\PROGRA~1\COMMON~1\REAL\UPDATE~1\BAK 08/23/2003 09:14 AM 151,597 realsched.exe 1 File(s) 151,597 bytes Directory of C:\PROGRA~1\COMMON~1\SONIC\UPDATE~1\BAK 02/13/2003 10:01 AM 155,648 sgtray.exe 1 File(s) 155,648 bytes Directory of C:\PROGRA~1\HEWLET~1\DIGITA~1\BIN\BAK 06/22/2003 11:25 PM 24,576 backupnotify.exe 1 File(s) 24,576 bytes Directory of C:\PROGRA~1\HEWLET~1\DIGITA~1\UNLOAD\BAK 10/07/2002 09:23 AM 90,112 hpqcmon.exe 1 File(s) 90,112 bytes Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~

Hi hatsuko,

Looks like you've got AWF. This is an infection that hides by re-writing a number of legitimate files on your computer, so it is not detected by conventional scanners.

However your FindAWF log got cut short and I haven't got all the information I need to produce a fix for you.

Can you run FindAWF again and post me the full log please.

Directory of C:\HP\BIN\BAK 06/18/2003 09:19 PM 53,248 AUTOTKIT.EXE 1 File(s) 53,248 bytes Directory of C:\HP\KBD\BAK 02/11/2003 10:02 PM 61,440 KBD.EXE 1 File(s) 61,440 bytes Directory of C:\PROGRA~1\ITUNES\BAK 10/06/2005 06:03 PM 278,528 iTunesHelper.exe 1 File(s) 278,528 bytes Directory of C:\PROGRA~1\LEXMAR~1\BAK 08/19/2003 05:43 AM 57,344 lxbkbmgr.exe 1 File(s) 57,344 bytes Directory of C:\PROGRA~1\MESSEN~1\BAK 08/21/2002 12:08 AM 1,511,453 msmsgs.exe 1 File(s) 1,511,453 bytes Directory of C:\PROGRA~1\NORTON~1\BAK 11/15/2002 09:08 AM 476,792 Cfgwiz.exe 1 File(s) 476,792 bytes Directory of C:\PROGRA~1\QUICKT~1\BAK 06/16/2006 01:51 AM 155,648 qttask.exe 1 File(s) 155,648 bytes Directory of C:\WINDOWS\SMINST\BAK 09/13/2002 11:42 PM 212,992 RECGUARD.EXE 1 File(s) 212,992 bytes Directory of C:\WINDOWS\SYSTEM\BAK 05/07/1998 06:04 PM 52,736 hpsysdrv.exe 1 File(s) 52,736 bytes Directory of C:\PROGRA~1\COMMON~1\SYMANT~1\BAK 11/15/2002 04:29 AM 54,976 ccApp.exe 11/15/2002 04:29 AM 59,072 ccRegVfy.exe 2 File(s) 114,048 bytes Directory of C:\PROGRA~1\HEWLET~1\{45B61~1\BAK 05/23/2003 05:03 AM 49,152 hphupd05.exe 1 File(s) 49,152 bytes Directory of C:\PROGRA~1\HP\HPCORE~1\BAK 12/22/2003 07:38 AM 241,664 hpcmpmgr.exe 1 File(s) 241,664 bytes Directory of C:\PROGRA~1\HP\HPSOFT~1\BAK 08/04/2003 04:28 PM 49,152 HPWuSchd.exe 1 File(s) 49,152 bytes Directory of C:\PROGRA~1\MUSICM~1\MUSICM~1\BAK 02/24/2003 08:51 PM 53,248 mmtask.exe 1 File(s) 53,248 bytes Directory of C:\PROGRA~1\MYSPACE\IM\BAK 06/14/2006 06:58 PM 1,159,168 MySpaceIM.exe 1 File(s) 1,159,168 bytes Directory of C:\PROGRA~1\COMMON~1\REAL\UPDATE~1\BAK 08/23/2003 09:14 AM 151,597 realsched.exe 1 File(s) 151,597 bytes Directory of C:\PROGRA~1\COMMON~1\SONIC\UPDATE~1\BAK 02/13/2003 10:01 AM 155,648 sgtray.exe 1 File(s) 155,648 bytes Directory of C:\PROGRA~1\HEWLET~1\DIGITA~1\BIN\BAK 06/22/2003 11:25 PM 24,576 backupnotify.exe 1 File(s) 24,576 bytes Directory of C:\PROGRA~1\HEWLET~1\DIGITA~1\UNLOAD\BAK 10/07/2002 09:23 AM 90,112 hpqcmon.exe 1 File(s) 90,112 bytes Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ 53248 Jun 18 2003 "C:\hp\bin\AUTOTKIT.EXE" 53248 Jun 18 2003 "C:\hp\EXPLOREBAR\AUTOTKIT.EXE" 53248 Jun 18 2003 "C:\hp\bin\bak\AUTOTKIT.EXE" 61440 Feb 11 2003 "C:\hp\KBD\kbd.exe" 61440 Feb 11 2003 "C:\hp\KBD\bak\KBD.EXE" 257088 Jun 1 2007 "C:\Program