Spyware / Malware / Virus Removal

Help! Some Wierd Virus On My Computer!

17 min read

Looking for the outcome? Ask AI

Teutonic_Order Topic Starter

Post #1June 24, 2007, 11:23 PM UTC

Hi, i just registered and im extremely new to this whole "Hijack This". Whenever i turn on my computer, on the desktop it has an error message that says ""Onoes" has encountered a fatal operation" or something like that! im not kidding about the onoes thing by the way lol. Also, Ctrl+Alt+Delete doesn't work for me, and i have an ad-aware trial that keeps finding worms and they keep coming back. I used to have limewire but i uninstalled it right away when my friend told me it brings viruses(i should have known) and that it was illegal i uninstalled it. So my worms keep coming back and i heard about this so here is my log report. Sorry about the long intro : /

Logfile of HijackThis v1.99.1
Scan saved at 3:36:09 PM, on 6/24/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\outlook\outlook.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\PROGRA~1\AIM\aim.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Dell Photo Printer 720\dlbcserv.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\palstart.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Bodie Foster\Desktop\hijackthis_sfx.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wowglider.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {d869742a-e5d2-4624-96c7-aae26170665e} - C:\Program Files\MMediaCodec\isaddon.dll (file missing)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Protection Bar - {479fd0cf-5be9-4c63-8cda-b6d371c67bd5} - C:\Program Files\MMediaCodec\iesplugin.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [OSCD_Creator] c:\Dell\PreODM.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE /P30 "EPSON Stylus Photo R200 Series" /O6 "USB002" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [dc6_check] C:\Program Files\SystemDoctor 2006 Free\startmon.exe
O4 - HKLM\..\Run: [USDR6cw] C:\Program Files\SystemDoctor 2006 Free\USDR6cw.exe -c
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\RunOnce: [OSCD_Creator] C:\Dell\PreODM.EXE /2
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Uniblue Registry Booster2] C:\Program Files\Uniblue\RegistryBooster2\RegistryBooster.exe /S
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: dlbcserv.lnk = C:\Program Files\Dell Photo Printer 720\dlbcserv.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O4 - Global Startup: palstart.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/platypus/miniclipGameLoader.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: contrabandists - {dfa61db1-388e-4c87-8d56-540fa229bcb4} - C:\WINDOWS\system32\dpfwu.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

Trevuren

Post #2June 25, 2007, 12:07 AM UTC

Hello Teutonic Order and welcome to the TomCoyote Forums

My name is Trevuren and I will be helping you with your problem.

A. Please provide a list of uninstallable programs.

To Provide a List of Installed Programs

Run HijackThis.
Click Config>>Miscellaneous Tools>>Open Uninstall Manager>>Save List
Save list to Desktop
Copy the Notepad list and Paste it into this thread.

B. Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.

Double-click smitfraudfix.exe
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc…processutil.htm

Regards,

Trevuren

Teutonic_Order

Post #3June 25, 2007, 12:56 AM UTC

Hello Teutonic Order and welcome to the TomCoyote Forums

My name is Trevuren and I will be helping you with your problem.

A. Please provide a list of uninstallable programs.

To Provide a List of Installed Programs
Run HijackThis.
Click Config>>Miscellaneous Tools>>Open Uninstall Manager>>Save List
Save list to Desktop
Copy the Notepad list and Paste it into this thread.
B. Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.

Double-click smitfraudfix.exe
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc…processutil.htm

Regards,

Trevuren

oh ok sorry about that… im new to this

Thanks for the kind response, i was expecting someone to yell at me saying what a noob i was or something. and without further ado here is the info:

List of Uninstallable Programs:

Ad-Aware SE Personal
Adobe Flash Player Plugin
Adobe Reader 7.0.9
Alien Shooter
AOL Instant Messenger
AOL Toolbar 2.0
Apple Software Update
ArcSoft Software Suite
ATI Control Panel
ATI Display Driver
Banctec Service Agreement
Conexant D850 56K V.9x DFVc Modem
Dell Driver Reset Tool
Dell Media Experience
Dell Photo Printer 720
Dell Photo Printer 720 Logger
Dell Picture Studio v3.0
DellSupport
Digital Line Detect
DivX Codec
DivX Content Uploader
DivX Converter
DivX Player
DivX Web Player
Dr. DivX Trial
EarthLink setup files
EAX4 Unified Redist
Empire Earth
Empire Earth - The Art of Conquest
EPSON Printer Software
Google Desktop
Google Pack Screensaver
Google Toolbar for Firefox
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
Google Updater
HijackThis 1.99.1
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
HP Memories Disc
hp print screen utility
HyperCam 2
Intel® PRO Network Connections Drivers
Intel® PROSet for Wired Connections
Internet Explorer Default Page
Internet Explorer Security Plugin 2006
Internet Security Add-On
iPod for Windows 2005-03-23
iTunes
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 3
J2SE Runtime Environment 5.0 Update 6
Jasc Paint Shop Photo Album
Jasc Paint Shop Photo Album 5
Jasc Paint Shop Pro Studio, Dell Editon
Java 2 Runtime Environment, SE v1.4.2_03
Learn2 Player (Uninstall Only)
Logitech Desktop Messenger
Logitech SetPoint
Macromedia Flash Player
Macromedia Flash Player 8
Macromedia Shockwave Player
Masque Games on aim
MediaTickets by OIN
Medieval 2 Screensaver
Medieval II Total War
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB886903)
Microsoft .NET Framework 2.0
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft User-Mode Driver Framework Feature Pack 1.0
Modem Helper
Mozilla Firefox (2.0.0.4)
MS Access 97 SP2
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 Parser and SDK
MSXML4 Parser
MUSICMATCH® Jukebox
My Search Bar
My Way Search Assistant
NetWaiting
NetZeroInstallers
Nikon Message Center
Photo Click
Picasa 2
PictureProject
Pivot Stickfigure Animator
PowerDVD 5.3
Public Messenger ver 2.03
QuickTime
RealPlayer
Safety Alerter 2006
Security Update for Microsoft .NET Framework 2.0 (KB917283)
Security Update for Microsoft .NET Framework 2.0 (KB922770)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928090)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929969)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
TeamSpeak 2 RC2
The Magical Worlds of Joseph Cornell
The Sims Deluxe Edition
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB931836)
Ventrilo Client
Ventrilo Server
Viewpoint Media Player
WC3Banlist
WildTangent Web Driver
Windows Installer 3.1 (KB893803)
Windows Installer 3.1 (KB893803)
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 10
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
WinPcap 3.1
WinRAR archiver
WordPerfect Office 12
Wyzo 0.5.3
Xfire (remove only)
Yahoo! Anti-Spy
Yahoo! Toolbar

SmitFraudFix v2.195

Scan done at 20:49:25.50, Sun 06/24/2007
Run from C:\Documents and Settings\Bodie Foster\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\outlook\outlook.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\PROGRA~1\AIM\aim.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Dell Photo Printer 720\dlbcserv.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\palstart.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\CSCRIPT.EXE

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Bodie Foster

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Bodie Foster\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\BODIEF~1\FAVORI~1

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

C:\Program Files\MMediaCodec\ FOUND !
C:\Program Files\VirusBurster\ FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{dfa61db1-388e-4c87-8d56-540fa229bcb4}"="contrabandists"

[HKEY_CLASSES_ROOT\CLSID\{dfa61db1-388e-4c87-8d56-540fa229bcb4}\InProcServer32]
@="C:\WINDOWS\system32\dpfwu.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{dfa61db1-388e-4c87-8d56-540fa229bcb4}\InProcServer32]
@="C:\WINDOWS\system32\dpfwu.dll"

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\\PROGRA~1\\Google\\GOOGLE~1\\GOEC62~1.DLL"
"LoadAppInit_DLLs"=dword:00000001

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Rustock

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel® PRO/100 VE Network Connection - Packet Scheduler Miniport
DNS Server Search Order: 68.87.71.226
DNS Server Search Order: 68.87.73.242

HKLM\SYSTEM\CCS\Services\Tcpip\..\{1BDB2B37-D7BC-49B0-B960-9D1135B6932E}: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS1\Services\Tcpip\..\{1BDB2B37-D7BC-49B0-B960-9D1135B6932E}: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS3\Services\Tcpip\..\{1BDB2B37-D7BC-49B0-B960-9D1135B6932E}: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed]

»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

And in case this helps, the reccuring worm is: Win32.P2P-Worm.Alcan.a

Trevuren

Post #4June 25, 2007, 1:20 AM UTC

A. There is no requirement for you to quote my replies in your posts as I can easily see what has already been posted and it would help us by saving on bandwith. Thanks.

