Spyware / Malware / Virus Removal

[Resolved]Please Help, I Am Definately Hijacked

17 min read

Looking for the outcome? Ask AI

danduster Topic Starter

Post #1August 24, 2007, 4:49 PM UTC

My wife was clicking on popups now I have all these icons and popups trying to get me to download antivirus programs. I've done multiple scans with different programs and have removed some malware but I can not get rid of the popups and icons. Here is my log:

Logfile of HijackThis v1.99.1
Scan saved at 11:41:28 AM, on 8/24/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\a-squared\a2service.exe
C:\Program Files\Norton Utilities\NProtect.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Speed Disk\nopdb.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Video ActiveX Access\iesmn.exe
C:\Program Files\Video ActiveX Access\imsmain.exe
C:\PROGRA~1\SBCLIG~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Softwin\BitDefender8\bdmcon.exe
C:\Program Files\Softwin\BitDefender8\bdnagent.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Video ActiveX Access\imsmn.exe
C:\Program Files\Silicon Prairie Software\MemTurbo\memturbo.exe
C:\Program Files\Video ActiveX Access\iesmin.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Danny\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mybluelight.com/s/sp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dial
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,kernel32.exe,
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: (no name) - {5DDE5591-A8AB-4897-93EF-1E4E943F85A7} - C:\Program Files\Video ActiveX Access\iesplg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Protection Bar - {CC18AE76-7E65-4258-A193-9EA0C52DA6B8} - C:\Program Files\Video ActiveX Access\iesbpl.dll
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCLIG~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender8\bdmcon.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender8\bdnagent.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - Global Startup: MemTurbo.lnk = C:\Program Files\Silicon Prairie Software\MemTurbo\memturbo.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmesus.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmesus.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Support - {332362CF-19FF-4C56-BD81-F0181F63FA75} - C:\WINDOWS\System32\shdocvw.dll (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.mybluelight.com/s/sp
O16 - DPF: ChatSpace Full Java Client 3.1.0.229 - http://surechat.com:9000/Java/cfs31229.cab
O16 - DPF: GraphicalChat Application - http://www.onchat.com/ChatWorld/chat-signed-ie.cab
O16 - DPF: Video Poker - http://download.games.yahoo.com/games/clients/y/vpt0_x.cab
O16 - DPF: Yahoo! Bingo - http://download.games.yahoo.com/games/clients/y/xt0_x.cab
O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/clients/y/jt0_x.cab
O16 - DPF: Yahoo! Chat - http://cs6.chat.sc5.yahoo.com/c381/chat.cab
O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/games/clients/y/ct0_x.cab
O16 - DPF: Yahoo! Dice - http://download.games.yahoo.com/games/clients/y/dct0_x.cab
O16 - DPF: Yahoo! Dots - http://download.games.yahoo.com/games/clients/y/dtt0_x.cab
O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/games/clients/y/et1_x.cab
O16 - DPF: Yahoo! Fleet - http://download.games.yahoo.com/games/clients/y/fltt0_x.cab
O16 - DPF: Yahoo! Freecell Solitaire - http://yog55.games.scd.yahoo.com/yog/y/fs9_x.cab
O16 - DPF: Yahoo! Go - http://download.games.yahoo.com/games/clients/y/gt0_x.cab
O16 - DPF: Yahoo! Graffiti - http://download.games.yahoo.com/games/clients/y/grt4_x.cab
O16 - DPF: Yahoo! Klondike Solitaire - http://yog55.games.scd.yahoo.com/yog/y/ks11_x.cab
O16 - DPF: Yahoo! Literati - http://download.games.yahoo.com/games/clients/y/tt0_x.cab
O16 - DPF: Yahoo! MahJong Solitaire - http://download.games.yahoo.com/games/clients/y/mjst0_x.cab
O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt0_x.cab
O16 - DPF: Yahoo! Reversi - http://download.games.yahoo.com/games/clients/y/rt0_x.cab
O16 - DPF: Yahoo! Spades - http://download.games.yahoo.com/games/clients/y/st2_x.cab
O16 - DPF: Yahoo! Trivia - http://download.games.yahoo.com/games/clients/y/tvt0_x.cab
O16 - DPF: {01111C00-3E00-11D2-8470-0060089874ED} - http://65.83.242.101/sdccommon/download/tgctlar.cab
O16 - DPF: {01111E00-3E00-11D2-8470-0060089874ED} - http://65.83.242.102/sdccommon/download/tgctlsi.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} - http://65.83.242.102/sdccommon/download/tgctlcm.cab
O16 - DPF: {29C13B62-B9F7-4CD3-8CEF-0A58A1A99441} - http://fdl.msn.com/public/chat/msnchat41.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200203…meInstaller.exe
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} - http://us.games2.yimg.com/download.games.y…ctl_0_0_0_1.ocx
O16 - DPF: {768D513A-C75B-4FAA-8452-E906CDAB6545} - http://flipviewer.com/exe//fvlite/fvliteY.cab
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A424AD33-B192-4B0F-8D46-A90543F8C535} - http://iii.tv/pink/005/XEng005.CAB
O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} (LinkSys Content Update) - http://www.linksysfix.com/netcheck/53/install/gtdownls.cab
O16 - DPF: {ABB660B6-6694-407B-950A-EDBA5A159722} (DVCDownloadControl) - http://download.games.yahoo.com/games/web_…loadControl.cab
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} - http://us.dl1.yimg.com/download.yahoo.com/…ropper1_2us.cab
O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} -
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_…aploader_v6.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} - http://chat.yahoo.com/cab/yvwrctl.cab
O16 - DPF: {E87A6788-1D0F-4444-8898-1D25829B6755} - http://fdl.msn.com/public/chat/msnchat4.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.yahoo.com/…/yiebio4023.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} - http://sc.communities.msn.com/controls/chat/msnchat45.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\program files\a-squared\a2service.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: F-Secure Network Request Broker - Unknown owner - C:\Program Files\F-Secure\Common\FNRB32.EXE (file missing)
O23 - Service: F-Secure Management Agent (FSMA) - Unknown owner - C:\Program Files\F-Secure\Common\FSMA32.EXE (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NProtect.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - Unknown owner - C:\WINDOWS\system32\pctspk.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

Scotty

Post #2August 24, 2007, 6:14 PM UTC

Hi! Welcome to the Tom Coyote forums.
My name is Scotty. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.
Please be patient and I'd be grateful if you would note the following:

I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for this issue on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Please make a uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
5. Click on the Save list… button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here in a reply.

Download and Run ComboFix

Download this file from below:

Here
Disconnect from the Internet, than disable your anti-virus and any real-time anti-spyware monitors that are running.
Then double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you. Post that log in your next reply with a new HijackThis log.

Note 1: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Note 2:Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.