Files\iTunes\iTunesHelper.exe" 278528 Oct 6 2005 "C:\Program Files\iTunes\bak\iTunesHelper.exe" 102400 Jun 6 2007 "C:\WINDOWS\Installer\{553E56C3-7AA1-45FE-A2FC-2C43DC27F765}\iTunesIco.exe" 116288 Jun 1 2007 "C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.2.0.35\iTunesSetupAdmin.exe" 57344 Aug 19 2003 "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" 57344 Aug 19 2003 "C:\Program Files\Lexmark X1100 Series\bak\lxbkbmgr.exe" 1694208 Oct 13 2004 "C:\Program Files\Messenger\msmsgs.exe" 1667584 Aug 3 2004 "C:\WINDOWS\$NtUninstallKB887472$\msmsgs.exe" 1511453 Aug 21 2002 "C:\Program Files\Messenger\bak\msmsgs.exe" 1694208 Oct 13 2004 "C:\WINDOWS\$hf_mig$\KB887472\SP2QFE\msmsgs.exe" 1694208 Oct 13 2004 "C:\WINDOWS\SoftwareDistribution\Download\561c9bea035f5195ab841bef0d7c79b4\sp2gdr\msmsgs.exe" 1694208 Oct 13 2004 "C:\WINDOWS\SoftwareDistribution\Download\561c9bea035f5195ab841bef0d7c79b4\sp2qfe\msmsgs.exe" 476792 Nov 15 2002 "C:\Program Files\Norton AntiVirus\bak\Cfgwiz.exe" 282624 Apr 27 2007 "C:\Program Files\QuickTime\qttask.exe" 155648 Jun 16 2006 "C:\Program Files\QuickTime\bak\qttask.exe" 212992 Sep 13 2002 "C:\WINDOWS\SMINST\Recguard.exe" 212992 Sep 13 2002 "C:\WINDOWS\SMINST\bak\RECGUARD.EXE" 52736 May 7 1998 "C:\WINDOWS\system\hpsysdrv.exe" 52736 May 7 1998 "C:\WINDOWS\system\bak\hpsysdrv.exe" 54976 Nov 15 2002 "C:\Program Files\Common Files\Symantec Shared\bak\ccApp.exe" 59072 Nov 15 2002 "C:\Program Files\Common Files\Symantec Shared\bak\ccRegVfy.exe" 49152 May 23 2003 "C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" 49152 May 23 2003 "C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\bak\hphupd05.exe" 241664 Dec 22 2003 "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" 241664 Dec 22 2003 "C:\Program Files\HP\hpcoretech\bak\hpcmpmgr.exe" 49152 Aug 4 2003 "C:\Program Files\HP\HP Software Update\hpwuSchd.exe" 49152 Aug 4 2003 "C:\Program Files\HP\HP Software Update\bak\HPWuSchd.exe" 53248 Feb 24 2003 "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" 53248 Feb 24 2003 "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\bak\mmtask.exe" 53248 Feb 24 2003 "C:\Program Files\MUSICMATCH\MUSICMATCH Update\MMJB\mmtask.exe" 4286 Jun 2 2006 "C:\WINDOWS\Installer\{3F7A29AC-A839-49A7-B2F4-BD9A35CDE5EC}\MySpaceIM.exe" 4286 Jun 16 2006 "C:\WINDOWS\Installer\{5E52F124-0C19-45AF-A9D2-FC7D72041AE3}\MySpaceIM.exe" 1159168 Jun 14 2006 "C:\Program Files\MySpace\IM\bak\MySpaceIM.exe" 151597 Aug 23 2003 "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" 151597 Aug 23 2003 "C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe" 155648 Feb 13 2003 "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" 155648 Feb 13 2003 "C:\Program Files\Common Files\Sonic\Update Manager\bak\sgtray.exe" 24576 Jun 22 2003 "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\BackupNotify.exe" 24576 Jun 22 2003 "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\bak\backupnotify.exe" 90112 Oct 7 2002 "C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\HpqCmon.exe" 90112 Oct 7 2002 "C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\bak\hpqcmon.exe" end of report

That's better, now we can see what we're up against.