B. In addition, to the Alcra worm, your system is infected by Smitfraud and you are running numerous malware programs that are just attracting the bugs.

C. 1. You are missing one important program on that computer: An antivirus.
You need to install an antivirus program as soon as you can and run a complete scan of the computer.
I suggest AVG - it's free! :thumbsup:

AVG Free AntiVirus

Choose one, install it, and then run a full scan. Let it quarantine/delete anything it finds. Let me know if there is anything that it reports but can not remove.

2. It is important that you also use a software firewall, to prevent unauthorised traffic both out of and into your computer.
Your log doesn't show a firewall running. If you have disabled it, please re-enable it.
If you do not have a firewall installed, please download and install : Zone Alarm. It is the one I have on my system and works fine for me.
It is important to note that you should only have one firewall installed at a time.

D. I am strongly suggesting that you UNINSTALL the following programs that are either malware or come bundled with malware or they are foistware, i-e programs that are usually installed without the user's consent. Others are no longer used as you have replaced them with more current versions:

See the following if you want a more in-depth explanation:

http://www.bleepingcomputer.com/uninstall/all.html

and/or

http://www.spywarewarrior.com/rogue_anti-s…re.htm#products

Using the Add/Remove Programs module in your Control Panel, please UNINSTALL the following programs:

MediaTickets by OIN
Logitech Desktop Messenger
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB886903)
My Search Bar
My Way Search Assistant
Safety Alerter 2006
Public Messenger ver 2.03

E.Please print out or copy these instructions/tutorial to Notepad as the internet will not be available to you at certain points of the removal process (while in Safe Mode). Make sure to work through all the Steps in the exact order in which they are listed below. If there's anything that you don't understand, ask your question(s) before moving on with the fixes.

1. Download and update AVG AntiSpyware 7.5.

First download AVG AntiSpyware from HERE and save that file to your desktop.
This is a 30 day trial of the program

Once you have downloaded AVG AntiSpyware, locate the icon on the desktop and double-click it to launch the set up program.
Once the setup is complete, run AVG AntiSpyware and update the definition files.
On the main screen select the icon "Update" then select the "Update now" link.
- Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.
Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
Under "Reports"
- Select "Automatically generate report after every scan"
- Un-Select "Only if threats were found"

Close AVG AntiSpyware, Do Not run a scan just yet

2. Reboot your computer into Safe Mode.

If the computer is running, shut down Windows, and then turn off the power.
Wait 30 seconds, and then turn the computer on.
Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
Ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.
Login on your usual account.

3. Once in Safe Mode, double-click Smitfraudfix.exe
Select option #2 - Clean by typing 2 and press Enter to delete the infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.
The tool will now check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. Reboot in Safe Mode.

The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.

4. Clean out your Temporary Internet files. Proceed as follows:

Quit Internet Explorer and quit any instances of Windows Explorer.
Click Start, click Control Panel, and then double-click Internet Options.
On the General tab, click Delete Files under Temporary Internet Files.
In the Delete Files dialog box, tick the Delete all offline content check box , and then click OK.
On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
Click OK.

5. Next Click Start, click Control Panel and then double-click Display. Click on the Desktop tab, then click the Customize Desktop button. Click on the Web tab. Under Web Pages you should see a checked entry called Security info or something similar. If it is there, select that entry and click the Delete button. Click Ok then Apply and Ok.

6. Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.

7. Launch AVG AntiSpyware by double-clicking the icon on your desktop.

Note: IMPORTANT: Do not open any other windows or programs while AVG AntiSpyware is scanning, it may interfere with the scanning proccess
Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".
AVG AntiSpyware will now begin the scanning process, be patient this may take a little time.
Once the scan is complete do the following:
If you have any infections you will prompted, then select "Apply all actions"
Next select the "Reports" icon at the top.
Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).

8. Close AVG AntiSpyware and Reboot back into Normal Windows Mode

9. Run SmitfraudFix. Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #3 - Delete Trusted zone by typing 3 and press Enter
Answer YES to the question "Restore Trusted Zone?" by Typing Y and hit Enter.

Note, if you use SpywareBlaster and/or IE-SPYAD, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the program and re-protect all items. For IE-SPYAD, run the batch file and reinstall the protection.

10. Please Post the following logs:

c:\rapport.txt
AVG AntiSpyware log
A new HijackThis log

Your may need several replies to post the requested logs, otherwise they might get cut off.

Regards,

Trevuren

Teutonic_Order

Post #5June 25, 2007, 12:59 PM UTC

Ok thanks for the tips on cleaning up my computer-it has gotten much faster. Im facing some problems though, on instruction #3, once in safemode i do the smitfraud up to do you want to clean the registry? i pressy and enter and i brings up a report. i didnt get the second prompt. Then, AVG didnt make a report, i got like 10 viruses found, i quarentined them but no report so i checked the tab and it says make report for every scan, and only for threats being found unchecked just like you said, and still no report was done… what do i do? by the way here is the "rapport" SmitFraudFix v2.195 Scan done at 22:03:31.45, Sun 06/24/2007 Run from C:\Documents and Settings\Bodie Foster\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files »»»»»»»»»»»»»»»»»»»»»»»» DNS HKLM\SYSTEM\CCS\Services\Tcpip\..\{1BDB2B37-D7BC-49B0-B960-9D1135B6932E}: DhcpNameServer=[removed] [removed] HKLM\SYSTEM\CS1\Services\Tcpip\..\{1BDB2B37-D7BC-49B0-B960-9D1135B6932E}: DhcpNameServer=[removed] [removed] HKLM\SYSTEM\CS3\Services\Tcpip\..\{1BDB2B37-D7BC-49B0-B960-9D1135B6932E}: DhcpNameServer=[removed] [removed] HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed] HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed] HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed] »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End

Trevuren

Post #6June 25, 2007, 1:11 PM UTC

It appears as if some of the tools are not running the way they are supposed to so we will try to do this another way:

A. AGAIN Please provide a list of uninstallable programs.

To Provide a List of Installed Programs

Run HijackThis.
Click Config>>Miscellaneous Tools>>Open Uninstall Manager>>Save List
Save list to Desktop
Copy the Notepad list and Paste it into this thread.