danduster

Post #3August 24, 2007, 6:35 PM UTC

unistall list

µTorrent
·¬¯½ÙÌ§ÝÀ¼Þ±¹–‚‘åí
Actual Spy
Adobe Acrobat 5.0
Adobe Flash Player 9 ActiveX
Adobe Photoshop 7.0
Advanced WindowsCare 2.41 Personal
American McGee's Alice™
Ares 2.0.8
a-squared Free 2.0
Automatic Windows Internet Washer
Battlefield 1942
Bejeweled 2 Deluxe 1.0
BitDefender 8 Free Edition
Broken Saints Screen Saver (screensaver)
CamStudio
Cole2k Media - Codec Pack (Advanced)
Coloreal
Compaq Wallpaper
Compaq WinDVD
Creative WebCam NX Pro Driver (1.03.03.0326)
Disney's Iguanodon Pond-a-Thon
Easy Access Button Support
eMulev0.48a.-MorphXTv10.1
eMusic - 50 Free MP3 offer
Evidence Eliminator
EZLive Monitor 2.0
EZMedia Box 2.0
Fallout2
FireBurner
FlashFXP v3
FruityLoops v3.56 Full
Geiss2 for Winamp 2x (remove only)
GetRight
GiPo@MoveOnBoot 1.9.5
Glover
Google Toolbar for Internet Explorer
HighMAT Extension to Microsoft Windows XP CD Writing Wizard
HijackThis 1.99.1
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows XP (KB896344)
Hotfix for Windows XP (KB912475)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB928388)
Hotfix for Windows XP (KB929120)
HSP56 MicroModem Drivers
IExplorer Security Plug-in
Intel® PRO Network Connections Drivers
InterActual Player
Internet Explorer Secure Bar
InterVideo Installer
iPod for Windows 2005-02-22
iTunes
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 6
Java 2 Runtime Environment, SE v1.4.1
Java Web Start
Jay Jay Sky Heroes to the Rescue
JumpStart Advanced Kindergarten
JumpStart Animal Field Trip
Kazaa Lite Resurrection 0.0.8
KC Softwares VideoToolBox
Macromedia Shockwave Player
MakeTorrent v2.1
MemTurbo
Messenger Service
Microsoft .NET Framework (English)
Microsoft .NET Framework (English) v1.0.3705
Microsoft .NET Framework 1.0 Hotfix (KB928367)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Data Access Components KB870669
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Reader
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual Studio 6.0 Enterprise Edition
Microsoft Web Publishing Wizard 1.53
Microsoft Windows Journal Viewer
Microsoft Windows Media Video 9 VCM
Microsoft Works 6.0
MilkDrop for Winamp 2x (remove only)
mIRC
Mozilla Firefox (2.0.0.4)
MS Access 97 SP2
MSN Messenger 7.5
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML4 Parser
Muppet Babies - Animals in Nature
My DSC
My Little Pony
MySpaceIM
Nero Suite
Norton Utilities 2002 for Windows
NVIDIA Display Driver
NVIDIA Drivers
NVIDIA Screen Saver 1.2
Paint Shop Pro 7 ESD
Panda ActiveScan
PeerGuardian 2.0
QuickTime
R4
Reader Rabbit Personalized 1st Grade
RealPlayer
Registry Mechanic 5.1
RTPatch Update
SBC Self Support Tool
Security Update for Microsoft .NET Framework 2.0 (KB928365)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901190)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB938829)
SequoiaView
Shockwave
SoulSeek Client 146c
Sound Blaster Audigy
SoundMAX2
Stealther
Ulead Photo Express 4.0 My Custom Edition
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB900930)
Update for Windows XP (KB904942)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB912945)
Update for Windows XP (KB916595)
Update for Windows XP (KB920342)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
V1.0
Video ActiveX Solution 2.07
VideoLAN VLC media player 0.8.1
Viewpoint Media Player
Webcam Basic
Willing Webcam
Winamp (remove only)
Window Washer
Windows Genuine Advantage v1.3.0254.0
Windows Installer 3.1 (KB893803)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Format SDK Hotfix - KB891122
Windows Media Player 11
Windows Media Player 11
Windows Safety Alert
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Windows XP Service Pack 2
WinRAR archiver
WinZip
X-NetStat 5.0 Standard
Xteq Systems X-Setup 6.3
Yahoo! extras
Yahoo! Messenger
Yahoo! Toolbar
Yahoo! Widget Engine
Yahoo! Widget Engine

ComboFix 07-08-24.4 - "Danny" 2007-08-24 13:19:04.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.139 [GMT -5:00]

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\Program Files\video activex access
C:\Program Files\video activex access\iesbpl.dll
C:\Program Files\video activex access\iesbunst.exe
C:\Program Files\video activex access\iesmin.exe
C:\Program Files\video activex access\iesmn.exe
C:\Program Files\video activex access\iesplg.dll
C:\Program Files\video activex access\iesunst.exe
C:\Program Files\video activex access\imsmain.exe
C:\Program Files\video activex access\imsmn.exe
C:\Program Files\video activex access\imsunst.exe
C:\Program Files\video activex access\ot.ico
C:\Program Files\video activex access\ts.ico
C:\Program Files\video activex access\uninst.exe

((((((((((((((((((((((((( Files Created from 2007-07-24 to 2007-08-24 )))))))))))))))))))))))))))))))

2007-08-24 13:18 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-23 18:14 d——– C:\WINDOWS\system32\ActiveScan
2007-08-05 16:53 d-a—— C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-08-05 16:52 d——– C:\Program Files\Automatic Windows Internet Washer
2007-08-04 10:15 d——– C:\Program Files\eMule

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-24 12:37 ——— d——– C:\DOCUME~1\Danny\APPLIC~3\uTorrent
2007-08-24 12:37 ——— d——– C:\DOCUME~1\Danny\APPLIC~3\uTorrent
2007-08-24 11:21 ——— d——– C:\Program Files\a-squared
2007-08-23 13:22 ——— d——– C:\Program Files\Common Files\Scanner
2007-08-23 07:54 12288 –a-s—- C:\WINDOWS\system32\fwjgtk.dll
2007-08-19 20:40 ——— d——– C:\Program Files\PeerGuardian2
2007-08-04 14:48 ——— d——– C:\Program Files\mIRC
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\wups.dll
2007-07-06 13:10 ——— d——– C:\Program Files\GetRight
2007-06-26 01:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-19 08:31 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-13 05:23 1033216 –a—— C:\WINDOWS\explorer.exe
2004-04-06 17:55 0 –a—— C:\DOCUME~1\Danny\RedDwarf.bat

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Motive SmartBridge"="C:\PROGRA~1\SBCLIG~1\SMARTB~1\MotiveSB.exe" [2003-12-10 03:52]
"BDMCon"="C:\Program Files\Softwin\BitDefender8\bdmcon.exe" [2005-06-20 12:10]
"BDNewsAgent"="C:\Program Files\Softwin\BitDefender8\bdnagent.exe" [2005-05-09 12:19]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2004-08-19 23:57]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-12-10 03:06]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-12-07 09:59]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-03-27 15:22]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"NvMediaCenter"=RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
"MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe

C:\DOCUME~1\Robin\STARTM~1\Programs\Startup\
Yahoo! Widget Engine.lnk - C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe [2006-05-23 16:17:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"=1 (0x1)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{6747456b-cea8-463d-ad2a-50d67ae73d30}"= C:\WINDOWS\system32\fwjgtk.dll [2007-08-23 07:54 12288]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2409960447-1256799619-874574627-1006\Scripts\Logoff\]
"Script"=C:\Program Files\Automatic Windows Internet Washer\xp.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^GetRight - Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\GetRight - Tray Icon.lnk
backup=C:\WINDOWS\pss\GetRight - Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Norton System Doctor.lnk]
backup=C:\WINDOWS\pss\Norton System Doctor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ZoneAlarm Pro.lnk]
backup=C:\WINDOWS\pss\ZoneAlarm Pro.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Danny^Start Menu^Programs^Startup^Yahoo! Widget Engine.lnk]
path=C:\Documents and Settings\Danny\Start Menu\Programs\Startup\Yahoo! Widget Engine.lnk
backup=C:\WINDOWS\pss\Yahoo! Widget Engine.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]
"C:\Program Files\Ares\Ares.exe" -h

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\areslite]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AT-Watch]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_EMC]
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CPQEASYACC]
C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
"C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
"C:\Program Files\D-Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DateChecker]
C:\Cpqs\Scom\srmclean.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure Manager]
"C:\Program Files\F-Secure\Common\FSM32.EXE" /splash

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iestart]
C:\Program Files\Windows Media Player\wmplayer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Jet Detection]
C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyStartUp]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RunDLL32.exe NvMCTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCTVOICE]
pctspk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlaxoUpdate]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smapp]
Smtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\srmclean]
C:\Cpqs\Scom\srmclean.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
C:\WINDOWS\Updreg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WCOLOREAL]
"C:\Program Files\COMPAQ\Coloreal\coloreal.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Yahoo! Pager"=C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Evidence Eliminator"=C:\Program Files\Evidence Eliminator\ee.exe /m
"RealTray"=C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
"WorksFUD"=
"Microsoft Works Portfolio"=C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
"Microsoft Works Update Detection"=C:\Program Files\Microsoft Works\WkDetect.exe

R1 SSHDRV65;SSHDRV65;\??\C:\WINDOWS\System32\drivers\SSHDRV65.sys
R1 SSHDRV77;SSHDRV77;\??\C:\WINDOWS\System32\drivers\SSHDRV77.sys
R3 NPDriver;Norton Unerase Protection Driver;\??\C:\WINDOWS\System32\Drivers\NPDRIVER.SYS
S0 ElbyVCD;ElbyVCD;C:\WINDOWS\system32\DRIVERS\ElbyVCD.sys
S1 EACMOS;EACMOS;C:\WINDOWS\system32\drivers\EACMOS.SYS
S1 EAWDMFD;EAWDMFD;C:\WINDOWS\system32\drivers\EAWDMFD.sys
S2 F-Secure Filter;F-Secure File System Filter;\??\C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys
S2 F-Secure Gatekeeper;F-Secure Gatekeeper;\??\C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys
S2 F-Secure Recognizer;F-Secure File System Recognizer;\??\C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys
S2 Pctspk;PCTEL Speaker Phone;C:\WINDOWS\system32\pctspk.exe
S3 Amsmpu4p;Amsmpu4p;\??\C:\DOCUME~1\Danny\LOCALS~1\Temp\Amsmpu4p.sys
S3 emu10kx;Creative EMU10K1/EMU10K2 Audio Driver (WDM);C:\WINDOWS\system32\drivers\e10kx2k.sys
S3 P1130VID;Creative WebCam NX Pro;C:\WINDOWS\system32\DRIVERS\P1130Vid.sys
S3 PAC207;Webcam Basic;C:\WINDOWS\system32\DRIVERS\pfc027.sys
S3 Ptserlp;PCTEL Serial Device Driver for PCI;C:\WINDOWS\system32\DRIVERS\ptserlp.sys

Contents of the 'Scheduled Tasks' folder
2001-09-29 11:58:08 C:\WINDOWS\Tasks\Registration reminder 1.job - C:\WINDOWS\System32\OOBE\oobebaln.exe
2001-09-29 11:58:08 C:\WINDOWS\Tasks\Registration reminder 2.job - C:\WINDOWS\System32\OOBE\oobebaln.exe
2001-09-29 11:58:09 C:\WINDOWS\Tasks\Registration reminder 3.job - C:\WINDOWS\System32\OOBE\oobebaln.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-24 13:26:23
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-24 13:29:04 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-08-24 13:28

— E O F —

Scotty

Post #4August 24, 2007, 7:00 PM UTC

Hi danduster

Why are you getting Microsoft reminders?