OK, lets get rid of AWF

• Right click on DelDomains and select Save Target As (in Firefox it's Save Link As) and save it to your Desktop.
• To run the file, right click on DelDomains.inf and select Install.
• Once it is finished your Zones should be reset. (Note: There is no onscreen indication).

Note: If you use SpywareBlaster and/or IESpyads, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the program and re-protect all items. For IESpyads, run the batch file and reinstall the protection.

Next

• Right click on Reset Protocol Defaults and select Save Target As (in Firefox it's Save Link As) and save it to your Desktop.
• Double click ResetProtocolDefaults.reg to run it, and when prompted allow it to merge with the Registry.

Next

• Click Start > Run type Notepad click OK.
• This will open an empty Notepad file.
• Copy/Paste the contents of the box below into Notepad.

if exist "C:\hp\bin\AUTOTKIT.EXE" del /q "C:\hp\bin\AUTOTKIT.EXE"	  
copy /y "C:\hp\bin\bak\AUTOTKIT.EXE" "C:\hp\bin\AUTOTKIT.EXE"	  
if exist "C:\hp\KBD\KBD.EXE" del /q "C:\hp\KBD\KBD.EXE"	  
copy /y "C:\hp\KBD\bak\KBD.EXE" "C:\hp\KBD\KBD.EXE"	  
if exist "C:\Program Files\iTunes\iTunesHelper.exe" del /q "C:\Program Files\iTunes\iTunesHelper.exe"	  
copy /y "C:\Program Files\iTunes\bak\iTunesHelper.exe" "C:\Program Files\iTunes\iTunesHelper.exe"	  
if exist "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" del /q "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"	  
copy /y "C:\Program Files\Lexmark X1100 Series\bak\lxbkbmgr.exe" "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"	  
if exist "C:\Program Files\Messenger\msmsgs.exe" del /q "C:\Program Files\Messenger\msmsgs.exe"	  
copy /y "C:\Program Files\Messenger\bak\msmsgs.exe" "C:\Program Files\Messenger\msmsgs.exe"	  
if exist "C:\Program Files\Norton AntiVirus\Cfgwiz.exe" del /q "C:\Program Files\Norton AntiVirus\Cfgwiz.exe"	  
copy /y "C:\Program Files\Norton AntiVirus\bak\Cfgwiz.exe" "C:\Program Files\Norton AntiVirus\Cfgwiz.exe"	  
if exist "C:\Program Files\QuickTime\qttask.exe" del /q "C:\Program Files\QuickTime\qttask.exe"	  
copy /y "C:\Program Files\QuickTime\bak\qttask.exe" "C:\Program Files\QuickTime\qttask.exe"	  
if exist "C:\WINDOWS\SMINST\RECGUARD.EXE" del /q "C:\WINDOWS\SMINST\RECGUARD.EXE"	  
copy /y "C:\WINDOWS\SMINST\bak\RECGUARD.EXE" "C:\WINDOWS\SMINST\RECGUARD.EXE"	  
if exist "C:\WINDOWS\system\hpsysdrv.exe" del /q "C:\WINDOWS\system\hpsysdrv.exe"	  
copy /y "C:\WINDOWS\system\bak\hpsysdrv.exe" "C:\WINDOWS\system\hpsysdrv.exe"	  
if exist "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" del /q "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"	  
copy /y "C:\Program Files\Common Files\Symantec Shared\bak\ccRegVfy.exe" "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"	  
if exist "C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" del /q "C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe"	  
copy /y "C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\bak\hphupd05.exe" "C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe"	  
if exist "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" del /q "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"	  
copy /y "C:\Program Files\HP\hpcoretech\bak\hpcmpmgr.exe" "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"	  
if exist "C:\Program Files\HP\HP Software Update\HPWuSchd.exe" del /q "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"	  
copy /y "C:\Program Files\HP\HP Software Update\bak\HPWuSchd.exe" "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"	  
if exist "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" del /q "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe"	  
copy /y "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\bak\mmtask.exe" "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe"	  
if exist "C:\Program Files\MySpace\IM\MySpaceIM.exe" del /q "C:\Program Files\MySpace\IM\MySpaceIM.exe"	  
copy /y "C:\Program Files\MySpace\IM\bak\MySpaceIM.exe" "C:\Program Files\MySpace\IM\MySpaceIM.exe"	  
if exist "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" del /q "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"	  
copy /y "C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe" "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"	  
if exist "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" del /q "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe"	  
copy /y "C:\Program Files\Common Files\Sonic\Update Manager\bak\sgtray.exe" "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe"	  
if exist "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe" del /q "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe"	  
copy /y "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\bak\backupnotify.exe" "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe"	  
if exist "C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe" del /q "C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe"	  
copy /y "C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\bak\hpqcmon.exe" "C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe"