B. Please provide me with a fresh HJT log for review.

Trevuren

Teutonic_Order

Post #7June 25, 2007, 2:06 PM UTC

Uninstall List:

Ad-Aware SE Personal
Adobe Flash Player Plugin
Adobe Reader 7.0.9
Alien Shooter
AOL Instant Messenger
AOL Toolbar 2.0
Apple Software Update
ArcSoft Software Suite
ATI Control Panel
ATI Display Driver
AVG Anti-Spyware 7.5
Banctec Service Agreement
CleanUp!
Conexant D850 56K V.9x DFVc Modem
Dell Driver Reset Tool
Dell Media Experience
Dell Photo Printer 720
Dell Photo Printer 720 Logger
Dell Picture Studio v3.0
DellSupport
Digital Line Detect
DivX Codec
DivX Content Uploader
DivX Converter
DivX Player
DivX Web Player
Dr. DivX Trial
EarthLink setup files
EAX4 Unified Redist
Empire Earth
Empire Earth - The Art of Conquest
EPSON Printer Software
Google Desktop
Google Pack Screensaver
Google Toolbar for Firefox
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
Google Updater
HijackThis 1.99.1
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
HP Memories Disc
hp print screen utility
HyperCam 2
Intel® PRO Network Connections Drivers
Intel® PROSet for Wired Connections
Internet Explorer Default Page
iPod for Windows 2005-03-23
iTunes
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 3
J2SE Runtime Environment 5.0 Update 6
Jasc Paint Shop Photo Album
Jasc Paint Shop Photo Album 5
Jasc Paint Shop Pro Studio, Dell Editon
Java 2 Runtime Environment, SE v1.4.2_03
Learn2 Player (Uninstall Only)
Logitech SetPoint
Macromedia Flash Player
Macromedia Flash Player 8
Macromedia Shockwave Player
Masque Games on aim
Medieval 2 Screensaver
Medieval II Total War
Microsoft .NET Framework 2.0
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft User-Mode Driver Framework Feature Pack 1.0
Modem Helper
Mozilla Firefox (2.0.0.4)
MS Access 97 SP2
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 Parser and SDK
MSXML4 Parser
MUSICMATCH® Jukebox
My Search Bar
My Way Search Assistant
NetWaiting
NetZeroInstallers
Nikon Message Center
Photo Click
Picasa 2
PictureProject
Pivot Stickfigure Animator
PowerDVD 5.3
QuickTime
RealPlayer
Security Update for Microsoft .NET Framework 2.0 (KB917283)
Security Update for Microsoft .NET Framework 2.0 (KB922770)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928090)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929969)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
TeamSpeak 2 RC2
The Magical Worlds of Joseph Cornell
The Sims Deluxe Edition
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB931836)
Ventrilo Client
Ventrilo Server
Viewpoint Media Player
WC3Banlist
WildTangent Web Driver
Windows Installer 3.1 (KB893803)
Windows Installer 3.1 (KB893803)
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 10
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
WinPcap 3.1
WinRAR archiver
WordPerfect Office 12
Wyzo 0.5.3
Xfire (remove only)
Yahoo! Anti-Spy
Yahoo! Toolbar

And now for the HJT log

Logfile of HijackThis v1.99.1
Scan saved at 9:56:23 AM, on 6/25/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Dell Photo Printer 720\dlbcserv.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\palstart.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [OSCD_Creator] c:\Dell\PreODM.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE /P30 "EPSON Stylus Photo R200 Series" /O6 "USB002" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\RunOnce: [OSCD_Creator] C:\Dell\PreODM.EXE /2
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: dlbcserv.lnk = C:\Program Files\Dell Photo Printer 720\dlbcserv.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O4 - Global Startup: palstart.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/platypus/miniclipGameLoader.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

Hope this helps

thanks in advance

Trevuren

Post #8June 25, 2007, 2:18 PM UTC

Apparently, it did get the infection but did not register its removal.

A. Please UNINSTALL the following programs:

WildTangent Web Driver
My Search Bar
My Way Search Assistan

B. Please disable AVG AntiSpyware by opening the program and on the Status page - beside "Resident Shield" click on "change status" so that it says "inactive" for it may interfere with our HJT fix.

Remember to reactivate this feature when all our work is finished.

C. Please download this file - combofix.exe by sUBs

Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log.

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

Regards,

Trevuren

Teutonic_Order

Post #9June 25, 2007, 3:05 PM UTC

"Bodie Foster" - 2007-06-25 10:55:43 - ComboFix 07-06-25.3 - Service Pack 2 NTFS

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

——-\LEGACY_NM
——-\nm

((((((((((((((((((((((((( Files Created from 2007-05-25 to 2007-06-25 )))))))))))))))))))))))))))))))

2007-06-25 10:41 49,152 –a—— C:\WINDOWS\nircmd.exe
2007-06-25 10:20 83,096 –a—— C:\WINDOWS\SYSTEM32\SSSensor.dll
2007-06-25 10:20 60,496 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\Teefer.sys
2007-06-25 10:20 21,075 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\wpsdrvnt.sys
2007-06-25 10:20 14,568 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\wg6n.sys
2007-06-25 10:20 14,568 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\wg5n.sys
2007-06-25 10:20 14,568 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\wg4n.sys
2007-06-25 10:20 14,568 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\wg3n.sys
2007-06-25 10:19 d——– C:\Program Files\Sygate
2007-06-24 21:44 10,872 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\AvgAsCln.sys
2007-06-24 20:46 2,014 –a—— C:\WINDOWS\SYSTEM32\tmp.reg
2007-06-24 20:45 53,248 –a—— C:\WINDOWS\SYSTEM32\Process.exe
2007-06-24 20:45 51,200 –a—— C:\WINDOWS\SYSTEM32\dumphive.exe
2007-06-24 20:45 288,417 –a—— C:\WINDOWS\SYSTEM32\SrchSTS.exe
2007-06-24 15:29 62,464 –a—— C:\WINDOWS\SYSTEM32\bszip.dll
2007-06-24 15:29 0 —hs—- C:\WINDOWS\SYSTEM32\tracert.com
2007-06-24 15:29 0 —hs—- C:\WINDOWS\SYSTEM32\tasklist.com
2007-06-24 15:29 0 —hs—- C:\WINDOWS\SYSTEM32\taskkill.com
2007-06-24 15:29 0 —hs—- C:\WINDOWS\SYSTEM32\regedit.com
2007-06-24 15:29 0 —hs—- C:\WINDOWS\SYSTEM32\ping.com
2007-06-24 15:29 0 —hs—- C:\WINDOWS\SYSTEM32\netstat.com
2007-06-24 15:29 0 —hs—- C:\WINDOWS\SYSTEM32\cmd.com
2007-06-22 20:56 d——– C:\DOCUME~1\BODIEF~1\APPLIC~1\InstallShield
2007-06-22 20:30 d——– C:\Program Files\iTunes
2007-06-22 20:28 d——– C:\Program Files\Apple Software Update
2007-06-22 09:51 1,432,242 –a—— C:\WINDOWS\SYSTEM32\Medievil 2.scr
2007-06-22 09:51 d——– C:\Program Files\SEGA
2007-06-21 12:53 d——– C:\DOCUME~1\BODIEF~1\APPLIC~1\Command & Conquer 3 Tiberium Wars Demo
2007-06-21 12:52 3,426,072 –a—— C:\WINDOWS\SYSTEM32\d3dx9_32.dll
2007-06-20 12:42 882,264 –a—— C:\DOCUME~1\BODIEF~1\HyCam2.exe
2007-06-20 12:42 87,656 –a—— C:\DOCUME~1\BODIEF~1\UnHyCam2.exe
2007-06-20 12:42 69,632 –a—— C:\DOCUME~1\BODIEF~1\CamRes2.dll
2007-06-20 12:42 57,344 –a—— C:\DOCUME~1\BODIEF~1\MClick2.dll
2007-06-20 12:40 d——– C:\Program Files\HyCam2
2007-06-18 14:34 d–hs—- C:\Program Files\outlook
2007-06-18 14:34 d–hs—- C:\DOCUME~1\BODIEF~1\Complete
2007-06-15 15:39 d——– C:\Program Files\Pivot Stickfigure Animator
2007-06-14 13:58 d——– C:\Program Files\Common Files\Vbox
2007-06-11 15:21 81,920 -ra—— C:\WINDOWS\SYSTEM32\hpovst08.dll
2007-06-10 17:35 d——– C:\Program Files\Wyzo