I see that Viewpoint Media Player is installed. Viewpoint, Viewpoint Manager, Viewpoint Media Player are Viewpoint components which are installed as a side effect of installing other software, most notably AOL and AOL Instant Messenger (AIM). Viewpoint Manager is responsible for managing and updating Viewpoint Media Player’s components. You can disable this using the Viewpoint Manager Control Panel found in the Windows Control Panel menu. By selecting Disable auto‑updating for the Viewpoint Manager ‑‑ the player will no longer attempt to check for updates. Anything that is installed without your consent is suspect. Read what Viewpoint says and make your own decision.

To provide a satisfying consumer experience and to operate effectively, the Viewpoint Media Player periodically sends information to servers at Viewpoint. Each installation of the Viewpoint Media Player is identifiable to Viewpoint via a Customer Unique Identifier (CUID), an alphanumeric identifier embedded in the Viewpoint Media Player. The Viewpoint Media Player randomly generates the CUID during installation and uses it to indicate a unique installation of the product. A CUID is never connected to a user's name, email address, or other personal contact information. CUIDs are used for the sole purpose of filtering redundant information. Each of these information exchanges occurs anonymously.

Viewpoint Manager is considered as foistware instead of malware since it is installed without user's approval but doesn't spy or do anything "bad". This may change, read Viewpoint to Plunge Into Adware.
I recommend that you remove the Viewpoint products; however, decide for yourself. To uninstall the the Viewpoint components (Viewpoint, Viewpoint Manager, Viewpoint Media Player):

Click Start, point to Settings, and then click Control Panel.
In Control Panel, double-click Add or Remove Programs.
In Add or Remove Programs, highlight >>Viewpoint component<< , click Remove.
Do the same for each Viewpoint component.

Remove programs from Add/Remove Programs List
Please go to:

Start
Control Panel
Add/Remove Programs

Find and remove these programs (if they are present)

Video ActiveX Solution 2.07

Open Notepad and Copy/Paste the text in the codebox below into it:

File::
C:\WINDOWS\system32\fwjgtk.dll
C:\DOCUME~1\Danny\RedDwarf.bat

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{6747456b-cea8-463d-ad2a-50d67ae73d30}"=-

Save this as "CFScript"

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log with a new HijackThis log.

danduster

Post #5August 24, 2007, 7:18 PM UTC

Looking good so far

ComboFix 07-08-24.4 - "Danny" 2007-08-24 14:02:18.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.93 [GMT -5:00]
Command switches used :: C:\Documents and Settings\Danny\Desktop\CFScript.txt

FILE::
C:\WINDOWS\system32\fwjgtk.dll
C:\DOCUME~1\Danny\RedDwarf.bat

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\DOCUME~1\Danny\RedDwarf.bat
C:\WINDOWS\system32\fwjgtk.dll

((((((((((((((((((((((((( Files Created from 2007-07-24 to 2007-08-24 )))))))))))))))))))))))))))))))

2007-08-24 13:18 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-23 18:14 d——– C:\WINDOWS\system32\ActiveScan
2007-08-05 16:53 d-a—— C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-08-05 16:52 d——– C:\Program Files\Automatic Windows Internet Washer
2007-08-04 10:15 d——– C:\Program Files\eMule

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-24 13:59 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
2007-08-24 12:37 ——— d——– C:\DOCUME~1\Danny\APPLIC~3\uTorrent
2007-08-24 12:37 ——— d——– C:\DOCUME~1\Danny\APPLIC~3\uTorrent
2007-08-24 11:21 ——— d——– C:\Program Files\a-squared
2007-08-23 13:22 ——— d——– C:\Program Files\Common Files\Scanner
2007-08-19 20:40 ——— d——– C:\Program Files\PeerGuardian2
2007-08-04 14:48 ——— d——– C:\Program Files\mIRC
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\wups.dll
2007-07-06 13:10 ——— d——– C:\Program Files\GetRight
2007-06-26 01:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-19 08:31 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-13 05:23 1033216 –a—— C:\WINDOWS\explorer.exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Motive SmartBridge"="C:\PROGRA~1\SBCLIG~1\SMARTB~1\MotiveSB.exe" [2003-12-10 03:52]
"BDMCon"="C:\Program Files\Softwin\BitDefender8\bdmcon.exe" [2005-06-20 12:10]
"BDNewsAgent"="C:\Program Files\Softwin\BitDefender8\bdnagent.exe" [2005-05-09 12:19]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2004-08-19 23:57]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-12-10 03:06]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-12-07 09:59]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-03-27 15:22]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"NvMediaCenter"=RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
"MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe

C:\DOCUME~1\Robin\STARTM~1\Programs\Startup\
Yahoo! Widget Engine.lnk - C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe [2006-05-23 16:17:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2409960447-1256799619-874574627-1006\Scripts\Logoff\]
"Script"=C:\Program Files\Automatic Windows Internet Washer\xp.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^GetRight - Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\GetRight - Tray Icon.lnk
backup=C:\WINDOWS\pss\GetRight - Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Norton System Doctor.lnk]
backup=C:\WINDOWS\pss\Norton System Doctor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ZoneAlarm Pro.lnk]
backup=C:\WINDOWS\pss\ZoneAlarm Pro.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Danny^Start Menu^Programs^Startup^Yahoo! Widget Engine.lnk]
path=C:\Documents and Settings\Danny\Start Menu\Programs\Startup\Yahoo! Widget Engine.lnk
backup=C:\WINDOWS\pss\Yahoo! Widget Engine.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]
"C:\Program Files\Ares\Ares.exe" -h

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\areslite]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AT-Watch]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_EMC]
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CPQEASYACC]
C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
"C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
"C:\Program Files\D-Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DateChecker]
C:\Cpqs\Scom\srmclean.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure Manager]
"C:\Program Files\F-Secure\Common\FSM32.EXE" /splash

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iestart]
C:\Program Files\Windows Media Player\wmplayer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Jet Detection]
C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyStartUp]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RunDLL32.exe NvMCTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCTVOICE]
pctspk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlaxoUpdate]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smapp]
Smtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\srmclean]
C:\Cpqs\Scom\srmclean.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
C:\WINDOWS\Updreg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WCOLOREAL]
"C:\Program Files\COMPAQ\Coloreal\coloreal.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Yahoo! Pager"=C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Evidence Eliminator"=C:\Program Files\Evidence Eliminator\ee.exe /m
"RealTray"=C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
"WorksFUD"=
"Microsoft Works Portfolio"=C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
"Microsoft Works Update Detection"=C:\Program Files\Microsoft Works\WkDetect.exe

R1 SSHDRV65;SSHDRV65;\??\C:\WINDOWS\System32\drivers\SSHDRV65.sys
R1 SSHDRV77;SSHDRV77;\??\C:\WINDOWS\System32\drivers\SSHDRV77.sys
R3 NPDriver;Norton Unerase Protection Driver;\??\C:\WINDOWS\System32\Drivers\NPDRIVER.SYS
S0 ElbyVCD;ElbyVCD;C:\WINDOWS\system32\DRIVERS\ElbyVCD.sys
S1 EACMOS;EACMOS;C:\WINDOWS\system32\drivers\EACMOS.SYS
S1 EAWDMFD;EAWDMFD;C:\WINDOWS\system32\drivers\EAWDMFD.sys
S2 F-Secure Filter;F-Secure File System Filter;\??\C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys
S2 F-Secure Gatekeeper;F-Secure Gatekeeper;\??\C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys
S2 F-Secure Recognizer;F-Secure File System Recognizer;\??\C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys
S2 Pctspk;PCTEL Speaker Phone;C:\WINDOWS\system32\pctspk.exe
S3 Amsmpu4p;Amsmpu4p;\??\C:\DOCUME~1\Danny\LOCALS~1\Temp\Amsmpu4p.sys
S3 emu10kx;Creative EMU10K1/EMU10K2 Audio Driver (WDM);C:\WINDOWS\system32\drivers\e10kx2k.sys
S3 P1130VID;Creative WebCam NX Pro;C:\WINDOWS\system32\DRIVERS\P1130Vid.sys
S3 PAC207;Webcam Basic;C:\WINDOWS\system32\DRIVERS\pfc027.sys
S3 Ptserlp;PCTEL Serial Device Driver for PCI;C:\WINDOWS\system32\DRIVERS\ptserlp.sys

Contents of the 'Scheduled Tasks' folder
2001-09-29 11:58:08 C:\WINDOWS\Tasks\Registration reminder 1.job - C:\WINDOWS\System32\OOBE\oobebaln.exe
2001-09-29 11:58:08 C:\WINDOWS\Tasks\Registration reminder 2.job - C:\WINDOWS\System32\OOBE\oobebaln.exe
2001-09-29 11:58:09 C:\WINDOWS\Tasks\Registration reminder 3.job - C:\WINDOWS\System32\OOBE\oobebaln.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-24 14:08:18
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-24 14:10:57 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-08-24 14:10
C:\ComboFix2.txt … 2007-08-24 13:29

— E O F —
Logfile of HijackThis v1.99.1
Scan saved at 2:11:45 PM, on 8/24/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\a-squared\a2service.exe
C:\Program Files\Norton Utilities\NProtect.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Speed Disk\nopdb.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\SBCLIG~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Softwin\BitDefender8\bdmcon.exe
C:\Program Files\Softwin\BitDefender8\bdnagent.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Silicon Prairie Software\MemTurbo\memturbo.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Danny\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mybluelight.com/s/sp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {CC18AE76-7E65-4258-A193-9EA0C52DA6B8} - (no file)
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCLIG~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender8\bdmcon.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender8\bdnagent.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - Global Startup: MemTurbo.lnk = C:\Program Files\Silicon Prairie Software\MemTurbo\memturbo.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmesus.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmesus.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Support - {332362CF-19FF-4C56-BD81-F0181F63FA75} - C:\WINDOWS\System32\shdocvw.dll (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.mybluelight.com/s/sp
O16 - DPF: ChatSpace Full Java Client 3.1.0.229 - http://surechat.com:9000/Java/cfs31229.cab
O16 - DPF: GraphicalChat Application - http://www.onchat.com/ChatWorld/chat-signed-ie.cab
O16 - DPF: Video Poker - http://download.games.yahoo.com/games/clients/y/vpt0_x.cab
O16 - DPF: Yahoo! Bingo - http://download.games.yahoo.com/games/clients/y/xt0_x.cab
O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/clients/y/jt0_x.cab
O16 - DPF: Yahoo! Chat - http://cs6.chat.sc5.yahoo.com/c381/chat.cab
O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/games/clients/y/ct0_x.cab
O16 - DPF: Yahoo! Dice - http://download.games.yahoo.com/games/clients/y/dct0_x.cab
O16 - DPF: Yahoo! Dots - http://download.games.yahoo.com/games/clients/y/dtt0_x.cab
O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/games/clients/y/et1_x.cab
O16 - DPF: Yahoo! Fleet - http://download.games.yahoo.com/games/clients/y/fltt0_x.cab
O16 - DPF: Yahoo! Freecell Solitaire - http://yog55.games.scd.yahoo.com/yog/y/fs9_x.cab
O16 - DPF: Yahoo! Go - http://download.games.yahoo.com/games/clients/y/gt0_x.cab
O16 - DPF: Yahoo! Graffiti - http://download.games.yahoo.com/games/clients/y/grt4_x.cab
O16 - DPF: Yahoo! Klondike Solitaire - http://yog55.games.scd.yahoo.com/yog/y/ks11_x.cab
O16 - DPF: Yahoo! Literati - http://download.games.yahoo.com/games/clients/y/tt0_x.cab
O16 - DPF: Yahoo! MahJong Solitaire - http://download.games.yahoo.com/games/clients/y/mjst0_x.cab
O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt0_x.cab
O16 - DPF: Yahoo! Reversi - http://download.games.yahoo.com/games/clients/y/rt0_x.cab
O16 - DPF: Yahoo! Spades - http://download.games.yahoo.com/games/clients/y/st2_x.cab
O16 - DPF: Yahoo! Trivia - http://download.games.yahoo.com/games/clients/y/tvt0_x.cab
O16 - DPF: {01111C00-3E00-11D2-8470-0060089874ED} - http://65.83.242.101/sdccommon/download/tgctlar.cab
O16 - DPF: {01111E00-3E00-11D2-8470-0060089874ED} - http://65.83.242.102/sdccommon/download/tgctlsi.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} - http://65.83.242.102/sdccommon/download/tgctlcm.cab
O16 - DPF: {29C13B62-B9F7-4CD3-8CEF-0A58A1A99441} - http://fdl.msn.com/public/chat/msnchat41.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200203…meInstaller.exe
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} - http://us.games2.yimg.com/download.games.y…ctl_0_0_0_1.ocx
O16 - DPF: {768D513A-C75B-4FAA-8452-E906CDAB6545} - http://flipviewer.com/exe//fvlite/fvliteY.cab
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A424AD33-B192-4B0F-8D46-A90543F8C535} - http://iii.tv/pink/005/XEng005.CAB
O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} (LinkSys Content Update) - http://www.linksysfix.com/netcheck/53/install/gtdownls.cab
O16 - DPF: {ABB660B6-6694-407B-950A-EDBA5A159722} (DVCDownloadControl) - http://download.games.yahoo.com/games/web_…loadControl.cab
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} - http://us.dl1.yimg.com/download.yahoo.com/…ropper1_2us.cab
O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} -
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_…aploader_v6.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} - http://chat.yahoo.com/cab/yvwrctl.cab
O16 - DPF: {E87A6788-1D0F-4444-8898-1D25829B6755} - http://fdl.msn.com/public/chat/msnchat4.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.yahoo.com/…/yiebio4023.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} - http://sc.communities.msn.com/controls/chat/msnchat45.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\program files\a-squared\a2service.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: F-Secure Network Request Broker - Unknown owner - C:\Program Files\F-Secure\Common\FNRB32.EXE (file missing)
O23 - Service: F-Secure Management Agent (FSMA) - Unknown owner - C:\Program Files\F-Secure\Common\FSMA32.EXE (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NProtect.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - Unknown owner - C:\WINDOWS\system32\pctspk.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

Scotty

Post #6August 24, 2007, 7:32 PM UTC

Hi

What's the answer on the Reminders?

Did you remove Viewpoint or opt to keep it?

Run HijackThis, select Do a system scan only and place checks against the following entries (if they are still present):
O16 - DPF: {A424AD33-B192-4B0F-8D46-A90543F8C535} - http://iii.tv/pink/005/XEng005.CAB
http://us.dl1.yimg.com/download.yahoo.com/…ropper1_2us.cab
O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} -

WITH ALL OTHER WINDOWS CLOSED Click on Fix Checked and exit HijackThis.

Download ATF (Atribune Temp File) Cleaner� by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it.

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

*Note* If you do not have Firefox or Opera, those options will be greyed out.

Please do an online scan with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then start to download the latest definition files.
Once the scanner is installed and the definitions downloaded, click Next.
Now click on Scan Settings
In the scan settings make sure that the following are selected:
- Scan using the following Anti-Virus database:
  
  + Extended(If available otherwise Standard)
- Scan Options:
  
  + Scan Archives
  + Scan Mail Bases
Click OK
Now under select a target to scan select My Computer
The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button
Save the file to your desktop.
Copy and paste that information in your next post with a new HijackThis log, please.

danduster

Post #7August 24, 2007, 9:04 PM UTC

I haven't noticed any reminders!? Yes, I did decide to take the ViewPoint Components off. I am still waiting to finish with the online scan(looks like it will take another 2 hours or so.) Everything seems to be working great though, will post the scan log as soon as I can.

danduster

Post #8August 24, 2007, 11:14 PM UTC

——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Friday, August 24, 2007 6:05:30 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.93.0 Kaspersky Anti-Virus database last update: 24/08/2007 Kaspersky Anti-Virus database records: 389594 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ G:\ Scan Statistics: Total number of scanned objects: 87836 Number of viruses found: 2 Number of infected objects: 2 Number of suspicious objects: 0 Duration of the scan process: 02:36:45 Infected Object Name / Virus Name / Last Action C:\Compaq\Features\Images\Thumbs.db Object is locked skipped C:\Documents and Settings\All Users\Application Data\Support.com\profiles\Violet\{Bellsouth}\issues\998cdb98-e325-4ffa-bbf7-789cdddd6da4.cab Object is locked skipped C:\Documents and Settings\All Users\Application Data\Support.com\profiles\Violet\{Bellsouth}\issues\siidx.xml Object is locked skipped C:\Documents and Settings\Danny\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Danny\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Documents and Settings\Danny\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Danny\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Danny\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Danny\Local Settings\History\History.IE5\MSHist012007082420070825\index.dat Object is locked skipped C:\Documents and Settings\Danny\Local Settings\Temp\Perflib_Perfdata_864.dat Object is locked skipped C:\Documents and Settings\Danny\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Danny\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Danny\ntuser.dat Object is locked skipped C:\Documents and Settings\Danny\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\InstallShield Installation Information\{21BCE515-D5A3-11D4-8E33-0010B53EC668}\setup.ilg Object is locked skipped C:\Program Files\InstallShield Installation Information\{CD0159C9-17FB-11D6-A76A-00B0D079AF64}\setup.ilg Object is locked skipped C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.62 skipped C:\Program Files\MultiProxy\Morpheus\PalTalk\d3T_C.htm Object is locked skipped C:\Program Files\MultiProxy\Morpheus\PalTalk\PaltalkLicense.txt Object is locked skipped C:\Program Files\MultiProxy\Morpheus\PalTalk\PaltalkReadme.txt Object is locked skipped C:\Program Files\MultiProxy\Morpheus\PalTalk\ReceivedFiles\location2.txt Object is locked skipped C:\Program Files\SBC LightSpeed Self Support Tool\SmartBridge\AlertFilter.log Object is locked skipped C:\Program Files\SBC LightSpeed Self Support Tool\SmartBridge\log\httpclient.log Object is locked skipped C:\Program Files\SBC LightSpeed Self Support Tool\SmartBridge\SmartBridge.log Object is locked skipped C:\QooBox\Quarantine\C\Program Files\Video ActiveX Access\iesmn.exe.vir Infected: Trojan-Downloader.Win32.Zlob.cba skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc13\Yahoo!\LAUNCH Music.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc13\Yahoo!\My Yahoo!.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc13\Yahoo!\Yahoo! Auctions.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc13\Yahoo!\Yahoo! Bookmarks.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc13\Yahoo!\Yahoo! Briefcase.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc13\Yahoo!\Yahoo! Calendar.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc13\Yahoo!\Yahoo! Entertainment.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc13\Yahoo!\Yahoo! Finance.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc13\Yahoo!\Yahoo! Games.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc13\Yahoo!\Yahoo! Groups.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc13\Yahoo!\Yahoo! Mail.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc13\Yahoo!\Yahoo! News.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc13\Yahoo!\Yahoo! People Search.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc13\Yahoo!\Yahoo! Personals.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc13\Yahoo!\Yahoo! Photos.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc13\Yahoo!\Yahoo! Shopping.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc13\Yahoo!\Yahoo! Sports.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc13\Yahoo!\Yahoo! Travel.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc13\Yahoo!\Yahoo! Yellow Pages.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc13\Yahoo!\Yahooligans!.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc2\Desktop.ini Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc2\Thumbs.db Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Communication\Alerts.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Communication\Greetings.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Communication\Mail.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Communication\Messenger.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Communication\Mobile.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Communication\Phone Card.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Communication\Yahoo! by Phone.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Community\Chat.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Community\Education.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Community\Experts.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Community\Groups.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Community\Member Directory.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Community\Message Boards.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Community\People Search.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Community\Personals.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Community\Photos.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Entertainment\Astrology.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Entertainment\Broadcast.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Entertainment\Entertainment Guide.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Entertainment\Entertainment.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Entertainment\Games.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Entertainment\LAUNCH Music.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Entertainment\Movies.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Entertainment\Radio.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Entertainment\Tickets.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Entertainment\TV Coverage.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Home & Living\Autos.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Home & Living\Careers.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Home & Living\Coupons.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Home & Living\Family Accounts.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Home & Living\Get Local.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Home & Living\Health.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Home & Living\Personals.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Home & Living\Pets.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Home & Living\Real Estate.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Home & Living\Yahooligans!.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Information Management\Address Book.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Information Management\Bookmarks.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Information Management\Briefcase.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Information Management\Calendar.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Information Management\Companion.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Information Management\Family Accounts.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Information Management\My Yahoo!.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Information Management\Notepad.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Information Management\Postal Center.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\News\Alerts.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\News\Buzz.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\News\Full Coverage.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\News\Lottery Results.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\News\News.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\News\Weather.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Personal Finance\Bill Pay.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Personal Finance\Finance.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Personal Finance\FinanceVision.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Personal Finance\PayDirect.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Personal Publishing\Domains.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Personal Publishing\GeoCities.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Personal Publishing\Photos.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Personal Publishing\Picture Gallery.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Shopping\Auctions.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Shopping\Autos.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Shopping\Classifieds.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Shopping\Coupons.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Shopping\Points.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Shopping\Real Estate.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Shopping\Shopping.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Shopping\Wallet.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Shopping\Yahoo! Gear.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Shopping\Yellow Pages.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Sports & Outdoors\Fantasy Sports.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Sports & Outdoors\Outdoors.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Sports & Outdoors\Parks.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Sports & Outdoors\Ski & Snow.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Sports & Outdoors\Sports.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Tools for Business\Business Express.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Tools for Business\Enterprise Solutions.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Tools for Business\Servers.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Tools for Business\Site.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Tools for Business\Small Business.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Tools for Business\Sponsored Sites.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Tools for Business\Store.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Tools for Business\Website Services.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Travel & Transportation\Lodging.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Travel & Transportation\Maps & Driving Directions.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Travel & Transportation\Restaurants.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc20\Travel & Transportation\Travel.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc22\MSN CarPoint.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc22\MSN Home.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc22\MSN HomeAdvisor.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc22\MSN Hotmail.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc22\MSN MoneyCentral.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc22\MSN People & Chat.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc22\MSN Shopping.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc22\MSN Web Search.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc25\Customize Links.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc25\Free AOL & Unlimited Internet.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc25\Free Hotmail.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc25\Windows Media.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc25\Windows.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc25\ My Yahoo!.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc25\ Yahoo! Mail.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc25\ Yahoo! News.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc25\ Yahoo!.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc56\violet.wpl Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Desktop.ini Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Internet Radio on LAUNCH.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Music Videos & More on LAUNCH.url Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music6 - Jennifer Lopez - All I Have (Feat. LL Cool J).mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\50 cent - Its Your Birthday.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\8. lincoln park - CRAWLING.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Aaliyah ft R.Kelly - Let Me Know (At Your Best) (remix)(1)(1).mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\aerosmith - I d'ont wanna missing thing.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\aerosmith - JADED normal.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\aerosmith - Sweet Child of Mine.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Alanis Morisette - Ironic(2).mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\blood sugar sex magic - Red hot chilli Peppers Under the bridge.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Brandy - Have You Ever.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Britney Spears - Im A Slave For You.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Christina Aguilara, Lil' Kim, Mya & Pink - Mulin Rouge.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Christina Aguilera - Dirty(1).mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Copy of Jennifer Lopez - JLO - hey dj(1).mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Eminem - Superman.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Eminem - The Eminem Show - 04 - Cleaning Out My Closet.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Eminem - Without Me.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\eminem- sing for the moment - 8 mile soundtrack.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Eve & Alicia Keys - Gangsta Lovin.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Fugees & Lauryn Hill - Killing Me Softly.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\HIT EM UP STYLE - Blu Cantrel.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\J-Love Spit Love - The Craft Soundtrack & Charmed Theme.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\ja rule - jarule ft jennifer lopez i'm real.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Ja Rule feat Lil Mo - Put it on me.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Jennifer Lopez - JLO - hey dj(1).mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Jennifer Lopez and JaRule- Ain't that funny (remix).mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Jennifer Lopez feat. Lox - Jenny From The Block.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Lady Marmalade-Christina Aguilera, Lil' Kim, Mya & Pink.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\lincoln park - one step closer 256.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Madonna - My Babys Got A Secret.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Mariah Carey Feat Jay Z - Heartbreaker.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\metallica - Metalica Unforgivin 2.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Montell Jordan - Get It On Tonite.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\morrissey - morrisey how soon is now.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Pink - Dont Let Me Get Me.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Pink - Family Portrait.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Pink - Just like a pill.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Pink - There You Go .mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Shakira - Objection.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Shakira whenever - wherever .mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Shortcut to Britney Spears - Im A Slave For You.lnk Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Shortcut to Toxic.lnk Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\silk - Lick you up and down.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\slowjams - SWV-I Get So Weak in the Knees.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\stain - outside (w fred durst).mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Sting - Desert Storm.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\tlc - Don`t go chasing Water Falls.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Tool- nima 1 - Stinkfist.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Toxic.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Usher - Nice and Slow.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Usher- My Way.mp3 Object is locked skipped C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007\Dc63\Violet's Music\Z- 1- Nelly feat. Kelly Rowland - Dilemma.mp3 Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\drivers\dtscsi.sys Object is locked skipped C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped C:\WINDOWS\system32\drivers\sptd2253.sys Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\spool\PRINTERS\002.SPL Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\tmp00001cfc\tmp00000000 Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed.

Scotty

Post #9August 24, 2007, 11:36 PM UTC

Hi

The reason I asked about the reminders is because they are in the Scheduled Tasks folder, and I wondered if you were getting constant reminders telling you to register Windows.

I would advise updating Adobe Reader, as the latest version clears up any vulnerabilities of previous versions.
First uninstall the version you have on your computer then download and install Adobe Reader 8.1.

Open Notepad and Copy/Paste the text in the codebox below into it:

Folder::
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint

Save this as "CFScript"

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log with a new HijackThis log.

Im going to look into emptying the Recycler folder. Ive never seen one so full. I wont reply until morning though. It's getting late here, and Ive not been well today.

danduster

Post #10August 25, 2007, 12:04 AM UTC

Thank you for all the help you have given me, I hope you feel better. I haven't had any reminders pop up as far as I can remember. I will update Adobe in the morning. Hope to talk to you then.

ComboFix 07-08-24.4 - "Danny" 2007-08-24 18:41:08.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.174 [GMT -5:00]
Command switches used :: C:\Documents and Settings\Danny\Desktop\CFScript.txt

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\-1054744159.mtx
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\-1209374090.mtx
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\-1257552095.712536053
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\-1260774074.741541615
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\-1476482372.712535979
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\-1522684570.SWF
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\-1550700062.mtx
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\-1675323418.713836840
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\-1683647556.726015377
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\-1744624506.713836803
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\-1756920320.MTZ
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\-1767541886.713836716
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\-1792851963.712535981
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\-1912772586.SWF
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\-1912774574.MTZ
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\-2028473534.726015375
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\-2080613713.685483756
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\-2080613713.fdg
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\-685991849.712535954
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\-708065856.713836749
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\-732913299.712536002
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\-763019087.713836937
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\-96559883.mtx
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\1125365030.745784267
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\1139765755.MTZ
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\1461440338.712535953
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\1564877131.712535908
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\1974037858.726015374
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\1989748647.mtx
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\2067489811.MTZ
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\253621806.mtx
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\25513469.MTZ
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\385814962.712536011
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\501688438.712536046
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\856594364.MTZ
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_00\URLCache.ini
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\-1041161462.mtx
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\-1216699398.mtx
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\-1630238855.MTZ
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\-167467785.712535921
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\-1735078747.713836821
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\-1887326999.726015384
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\-2040853405.mtx
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\-298155108.MTZ
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\-350945701.SWF
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\-378119151.712535947
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\-583022627.712535910
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\-665157353.745784144
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\-787478019.712535915
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\-982355842.712536070
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\1089921474.MTZ
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\1176327029.713836865
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\119661579.745784144
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\1220223377.712535992
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\1247495568.712535999
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\1304666343.712536034
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\1365507374.MTZ
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\1564898596.SWF
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\1874612289.MTZ
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\2054049490.MTZ
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\273800141.jsp
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\301743533.741541614
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\346281577.713836896
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\512589962.712536028
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\570073743.713863076
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\768763562.712535994
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\793729131.MTZ
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\802561231.SWF
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\860502393.712536026
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\925975223.mtx
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\991918861.mtx
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_01\URLCache.ini
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\-1140250495.713836908
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\-1149444489.712536068
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\-1219180738.713836830
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\-1270717649.mtx
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\-1430863033.SWF
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\-1438713594.mtx
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\-1610302144.712536009
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\-1651440994.712535931
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\-1772990867.MTZ
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\-1801392204.712535990
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\-1805464504.SWF
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\-1817435829.712536059
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\-1819899927.mtx
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\-1826628295.SWF
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\-1945132630.726015382
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\-2012478958.726015380
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\-2034384745.713836872
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\-2108356295.712535989
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\-243470204.712536022
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\-300725744.mtx
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\-41890203.712536041
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\-582640680.712536049
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\-668285516.mtx
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\-72580264.mtx
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\-764272172.712535942
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\1089921483.MTS
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\1229517749.712535939
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\1365252103.MTZ
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\1385903037.713836769
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\143415706.712536017
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\1520622600.712535996
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\172992995.mtx
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\1750973398.726015372
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\3030969.741541615
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\434599021.mtx
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\518054506.mtx
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\67631377.MTZ
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\738899098.SWF
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_02\URLCache.ini
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\-1037005395.713836741
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\-1106322216.mtx
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\-1294591352.712536065
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\-1307685966.713836843
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\-1603077681.712535983
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\-1625577909.713836700
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\-1720476204.mtx
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\-1799102199.713836711
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\-1877319710.713836793
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\-1882802687.MTZ
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\-1912774567.MTS
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\-1926077123.712535997
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\-1988993383.726015379
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\-26971116.SWF
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\-583862537.712536063
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\-66919675.712536043
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\-697565466.SWF
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\-932851767.726015378
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\1071317150.713836906
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\1117095853.SWF
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\119964245.713836888
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\1220603873.726015383
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\1365252108.MTS
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\1382942631.713836864
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\1385887584.713836838
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\1418335590.713836807
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\1669572585.712536032
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\1763533240.SWF
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\1813525384.MTZ
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\1838517554.712536007
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\1914027597.726015376
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\1944982022.SWF
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\2021793278.712535944
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\489659170.712536061
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\581741786.713836754
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\582067880.712535985
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\746857229.713836914
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\770800983.712535978
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\879056853.712535933
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\932053967.712536014
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\964877803.jsp
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\973040395.MTZ
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\980018594.mtx
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint\Resources\ResourceFolder_03\URLCache.ini

((((((((((((((((((((((((( Files Created from 2007-07-24 to 2007-08-24 )))))))))))))))))))))))))))))))

2007-08-24 14:40 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-08-24 14:40 d——– C:\WINDOWS\LastGood
2007-08-24 14:40 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-08-24 13:18 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-23 18:14 d——– C:\WINDOWS\system32\ActiveScan
2007-08-05 16:53 d-a—— C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-08-05 16:52 d——– C:\Program Files\Automatic Windows Internet Washer
2007-08-04 10:15 d——– C:\Program Files\eMule

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-24 12:37 ——— d——– C:\DOCUME~1\Danny\APPLIC~3\uTorrent
2007-08-24 12:37 ——— d——– C:\DOCUME~1\Danny\APPLIC~3\uTorrent
2007-08-24 11:21 ——— d——– C:\Program Files\a-squared
2007-08-23 13:22 ——— d——– C:\Program Files\Common Files\Scanner
2007-08-19 20:40 ——— d——– C:\Program Files\PeerGuardian2
2007-08-04 14:48 ——— d——– C:\Program Files\mIRC
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\wups.dll
2007-07-06 13:10 ——— d——– C:\Program Files\GetRight
2007-06-26 01:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-19 08:31 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-13 05:23 1033216 –a—— C:\WINDOWS\explorer.exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Motive SmartBridge"="C:\PROGRA~1\SBCLIG~1\SMARTB~1\MotiveSB.exe" [2003-12-10 03:52]
"BDMCon"="C:\Program Files\Softwin\BitDefender8\bdmcon.exe" [2005-06-20 12:10]
"BDNewsAgent"="C:\Program Files\Softwin\BitDefender8\bdnagent.exe" [2005-05-09 12:19]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2004-08-19 23:57]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-12-10 03:06]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-12-07 09:59]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-03-27 15:22]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"NvMediaCenter"=RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
"MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe

C:\DOCUME~1\Robin\STARTM~1\Programs\Startup\
Yahoo! Widget Engine.lnk - C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe [2006-05-23 16:17:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2409960447-1256799619-874574627-1006\Scripts\Logoff\]
"Script"=C:\Program Files\Automatic Windows Internet Washer\xp.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^GetRight - Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\GetRight - Tray Icon.lnk
backup=C:\WINDOWS\pss\GetRight - Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Norton System Doctor.lnk]
backup=C:\WINDOWS\pss\Norton System Doctor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ZoneAlarm Pro.lnk]
backup=C:\WINDOWS\pss\ZoneAlarm Pro.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Danny^Start Menu^Programs^Startup^Yahoo! Widget Engine.lnk]
path=C:\Documents and Settings\Danny\Start Menu\Programs\Startup\Yahoo! Widget Engine.lnk
backup=C:\WINDOWS\pss\Yahoo! Widget Engine.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]
"C:\Program Files\Ares\Ares.exe" -h

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\areslite]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AT-Watch]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_EMC]
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CPQEASYACC]
C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
"C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
"C:\Program Files\D-Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DateChecker]
C:\Cpqs\Scom\srmclean.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure Manager]
"C:\Program Files\F-Secure\Common\FSM32.EXE" /splash

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iestart]
C:\Program Files\Windows Media Player\wmplayer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Jet Detection]
C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyStartUp]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RunDLL32.exe NvMCTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCTVOICE]
pctspk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlaxoUpdate]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smapp]
Smtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\srmclean]
C:\Cpqs\Scom\srmclean.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
C:\WINDOWS\Updreg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WCOLOREAL]
"C:\Program Files\COMPAQ\Coloreal\coloreal.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Yahoo! Pager"=C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Evidence Eliminator"=C:\Program Files\Evidence Eliminator\ee.exe /m
"RealTray"=C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
"WorksFUD"=
"Microsoft Works Portfolio"=C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
"Microsoft Works Update Detection"=C:\Program Files\Microsoft Works\WkDetect.exe

R1 SSHDRV65;SSHDRV65;\??\C:\WINDOWS\System32\drivers\SSHDRV65.sys
R1 SSHDRV77;SSHDRV77;\??\C:\WINDOWS\System32\drivers\SSHDRV77.sys
R3 NPDriver;Norton Unerase Protection Driver;\??\C:\WINDOWS\System32\Drivers\NPDRIVER.SYS
S0 ElbyVCD;ElbyVCD;C:\WINDOWS\system32\DRIVERS\ElbyVCD.sys
S1 EACMOS;EACMOS;C:\WINDOWS\system32\drivers\EACMOS.SYS
S1 EAWDMFD;EAWDMFD;C:\WINDOWS\system32\drivers\EAWDMFD.sys
S2 F-Secure Filter;F-Secure File System Filter;\??\C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys
S2 F-Secure Gatekeeper;F-Secure Gatekeeper;\??\C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys
S2 F-Secure Recognizer;F-Secure File System Recognizer;\??\C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys
S2 Pctspk;PCTEL Speaker Phone;C:\WINDOWS\system32\pctspk.exe
S3 Amsmpu4p;Amsmpu4p;\??\C:\DOCUME~1\Danny\LOCALS~1\Temp\Amsmpu4p.sys
S3 emu10kx;Creative EMU10K1/EMU10K2 Audio Driver (WDM);C:\WINDOWS\system32\drivers\e10kx2k.sys
S3 P1130VID;Creative WebCam NX Pro;C:\WINDOWS\system32\DRIVERS\P1130Vid.sys
S3 PAC207;Webcam Basic;C:\WINDOWS\system32\DRIVERS\pfc027.sys
S3 Ptserlp;PCTEL Serial Device Driver for PCI;C:\WINDOWS\system32\DRIVERS\ptserlp.sys

Contents of the 'Scheduled Tasks' folder
2001-09-29 11:58:08 C:\WINDOWS\Tasks\Registration reminder 1.job - C:\WINDOWS\System32\OOBE\oobebaln.exe
2001-09-29 11:58:08 C:\WINDOWS\Tasks\Registration reminder 2.job - C:\WINDOWS\System32\OOBE\oobebaln.exe
2001-09-29 11:58:09 C:\WINDOWS\Tasks\Registration reminder 3.job - C:\WINDOWS\System32\OOBE\oobebaln.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-24 18:45:04
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

C:\WINDOWS\system32\cmd.exe [2072] 0x82EB7020

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-24 18:47:05
C:\ComboFix-quarantined-files.txt … 2007-08-24 18:46
C:\ComboFix2.txt … 2007-08-24 14:10
C:\ComboFix3.txt … 2007-08-24 13:29

— E O F —

Logfile of HijackThis v1.99.1
Scan saved at 6:59:47 PM, on 8/24/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\a-squared\a2service.exe
C:\Program Files\Norton Utilities\NProtect.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Speed Disk\nopdb.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\SBCLIG~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Softwin\BitDefender8\bdmcon.exe
C:\Program Files\Softwin\BitDefender8\bdnagent.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Silicon Prairie Software\MemTurbo\memturbo.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Danny\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mybluelight.com/s/sp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {CC18AE76-7E65-4258-A193-9EA0C52DA6B8} - (no file)
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCLIG~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender8\bdmcon.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender8\bdnagent.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - Global Startup: MemTurbo.lnk = C:\Program Files\Silicon Prairie Software\MemTurbo\memturbo.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmesus.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmesus.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Support - {332362CF-19FF-4C56-BD81-F0181F63FA75} - C:\WINDOWS\System32\shdocvw.dll (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.mybluelight.com/s/sp
O16 - DPF: ChatSpace Full Java Client 3.1.0.229 - http://surechat.com:9000/Java/cfs31229.cab
O16 - DPF: GraphicalChat Application - http://www.onchat.com/ChatWorld/chat-signed-ie.cab
O16 - DPF: Video Poker - http://download.games.yahoo.com/games/clients/y/vpt0_x.cab
O16 - DPF: Yahoo! Bingo - http://download.games.yahoo.com/games/clients/y/xt0_x.cab
O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/clients/y/jt0_x.cab
O16 - DPF: Yahoo! Chat - http://cs6.chat.sc5.yahoo.com/c381/chat.cab
O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/games/clients/y/ct0_x.cab
O16 - DPF: Yahoo! Dice - http://download.games.yahoo.com/games/clients/y/dct0_x.cab
O16 - DPF: Yahoo! Dots - http://download.games.yahoo.com/games/clients/y/dtt0_x.cab
O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/games/clients/y/et1_x.cab
O16 - DPF: Yahoo! Fleet - http://download.games.yahoo.com/games/clients/y/fltt0_x.cab
O16 - DPF: Yahoo! Freecell Solitaire - http://yog55.games.scd.yahoo.com/yog/y/fs9_x.cab
O16 - DPF: Yahoo! Go - http://download.games.yahoo.com/games/clients/y/gt0_x.cab
O16 - DPF: Yahoo! Graffiti - http://download.games.yahoo.com/games/clients/y/grt4_x.cab
O16 - DPF: Yahoo! Klondike Solitaire - http://yog55.games.scd.yahoo.com/yog/y/ks11_x.cab
O16 - DPF: Yahoo! Literati - http://download.games.yahoo.com/games/clients/y/tt0_x.cab
O16 - DPF: Yahoo! MahJong Solitaire - http://download.games.yahoo.com/games/clients/y/mjst0_x.cab
O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt0_x.cab
O16 - DPF: Yahoo! Reversi - http://download.games.yahoo.com/games/clients/y/rt0_x.cab
O16 - DPF: Yahoo! Spades - http://download.games.yahoo.com/games/clients/y/st2_x.cab
O16 - DPF: Yahoo! Trivia - http://download.games.yahoo.com/games/clients/y/tvt0_x.cab
O16 - DPF: {01111C00-3E00-11D2-8470-0060089874ED} - http://65.83.242.101/sdccommon/download/tgctlar.cab
O16 - DPF: {01111E00-3E00-11D2-8470-0060089874ED} - http://65.83.242.102/sdccommon/download/tgctlsi.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} - http://65.83.242.102/sdccommon/download/tgctlcm.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {29C13B62-B9F7-4CD3-8CEF-0A58A1A99441} - http://fdl.msn.com/public/chat/msnchat41.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200203…meInstaller.exe
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} - http://us.games2.yimg.com/download.games.y…ctl_0_0_0_1.ocx
O16 - DPF: {768D513A-C75B-4FAA-8452-E906CDAB6545} - http://flipviewer.com/exe//fvlite/fvliteY.cab
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} (LinkSys Content Update) - http://www.linksysfix.com/netcheck/53/install/gtdownls.cab
O16 - DPF: {ABB660B6-6694-407B-950A-EDBA5A159722} (DVCDownloadControl) - http://download.games.yahoo.com/games/web_…loadControl.cab
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} - http://us.dl1.yimg.com/download.yahoo.com/…ropper1_2us.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_…aploader_v6.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} - http://chat.yahoo.com/cab/yvwrctl.cab
O16 - DPF: {E87A6788-1D0F-4444-8898-1D25829B6755} - http://fdl.msn.com/public/chat/msnchat4.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.yahoo.com/…/yiebio4023.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} - http://sc.communities.msn.com/controls/chat/msnchat45.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\program files\a-squared\a2service.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: F-Secure Network Request Broker - Unknown owner - C:\Program Files\F-Secure\Common\FNRB32.EXE (file missing)
O23 - Service: F-Secure Management Agent (FSMA) - Unknown owner - C:\Program Files\F-Secure\Common\FSMA32.EXE (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NProtect.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - Unknown owner - C:\WINDOWS\system32\pctspk.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

Scotty

Post #11August 25, 2007, 3:01 PM UTC

Hi danduster

First delete the Combofix.exe icon from your Desktop, then navigate to, and delete the following folders,(if they are present).

C:\Combofix
C:\Qoobox

Go to Start>Control Panel>Add/Remove Programs and remove Kaspersky Online Scanner

Then go to Start>Run and in this order copy/paste the following lines.

cmd /c attrib -s -h -r C:\RECYCLER

then

cmd /c attrib -s -h -r C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007

then

cmd /c del /s/q C:\RECYCLER\S-1-5-21-2409960447-1256799619-874574627-1007

I would advise updating Adobe Reader, as the latest version clears up any vulnerabilities of previous versions.
First uninstall the version you have on your computer then download and install Adobe Reader 8.1.

Delete the older versions of Java and download the newest.
Please follow these steps to remove older version Java components.

Close any programmes you may have running, ESPECIALLY your web browser
Click Start > Control Panel.
Click Add/Remove Programs.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove all versions of Java.
Reboot your computer once all Java components are removed.

Then download the latest version of Java Runtime Environment (JRE) (4th one down the list), which is JRE6u2, and click Yes at the page warning, then accept the Licence Agreement before downloading the Offline file.

Then post a new HijackThis log, please.

danduster

Post #12August 25, 2007, 3:42 PM UTC

HI Mac70

I have the new java and adobe reader, here is my logfile.

Logfile of HijackThis v1.99.1
Scan saved at 10:37:35 AM, on 8/25/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\a-squared\a2service.exe
C:\Program Files\Norton Utilities\NProtect.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Speed Disk\nopdb.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\PROGRA~1\SBCLIG~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Softwin\BitDefender8\bdmcon.exe
C:\Program Files\Softwin\BitDefender8\bdnagent.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Silicon Prairie Software\MemTurbo\memturbo.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\Danny\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mybluelight.com/s/sp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {CC18AE76-7E65-4258-A193-9EA0C52DA6B8} - (no file)
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCLIG~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender8\bdmcon.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender8\bdnagent.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - Global Startup: MemTurbo.lnk = C:\Program Files\Silicon Prairie Software\MemTurbo\memturbo.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmesus.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmesus.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Support - {332362CF-19FF-4C56-BD81-F0181F63FA75} - C:\WINDOWS\System32\shdocvw.dll (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.mybluelight.com/s/sp
O16 - DPF: ChatSpace Full Java Client 3.1.0.229 - http://surechat.com:9000/Java/cfs31229.cab
O16 - DPF: GraphicalChat Application - http://www.onchat.com/ChatWorld/chat-signed-ie.cab
O16 - DPF: Video Poker - http://download.games.yahoo.com/games/clients/y/vpt0_x.cab
O16 - DPF: Yahoo! Bingo - http://download.games.yahoo.com/games/clients/y/xt0_x.cab
O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/clients/y/jt0_x.cab
O16 - DPF: Yahoo! Chat - http://cs6.chat.sc5.yahoo.com/c381/chat.cab
O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/games/clients/y/ct0_x.cab
O16 - DPF: Yahoo! Dice - http://download.games.yahoo.com/games/clients/y/dct0_x.cab
O16 - DPF: Yahoo! Dots - http://download.games.yahoo.com/games/clients/y/dtt0_x.cab
O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/games/clients/y/et1_x.cab
O16 - DPF: Yahoo! Fleet - http://download.games.yahoo.com/games/clients/y/fltt0_x.cab
O16 - DPF: Yahoo! Freecell Solitaire - http://yog55.games.scd.yahoo.com/yog/y/fs9_x.cab
O16 - DPF: Yahoo! Go - http://download.games.yahoo.com/games/clients/y/gt0_x.cab
O16 - DPF: Yahoo! Graffiti - http://download.games.yahoo.com/games/clients/y/grt4_x.cab
O16 - DPF: Yahoo! Klondike Solitaire - http://yog55.games.scd.yahoo.com/yog/y/ks11_x.cab
O16 - DPF: Yahoo! Literati - http://download.games.yahoo.com/games/clients/y/tt0_x.cab
O16 - DPF: Yahoo! MahJong Solitaire - http://download.games.yahoo.com/games/clients/y/mjst0_x.cab
O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt0_x.cab
O16 - DPF: Yahoo! Reversi - http://download.games.yahoo.com/games/clients/y/rt0_x.cab
O16 - DPF: Yahoo! Spades - http://download.games.yahoo.com/games/clients/y/st2_x.cab
O16 - DPF: Yahoo! Trivia - http://download.games.yahoo.com/games/clients/y/tvt0_x.cab
O16 - DPF: {01111C00-3E00-11D2-8470-0060089874ED} - http://65.83.242.101/sdccommon/download/tgctlar.cab
O16 - DPF: {01111E00-3E00-11D2-8470-0060089874ED} - http://65.83.242.102/sdccommon/download/tgctlsi.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} - http://65.83.242.102/sdccommon/download/tgctlcm.cab
O16 - DPF: {29C13B62-B9F7-4CD3-8CEF-0A58A1A99441} - http://fdl.msn.com/public/chat/msnchat41.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200203…meInstaller.exe
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} - http://us.games2.yimg.com/download.games.y…ctl_0_0_0_1.ocx
O16 - DPF: {768D513A-C75B-4FAA-8452-E906CDAB6545} - http://flipviewer.com/exe//fvlite/fvliteY.cab
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} (LinkSys Content Update) - http://www.linksysfix.com/netcheck/53/install/gtdownls.cab
O16 - DPF: {ABB660B6-6694-407B-950A-EDBA5A159722} (DVCDownloadControl) - http://download.games.yahoo.com/games/web_…loadControl.cab
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} - http://us.dl1.yimg.com/download.yahoo.com/…ropper1_2us.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_…aploader_v6.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} - http://chat.yahoo.com/cab/yvwrctl.cab
O16 - DPF: {E87A6788-1D0F-4444-8898-1D25829B6755} - http://fdl.msn.com/public/chat/msnchat4.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.yahoo.com/…/yiebio4023.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} - http://sc.communities.msn.com/controls/chat/msnchat45.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\program files\a-squared\a2service.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: F-Secure Network Request Broker - Unknown owner - C:\Program Files\F-Secure\Common\FNRB32.EXE (file missing)
O23 - Service: F-Secure Management Agent (FSMA) - Unknown owner - C:\Program Files\F-Secure\Common\FSMA32.EXE (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NProtect.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - Unknown owner - C:\WINDOWS\system32\pctspk.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

Scotty

Post #13August 25, 2007, 4:13 PM UTC

Hi

This is my usual speech for when you are clean, which you appear to be.

Please follow these simple steps in order to keep your computer clean and secure:
Disable and Enable System Restore.

It's also a good idea to Flush your System Restore points after ridding yourself of malware:

Click Start | Help and Support | Undo changes to your computer with System Restore.
Click Create A Restore Point then click Next. Give it a name it and then click Create, then Close.
Close the Help and Support Center box.
Click Start | Run and type Cleanmgr
Select (C: ) then click OK.
Click the More Options tab.
Click Clean Up in the System Restore Section.

This will remove all previous restore points except the newly created one.

Here are some free programs, I recommend.

Spybot Search and Destroy
Download it from here . Just choose a mirror and off you go.
Find here the tutorial on how to use Spybot properly here

Install Spyware Guard
Download it from here
Find here the tutorial on how to use Spyware Guard here

Install SpyWare Blaster
Download it from here
Find here the tutorial on how to use Spyware Blaster here

Install WinPatrol
Download it from here
Here you can find information about how WinPatrol works here

Make sure your Windows is ALWAYS up to date!

An unpatched Windows is vulnerable and even with the "best" Antivirus and Firewall installed, malware will find its way through.
So visit http://windowsupdate.microsoft.com/ to download and install the latest updates.

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Please check out Tony Klein's article "How did I get infected in the first place?"

Follow this list and your potential for being infected again will reduce dramatically.

Glad I was able to help.

danduster

Post #14August 25, 2007, 4:24 PM UTC

Thank you so much, I will follow all advise.

Scotty

Post #15August 26, 2007, 10:37 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved]Please Help, I Am Definately Hijacked

✨ Ask AI

Ask AI