• Click Format and ensure Wordwrap is unchecked.
• Save as RemoveAWF.bat
• Save as file type All Files or it won't work.
• Don't run it yet.

Next
Reboot your computer in Safe Mode

• If your computer is running, shut down Windows, then turn the power off.
• Wait 30 seconds, then turn the computer on, and begin tapping the F8 key.
• The Windows Advanced Options Menu appears. (If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again).
• Select Safe Mode using the up/down arrow keys.
• Press Enter.
• Log on with an account that has administrator priviledges (NOT the account named Administrator).

Once in Safe Mode

• Double click on RemoveAWF.bat to run it.

REBOOT INTO NORMAL MODE

Now run FindAWF.exe again, and post me the log please, along with a new HJT log.

Let me know how your computer is running now.

Gary, there are still popups… Find AWF report by noahdfear ©2006 bak folders found ~~~~~~~~~~~ Directory of C:\HP\BIN\BAK 06/18/2003 09:19 PM 53,248 AUTOTKIT.EXE 1 File(s) 53,248 bytes Directory of C:\HP\KBD\BAK 02/11/2003 10:02 PM 61,440 KBD.EXE 1 File(s) 61,440 bytes Directory of C:\PROGRA~1\ITUNES\BAK 10/06/2005 06:03 PM 278,528 iTunesHelper.exe 1 File(s) 278,528 bytes Directory of C:\PROGRA~1\LEXMAR~1\BAK 08/19/2003 05:43 AM 57,344 lxbkbmgr.exe 1 File(s) 57,344 bytes Directory of C:\PROGRA~1\MESSEN~1\BAK 08/21/2002 12:08 AM 1,511,453 msmsgs.exe 1 File(s) 1,511,453 bytes Directory of C:\PROGRA~1\NORTON~1\BAK 11/15/2002 09:08 AM 476,792 Cfgwiz.exe 1 File(s) 476,792 bytes Directory of C:\PROGRA~1\QUICKT~1\BAK 06/16/2006 01:51 AM 155,648 qttask.exe 1 File(s) 155,648 bytes Directory of C:\WINDOWS\SMINST\BAK 09/13/2002 11:42 PM 212,992 RECGUARD.EXE 1 File(s) 212,992 bytes Directory of C:\WINDOWS\SYSTEM\BAK 05/07/1998 06:04 PM 52,736 hpsysdrv.exe 1 File(s) 52,736 bytes Directory of C:\PROGRA~1\COMMON~1\SYMANT~1\BAK 11/15/2002 04:29 AM 54,976 ccApp.exe 11/15/2002 04:29 AM 59,072 ccRegVfy.exe 2 File(s) 114,048 bytes Directory of C:\PROGRA~1\HEWLET~1\{45B61~1\BAK 05/23/2003 05:03 AM 49,152 hphupd05.exe 1 File(s) 49,152 bytes Directory of C:\PROGRA~1\HP\HPCORE~1\BAK 12/22/2003 07:38 AM 241,664 hpcmpmgr.exe 1 File(s) 241,664 bytes Directory of C:\PROGRA~1\HP\HPSOFT~1\BAK 08/04/2003 04:28 PM 49,152 HPWuSchd.exe 1 File(s) 49,152 bytes Directory of C:\PROGRA~1\MUSICM~1\MUSICM~1\BAK 02/24/2003 08:51 PM 53,248 mmtask.exe 1 File(s) 53,248 bytes Directory of C:\PROGRA~1\MYSPACE\IM\BAK 06/14/2006 06:58 PM 1,159,168 MySpaceIM.exe 1 File(s) 1,159,168 bytes Directory of C:\PROGRA~1\COMMON~1\REAL\UPDATE~1\BAK 08/23/2003 09:14 AM 151,597 realsched.exe 1 File(s) 151,597 bytes Directory of C:\PROGRA~1\COMMON~1\SONIC\UPDATE~1\BAK 02/13/2003 10:01 AM 155,648 sgtray.exe 1 File(s) 155,648 bytes Directory of C:\PROGRA~1\HEWLET~1\DIGITA~1\BIN\BAK 06/22/2003 11:25 PM 24,576 backupnotify.exe 1 File(s) 24,576 bytes Directory of C:\PROGRA~1\HEWLET~1\DIGITA~1\UNLOAD\BAK 10/07/2002 09:23 AM 90,112 hpqcmon.exe 1 File(s) 90,112 bytes Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ 53248 Jun 18 2003 "C:\hp\bin\AUTOTKIT.EXE" 53248 Jun 18 2003 "C:\hp\EXPLOREBAR\AUTOTKIT.EXE" 53248 Jun 18 2003 "C:\hp\bin\bak\AUTOTKIT.EXE" 61440 Feb 11 2003 "C:\hp\KBD\KBD.EXE" 61440 Feb 11 2003 "C:\hp\KBD\bak\KBD.EXE" 278528 Oct 6 2005 "C:\Program Files\iTunes\iTunesHelper.exe" 