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-25 14:30:57 ——– d—–w C:\Program Files\WildTangent
2007-06-25 14:18:12 ——– d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-06-25 01:37:01 ——– d—–w C:\Program Files\Logitech
2007-06-23 01:03:38 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-06-23 00:30:56 ——– d—–w C:\Program Files\iPod
2007-06-23 00:30:16 ——– d—–w C:\Program Files\QuickTime
2007-06-22 01:35:52 ——– d—–w C:\Program Files\Microsoft Games
2007-06-21 21:41:53 ——– d—–w C:\Program Files\Electronic Arts
2007-06-10 15:16:23 ——– d—–w C:\Program Files\Warcraft III
2007-05-31 19:22:13 ——– d—–w C:\Program Files\Google
2007-05-22 14:46:48 848 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-05-21 20:33:42 ——– d—–w C:\Program Files\Game Cam v1.4
2007-05-11 13:34:28 ——– d—–w C:\DOCUME~1\BODIEF~1\APPLIC~1\Google
2007-05-07 20:25:24 ——– d—–w C:\Program Files\Windows Media Connect 2
2007-05-06 23:58:00 ——– d—–w C:\Program Files\WC3Banlist
2007-04-17 02:47:36 33,624 —-a-w C:\WINDOWS\system32\wups.dll
2007-04-17 02:45:54 1,710,936 —-a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-17 02:45:48 549,720 —-a-w C:\WINDOWS\system32\wuapi.dll
2007-04-17 02:45:42 325,976 —-a-w C:\WINDOWS\system32\wucltui.dll
2007-04-17 02:45:36 203,096 —-a-w C:\WINDOWS\system32\wuweb.dll
2007-04-17 02:45:28 92,504 —-a-w C:\WINDOWS\system32\cdm.dll
2007-04-17 02:45:20 53,080 —-a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-17 02:45:20 43,352 —-a-w C:\WINDOWS\system32\wups2.dll
2005-04-18 12:50:23 56 –sh–r C:\WINDOWS\SYSTEM32\585CAC3033.sys

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{02478D38-C3F9-4EFB-9B51-7695ECA05670}=C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-01-05 12:30]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll [2006-12-15 03:23]
{7C554162-8CB7-45A4-B8F4-8EA1C75885F9}=C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll [2005-08-02 14:41]
{AA58ED58-01DD-4d91-8333-CF10577473F7}=c:\program files\google\googletoolbar2.dll [2007-05-31 15:22]
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}=C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll [2007-05-31 15:22]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OSCD_Creator"="c:\Dell\PreODM.EXE" [2004-10-31 06:21]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 13:52]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-03-10 13:01 C:\WINDOWS\KHALMNPR.Exe]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-12-15 15:43]
"mmtask"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" [2004-04-20 16:50]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-01 16:51]
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 19:40]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"OSCD_Creator"=C:\Dell\PreODM.EXE /2

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe
"FlashPlayerUpdate"=C:\WINDOWS\SYSTEM32\Macromed\Flash\GetFlash.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 08:29]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
C:\PROGRA~1\AIM\aim.exe -cnetwait.odl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare]
"C:\Program Files\BearShare\BearShare.exe" /pause

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
"C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
C:\Program Files\Picasa2\PicasaMediaDetector.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue Registry Booster2]
C:\Program Files\Uniblue\RegistryBooster2\RegistryBooster.exe /S

Contents of the 'Scheduled Tasks' folder
2007-06-23 00:28:19 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2007-06-15 22:30:00 C:\WINDOWS\tasks\McAfee.com Scan for Viruses - My Computer (BO-Mom).job
2006-05-12 20:34:04 C:\WINDOWS\tasks\WebReg 20060512163404.job

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-25 11:00:30
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
OSCD_Creator = C:\Dell\PreODM.EXE /2??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-06-25 11:02:07 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-06-25 11:02

— E O F —

Logfile of HijackThis v1.99.1
Scan saved at 11:05:44 AM, on 6/25/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Dell Photo Printer 720\dlbcserv.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\palstart.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [OSCD_Creator] c:\Dell\PreODM.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\RunOnce: [OSCD_Creator] C:\Dell\PreODM.EXE /2
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: dlbcserv.lnk = C:\Program Files\Dell Photo Printer 720\dlbcserv.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O4 - Global Startup: palstart.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/platypus/miniclipGameLoader.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

Trevuren

Post #10June 25, 2007, 6:09 PM UTC

1. Please download Brute Force Uninstaller to your desktop.

Right click the BFU folder on your desktop, and choose Extract All
Click "Next"
In the box to choose where to extract the files to,
Click "Browse"
Click on the + sign next to "My Computer"
Click on "Local Disk (C:) or whatever your primary drive is
Click "Make New Folder"
Type in BFU
Click "Next", and Uncheck the "Show Extracted Files" box and then click "Finish".

2. RIGHT-CLICK HERE and choose "Save As" (in IE it's "Save Target As") in order to download Alcra PLUS Remover.
Save it in the same folder you made earlier (c:\BFU).

3. Download and scan with SUPERAntiSpyware Free for Home Users

Double-click SUPERAntiSpyware.exe and use the default settings for installation.
An icon will be created on your desktop. Double-click that icon to launch the program.
If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)
Under "Configuration and Preferences", click the Preferences button.
Click the Scanning Control tab.
Under Scanner Options make sure the following are checked (leave all others unchecked):
- Close browsers before scanning.
- Scan for tracking cookies.
- Terminate memory threats before quarantining.
Click the "Close" button to leave the control center screen.
Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
On the left, make sure you check C:\Fixed Drive.
On the right, under "Complete Scan", choose Perform Complete Scan.
Click "Next" to start the scan. Please be patient while it scans your computer.
After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
Make sure everything has a checkmark next to it and click "Next".
A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
Reboot into Safe Mode:

How to use the F8 method to Start Your Computer in Safe Mode*Restart the computer.
*as soon as BIOS is loaded begin tapping the F8 key until the Advanced Options menu appears.
*Use the arrow keys to select the Safe mode menu item
*press Enter.

4. Then, please go to Start > My Computer and navigate to the C:\BFU folder.

Start the Brute Force Uninstaller by doubleclicking BFU.exe
Behind the scriptline to execute field click the folder icon [external image: Posted Image] and select alcanshorty.bfu
Press Execute and let it do it’s job. (You ought to see a progress bar if you did this correctly.)
Wait for the complete script execution box to pop up and press OK.
Press exit to terminate the BFU program.

5. Reboot into normal windows.

6. After rebooting, retrieve the log from SUPERAntispyware.

Restart SuperAntispyware
Click Preferences, then click the Statistics/Logs tab.
Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
Please copy and paste the Scan Log results in your next reply.
Click Close to exit the program.

7. Now please run HJT again, click scan, produce a log and post it in your reply along with the log from Super Antispyware.