278528 Oct 6 2005 "C:\Program Files\iTunes\bak\iTunesHelper.exe" 102400 Jun 6 2007 "C:\WINDOWS\Installer\{553E56C3-7AA1-45FE-A2FC-2C43DC27F765}\iTunesIco.exe" 116288 Jun 1 2007 "C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.2.0.35\iTunesSetupAdmin.exe" 57344 Aug 19 2003 "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" 57344 Aug 19 2003 "C:\Program Files\Lexmark X1100 Series\bak\lxbkbmgr.exe" 1511453 Aug 21 2002 "C:\Program Files\Messenger\msmsgs.exe" 1667584 Aug 3 2004 "C:\WINDOWS\$NtUninstallKB887472$\msmsgs.exe" 1511453 Aug 21 2002 "C:\Program Files\Messenger\bak\msmsgs.exe" 1694208 Oct 13 2004 "C:\WINDOWS\$hf_mig$\KB887472\SP2QFE\msmsgs.exe" 1694208 Oct 13 2004 "C:\WINDOWS\SoftwareDistribution\Download\561c9bea035f5195ab841bef0d7c79b4\sp2gdr\msmsgs.exe" 1694208 Oct 13 2004 "C:\WINDOWS\SoftwareDistribution\Download\561c9bea035f5195ab841bef0d7c79b4\sp2qfe\msmsgs.exe" 476792 Nov 15 2002 "C:\Program Files\Norton AntiVirus\Cfgwiz.exe" 476792 Nov 15 2002 "C:\Program Files\Norton AntiVirus\bak\Cfgwiz.exe" 155648 Jun 16 2006 "C:\Program Files\QuickTime\qttask.exe" 155648 Jun 16 2006 "C:\Program Files\QuickTime\bak\qttask.exe" 212992 Sep 13 2002 "C:\WINDOWS\SMINST\RECGUARD.EXE" 212992 Sep 13 2002 "C:\WINDOWS\SMINST\bak\RECGUARD.EXE" 52736 May 7 1998 "C:\WINDOWS\system\hpsysdrv.exe" 52736 May 7 1998 "C:\WINDOWS\system\bak\hpsysdrv.exe" 54976 Nov 15 2002 "C:\Program Files\Common Files\Symantec Shared\bak\ccApp.exe" 59072 Nov 15 2002 "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" 59072 Nov 15 2002 "C:\Program Files\Common Files\Symantec Shared\bak\ccRegVfy.exe" 49152 May 23 2003 "C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" 49152 May 23 2003 "C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\bak\hphupd05.exe" 241664 Dec 22 2003 "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" 241664 Dec 22 2003 "C:\Program Files\HP\hpcoretech\bak\hpcmpmgr.exe" 49152 Aug 4 2003 "C:\Program Files\HP\HP Software Update\HPWuSchd.exe" 49152 Aug 4 2003 "C:\Program Files\HP\HP Software Update\bak\HPWuSchd.exe" 53248 Feb 24 2003 "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" 53248 Feb 24 2003 "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\bak\mmtask.exe" 53248 Feb 24 2003 "C:\Program Files\MUSICMATCH\MUSICMATCH Update\MMJB\mmtask.exe" 1159168 Jun 14 2006 "C:\Program Files\MySpace\IM\MySpaceIM.exe" 4286 Jun 2 2006 "C:\WINDOWS\Installer\{3F7A29AC-A839-49A7-B2F4-BD9A35CDE5EC}\MySpaceIM.exe" 4286 Jun 16 2006 "C:\WINDOWS\Installer\{5E52F124-0C19-45AF-A9D2-FC7D72041AE3}\MySpaceIM.exe" 1159168 Jun 14 2006 "C:\Program Files\MySpace\IM\bak\MySpaceIM.exe" 151597 Aug 23 2003 "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" 151597 Aug 23 2003 "C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe" 155648 Feb 13 2003 "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" 155648 Feb 13 2003 "C:\Program Files\Common Files\Sonic\Update Manager\bak\sgtray.exe" 24576 Jun 22 2003 "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe" 24576 Jun 22 2003 "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\bak\backupnotify.exe" 90112 Oct 7 2002 "C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe" 90112 Oct 7 2002 "C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\bak\hpqcmon.exe" end of report

OK, we need to check that the AWF has been removed. I'm afraid there's no easy way to do this, you're going to have to do this manually.

You're going to have to search one at a time for each of the files below (highlighted in bold).

C:\hp\bin\AUTOTKIT.EXE
C:\hp\KBD\KBD.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Norton AntiVirus\Cfgwiz.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\SMINST\RECGUARD.EXE
C:\WINDOWS\system\hpsysdrv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe

For each file do the following.

• Right click the file.
• Select Properties
• Click on the General tab and note down the following.
  • File size.
  • Date created.
  • Date modified.
• Click on the Version tab and note down the following.
  • Description.
  • Company (click on Company to reveal the name) if available.
• Post me the details for each file. Name them so I know which is which if there's no description field.

Lot of work I know, but I need to see if any of the files are still infected, and if so which ones.

Can you also run another scan for me.

• Create a folder on your desktop called Sysclean.
• Download Sysclean Package to the folder you made.
• Download Virus Pattern File (Official Pattern Release) to your desktop. This file will be called lptXXX.zip (XXX represents the version number)
• Unzip lptXXX.zip and you'll get the file lpt$vpn.XXX. Read here how to unzip/extract properly.
• Move the lpt$vpn.XXX to the Sysclean folder you created on your desktop.
• Open the sysclean folder and doubleclick sysclean.com.
• Check: Automatically clean or delete detected files.
• Click scan.

Open your sysclean folder and copy and paste the contents of sysclean.log in your next reply please.