Regards,

Trevuren

Teutonic_Order

Post #11June 26, 2007, 12:47 AM UTC

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 06/25/2007 at 07:48 PM

Application Version : 3.9.1008

Core Rules Database Version : 3260
Trace Rules Database Version: 1271

Scan type : Complete Scan
Total Scan Time : 01:18:18

Memory items scanned : 448
Memory threats detected : 1
Registry items scanned : 5070
Registry threats detected : 107
File items scanned : 80109
File threats detected : 168

Adware.PalTalk
C:\DOCUMENTS AND SETTINGS\ALL USERS\START MENU\PROGRAMS\STARTUP\PALSTART.EXE
C:\DOCUMENTS AND SETTINGS\ALL USERS\START MENU\PROGRAMS\STARTUP\PALSTART.EXE

Adware.MovieLand/MediaPipe
C:\Program Files\moviepass Terms.html

Trojan.MalwareWipe
HKCR\TypeLib\{7777CB57-9C54-4DD2-8976-0FD7864CF67C}
HKCR\TypeLib\{7777CB57-9C54-4DD2-8976-0FD7864CF67C}\1.0
HKCR\TypeLib\{7777CB57-9C54-4DD2-8976-0FD7864CF67C}\1.0
HKCR\TypeLib\{7777CB57-9C54-4DD2-8976-0FD7864CF67C}\1.0\win32
HKCR\TypeLib\{7777CB57-9C54-4DD2-8976-0FD7864CF67C}\1.0\FLAGS
HKCR\TypeLib\{7777CB57-9C54-4DD2-8976-0FD7864CF67C}\1.0\HELPDIR
HKCR\Interface\{124051BD-57BA-4614-945E-798AC91581B4}
HKCR\Interface\{124051BD-57BA-4614-945E-798AC91581B4}\ProxyStubClsid
HKCR\Interface\{124051BD-57BA-4614-945E-798AC91581B4}\ProxyStubClsid32
HKCR\Interface\{124051BD-57BA-4614-945E-798AC91581B4}\TypeLib
HKCR\Interface\{124051BD-57BA-4614-945E-798AC91581B4}\TypeLib#Version
HKCR\Interface\{23FD014C-455B-4497-98E9-D66EE36F1DE6}
HKCR\Interface\{23FD014C-455B-4497-98E9-D66EE36F1DE6}\ProxyStubClsid
HKCR\Interface\{23FD014C-455B-4497-98E9-D66EE36F1DE6}\ProxyStubClsid32
HKCR\Interface\{23FD014C-455B-4497-98E9-D66EE36F1DE6}\TypeLib
HKCR\Interface\{23FD014C-455B-4497-98E9-D66EE36F1DE6}\TypeLib#Version
HKCR\Interface\{3872760B-D0D8-41E0-9A73-E6A40E30D5AC}
HKCR\Interface\{3872760B-D0D8-41E0-9A73-E6A40E30D5AC}\ProxyStubClsid
HKCR\Interface\{3872760B-D0D8-41E0-9A73-E6A40E30D5AC}\ProxyStubClsid32
HKCR\Interface\{3872760B-D0D8-41E0-9A73-E6A40E30D5AC}\TypeLib
HKCR\Interface\{3872760B-D0D8-41E0-9A73-E6A40E30D5AC}\TypeLib#Version
HKCR\Interface\{3DBDA661-F6D1-4A43-8EAA-9A95977257F1}
HKCR\Interface\{3DBDA661-F6D1-4A43-8EAA-9A95977257F1}\ProxyStubClsid
HKCR\Interface\{3DBDA661-F6D1-4A43-8EAA-9A95977257F1}\ProxyStubClsid32
HKCR\Interface\{3DBDA661-F6D1-4A43-8EAA-9A95977257F1}\TypeLib
HKCR\Interface\{3DBDA661-F6D1-4A43-8EAA-9A95977257F1}\TypeLib#Version
HKCR\Interface\{525C8F79-9BEF-4F76-A28C-27F1E71BCE5A}
HKCR\Interface\{525C8F79-9BEF-4F76-A28C-27F1E71BCE5A}\ProxyStubClsid
HKCR\Interface\{525C8F79-9BEF-4F76-A28C-27F1E71BCE5A}\ProxyStubClsid32
HKCR\Interface\{525C8F79-9BEF-4F76-A28C-27F1E71BCE5A}\TypeLib
HKCR\Interface\{525C8F79-9BEF-4F76-A28C-27F1E71BCE5A}\TypeLib#Version
HKCR\Interface\{52F3ADB8-D062-4622-94FB-C0374DC4A94E}
HKCR\Interface\{52F3ADB8-D062-4622-94FB-C0374DC4A94E}\ProxyStubClsid
HKCR\Interface\{52F3ADB8-D062-4622-94FB-C0374DC4A94E}\ProxyStubClsid32
HKCR\Interface\{52F3ADB8-D062-4622-94FB-C0374DC4A94E}\TypeLib
HKCR\Interface\{52F3ADB8-D062-4622-94FB-C0374DC4A94E}\TypeLib#Version
HKCR\Interface\{54E16983-0202-43EC-9CAC-5B8F7493BB80}
HKCR\Interface\{54E16983-0202-43EC-9CAC-5B8F7493BB80}\ProxyStubClsid
HKCR\Interface\{54E16983-0202-43EC-9CAC-5B8F7493BB80}\ProxyStubClsid32
HKCR\Interface\{54E16983-0202-43EC-9CAC-5B8F7493BB80}\TypeLib
HKCR\Interface\{54E16983-0202-43EC-9CAC-5B8F7493BB80}\TypeLib#Version
HKCR\Interface\{73A77F6A-C2C9-4F7E-AD8B-3EC0A7877185}
HKCR\Interface\{73A77F6A-C2C9-4F7E-AD8B-3EC0A7877185}\ProxyStubClsid
HKCR\Interface\{73A77F6A-C2C9-4F7E-AD8B-3EC0A7877185}\ProxyStubClsid32
HKCR\Interface\{73A77F6A-C2C9-4F7E-AD8B-3EC0A7877185}\TypeLib
HKCR\Interface\{73A77F6A-C2C9-4F7E-AD8B-3EC0A7877185}\TypeLib#Version
HKCR\Interface\{8EE388CB-A53E-49EA-9E0F-9CCFA1C016B7}
HKCR\Interface\{8EE388CB-A53E-49EA-9E0F-9CCFA1C016B7}\ProxyStubClsid
HKCR\Interface\{8EE388CB-A53E-49EA-9E0F-9CCFA1C016B7}\ProxyStubClsid32
HKCR\Interface\{8EE388CB-A53E-49EA-9E0F-9CCFA1C016B7}\TypeLib
HKCR\Interface\{8EE388CB-A53E-49EA-9E0F-9CCFA1C016B7}\TypeLib#Version
HKCR\Interface\{939CBB64-212B-47C5-B610-38B5811E630A}
HKCR\Interface\{939CBB64-212B-47C5-B610-38B5811E630A}\ProxyStubClsid
HKCR\Interface\{939CBB64-212B-47C5-B610-38B5811E630A}\ProxyStubClsid32
HKCR\Interface\{939CBB64-212B-47C5-B610-38B5811E630A}\TypeLib
HKCR\Interface\{939CBB64-212B-47C5-B610-38B5811E630A}\TypeLib#Version
HKCR\Interface\{BA0017FE-829E-4460-9DEA-B969BA166B85}
HKCR\Interface\{BA0017FE-829E-4460-9DEA-B969BA166B85}\ProxyStubClsid
HKCR\Interface\{BA0017FE-829E-4460-9DEA-B969BA166B85}\ProxyStubClsid32
HKCR\Interface\{BA0017FE-829E-4460-9DEA-B969BA166B85}\TypeLib
HKCR\Interface\{BA0017FE-829E-4460-9DEA-B969BA166B85}\TypeLib#Version
HKCR\Interface\{D56C35E6-720F-451D-A85E-E07317479F3E}
HKCR\Interface\{D56C35E6-720F-451D-A85E-E07317479F3E}\ProxyStubClsid
HKCR\Interface\{D56C35E6-720F-451D-A85E-E07317479F3E}\ProxyStubClsid32
HKCR\Interface\{D56C35E6-720F-451D-A85E-E07317479F3E}\TypeLib
HKCR\Interface\{D56C35E6-720F-451D-A85E-E07317479F3E}\TypeLib#Version
HKCR\Interface\{D8E3D728-0F31-4479-B936-35EED7015282}
HKCR\Interface\{D8E3D728-0F31-4479-B936-35EED7015282}\ProxyStubClsid
HKCR\Interface\{D8E3D728-0F31-4479-B936-35EED7015282}\ProxyStubClsid32
HKCR\Interface\{D8E3D728-0F31-4479-B936-35EED7015282}\TypeLib
HKCR\Interface\{D8E3D728-0F31-4479-B936-35EED7015282}\TypeLib#Version
HKCR\Interface\{E4245BB7-4478-4D78-B9A6-12D3EA5BEFA6}
HKCR\Interface\{E4245BB7-4478-4D78-B9A6-12D3EA5BEFA6}\ProxyStubClsid
HKCR\Interface\{E4245BB7-4478-4D78-B9A6-12D3EA5BEFA6}\ProxyStubClsid32
HKCR\Interface\{E4245BB7-4478-4D78-B9A6-12D3EA5BEFA6}\TypeLib
HKCR\Interface\{E4245BB7-4478-4D78-B9A6-12D3EA5BEFA6}\TypeLib#Version
HKCR\Interface\{E4D111A5-A3D5-4097-BBE6-2EDBC0277D61}
HKCR\Interface\{E4D111A5-A3D5-4097-BBE6-2EDBC0277D61}\ProxyStubClsid
HKCR\Interface\{E4D111A5-A3D5-4097-BBE6-2EDBC0277D61}\ProxyStubClsid32
HKCR\Interface\{E4D111A5-A3D5-4097-BBE6-2EDBC0277D61}\TypeLib
HKCR\Interface\{E4D111A5-A3D5-4097-BBE6-2EDBC0277D61}\TypeLib#Version
HKCR\Interface\{EDF9F7F2-C764-46D6-B5A8-5A87938F9793}
HKCR\Interface\{EDF9F7F2-C764-46D6-B5A8-5A87938F9793}\ProxyStubClsid
HKCR\Interface\{EDF9F7F2-C764-46D6-B5A8-5A87938F9793}\ProxyStubClsid32
HKCR\Interface\{EDF9F7F2-C764-46D6-B5A8-5A87938F9793}\TypeLib
HKCR\Interface\{EDF9F7F2-C764-46D6-B5A8-5A87938F9793}\TypeLib#Version
C:\Documents and Settings\Bodie Foster\Application Data\Microsoft\Internet Explorer\Quick Launch\MalwareWipe.com 4.2.lnk

Adware.Starware
C:\Documents and Settings\All Users\Application Data\Starware\buttons
C:\Documents and Settings\All Users\Application Data\Starware\contexts
C:\Documents and Settings\All Users\Application Data\Starware\images
C:\Documents and Settings\All Users\Application Data\Starware\News
C:\Documents and Settings\All Users\Application Data\Starware\SimpleUpdate
C:\Documents and Settings\All Users\Application Data\Starware
C:\PROGRAM FILES\YAHOO!\YPSR\QUARANTINE\PPQ50.TMP\BIN\STARWARE.DLL

Adware.Zango Toolbar/Hb
HKU\S-1-5-21-389242310-2966289616-1651840556-1011\Software\ZangoToolbar
HKLM\Software\ZangoToolbar
HKLM\Software\ZangoToolbar\ZangoToolbar
HKLM\Software\ZangoToolbar\ZangoToolbar\PI
HKLM\Software\ZangoToolbar\ZangoToolbar\PI\3.2
HKLM\Software\ZangoToolbar\ZangoToolbar\PI\3.2#PID00
HKLM\Software\ZangoToolbar\ZangoToolbar\Upgrade
HKLM\Software\ZangoToolbar\ZangoToolbar\Upgrade#LastChecked
HKCR\CLSID\{8109FD3D-D891-4F80-8339-50A4913ACE6F}
HKCR\CLSID\{8109FD3D-D891-4F80-8339-50A4913ACE6F}\InprocServer32
HKCR\CLSID\{8109FD3D-D891-4F80-8339-50A4913ACE6F}\InprocServer32#ThreadingModel
HKCR\CLSID\{8109FD3D-D891-4F80-8339-50A4913ACE6F}\ProgID
HKCR\CLSID\{8109FD3D-D891-4F80-8339-50A4913ACE6F}\Programmable
HKCR\CLSID\{8109FD3D-D891-4F80-8339-50A4913ACE6F}\TypeLib
HKCR\CLSID\{8109FD3D-D891-4F80-8339-50A4913ACE6F}\VersionIndependentProgID
HKCR\TypeLib\{5937CD7F-1C0B-41E1-9075-60EBDF3C7D34}
HKCR\TypeLib\{5937CD7F-1C0B-41E1-9075-60EBDF3C7D34}\1.0
HKCR\TypeLib\{5937CD7F-1C0B-41E1-9075-60EBDF3C7D34}\1.0
HKCR\TypeLib\{5937CD7F-1C0B-41E1-9075-60EBDF3C7D34}\1.0\win32
HKCR\TypeLib\{5937CD7F-1C0B-41E1-9075-60EBDF3C7D34}\1.0\FLAGS
HKCR\TypeLib\{5937CD7F-1C0B-41E1-9075-60EBDF3C7D34}\1.0\HELPDIR
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoOI\static
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoOI
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoOL\static
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoOL
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\1.sdf
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\1066790.sdf
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\2451.sdf
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\2884306.sdf
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\2884309.sdf
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\600583.sdf
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\698191.sdf
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\952211.sdf
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\ASPL1.dat
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\hstat\3495.dat
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\hstat
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\1000029706
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\1000047601
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\1000047604
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\1000047766
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\11213
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\13738
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\142323
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\1509
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\17025
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\19052
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\20517
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\21017
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\210198
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\216168
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\27503
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\28049
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\28812
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\31485
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\32812
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\35047
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\36079
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\36735
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\42861
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\44878
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\450210
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\45833
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\526389
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\531510
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\53813
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\578081
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\578140
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\578150
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\58197
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\59844
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\61779
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\6292
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\64678
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\72882
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\73922
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\7652
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\80670
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\85062
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\86379
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\93899
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\95645
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\96961
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\ustat
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\btntrans1.dat
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\buttondir.txt
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\components.cdf
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\default.cdf
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_511745-514279.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_bidzC_ZT_IE-ca.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_bidzC_ZT_IE-us.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_categorize.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_comparison.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_explorer-Mails.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_explorer-people.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_favorites.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_Games.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_Hide.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_hotbarcom.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_Hotmail.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_hsskin.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_jemster.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_jemsterie.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_jemsteruk.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_jobsearch.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_Mails.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_MobileSidewalk.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_new.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_premium.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_reun.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_ringtones.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_SearchBoxTrapper.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_searchfor.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_searchgo.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_weather.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_yellowpages.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_1000.res
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_2000.res
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_3000.res
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_bar.res
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_bbar1.res
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_logos.res
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_other.res
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\email-def-511724-548964.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\email-def-511724-9595.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\email-t1-bg.res
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\icons2.res
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\keywords1.dat
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\layout.cdf
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\linkpathlegal.txt
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\progress.res
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\sales_buttons.res
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\s_icons_buttons.res
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\t2_bg.res
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\theweb.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\top7.cdf
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Top7_theweb.mnu
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\tsd_bg.res
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\zango.res
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\BtnTrans.xip
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\BtnTrans1.xip
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\buttondir.xip
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\default.xip
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_1000.xip
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_2000.xip
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_3000.xip
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_bar.xip
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_bbar1.xip
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_logos.xip
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_other.xip
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\email-t1-bg.xip
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\icons2.xip
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\keywords.idx
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\keywords.xip
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\keywords1.xip
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\layout.xip
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\linkpathlegal.xip
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\progress.xip
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\sales_buttons.xip
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\samplegroups2.txt
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\samplegroups2.xip
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\s_icons_buttons.xip
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\t2_bg.xip
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\top7.xip
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\tsd_bg.xip
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\zango.xip
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0\ZangoToolbar
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\v3.0
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar\zbar.log
C:\Documents and Settings\Bodie Foster\Application Data\ZangoToolbar

Trojan.PestTrap
C:\PROGRAM FILES\YAHOO!\YPSR\QUARANTINE\PPQ2A.TMP\PESTTRAP.EXE

Adware.180solutions/Search Assistant
C:\PROGRAM FILES\YAHOO!\YPSR\QUARANTINE\PPQ34.TMP

Trojan.Unknown Origin
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP525\A0182537.ICO
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP525\A0182538.ICO

MyWay Search Assistant Computers
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP526\A0182693.DLL

Logfile of HijackThis v1.99.1
Scan saved at 8:47:15 PM, on 6/25/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Dell Photo Printer 720\dlbcserv.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\iTunes\iTunes.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [OSCD_Creator] c:\Dell\PreODM.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\RunOnce: [OSCD_Creator] C:\Dell\PreODM.EXE /2
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: dlbcserv.lnk = C:\Program Files\Dell Photo Printer 720\dlbcserv.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/platypus/miniclipGameLoader.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

Trevuren

Post #12June 26, 2007, 1:11 AM UTC

A. You need to update the version of Java that is currently on your system

Download the latest version of Java™ SE Runtime Environment 6 Update u1 from HERE
- Scroll down to where it says "Windows Offline Installation"
- Click the "Download" button to the right.
Once the program has finished downloading:
- Close any programs you may have running - especially your web browser.
- Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
- Check any item with Java Runtime Environment (JRE or J2SE) in the name.
- Click the Remove or Change/Remove button.
- Repeat as many times as necessary to remove each Java versions.
- Reboot your computer once all Java components are removed.
- Then from your desktop double-click on jre-6u1-windows-i586-p.exe to install the newest version.
Go back into the Control Panel and double-click the Java Icon.
- Under Temporary Internet Files, click the Delete Files button.
- There are three options in the window to clear the cache - Leave ALL 3 CheckedDownloaded Applets
  Downloaded Applications
  Other Files
Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Java Control Panel.

B. Please RUN HijackThis

Click the SCAN button to produce a log.
Place a check mark beside each one of the following items:

O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/platypus/miniclipGameLoader.dll
Now with all the items selected, and all windows closed except for HJT, delete them by clicking the FIX checked button. Close the HijackThis window.
Reboot Your System

C. Please do an online scan with Kaspersky Online Virus Scanner (Use Internet Explorer as your Browser)

Note: If you have used this particular scanner before, you MAY HAVE YO UNINSTALL the program through Add/Remove Programs before downloading the new ActiveX component

Next Click on Free Virus Scanner, then Kaspersky Online Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:
- Scan using the following Anti-Virus database:
Standard
- Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan:Select My Computer
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
- Now click on the Save as Text button:
Save the file to your desktop.
Copy and paste that information into your next post along with a fresh HJT log.

Regards

Trevuren

Teutonic_Order

Post #13June 26, 2007, 9:39 PM UTC

Logfile of HijackThis v1.99.1
Scan saved at 5:38:51 PM, on 6/26/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Dell Photo Printer 720\dlbcserv.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\WordPerfect Office 12\Programs\wpwin12.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [OSCD_Creator] c:\Dell\PreODM.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [OSCD_Creator] C:\Dell\PreODM.EXE /2
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: dlbcserv.lnk = C:\Program Files\Dell Photo Printer 720\dlbcserv.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Tuesday, June 26, 2007 5:38:10 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 26/06/2007
Kaspersky Anti-Virus database records: 331788
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 80421
Number of viruses found: 0
Number of infected objects: 0
Number of suspicious objects: 0
Duration of the scan process: 01:23:10

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\InboxLOG.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\OutboxLOG.txt Object is locked skipped
C:\Documents and Settings\Bodie Foster\Application Data\Corel\PerfectExpert\12\Custom WP Templates\qw12EN.wpt Object is locked skipped
C:\Documents and Settings\Bodie Foster\Application Data\Corel\PerfectExpert\12\Custom WP Templates\wp12US.wpt Object is locked skipped
C:\Documents and Settings\Bodie Foster\Application Data\Corel\PerfectExpert\12\Custom WP Templates\XML\XML.wpt Object is locked skipped
C:\Documents and Settings\Bodie Foster\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\DSAgnt.log Object is locked skipped
C:\Documents and Settings\Bodie Foster\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\DSAgnt_GTActions.log Object is locked skipped
C:\Documents and Settings\Bodie Foster\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\gdql_d_DSAgnt.log Object is locked skipped
C:\Documents and Settings\Bodie Foster\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\glog.log Object is locked skipped
C:\Documents and Settings\Bodie Foster\Application Data\Mozilla\Firefox\Profiles\mscl8b9x.default\cert8.db Object is locked skipped
C:\Documents and Settings\Bodie Foster\Application Data\Mozilla\Firefox\Profiles\mscl8b9x.default\history.dat Object is locked skipped
C:\Documents and Settings\Bodie Foster\Application Data\Mozilla\Firefox\Profiles\mscl8b9x.default\key3.db Object is locked skipped
C:\Documents and Settings\Bodie Foster\Application Data\Mozilla\Firefox\Profiles\mscl8b9x.default\parent.lock Object is locked skipped
C:\Documents and Settings\Bodie Foster\Application Data\Mozilla\Firefox\Profiles\mscl8b9x.default\search.sqlite Object is locked skipped
C:\Documents and Settings\Bodie Foster\Application Data\Mozilla\Firefox\Profiles\mscl8b9x.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\Bodie Foster\Application Data\PFP120JCM.{PB Object is locked skipped
C:\Documents and Settings\Bodie Foster\Application Data\PFP120JPR.{PB Object is locked skipped
C:\Documents and Settings\Bodie Foster\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SUPERANTISPYWARE.LOG Object is locked skipped
C:\Documents and Settings\Bodie Foster\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Bodie Foster\Desktop\miitw_update2_efigs_rc_final.exe Object is locked skipped
C:\Documents and Settings\Bodie Foster\Desktop\Unused Desktop Shortcuts\Word Prosessor.WPD Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Application Data\Google\Google Desktop\7105672a0b12\dbc2e.ht1 Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Application Data\Google\Google Desktop\7105672a0b12\dbdam Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Application Data\Google\Google Desktop\7105672a0b12\dbdao Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Application Data\Google\Google Desktop\7105672a0b12\dbeam Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Application Data\Google\Google Desktop\7105672a0b12\dbeao Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Application Data\Google\Google Desktop\7105672a0b12\dbm Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Application Data\Google\Google Desktop\7105672a0b12\dbu2d.ht1 Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Application Data\Google\Google Desktop\7105672a0b12\dbvm.cf1 Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Application Data\Google\Google Desktop\7105672a0b12\dbvmh.ht1 Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Application Data\Google\Google Desktop\7105672a0b12\fii.cf1 Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Application Data\Google\Google Desktop\7105672a0b12\fiih.ht1 Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Application Data\Google\Google Desktop\7105672a0b12\hp Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Application Data\Google\Google Desktop\7105672a0b12\hpt2i.ht1 Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Application Data\Google\Google Desktop\7105672a0b12\rpm.cf1 Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Application Data\Google\Google Desktop\7105672a0b12\rpm1m.cf1 Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Application Data\Google\Google Desktop\7105672a0b12\rpm1mh.ht1 Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Application Data\Google\Google Desktop\7105672a0b12\rpmh.ht1 Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Application Data\Mozilla\Firefox\Profiles\mscl8b9x.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Application Data\Mozilla\Firefox\Profiles\mscl8b9x.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Application Data\Mozilla\Firefox\Profiles\mscl8b9x.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Application Data\Mozilla\Firefox\Profiles\mscl8b9x.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Temp\WT12.tmp Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Temp\WT13.tmp Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Temp\WT14.tmp Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Temp\WT1E7.tmp Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Temp\WT1E8.tmp Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Temp\~DF1274.tmp Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Temp\~DF1294.tmp Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Temp\~DF5DB.tmp Object is locked skipped
C:\Documents and Settings\Bodie Foster\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Bodie Foster\My Documents\Corel User Files\WT12US.UWL Object is locked skipped
C:\Documents and Settings\Bodie Foster\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Bodie Foster\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\InstallShield Installation Information\{017E65B1-7484-461A-B16F-7C931166083B}\setup.ilg Object is locked skipped
C:\Program Files\InstallShield Installation Information\{10798AE3-DCBB-43C3-9C93-C23512427E25}\setup.ilg Object is locked skipped
C:\Program Files\InstallShield Installation Information\{45EBDA59-D33B-433A-956E-B2F236468B56}\setup.ilg Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\20060513023349.zip Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\20060513023631.zip Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\20060513150107.zip Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\20060514181323.zip Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\20060520231424.zip Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\20060605212325.zip Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\20060626045953.zip Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\20060627230606.zip Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\20060812004715.zip Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\20061011182117.zip Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\20061012194643.zip Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq24.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq2A.tmp\base.avd Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq2A.tmp\base001.avd Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq2A.tmp\base002.avd Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq2A.tmp\found.wav Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq2A.tmp\notfound.wav Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq2A.tmp\PestTrap.dvm Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq2A.tmp\removed.wav Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq2A.tmp\Uninstall.exe Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq2B.tmp\PestTrap.lnk Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq2D.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq2F.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq31.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq33.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq36.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq3A.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq3C.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq3E.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq40.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq42.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq43.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq44.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq45.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq46.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq47.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq48.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\.NetworkShare\LimeWirePackedJars4.10.5.7z Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\.NetworkShare\LimeWireWin4.10.5.exe Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\clink.jar Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\commons-httpclient.jar Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\commons-logging.jar Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\commons-net.jar Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\COPYING Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\daap.jar Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\data.ser Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\donotremove.htm Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\GenericWindowsUtils.dll Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\hashes Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\i18n.jar Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\icu4j.jar Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\id3v2.jar Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\install.log Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\jcraft.jar Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\jl011.jar Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\jmdns.jar Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\language.prop Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\LimeWire On Startup.lnk Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\LimeWire.exe Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\LimeWire.ico Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\LimeWire.jar Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\LimeWire20.dll Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\log4j.jar Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\log4j.properties Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\logicrypto.jar Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\looks.jar Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\MessagesBundle.properties Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\MessagesBundles.jar Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\mp3sp14.jar Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\pmf.ico Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\ProgressTabs.jar Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\root\magnet10\badge.img Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\root\magnet10\canHandle.img Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\root\magnet10\limewire.gif Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\root\magnet10\options.js Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\root\magnet10\silentdetect.js Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\SOURCE Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\spacer.gif Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\themes.jar Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\tritonus.jar Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\uninstall.exe Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\unpack.log Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\update.ver Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\vorbis.jar Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\WindowsV5PlusUtils.dll Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\xerces.jar Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\xml-apis.jar Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq49.tmp\xml.war Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4A.tmp\LimeWire 4.10.5.lnk Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4A.tmp\Uninstall.lnk Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4B.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4C.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4D.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4E.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\BrowserSearch\BrowserSearch.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\BrowserSearch\BrowserSearch.xml.backup Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\ErrorSearch\ErrorSearchOptions.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\ErrorSearch\ErrorSearchOptions.xml.backup Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\Layouts\PreferencesLayout.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\Layouts\PreferencesLayout.xml.backup Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\Layouts\ToolbarLayout.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\Layouts\ToolbarLayout.xml.backup Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\Manager\ManagerOptions.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\Manager\ManagerOptions.xml.backup Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\News\Feeds\FEED_0.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\News\Feeds\FEED_1.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\News\Feeds\FEED_10.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\News\Feeds\FEED_11.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\News\Feeds\FEED_2.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\News\Feeds\FEED_3.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\News\Feeds\FEED_4.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\News\Feeds\FEED_5.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\News\Feeds\FEED_6.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\News\Feeds\FEED_7.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\News\Feeds\FEED_8.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\News\Feeds\FEED_9.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\News\NewsOptions.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\News\NewsOptions.xml.backup Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\NewsSearch\NewsSearchOptions.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\NewsSearch\NewsSearchOptions.xml.backup Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\PopupBlocker\PopupBlockerOptions.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\PopupBlocker\PopupBlockerOptions.xml.backup Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\Reference\ReferenceOptions.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\Reference\ReferenceOptions.xml.backup Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\RelatedSearch\RelatedSearchOptions.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\RelatedSearch\RelatedSearchOptions.xml.backup Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\SearchAssistPlus\SearchAssistPlusOptions.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\SearchAssistPlus\SearchAssistPlusOptions.xml.backup Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\SearchMatch\SearchMatchOptions.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\SearchMatch\SearchMatchOptions.xml.backup Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\SmileyTown\SmileyTownOptions.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\SmileyTown\SmileyTownOptions.xml.backup Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\Toolbar\TBProductsOptions.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\Toolbar\TBProductsOptions.xml.backup Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\ToolbarLogo\ToolbarLogoOptions.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\ToolbarLogo\ToolbarLogoOptions.xml.backup Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\ToolbarSearch\ToolbarSearchOptions.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\ToolbarSearch\ToolbarSearchOptions.xml.backup Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\TravelSearch\TravelSearchOptions.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\TravelSearch\TravelSearchOptions.xml.backup Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\Weather\AlertArchive.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\Weather\WeatherOptions.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp\Weather\WeatherOptions.xml.backup Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq5.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq50.tmp\brand.bmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq50.tmp\icons\star_16.ico Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq50.tmp\StarwareConfig.xml Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq50.tmp\StarwareUninstall.exe Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq51.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq52.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq53.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq54.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq55.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq56.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq57.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq58.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq59.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq5A.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq5B.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq5C.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq5D.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq5E.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq5F.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq6.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq60.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq61.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq62.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq63.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq64.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq65.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq66.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq67.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq68.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq69.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq6A.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq6B.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq6C.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq6D.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq6E.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq6F.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq7.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq70.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq71.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq72.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq73.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq74.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq75.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq76.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq77.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq78.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq79.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq7A.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq7B.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq7C.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq7D.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq7E.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq7F.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq8.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq80.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq81.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq82.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq83.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq84.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq85.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq86.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq87.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq88.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq89.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq8A.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq8B.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq8C.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq8D.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq8E.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq8F.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq9.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq91.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq93.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq95.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq97.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq99.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq9B.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq9D.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq9E.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqAF.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqB4.tmp Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqdb.dat Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqsdb.dat Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP533\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\ModemLog_Conexant D850 56K V.9x DFVc Modem.txt Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WIADEBUG.LOG Object is locked skipped
C:\WINDOWS\WIASERVC.LOG Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

Trevuren

Post #14June 26, 2007, 9:55 PM UTC

A. Please delete the content of: C:\Program Files\Yahoo!\YPSR\Quarantine\ (Not the folder, just its content)

B. Make sure that AVG AS guard is disabled as before.

C. Please RUN HijackThis

Click the SCAN button to produce a log.
Place a check mark beside each one of the following items:

O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
Now with all the items selected, and all windows closed except for HJT, delete them by clicking the FIX checked button. Close the HijackThis window.
Reboot Your System
RUN Hijackthis again and produce a new HJT log. Post it in this thread so we can check how everything looks now. In addition, please tell me if there are any more malware problems that you are aware of.

D. Please tell me how everything is now running.

Regards,

Trevuren

Teutonic_Order

Post #15June 27, 2007, 12:34 AM UTC

Logfile of HijackThis v1.99.1
Scan saved at 8:34:10 PM, on 6/26/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Dell Photo Printer 720\dlbcserv.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [OSCD_Creator] c:\Dell\PreODM.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [OSCD_Creator] C:\Dell\PreODM.EXE /2
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: dlbcserv.lnk = C:\Program Files\Dell Photo Printer 720\dlbcserv.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Help! Some Wierd Virus On My Computer!

✨ Ask AI

Ask AI