C:\hp\bin\AUTOTKIT.EXE File size: 52.0 KB (53,248 bytes) Date created: Saturday, August 23, 2003, 9:18:40 AM Date modified: Wednesday, June 18, 2003, 9:19:08 PM Description: Company: C:\hp\KBD\KBD.EXE File size: 60.0 KB (61,440 bytes) Date created: Saturday, August 23, 2003, 9:05:34 AM Date modified:Tuesday, February 11, 2003, 10:02:48 PM Description: KBD EXE Company: Hewlett-Packard Company C:\Program Files\iTunes\iTunesHelper.exe File size: 272 KB (278,528 bytes) Date created: Saturday, June 30, 2007, 7:09:23 PM Date modified:Thursday, October 06, 2005, 6:03:14 PM Description: iTunesHelper Module Company: C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe File size: 56.0 KB (57,344 bytes) Date created: Saturday, December 24, 2005, 1:14:35 PM Date modified: Tuesday, August 19, 2003, 5:43:46 AM Description: Lexmark X1100 Series Button Manager Company: Lexmark International, Inc. C:\Program Files\Messenger\msmsgs.exe File size: 1.44 MB (1,511,453 bytes) Date created: Friday, June 08, 2007, 5:13:41 PM Date modified: Wednesday, August 21, 2002, 12:08:38 AM Description: Messenger Company: Microsoft Corporation C:\Program Files\Norton AntiVirus\Cfgwiz.exe File size: 465 KB (476,792 bytes) Date created: Saturday, June 30, 2007, 7:09:25 PM Date modified: Friday, November 15, 2002, 9:08:08 AM Description: Norton AntiVirus Information Wizard Company: Symantec Corporation C:\Program Files\QuickTime\qttask.exe File size: 152 KB (155,648 bytes) Date created: Friday, April 27, 2007, 8:41:54 AM Date modified: Friday, June 16, 2006, 1:51:43 AM Description: QuickTime Task Company: Apple Computer, Inc. C:\WINDOWS\SMINST\RECGUARD.EXE File size: 208 KB (212,992 bytes) Date created: Saturday, August 23, 2003, 9:34:03 AM Date modified: Friday, September 13, 2002, 11:42:26 PM Description: Recguard MFC Application Company: C:\WINDOWS\system\hpsysdrv.exe File size: 51.5 KB (52,736 bytes) Date created: Saturday, August 23, 2003, 8:27:02 AM Date modified: Thursday, May 07, 1998, 6:04:38 PM Description: hpsysdrv Company: Hewlett-Packard Company C:\Program Files\Common Files\Symantec Shared\ccApp.exe File size: 53.6 KB (54,976 bytes) Date created: Friday, November 15, 2002, 4:29:06 AM Date modified: Friday, November 15, 2002, 4:29:06 AM Description: Common Client CC App Company: Symantec Corporation C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe File size: 57.6 KB (59,072 bytes) Date created: Saturday, June 30, 2007, 7:09:27 PM Date modified: Friday, November 15, 2002, 4:29:48 AM Description: Common Client Registry Integrity Verifier Company: Symantec Corporation C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe File size: 48.0 KB (49,152 bytes) Date created: Saturday, August 23, 2003, 9:01:38 AM Date modified: Friday, May 23, 2003, 5:03:16 AM Description: HPHupd05 Company: Hewlett-Packard C:\Program Files\HP\hpcoretech\hpcmpmgr.exe File size: 236 KB (241,664 bytes) Date created: Monday, December 22, 2003, 7:38:42 AM Date modified: Monday, December 22, 2003, 7:38:42 AM Description: HP Framework Component Manager Service Company: Hewlett-Packard Company C:\Program Files\HP\HP Software Update\HPWuSchd.exe File size: 48.0 KB (49,152 bytes) Date created: Monday, August 04, 2003, 4:28:18 PM Date modified: Monday, August 04, 2003, 4:28:18 PM Description: hpwuSchd Company: Hewlett-Packard C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe File size: 52.0 KB (53,248 bytes) Date created: Saturday, August 23, 2003, 9:23:18 AM Date modified: Monday, February 24, 2003, 8:51:14 PM Description: TODO: Company: TODO: C:\Program Files\MySpace\IM\MySpaceIM.exe File size: 1.10 MB (1,159,168 bytes) Date created: Saturday, June 30, 2007, 7:09:29 PM Date modified: Wednesday, June 14, 2006, 6:58:46 PM Description: MySpace Instant Messenger Company: C:\Program Files\Common Files\Real\Update_OB\realsched.exe File size: 148 KB (151,597 bytes) Date created: Saturday, June 30, 2007, 7:09:30 PM Date modified: Saturday, August 23, 2003, 9:14:01 AM Description: RealNetworks Scheduler Company: RealNetworks, Inc. C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe File size: 152 KB (155,648 bytes) Date created: Thursday, February 13, 2003, 10:01:00 AM Date modified: Thursday, February 13, 2003, 10:01:00 AM Description: Sonic Update Manager Company: Sonic Solutions C:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe File size: 24.0 KB (24,576 bytes) Date created: Saturday, June 30, 2007, 7:09:31 PM Date modified: Sunday, June 22, 2003, 11:25:28 PM Description: Company: C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe File size: 88.0 KB (90,112 bytes) Date created: Monday, October 07, 2002, 9:23:20 AM Date modified: Monday, October 07, 2002, 9:23:20 AM Description: HpqCmon MFC Application Company: