Spyware / Malware / Virus Removal

[Resolved] Help With Log Please!

19 min read

Looking for the outcome? Ask AI

ginnyliny Topic Starter

Post #1September 8, 2007, 12:44 PM UTC

My computer is running SO slow, it locks up and I am getting pop ups from everyplace.

ogfile of HijackThis v1.99.1
Scan saved at 8:35:34 AM, on 9/8/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\QuickTime\bak\qttask.exe
C:\WINDOWS\svhost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\Insider\Insider.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\MCROSO~1\spoolsv.exe
C:\WINDOWS\retadpu77.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\s?stem32\w?nspool.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\System32\msiexec.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\WINDOWS\System32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://disboards.com/forumdisplay.php?f=33
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: (no name) - {791FDAF9-6D62-68CC-6557-4F71C60595BD} - C:\WINDOWS\System32\yugfagpm.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {C84D8A0A-E708-42B6-90CA-9C30956A87C6} - C:\WINDOWS\System32\khffdba.dll (file missing)
O2 - BHO: (no name) - {CA3C3756-52F4-45D3-9667-9F65BDA986CC} - C:\WINDOWS\System32\awtsq.dll (file missing)
O2 - BHO: (no name) - {E64F0381-0053-4842-B3E5-08F6C4A0AEB6} - C:\WINDOWS\System32\yyeolris.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\bak\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Gigaware\Gigaware Driver\4.06\MOUSE32A.EXE
O4 - HKLM\..\Run: [svhost] "C:\WINDOWS\svhost.exe"
O4 - HKLM\..\Run: [SystemRestoreStatus] rundll32.exe "C:\WINDOWS\System32\cugutkwj.dll",sitypnow
O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu77.exe 61A847B5BBF72815358B2B27128065E9C084320161C4661227A755E9C2933154389A
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [WinTouch] "C:\Documents and Settings\Gail\Application Data\WinTouch\WinTouch.exe"
O4 - HKCU\..\Run: [Itcnl] "C:\Documents and Settings\Gail\My Documents\??sembly\d?xplore.exe"
O4 - HKCU\..\Run: [Krqbvrqi] C:\WINDOWS\s?stem32\w?nspool.exe
O4 - HKCU\..\Run: [Insider] "C:\Program Files\Insider\Insider.exe"
O4 - HKCU\..\Run: [Aida] "C:\WINDOWS\MCROSO~1\spoolsv.exe" -vt ndrv
O4 - Startup: Tycoon City_ New York Registration.lnk = C:\Documents and Settings\Gail\Local Settings\Temp\{173D001A-B43B-4F40-AFD5-37BD22E13EC1}\{A5101403-2C42-40E0-8D9E-5E49E7C3B89E}\ATR1.EXE
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0b\aoltray.exe
O4 - Global Startup: Billminder.lnk = C:\Program Files\QUICKENW\billmind.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\QUICKENW\bagent.exe
O4 - Global Startup: Quicken Startup.lnk = C:\Program Files\QUICKENW\QWDLLS.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: RemindU - {16BF42FD-CA0A-4f48-819D-B0343254DD67} - file://C:\Program Files\UpromiseRemindU\System\Temp\upromise_script0.htm (file missing) (HKCU)
O9 - Extra button: (no name) - {2863ACA1-9AA0-4432-8CFE-88C12B3B2E5E} - file://C:\Program Files\Upromise_RemindU\Sy1050\Tp1050\scri1050a.htm (file missing) (HKCU)
O16 - DPF: 6th Street Omaha Poker by pogo - http://game1.pogo.com/applet-6.4.3.36/omah…a-ob-assets.cab
O16 - DPF: Aces Up! by pogo - http://game1.pogo.com/applet-8.0.5.48/aces/aces-en_US.cab
O16 - DPF: Ali Baba Slots TM by pogo - http://game1.pogo.com/applet-6.3.0.53/slot…a-ob-assets.cab
O16 - DPF: Backgammon by pogo - http://game1.pogo.com/applet-6.3.3.38/back…n-ob-assets.cab
O16 - DPF: Blackjack by pogo - http://game1.pogo.com/applet-8.0.3.20/blac…kjack-en_US.cab
O16 - DPF: Blackjack Carnival by pogo - http://game1.pogo.com/applet-6.8.1.38/vbja…jack2-en_US.cab
O16 - DPF: Blooop by pogo - http://game1.pogo.com/applet-6.9.4.41/casc…scade-en_US.cab
O16 - DPF: Bowling by pogo - http://game1.pogo.com/applet-8.0.7.27/bowl…wling-en_US.cab
O16 - DPF: Buckaroo Blackjack TM by pogo - http://game1.pogo.com/applet-6.7.3.23/vide…kjack-en_US.cab
O16 - DPF: Canasta by pogo - http://game1.pogo.com/applet-8.0.5.48/cana…nasta-en_US.cab
O16 - DPF: Checkers by pogo - http://game1.pogo.com/applet-6.4.0.34/chec…s-ob-assets.cab
O16 - DPF: Chess by pogo - http://game1.pogo.com/applet-6.5.0.45/ches…2-ob-assets.cab
O16 - DPF: Dice City Roller by pogo - http://game1.pogo.com/applet-8.0.4.32/ytz/ytz-en_US.cab
O16 - DPF: Dice Derby by pogo - http://game1.pogo.com/applet-8.0.1.23/chec…dflag-en_US.cab
O16 - DPF: Dice Derby by pogo.com - http://checkeredflag.pogo.com/applet/check…g-ob-assets.cab
O16 - DPF: Dominoes by pogo - http://game1.pogo.com/applet-6.5.5.29/domi…omino-en_US.cab
O16 - DPF: Double Deuce Poker by pogo - http://game1.pogo.com/applet-6.7.0.32/vide…deuce-en_US.cab
O16 - DPF: Euchre by pogo - http://game1.pogo.com/applet-6.5.2.26/euch…uchre-en_US.cab
O16 - DPF: First Class Solitaire by pogo - http://game1.pogo.com/applet-8.0.4.32/firs…lass2-en_US.cab
O16 - DPF: Fortune Bingo by pogo - http://game1.pogo.com/applet-8.0.5.30/supe…bingo-en_US.cab
O16 - DPF: Greenback Bayou by pogo - http://game1.pogo.com/applet-8.0.3.20/gree…nback-en_US.cab
O16 - DPF: Greenback Bayou by pogo.com - http://greenback.pogo.com/applet/greenback…k-ob-assets.cab
O16 - DPF: Hangman Hijinks by pogo - http://game1.pogo.com/applet-8.0.1.32/hang…ngman-en_US.cab
O16 - DPF: Harvest Mania by pogo - http://game1.pogo.com/applet-6.8.2.23/harv…rvest-en_US.cab
O16 - DPF: Hearts by pogo - http://game1.pogo.com/applet-8.0.5.48/hear…earts-en_US.cab
O16 - DPF: High Stakes Poker by pogo - http://game1.pogo.com/applet-6.8.4.51/draw…poker-en_US.cab
O16 - DPF: High Stakes Pool by pogo - http://game1.pogo.com/applet-6.6.2.21/pool2/pool-en_US.cab
O16 - DPF: Hog Heaven Slots by pogo - http://game1.pogo.com/applet-8.0.5.30/fancy/fancy-en_US.cab
O16 - DPF: Jigsaw Detective by pogo - http://game1.pogo.com/applet-6.3.2.25/jigs…w-ob-assets.cab
O16 - DPF: Jungle Gin by pogo - http://game1.pogo.com/applet-6.8.3.35/gin2/gin2-en_US.cab
O16 - DPF: Keno by pogo - http://game1.pogo.com/applet-6.7.3.30/keno/keno-en_US.cab
O16 - DPF: Lost Temple Poker by pogo - http://game1.pogo.com/applet-8.0.6.59/mhpo…poker-en_US.cab
O16 - DPF: Lottso by pogo - http://game1.pogo.com/applet-8.0.5.30/lott…ottso-en_US.cab
O16 - DPF: Mah Jong Garden by pogo - http://game1.pogo.com/applet-8.0.6.49/mahj…jong2-en_US.cab
O16 - DPF: Makeover Madness by pogo - http://game1.pogo.com/applet-8.0.4.41/shoes/shoes-en_US.cab
O16 - DPF: Multiline Slots by pogo - http://game1.pogo.com/applet-6.6.4.29/mlsl…slots-en_US.cab
O16 - DPF: Pai Gow by pogo - http://game1.pogo.com/applet-6.9.0.43/paig…aigow-en_US.cab
O16 - DPF: Payday FreeCell by pogo - http://game1.pogo.com/applet-6.9.0.43/free…ecell-en_US.cab
O16 - DPF: Payday Freecell Solitaire by pogo - http://game1.pogo.com/applet-6.9.4.34/free…cell2-en_US.cab
O16 - DPF: Penguin Blocks by pogo - http://game1.pogo.com/applet-8.0.5.30/peng…guins-en_US.cab
O16 - DPF: Perfect Pair Solitaire by pogo - http://game1.pogo.com/applet-8.0.5.48/wate…wheel-en_US.cab
O16 - DPF: Phlinx by pogo - http://game1.pogo.com/applet-8.0.4.32/flin…inger-en_US.cab
O16 - DPF: Pinochle by pogo - http://game1.pogo.com/applet-6.6.3.34/pino…ochle-en_US.cab
O16 - DPF: Pop Fu by pogo - http://game1.pogo.com/applet-6.9.3.49/popfu/popfu-en_US.cab
O16 - DPF: Pop Fu by pogo.com - http://popfu.pogo.com/applet/popfu/popfu-ob-assets.cab
O16 - DPF: PoppaZoppa by pogo - http://game1.pogo.com/applet-6.9.1.32/popp…zoppa-en_US.cab
O16 - DPF: Poppit by pogo - http://game1.pogo.com/applet-8.0.2.32/popp…ppit2-en_US.cab
O16 - DPF: Quick Quack by pogo - http://game1.pogo.com/applet-6.7.4.35/hots…treak-en_US.cab
O16 - DPF: QWERTY by pogo - http://game1.pogo.com/applet-6.6.2.21/squa…uares-en_US.cab
O16 - DPF: Ride The Tide by pogo - http://game1.pogo.com/applet-6.6.2.21/ride/ride-en_US.cab
O16 - DPF: Showbiz Slots 2 by pogo - http://game1.pogo.com/applet-6.8.0.32/slot…wbiz2-en_US.cab
O16 - DPF: Showbiz Slots by pogo - http://game1.pogo.com/applet-6.4.2.30/slot…z-ob-assets.cab
O16 - DPF: Shuffle Bump by pogo - http://game1.pogo.com/applet-6.7.0.32/puck/puck-en_US.cab
O16 - DPF: Spades 2 by pogo - http://game1.pogo.com/applet-8.0.2.32/spad…ades2-en_US.cab
O16 - DPF: Spider Solitaire by pogo - http://game1.pogo.com/applet-8.0.0.20/spid…pider-en_US.cab
O16 - DPF: Squelchies by pogo - http://game1.pogo.com/applet-8.0.6.49/sque…chies-en_US.cab
O16 - DPF: Stax by pogo - http://game1.pogo.com/applet-8.0.7.27/stax/stax-en_US.cab
O16 - DPF: Stellar Sweeper by pogo - http://game1.pogo.com/applet-6.9.3.39/swee…eeper-en_US.cab
O16 - DPF: Sweet Tooth TM by pogo - http://game1.pogo.com/applet-8.0.7.27/swee…tooth-en_US.cab
O16 - DPF: Texas Hold'em Poker by pogo - http://game1.pogo.com/applet-8.0.4.32/hold…oldem-en_US.cab
O16 - DPF: Top Down Baseball Challenge by pogo - http://game1.pogo.com/applet-6.4.4.27/topd…2-ob-assets.cab
O16 - DPF: Tri-Peaks by pogo - http://game1.pogo.com/applet-8.0.5.48/peaks/peaks-en_US.cab
O16 - DPF: Tumble Bees by pogo - http://game1.pogo.com/applet-8.0.4.32/tumb…mbee2-en_US.cab
O16 - DPF: Turbo 21 TM by pogo - http://game1.pogo.com/applet-6.3.2.25/turb…1-ob-assets.cab
O16 - DPF: Turbo 21 v2 by pogo - http://game1.pogo.com/applet-8.0.0.20/turb…rbo22-en_US.cab
O16 - DPF: Wonderland Memories by pogo - http://game1.pogo.com/applet-8.0.5.30/memo…ories-en_US.cab
O16 - DPF: Word Craft by pogo - http://game1.pogo.com/applet-6.9.4.34/babb…abble-en_US.cab
O16 - DPF: Word Search Daily by pogo - http://game1.pogo.com/applet-8.0.7.27/word…earch-en_US.cab
O16 - DPF: Word Whomp by pogo - http://game1.pogo.com/applet-8.0.5.30/word…homp2-en_US.cab
O16 - DPF: Word Whomp Whackdown by pogo - http://game1.pogo.com/applet-8.0.6.59/whac…kdown-en_US.cab
O16 - DPF: WordJong by pogo - http://game1.pogo.com/applet-8.0.5.30/word…djong-en_US.cab
O16 - DPF: World Class Solitaire by pogo - http://game1.pogo.com/applet-8.0.6.49/worl…class-en_US.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} (AOL Content Update) - http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab
O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} - http://install.wildtangent.com/ActiveLaunc…iveLauncher.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.costcophotocenter.com/CostcoActivia.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/11edaa929534aae9b605/…ip/RdxIE601.cab
O16 - DPF: {5E943D9C-F8DC-4258-8E3F-A61BB3405A33} (ZingBatchAXDwnl Class) - http://www.imagestation.com/common/classes…ion=4,3,2,20802
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://floridakeysmedia.tv/axiscam/Codebas…sCamControl.ocx
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/1452/ftp…02/cpbrkpie.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/…loadcontrol.cab
O16 - DPF: {C6B086D2-146B-47A4-A218-B82DCAF2D872} (cpbrxpie Control) - http://a19.g.akamai.net/7/19/7125/1433/ftp…20/cpbrxpie.cab
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://clubgames.pogo.com/online2/pogop/di…sh.1.0.0.80.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://aol131.pogo.com/game/deluxe/zuma/popcaploader_v5.cab
O16 - DPF: {E6EB803E-DD89-11D3-80C4-0050DA2E09D0} (LightSurfUploadCtl Class) - http://prints.picturecenter.kodak.com/acti…loadControl.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: awtsq - C:\WINDOWS\System32\awtsq.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: khffdba - khffdba.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

Scotty

Post #2September 8, 2007, 2:12 PM UTC

Hi! Welcome to the WTT forums.
I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.
Please be patient and I'd be grateful if you would note the following:

I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for this issue on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Please make a uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
5. Click on the Save list… button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here in a reply.

Download and Run ComboFix

Download this file from below:

Here
Disconnect from the Internet, than disable your anti-virus and any real-time anti-spyware monitors that are running.
Then double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you. Post that log in your next reply with a new HijackThis log.

Note 1: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Note 2:Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.

ginnyliny

Post #3September 8, 2007, 6:50 PM UTC

Ad-Aware SE Personal Adobe Acrobat 5.0 Adobe Download Manager 2.2 (Remove Only) Adobe Flash Player 9 ActiveX Adobe Shockwave Player Advanced Networking Pack for Windows XP AdwareFilter ToolBar AOL Coach Version 1.0(Build:20040229.1 en) AOL Coach Version 2.0(Build:20041026.5 en) AOL Communicator (remove only) AOL Computer Check-Up AOL Connectivity Services AOL Toolbar AOL Uninstaller Apple Software Update aspi AXIS Camera Server Control BCM V.92 56K Modem Broadcom Advanced Control Suite Cake Mania CCHelp CCScore Dell Solution Center Dell Support Digital Line Detect Easy CD Creator 5 Basic ESSAdpt ESSANUP ESSBrwr ESSCAM ESSCDBK ESScore ESSCT ESSgui ESShelp ESSini ESSPCD ESSPDock ESSTUTOR ESSvpaht ESSvpot Google Desktop Hijackthis 1.99.1 HijackThis 1.99.1 HLPCCTR HLPIndex HLPPDOCK Hotfix for MDAC 2.80 (KB911562) HP Image Zone 4.2 HP PhotoSmart C200 Photo Imaging Software HP PhotoSmart Photo Printing Software HP PSC & OfficeJet 4.2 HP Software Update ImageStation Easy Upload Tools iTunes J2SE Runtime Environment 5.0 Update 8 Kodak EasyShare software KSU LimeWire 4.12.6 LiveReg (Symantec Corporation) LiveUpdate 2.5 (Symantec Corporation) Mattel Vidster Microsoft .NET Framework (English) Microsoft .NET Framework (English) v1.0.3705 Microsoft .NET Framework 1.1 Microsoft Data Access Components KB870669 Microsoft Picture It! Photo Premium 2001 Microsoft Streets and Trips 2005 Mozilla Firefox (2.0.0.6) muvee autoProducer 3.5 magicMoments MWSnap 3 Norton AntiVirus 2002 Notifier Ofoto Easy Upload ActiveX Control OTtBP Outerinfo PCDLNCH QuickCam Drivers Quicken 2003 Basic QuickTime RealPlayer Rhapsody Player Engine Sandlot Games Client Services Security Update for Step By Step Interactive Training (KB898458) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 8 (KB917734) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905495) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917422) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921398) Security Update for Windows XP (KB921883) Security Update for Windows XP (KB922616) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924496) SFR SFR2 Shockwave Snapshot Viewer Spy Sweeper Ulead Photo Explorer 4.2 Update for Windows XP (KB835409) Update for Windows XP (KB898461) Update for Windows XP (KB908531) Update for Windows XP (KB910437) Update for Windows XP (KB911280) VCAMCEN Viewpoint Media Player VPRINTOL Windows Installer 3.1 (KB893803) Windows Media Player Hotfix [See wm828026 for more information] Windows XP Hotfix - KB810217 Windows XP Hotfix - KB820291 Windows XP Hotfix - KB821253 Windows XP Hotfix - KB821557 Windows XP Hotfix - KB822603 Windows XP Hotfix - KB823182 Windows XP Hotfix - KB823559 Windows XP Hotfix - KB823980 Windows XP Hotfix - KB824105 Windows XP Hotfix - KB824141 Windows XP Hotfix - KB824146 Windows XP Hotfix - KB825119 Windows XP Hotfix - KB828028 Windows XP Hotfix - KB828035 Windows XP Hotfix - KB828741 Windows XP Hotfix - KB833987 Windows XP Hotfix - KB835732 Windows XP Hotfix - KB837001 Windows XP Hotfix - KB839645 Windows XP Hotfix - KB840315 Windows XP Hotfix - KB840374 Windows XP Hotfix - KB840987 Windows XP Hotfix - KB841356 Windows XP Hotfix - KB841533 Windows XP Hotfix - KB841873 Windows XP Hotfix - KB842773 Windows XP Hotfix - KB867282 Windows XP Hotfix - KB871250 Windows XP Hotfix - KB873333 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB873376 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB889293 Windows XP Hotfix - KB890047 Windows XP Hotfix - KB890175 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB890923 Windows XP Hotfix - KB891711 Windows XP Hotfix - KB891781 Windows XP Hotfix - KB893066 Windows XP Hotfix - KB893086 Windows XP Hotfix - KB911567 Windows XP Hotfix - KB918439 Windows XP Hotfix - KB918899 Windows XP Hotfix - KB925486 Windows XP Hotfix (SP2) [See Q329048 for more information] Windows XP Hotfix (SP2) [See Q329115 for more information] Windows XP Hotfix (SP2) [See Q329390 for more information] Windows XP Hotfix (SP2) [See Q329834 for more information] Windows XP Hotfix (SP2) Q327979 Windows XP Hotfix (SP2) Q328310 Windows XP Hotfix (SP2) Q329170 Windows XP Hotfix (SP2) Q329441 Windows XP Hotfix (SP2) Q331953 Windows XP Hotfix (SP2) Q810565 Windows XP Hotfix (SP2) Q810577 Windows XP Hotfix (SP2) Q810833 Windows XP Hotfix (SP2) Q811493 Windows XP Hotfix (SP2) Q814033 Windows XP Hotfix (SP2) Q814995 Windows XP Hotfix (SP2) Q815021 Windows XP Hotfix (SP2) Q817606 Windows XP Hotfix (SP2) Q819696 WordPerfect Office 2002 WordPerfect Office 2002

ginnyliny

Post #4September 8, 2007, 7:22 PM UTC

ComboFix 07-09-09.4 - "Gail" 2007-09-08 14:51:33.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1033.18.61 [GMT -4:00]
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DOCUME~1\Gail\APPLIC~1\WinTouch
C:\DOCUME~1\Gail\APPLIC~1\WinTouch\wintouch.cfg
C:\DOCUME~1\Gail\APPLIC~1\WinTouch\WinTouch.exe
C:\DOCUME~1\Gail\MYDOCU~1\SEMBLY~1
C:\DOCUME~1\Gail\STARTM~1\Programs\Outerinfo
C:\DOCUME~1\Gail\STARTM~1\Programs\Outerinfo\Terms.lnk
C:\DOCUME~1\Gail\STARTM~1\Programs\Outerinfo\Uninstall.lnk
C:\Program Files\outerinfo
C:\Program Files\outerinfo\OiUninstaller.exe
C:\Program Files\outerinfo\outerinfo.ico
C:\Program Files\outerinfo\Terms.rtf
C:\Program Files\stem~1
C:\Program Files\svhost
C:\Program Files\svhost\wr-1-77.exe
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\Temp\fse
C:\Temp\fse\tmpZTF.log
C:\WINDOWS\b143.exe
C:\WINDOWS\b147.exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\accessories\cup.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\accessories\customer_cup.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\accessories\heart.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\accessories\menu_down.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\accessories\menu_up.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\accessories\plates.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\accessories\ticket.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\accessories\tray.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\audio\music\mainmenumusic.ogg
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\audio\sfx\sfx_bring_check_1_snd.ogg
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\audio\sfx\sfx_deliver_food_1_snd.ogg
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\audio\sfx\sfx_deliver_order_1_snd.ogg
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\audio\sfx\sfx_diner.ogg
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\audio\sfx\sfx_dish_dropoff_1_snd.ogg
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\audio\sfx\sfx_food_ready_1_snd.ogg
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\audio\sfx\sfx_gain_heart_1.ogg
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\audio\sfx\sfx_get_drinks_1_snd.ogg
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\audio\sfx\sfx_party_arrive_1_snd.ogg
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\audio\sfx\sfx_pencil_write_2.ogg
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\audio\sfx\sfx_pickup_food_1_snd.ogg
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\audio\sfx\sfx_rollover_1.ogg
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\audio\sfx\sfx_seat_people_snd.ogg
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\backgrounds\choosedifficulty.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\backgrounds\credits.jpg
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\backgrounds\flo_lose.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\backgrounds\flo_win.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\backgrounds\help1.jpg
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\backgrounds\help2.jpg
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\backgrounds\highscores.jpg
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\backgrounds\levelintro.jpg
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\backgrounds\levelintro_mask.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\backgrounds\levelover.jpg
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\backgrounds\levelover_mask.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\backgrounds\mainmenu.jpg
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\backgrounds\popup.jpg
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\backgrounds\popup_mask.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\backgrounds\upgradegrid.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\backgrounds\upgradetitle.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\backgrounds\upsell.jpg
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\arrowleft_blue.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\arrowleft_yellow.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\arrowright_blue.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\arrowright_yellow.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\back_blue.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\back_yellow.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\backchalk.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\backchalkup.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\backtomenu_blue.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\backtomenu_yellow.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\cancel.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\cancelup.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\career.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\career_over.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\close.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\closeup.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\continue.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\continueover.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\credits_blue.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\credits_yellow.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\download_blue.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\download_yellow.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\easy.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\easy_over.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\endlessshift.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\endlessshift_over.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\hard.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\hard_over.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\help.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\help_over.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\highscores.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\highscores_over.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\instructions_blue.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\instructions_yellow.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\letsplay.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\letsplayover.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\medium.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\medium_over.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\moreinfo.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\moreinfoup.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\off.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\off_on.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\on.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\on_on.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\pause.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\pauseover.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\quit.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\quitgame.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\quitgameover.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\quitover.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\resumegame.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\resumegameover.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\submit.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\submitup.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\tryagain.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\tryagainover.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\upgrade_over.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\upgrade_up.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\viewglobal.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\viewglobalup.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\viewhighscore.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\viewhighscoreon.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\viewlocal.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\buttons\viewlocalup.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\comics\webcomic.jpg
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\config\career.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\config\customer.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\config\endless.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\config\global.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\config\powerups.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\cook\cook.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\cook\cook.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\cook\stove.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\cursor\arrow.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\cursor\click.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\cursor\click2.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\cursor\grab.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\cursor\open.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\old_male\anim.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\old_male\blue\anim.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\old_male\blue\anim.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\old_male\blue\sit_legs.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\old_male\green\anim.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\old_male\green\anim.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\old_male\green\sit_legs.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\old_male\purple\anim.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\old_male\purple\anim.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\old_male\purple\sit_legs.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\old_male\red\anim.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\old_male\red\anim.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\old_male\red\sit_legs.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\old_male\yellow\anim.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\old_male\yellow\anim.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\old_male\yellow\sit_legs.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\young_female\anim.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\young_female\blue\anim.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\young_female\blue\anim.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\young_female\blue\sit_legs.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\young_female\green\anim.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\young_female\green\anim.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\young_female\green\sit_legs.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\young_female\purple\anim.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\young_female\purple\anim.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\young_female\purple\sit_legs.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\young_female\red\anim.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\young_female\red\anim.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\young_female\red\sit_legs.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\young_female\yellow\anim.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\young_female\yellow\anim.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\customers\young_female\yellow\sit_legs.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\flo\idle.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\flo\idle.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\flo\lower.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\flo\lower.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\flo\upper.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\flo\upper.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\fonts\arial.mvec
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\fonts\komikaaxis.mvec
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\furniture\chair.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\furniture\chair.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\furniture\dirt2top.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\furniture\dirt4top.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\furniture\dishcart.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\furniture\dishcart.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\furniture\drinkstation_off.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\furniture\drinkstation_on1.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\furniture\drinkstation_on2.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\furniture\ticketstation.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\furniture\ticketstation.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\hiscore\arrowdown.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\hiscore\arrowdownon.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\hiscore\arrowleft.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\hiscore\arrowlefton.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\hiscore\arrowright.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\hiscore\arrowrighton.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\hiscore\arrowup.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\hiscore\arrowupon.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\hiscore\p1icon.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\hiscore\textedit.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\hiscore\title.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\layouts\endless_1_1.txt
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\layouts\endless_1_1_a.txt
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\layouts\endless_1_1_b.txt
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\layouts\endless_1_1_c.txt
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\layouts\endless_1_2.txt
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\layouts\endless_1_2_a.txt
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\layouts\endless_1_2_b.txt
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\layouts\endless_1_2_c.txt
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\layouts\endless_1_2_d.txt
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\layouts\endless_1_3.txt
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\layouts\endless_1_3_a.txt
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\layouts\endless_1_3_b.txt
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\layouts\endless_1_3_c.txt
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\layouts\endless_1_3_d.txt
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\layouts\fifth_level_diner.txt
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\layouts\first_level_diner.txt
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\layouts\fourth_level_diner.txt
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\layouts\second_level_diner.txt
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\playfirst_logo.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\restaurants\diner\background.jpg
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\restaurants\diner\food\food1.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\restaurants\diner\food\food1.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\restaurants\diner\food\food2.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\restaurants\diner\food\food2.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\restaurants\diner\food\food3.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\restaurants\diner\food\food3.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\restaurants\diner\frames\upgrade_0001.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\restaurants\diner\tables\2top.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\restaurants\diner\tables\2top.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\restaurants\diner\tables\4top.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\restaurants\diner\tables\4top.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\restaurants\diner\upgrades.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\restaurants\tableshadow.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\scripts\choosedifficulty.lua
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\scripts\chooseplayer.lua
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\scripts\chooserestaurant.lua
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\scripts\credits.lua
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\scripts\game.lua
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\scripts\gothighscore.lua
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\scripts\help.lua
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\scripts\help2.lua
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\scripts\hiscore.lua
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\scripts\hiscoreinfo.lua
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\scripts\hiscoresubmit.lua
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\scripts\levelintro.lua
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\scripts\levelover.lua
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\scripts\loading.lua
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\scripts\mainloop.lua
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\scripts\mainmenu.lua
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\scripts\ok.lua
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\scripts\pause.lua
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\scripts\style.lua
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\scripts\tutorialintro.lua
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\scripts\upgrade.lua
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\scripts\upsell.lua
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\scripts\webcomic.lua
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\scripts\yesno.lua
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\splash\aol_logo.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\splash\gamelabsplash.jpg
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\splash\playfirst_logo.jpg
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\strings.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\angersmoke.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\angersmoke.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\chairflags.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\chairflags.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\check.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\checkmark.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\clock.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\closed.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\closingtime.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\coinflip.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\coinflip.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\dollar.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\doodles\coffee.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\doodles\tables.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\doodles\wallpaper.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\expert.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\expertscore.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\foodpoof.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\foodpoof.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\fork_timer.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\goalcompleted.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\heartgrow.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\heartgrow.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\jar.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\jar.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\level.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\level_career.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\score.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\sound.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\staroff.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\staron.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\tablenumber.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\tablenumberup.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\traynumber.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\tutorial_character.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\tutorialarrow.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\tutorialbox.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\upgradeanim.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\upgradeanim.xml
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\upgrades\drinks.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\upgrades\maitred.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\upgrades\oven.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\upgrades\select.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\upgrades\shoes.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\upgrades\stereo.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\assets\ui\upgrades\table.png
C:\WINDOWS\DOWNLO~1.\DinerDash.1.0.0.80\dinerdash.exe
C:\WINDOWS\mcroso~1
C:\WINDOWS\mcroso~1\M?crosoft\
C:\WINDOWS\mcroso~1\spoolsv.exe
C:\WINDOWS\retadpu77.exe
C:\WINDOWS\sstem3~1
C:\WINDOWS\sstem3~1\w?nspool.exe
C:\WINDOWS\svhost.exe
C:\WINDOWS\system32\aiqqguyu.dll
C:\WINDOWS\system32\arnvhpsh.dll
C:\WINDOWS\system32\ckshovly.dll
C:\WINDOWS\system32\cugutkwj.dll
C:\WINDOWS\system32\drivers\ASC3550.SYS
C:\WINDOWS\system32\drivers\fad.sys
C:\WINDOWS\system32\eijclugu.dll
C:\WINDOWS\system32\f10WtR
C:\WINDOWS\system32\ffoiteiq.dll
C:\WINDOWS\system32\gwawqhgn.dll
C:\WINDOWS\SYSTEM32\ifgqkxsp.ini2
C:\WINDOWS\SYSTEM32\ifgqkxsp.tmp
C:\WINDOWS\system32\jfcebtjc.dll
C:\WINDOWS\system32\jlqlxxld.dll
C:\WINDOWS\SYSTEM32\jwktuguc.ini
C:\WINDOWS\SYSTEM32\jwktuguc.ini2
C:\WINDOWS\SYSTEM32\jwktuguc.tmp
C:\WINDOWS\system32\kboxkgyn.dll
C:\WINDOWS\SYSTEM32\kukvnwvs.ini
C:\WINDOWS\SYSTEM32\mhawgelv.ini
C:\WINDOWS\system32\njddiodc.dll
C:\WINDOWS\system32\nvhipdmu.dll
C:\WINDOWS\system32\ogqtdjwa.dll
C:\WINDOWS\system32\psxkqgfi.dll
C:\WINDOWS\system32\quiilddp.dll
C:\WINDOWS\SYSTEM32\rcnawokv.ini
C:\WINDOWS\system32\rhttiebs.dll
C:\WINDOWS\system32\slygtxgw.dll
C:\WINDOWS\system32\sstem~1
C:\WINDOWS\system32\svwnvkuk.dll
C:\WINDOWS\system32\ujyjsoxj.dll
C:\WINDOWS\system32\upodsbib.dll
C:\WINDOWS\system32\vkowancr.dll
C:\WINDOWS\system32\vlegwahm.dll
C:\WINDOWS\system32\wtssvit32.exe
C:\WINDOWS\system32\yugfagpm.dll
C:\WINDOWS\system32\yxowxyfy.dll
C:\WINDOWS\system32\yyeolris.dll
C:\WINDOWS\wr.txt

((((((((((((((((((((((((( Files Created from 2007-08-09 to 2007-09-09 )))))))))))))))))))))))))))))))
.

2007-09-08 14:49 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-09-05 18:26 d——– C:\Program Files\Insider
2007-09-03 06:53 d–h-c— C:\WINDOWS\$SQLUninstallMDAC28-KB911562-x86-ENU$
2007-09-01 16:53 2,005,299 —hs—- C:\WINDOWS\SYSTEM32\qstwa.ini2
2007-09-01 16:35 23,864 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\sskbfd.sys
2007-09-01 16:35 21,816 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\sshrmd.sys
2007-09-01 16:35 20,280 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\SSFS0BB8.sys
2007-09-01 16:35 163,128 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\ssidrv.sys
2007-09-01 16:35 d——– C:\DOCUME~1\LOCALS~1\APPLIC~1\Webroot
2007-09-01 16:34 1,521,464 –a—— C:\WINDOWS\WRSetup.dll
2007-09-01 16:33 164 –a—— C:\install.dat
2007-08-30 04:22 d——– C:\Program Files\Words
2007-08-30 04:12 d——– C:\WINDOWS\izfo
2007-08-30 04:12 d——– C:\Program Files\Common Files\izfo
2007-08-25 22:46 d——– C:\DOCUME~1\Gail\APPLIC~1\Walgreens
2007-08-25 18:07 1,165 –a—— C:\WINDOWS\mozver.dat
2007-08-22 21:28 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Webroot
2007-08-22 21:27 d——– C:\DOCUME~1\Gail\APPLIC~1\GetRightToGo
2007-08-18 20:47 2,112,574 —hs—- C:\WINDOWS\SYSTEM32\qstwa.bak2
2007-08-18 10:02 d——– C:\DOCUME~1\LOCALS~1\APPLIC~1\Google
2007-08-18 08:54 d——– C:\DOCUME~1\Gail\APPLIC~1\Google
2007-08-18 08:54 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-08-18 08:46 2,172,297 —hs—- C:\WINDOWS\SYSTEM32\qstwa.bak1
2007-08-18 08:41 d–hs—- C:\WINDOWS\R2FpbA
2007-08-18 08:40 d——– C:\WINDOWS\SYSTEM32\tmp66
2007-08-18 08:40 d——– C:\WINDOWS\SYSTEM32\ICM55
2007-08-18 08:40 d——– C:\WINDOWS\SYSTEM32\dlls99
2007-08-18 08:40 d——– C:\WINDOWS\SYSTEM32\corfigs
2007-08-18 08:39 d——– C:\Temp
2007-08-15 19:25 d——– C:\Program Files\WinBudget

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-08 08:57 ——— d——– C:\Program Files\America Online 8.0a
2007-09-03 06:31 ——— d——– C:\Program Files\SymNetDrv
2007-09-03 06:31 ——— d——– C:\Program Files\Norton AntiVirus
2007-09-03 06:31 ——— d——– C:\Program Files\iTunes
2007-09-03 06:31 ——— d——– C:\Program Files\Dell Support
2007-09-03 06:31 ——— d——– C:\Program Files\Common Files\Zing
2007-09-01 16:29 ——— d——– C:\DOCUME~1\Gail\APPLIC~1\Webroot
2007-09-01 16:21 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-08-28 21:35 ——— d——– C:\Program Files\Pure Networks
2007-08-28 21:22 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-08-28 21:19 ——— d——– C:\Program Files\Dell Computer
2007-08-28 21:13 ——— d——– C:\Program Files\QuickTime
2007-08-28 21:12 ——— d——– C:\Program Files\Mattel Vidster
2007-08-28 21:12 ——— d——– C:\Program Files\Google
2007-08-28 21:12 ——— d——– C:\Program Files\Disney Interactive
2007-08-28 21:12 ——— d——– C:\Program Files\Common Files\aolshare
2007-08-28 21:12 ——— d——– C:\Program Files\Britannica
2007-08-28 21:12 ——— d——– C:\Program Files\AOL Companion
2007-08-28 21:12 ——— d——– C:\Program Files\America Online 9.0b
2007-08-28 21:12 ——— d——– C:\Program Files\America Online 9.0a
2007-08-28 21:12 ——— d——– C:\Program Files\America Online 9.0
2007-08-12 09:19 ——— d——– C:\Program Files\Oberon Media
2007-08-05 09:28 ——— d-a—— C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-07-24 13:14 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sandlot Games
2007-07-24 13:12 ——— d——– C:\DOCUME~1\Gail\APPLIC~1\Sandlot Games
2007-07-18 10:11 ——— d——– C:\Program Files\Atari
2007-07-17 21:22 ——— d——– C:\DOCUME~1\Gail\APPLIC~1\Pogo Games
2003-06-11 07:03 208481 –a—— C:\Program Files\INSTALL.LOG
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CA3C3756-52F4-45D3-9667-9F65BDA986CC}]
C:\WINDOWS\System32\awtsq.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 04:59 C:\WINDOWS\BCMSMMSG.exe]
"QuickTime Task"="C:\Program Files\QuickTime\bak\qttask.exe" [2006-10-25 19:58]
"LWBMOUSE"="C:\Program Files\Gigaware\Gigaware Driver\4.06\MOUSE32A.EXE" []
"svhost"="C:\WINDOWS\svhost.exe" []
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2007-07-19 22:54]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\MSMSGS.exe" [2004-11-15 16:18]
"Itcnl"="C:\Documents and Settings\Gail\My Documents\??sembly\d?xplore.exe" []
"Krqbvrqi"="C:\WINDOWS\s?stem32\w?nspool.exe" [2002-08-29 07:00]
"Insider"="C:\Program Files\Insider\Insider.exe" [2007-09-05 18:26]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"FlashPlayerUpdate"=C:\WINDOWS\System32\Macromed\Flash\GetFlash.exe

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\
America Online 9.0 Tray Icon.lnk - C:\Program Files\America Online 9.0b\aoltray.exe [2004-08-16 07:09:20]
Billminder.lnk - C:\Program Files\QUICKENW\billmind.exe [2002-07-30 13:34:16]
DESKTOP.INI [2002-09-03 11:00:00]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2002-12-04 12:58:52]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 23:31:38]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-29 00:06:36]
Kodak EasyShare software.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2004-04-27 02:04:44]
Kodak software updater.lnk - C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe [2004-02-11 16:58:16]
Quicken Scheduled Updates.lnk - C:\Program Files\QUICKENW\bagent.exe [2002-07-30 13:34:30]
Quicken Startup.lnk - C:\Program Files\QUICKENW\QWDLLS.EXE [2002-07-30 13:34:34]

C:\DOCUME~1\Gail\STARTM~1\Programs\Startup\
DESKTOP.INI [2002-09-03 11:00:00]

C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM~1\STARTM~1\Programs\Startup\
DESKTOP.INI [2002-09-03 11:00:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtsq]
C:\WINDOWS\System32\awtsq.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\khffdba]
khffdba.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

R0 SSFS0BB8;Spy Sweeper File System Filer Driver: 0BB8;C:\WINDOWS\System32\Drivers\SSFS0BB8.SYS
R1 cdudf_xp;cdudf_xp;C:\WINDOWS\System32\drivers\cdudf_xp.sys
R1 DcCam;Kodak Camera Proxy;C:\WINDOWS\System32\DRIVERS\DcCam.sys
R1 pwd_2k;pwd_2k;C:\WINDOWS\System32\drivers\pwd_2k.sys
R1 UdfReadr_xp;UdfReadr_xp;C:\WINDOWS\System32\drivers\UdfReadr_xp.sys
R2 DCFS2K;Kodak DCFS2K Driver;C:\WINDOWS\System32\drivers\dcfs2k.sys
R3 BCMModem;BCM V.92 56K Modem;C:\WINDOWS\System32\DRIVERS\BCMSM.sys
R3 mmc_2K;mmc_2K;C:\WINDOWS\System32\drivers\mmc_2K.sys
S1 Exportit;Exportit;C:\WINDOWS\System32\DRIVERS\exportit.sys
S3 DcFpoint;DcFpoint;C:\WINDOWS\System32\DRIVERS\DcFpoint.sys
S3 DcLps;Legacy Polling Service;C:\WINDOWS\System32\DRIVERS\DcLps.sys
S3 DcPTP;dcptp;C:\WINDOWS\System32\DRIVERS\DcPTP.sys
S3 dvd_2K;dvd_2K;C:\WINDOWS\System32\drivers\dvd_2K.sys
S3 Ip6FwHlp;IPv6 Internet Connection Firewall;C:\WINDOWS\System32\svchost.exe -k netsvcs

*Newly Created Service* - ALG
*Newly Created Service* - IPNAT
*Newly Created Service* - SHAREDACCESS
.
Contents of the 'Scheduled Tasks' folder
"2007-09-06 10:39:06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-09-08 14:01:33 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer.job"
"2007-09-08 15:56:26 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-09 15:04:09
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-09 15:15:14 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-09-09 15:15
.
— E O F —

ginnyliny

Post #5September 8, 2007, 7:24 PM UTC

Logfile of HijackThis v1.99.1
Scan saved at 3:21:10 PM, on 9/9/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\QuickTime\bak\qttask.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\Insider\Insider.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://disboards.com/forumdisplay.php?f=33
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {CA3C3756-52F4-45D3-9667-9F65BDA986CC} - C:\WINDOWS\System32\awtsq.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\bak\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Gigaware\Gigaware Driver\4.06\MOUSE32A.EXE
O4 - HKLM\..\Run: [svhost] "C:\WINDOWS\svhost.exe"
O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [Itcnl] "C:\Documents and Settings\Gail\My Documents\??sembly\d?xplore.exe"
O4 - HKCU\..\Run: [Krqbvrqi] C:\WINDOWS\s?stem32\w?nspool.exe
O4 - HKCU\..\Run: [Insider] "C:\Program Files\Insider\Insider.exe"
O4 - Startup: Tycoon City_ New York Registration.lnk = C:\Documents and Settings\Gail\Local Settings\Temp\{173D001A-B43B-4F40-AFD5-37BD22E13EC1}\{A5101403-2C42-40E0-8D9E-5E49E7C3B89E}\ATR1.EXE
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0b\aoltray.exe
O4 - Global Startup: Billminder.lnk = C:\Program Files\QUICKENW\billmind.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\QUICKENW\bagent.exe
O4 - Global Startup: Quicken Startup.lnk = C:\Program Files\QUICKENW\QWDLLS.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: RemindU - {16BF42FD-CA0A-4f48-819D-B0343254DD67} - file://C:\Program Files\UpromiseRemindU\System\Temp\upromise_script0.htm (file missing) (HKCU)
O9 - Extra button: (no name) - {2863ACA1-9AA0-4432-8CFE-88C12B3B2E5E} - file://C:\Program Files\Upromise_RemindU\Sy1050\Tp1050\scri1050a.htm (file missing) (HKCU)
O16 - DPF: 6th Street Omaha Poker by pogo - http://game1.pogo.com/applet-6.4.3.36/omah…a-ob-assets.cab
O16 - DPF: Aces Up! by pogo - http://game1.pogo.com/applet-8.0.5.48/aces/aces-en_US.cab
O16 - DPF: Ali Baba Slots TM by pogo - http://game1.pogo.com/applet-6.3.0.53/slot…a-ob-assets.cab
O16 - DPF: Backgammon by pogo - http://game1.pogo.com/applet-6.3.3.38/back…n-ob-assets.cab
O16 - DPF: Blackjack by pogo - http://game1.pogo.com/applet-8.0.3.20/blac…kjack-en_US.cab
O16 - DPF: Blackjack Carnival by pogo - http://game1.pogo.com/applet-6.8.1.38/vbja…jack2-en_US.cab
O16 - DPF: Blooop by pogo - http://game1.pogo.com/applet-6.9.4.41/casc…scade-en_US.cab
O16 - DPF: Bowling by pogo - http://game1.pogo.com/applet-8.0.7.27/bowl…wling-en_US.cab
O16 - DPF: Buckaroo Blackjack TM by pogo - http://game1.pogo.com/applet-6.7.3.23/vide…kjack-en_US.cab
O16 - DPF: Canasta by pogo - http://game1.pogo.com/applet-8.0.5.48/cana…nasta-en_US.cab
O16 - DPF: Checkers by pogo - http://game1.pogo.com/applet-6.4.0.34/chec…s-ob-assets.cab
O16 - DPF: Chess by pogo - http://game1.pogo.com/applet-6.5.0.45/ches…2-ob-assets.cab
O16 - DPF: Dice City Roller by pogo - http://game1.pogo.com/applet-8.0.4.32/ytz/ytz-en_US.cab
O16 - DPF: Dice Derby by pogo - http://game1.pogo.com/applet-8.0.1.23/chec…dflag-en_US.cab
O16 - DPF: Dice Derby by pogo.com - http://checkeredflag.pogo.com/applet/check…g-ob-assets.cab
O16 - DPF: Dominoes by pogo - http://game1.pogo.com/applet-6.5.5.29/domi…omino-en_US.cab
O16 - DPF: Double Deuce Poker by pogo - http://game1.pogo.com/applet-6.7.0.32/vide…deuce-en_US.cab
O16 - DPF: Euchre by pogo - http://game1.pogo.com/applet-6.5.2.26/euch…uchre-en_US.cab
O16 - DPF: First Class Solitaire by pogo - http://game1.pogo.com/applet-8.0.4.32/firs…lass2-en_US.cab
O16 - DPF: Fortune Bingo by pogo - http://game1.pogo.com/applet-8.0.5.30/supe…bingo-en_US.cab
O16 - DPF: Greenback Bayou by pogo - http://game1.pogo.com/applet-8.0.3.20/gree…nback-en_US.cab
O16 - DPF: Greenback Bayou by pogo.com - http://greenback.pogo.com/applet/greenback…k-ob-assets.cab
O16 - DPF: Hangman Hijinks by pogo - http://game1.pogo.com/applet-8.0.1.32/hang…ngman-en_US.cab
O16 - DPF: Harvest Mania by pogo - http://game1.pogo.com/applet-6.8.2.23/harv…rvest-en_US.cab
O16 - DPF: Hearts by pogo - http://game1.pogo.com/applet-8.0.5.48/hear…earts-en_US.cab
O16 - DPF: High Stakes Poker by pogo - http://game1.pogo.com/applet-6.8.4.51/draw…poker-en_US.cab
O16 - DPF: High Stakes Pool by pogo - http://game1.pogo.com/applet-6.6.2.21/pool2/pool-en_US.cab
O16 - DPF: Hog Heaven Slots by pogo - http://game1.pogo.com/applet-8.0.5.30/fancy/fancy-en_US.cab
O16 - DPF: Jigsaw Detective by pogo - http://game1.pogo.com/applet-6.3.2.25/jigs…w-ob-assets.cab
O16 - DPF: Jungle Gin by pogo - http://game1.pogo.com/applet-6.8.3.35/gin2/gin2-en_US.cab
O16 - DPF: Keno by pogo - http://game1.pogo.com/applet-6.7.3.30/keno/keno-en_US.cab
O16 - DPF: Lost Temple Poker by pogo - http://game1.pogo.com/applet-8.0.6.59/mhpo…poker-en_US.cab
O16 - DPF: Lottso by pogo - http://game1.pogo.com/applet-8.0.5.30/lott…ottso-en_US.cab
O16 - DPF: Mah Jong Garden by pogo - http://game1.pogo.com/applet-8.0.6.49/mahj…jong2-en_US.cab
O16 - DPF: Makeover Madness by pogo - http://game1.pogo.com/applet-8.0.4.41/shoes/shoes-en_US.cab
O16 - DPF: Multiline Slots by pogo - http://game1.pogo.com/applet-6.6.4.29/mlsl…slots-en_US.cab
O16 - DPF: Pai Gow by pogo - http://game1.pogo.com/applet-6.9.0.43/paig…aigow-en_US.cab
O16 - DPF: Payday FreeCell by pogo - http://game1.pogo.com/applet-6.9.0.43/free…ecell-en_US.cab
O16 - DPF: Payday Freecell Solitaire by pogo - http://game1.pogo.com/applet-6.9.4.34/free…cell2-en_US.cab
O16 - DPF: Penguin Blocks by pogo - http://game1.pogo.com/applet-8.0.5.30/peng…guins-en_US.cab
O16 - DPF: Perfect Pair Solitaire by pogo - http://game1.pogo.com/applet-8.0.5.48/wate…wheel-en_US.cab
O16 - DPF: Phlinx by pogo - http://game1.pogo.com/applet-8.0.4.32/flin…inger-en_US.cab
O16 - DPF: Pinochle by pogo - http://game1.pogo.com/applet-6.6.3.34/pino…ochle-en_US.cab
O16 - DPF: Pop Fu by pogo - http://game1.pogo.com/applet-6.9.3.49/popfu/popfu-en_US.cab
O16 - DPF: Pop Fu by pogo.com - http://popfu.pogo.com/applet/popfu/popfu-ob-assets.cab
O16 - DPF: PoppaZoppa by pogo - http://game1.pogo.com/applet-6.9.1.32/popp…zoppa-en_US.cab
O16 - DPF: Poppit by pogo - http://game1.pogo.com/applet-8.0.2.32/popp…ppit2-en_US.cab
O16 - DPF: Quick Quack by pogo - http://game1.pogo.com/applet-6.7.4.35/hots…treak-en_US.cab
O16 - DPF: QWERTY by pogo - http://game1.pogo.com/applet-6.6.2.21/squa…uares-en_US.cab
O16 - DPF: Ride The Tide by pogo - http://game1.pogo.com/applet-6.6.2.21/ride/ride-en_US.cab
O16 - DPF: Showbiz Slots 2 by pogo - http://game1.pogo.com/applet-6.8.0.32/slot…wbiz2-en_US.cab
O16 - DPF: Showbiz Slots by pogo - http://game1.pogo.com/applet-6.4.2.30/slot…z-ob-assets.cab
O16 - DPF: Shuffle Bump by pogo - http://game1.pogo.com/applet-6.7.0.32/puck/puck-en_US.cab
O16 - DPF: Spades 2 by pogo - http://game1.pogo.com/applet-8.0.2.32/spad…ades2-en_US.cab
O16 - DPF: Spider Solitaire by pogo - http://game1.pogo.com/applet-8.0.0.20/spid…pider-en_US.cab
O16 - DPF: Squelchies by pogo - http://game1.pogo.com/applet-8.0.6.49/sque…chies-en_US.cab
O16 - DPF: Stax by pogo - http://game1.pogo.com/applet-8.0.7.27/stax/stax-en_US.cab
O16 - DPF: Stellar Sweeper by pogo - http://game1.pogo.com/applet-6.9.3.39/swee…eeper-en_US.cab
O16 - DPF: Sweet Tooth TM by pogo - http://game1.pogo.com/applet-8.0.7.27/swee…tooth-en_US.cab
O16 - DPF: Texas Hold'em Poker by pogo - http://game1.pogo.com/applet-8.0.4.32/hold…oldem-en_US.cab
O16 - DPF: Top Down Baseball Challenge by pogo - http://game1.pogo.com/applet-6.4.4.27/topd…2-ob-assets.cab
O16 - DPF: Tri-Peaks by pogo - http://game1.pogo.com/applet-8.0.5.48/peaks/peaks-en_US.cab
O16 - DPF: Tumble Bees by pogo - http://game1.pogo.com/applet-8.0.4.32/tumb…mbee2-en_US.cab
O16 - DPF: Turbo 21 TM by pogo - http://game1.pogo.com/applet-6.3.2.25/turb…1-ob-assets.cab
O16 - DPF: Turbo 21 v2 by pogo - http://game1.pogo.com/applet-8.0.0.20/turb…rbo22-en_US.cab
O16 - DPF: Wonderland Memories by pogo - http://game1.pogo.com/applet-8.0.5.30/memo…ories-en_US.cab
O16 - DPF: Word Craft by pogo - http://game1.pogo.com/applet-6.9.4.34/babb…abble-en_US.cab
O16 - DPF: Word Search Daily by pogo - http://game1.pogo.com/applet-8.0.7.27/word…earch-en_US.cab
O16 - DPF: Word Whomp by pogo - http://game1.pogo.com/applet-8.0.5.30/word…homp2-en_US.cab
O16 - DPF: Word Whomp Whackdown by pogo - http://game1.pogo.com/applet-8.0.6.59/whac…kdown-en_US.cab
O16 - DPF: WordJong by pogo - http://game1.pogo.com/applet-8.0.5.30/word…djong-en_US.cab
O16 - DPF: World Class Solitaire by pogo - http://game1.pogo.com/applet-8.0.6.49/worl…class-en_US.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} (AOL Content Update) - http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab
O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} - http://install.wildtangent.com/ActiveLaunc…iveLauncher.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.costcophotocenter.com/CostcoActivia.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/11edaa929534aae9b605/…ip/RdxIE601.cab
O16 - DPF: {5E943D9C-F8DC-4258-8E3F-A61BB3405A33} (ZingBatchAXDwnl Class) - http://www.imagestation.com/common/classes…ion=4,3,2,20802
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://floridakeysmedia.tv/axiscam/Codebas…sCamControl.ocx
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/1452/ftp…02/cpbrkpie.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/…loadcontrol.cab
O16 - DPF: {C6B086D2-146B-47A4-A218-B82DCAF2D872} (cpbrxpie Control) - http://a19.g.akamai.net/7/19/7125/1433/ftp…20/cpbrxpie.cab
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://clubgames.pogo.com/online2/pogop/di…sh.1.0.0.80.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://aol131.pogo.com/game/deluxe/zuma/popcaploader_v5.cab
O16 - DPF: {E6EB803E-DD89-11D3-80C4-0050DA2E09D0} (LightSurfUploadCtl Class) - http://prints.picturecenter.kodak.com/acti…loadControl.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: awtsq - C:\WINDOWS\System32\awtsq.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: khffdba - khffdba.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

Scotty

Post #6September 9, 2007, 10:16 AM UTC last edited September 9, 2007, 2:28 PM UTC

Hi

Remove programs from Add/Remove Programs List
Please go to:

Start
Control Panel
Add/Remove Programs

Find and remove these programs (if they are present)

Insider
WinBudget

Open Notepad and Copy/Paste the text in the codebox below into it:

File::
C:\WINDOWS\SYSTEM32\qstwa.ini2
C:\WINDOWS\SYSTEM32\qstwa.bak2
C:\WINDOWS\SYSTEM32\qstwa.bak1
 C:\WINDOWS\System32\awtsq.dll
C:\WINDOWS\svhost.exe

Folder::
C:\Program Files\Insider
C:\Program Files\WinBudget

 
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CA3C3756-52F4-45D3-9667-9F65BDA986CC}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"svhost"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Itcnl"=-
"Krqbvrqi"=-
"Insider"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtsq] 
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\khffdba]

Save this as "CFScript"

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log with a new HijackThis log.

Please do an online scan with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then start to download the latest definition files.
Once the scanner is installed and the definitions downloaded, click Next.
Now click on Scan Settings
In the scan settings make sure that the following are selected:
- Scan using the following Anti-Virus database:
  
  + Extended(If available otherwise Standard)
- Scan Options:
  
  + Scan Archives
  + Scan Mail Bases
Click OK
Now under select a target to scan select My Computer
The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button
Save the file to your desktop.
Copy and paste that information in your next post.

ginnyliny

Post #7September 9, 2007, 3:07 PM UTC

ComboFix 07-09-09.4 - "Gail" 2007-09-10 10:26:09.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1033.18.41 [GMT -4:00]
* Created a new restore point

FILE::
C:\WINDOWS\SYSTEM32\qstwa.ini2
C:\WINDOWS\SYSTEM32\qstwa.bak2
C:\WINDOWS\SYSTEM32\qstwa.bak1
C:\WINDOWS\System32\awtsq.dll
C:\WINDOWS\svhost.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Insider
C:\Program Files\WinBudget
C:\Program Files\WinBudget\bin\carp**.1187220347.old
C:\Program Files\WinBudget\bin\matrix.dll
C:\WINDOWS\system32\drivers\asc3550.sys
C:\WINDOWS\SYSTEM32\qstwa.bak1
C:\WINDOWS\SYSTEM32\qstwa.bak2
C:\WINDOWS\SYSTEM32\qstwa.ini2

((((((((((((((((((((((((( Files Created from 2007-08-10 to 2007-09-10 )))))))))))))))))))))))))))))))
.

2007-09-08 14:49 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-09-03 06:53 d–h-c— C:\WINDOWS\$SQLUninstallMDAC28-KB911562-x86-ENU$
2007-09-01 16:35 23,864 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\sskbfd.sys
2007-09-01 16:35 21,816 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\sshrmd.sys
2007-09-01 16:35 20,280 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\SSFS0BB8.sys
2007-09-01 16:35 163,128 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\ssidrv.sys
2007-09-01 16:35 d——– C:\DOCUME~1\LOCALS~1\APPLIC~1\Webroot
2007-09-01 16:34 1,521,464 –a—— C:\WINDOWS\WRSetup.dll
2007-09-01 16:33 164 –a—— C:\install.dat
2007-08-30 04:22 d——– C:\Program Files\Words
2007-08-30 04:12 d——– C:\WINDOWS\izfo
2007-08-30 04:12 d——– C:\Program Files\Common Files\izfo
2007-08-25 22:46 d——– C:\DOCUME~1\Gail\APPLIC~1\Walgreens
2007-08-25 18:07 1,165 –a—— C:\WINDOWS\mozver.dat
2007-08-22 21:28 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Webroot
2007-08-22 21:27 d——– C:\DOCUME~1\Gail\APPLIC~1\GetRightToGo
2007-08-18 10:02 d——– C:\DOCUME~1\LOCALS~1\APPLIC~1\Google
2007-08-18 08:54 d——– C:\DOCUME~1\Gail\APPLIC~1\Google
2007-08-18 08:54 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-08-18 08:41 d–hs—- C:\WINDOWS\R2FpbA
2007-08-18 08:40 d——– C:\WINDOWS\SYSTEM32\tmp66
2007-08-18 08:40 d——– C:\WINDOWS\SYSTEM32\ICM55
2007-08-18 08:40 d——– C:\WINDOWS\SYSTEM32\dlls99
2007-08-18 08:40 d——– C:\WINDOWS\SYSTEM32\corfigs
2007-08-18 08:39 d——– C:\Temp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-10 07:54 ——— d——– C:\Program Files\America Online 8.0a
2007-09-03 06:31 ——— d——– C:\Program Files\SymNetDrv
2007-09-03 06:31 ——— d——– C:\Program Files\Norton AntiVirus
2007-09-03 06:31 ——— d——– C:\Program Files\iTunes
2007-09-03 06:31 ——— d——– C:\Program Files\Dell Support
2007-09-03 06:31 ——— d——– C:\Program Files\Common Files\Zing
2007-09-01 16:29 ——— d——– C:\DOCUME~1\Gail\APPLIC~1\Webroot
2007-09-01 16:21 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-08-28 21:35 ——— d——– C:\Program Files\Pure Networks
2007-08-28 21:22 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-08-28 21:19 ——— d——– C:\Program Files\Dell Computer
2007-08-28 21:13 ——— d——– C:\Program Files\QuickTime
2007-08-28 21:12 ——— d——– C:\Program Files\Mattel Vidster
2007-08-28 21:12 ——— d——– C:\Program Files\Google
2007-08-28 21:12 ——— d——– C:\Program Files\Disney Interactive
2007-08-28 21:12 ——— d——– C:\Program Files\Common Files\aolshare
2007-08-28 21:12 ——— d——– C:\Program Files\Britannica
2007-08-28 21:12 ——— d——– C:\Program Files\AOL Companion
2007-08-28 21:12 ——— d——– C:\Program Files\America Online 9.0b
2007-08-28 21:12 ——— d——– C:\Program Files\America Online 9.0a
2007-08-28 21:12 ——— d——– C:\Program Files\America Online 9.0
2007-08-12 09:19 ——— d——– C:\Program Files\Oberon Media
2007-08-05 09:28 ——— d-a—— C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-07-30 19:19 92504 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\cdm.dll
2007-07-30 19:19 92504 –a—— C:\WINDOWS\SYSTEM32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\SYSTEM32\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\SYSTEM32\wuauclt.exe
2007-07-30 19:19 53080 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\SYSTEM32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\SYSTEM32\wucltui.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\SYSTEM32\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\SYSTEM32\wuaueng.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\SYSTEM32\wups.dll
2007-07-24 13:14 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sandlot Games
2007-07-24 13:12 ——— d——– C:\DOCUME~1\Gail\APPLIC~1\Sandlot Games
2007-07-18 10:11 ——— d——– C:\Program Files\Atari
2007-07-17 21:22 ——— d——– C:\DOCUME~1\Gail\APPLIC~1\Pogo Games
2003-06-11 07:03 208481 –a—— C:\Program Files\INSTALL.LOG
.

((((((((((((((((((((((((((((( snapshot_2007-09-09_151003.35 )))))))))))))))))))))))))))))))))))))))))
.
—-a-w 16,384 2007-09-10 14:35:59 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\INDEX.DAT
—-a-w 32,768 2007-09-10 14:35:59 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\INDEX.DAT
—-a-w 49,152 2007-09-10 14:35:59 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT
.
—-a-w 16,384 2007-09-09 19:03:31 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\INDEX.DAT
—-a-w 32,768 2007-09-09 19:03:31 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\INDEX.DAT
—-a-w 49,152 2007-09-09 19:03:31 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 04:59 C:\WINDOWS\BCMSMMSG.exe]
"QuickTime Task"="C:\Program Files\QuickTime\bak\qttask.exe" [2006-10-25 19:58]
"LWBMOUSE"="C:\Program Files\Gigaware\Gigaware Driver\4.06\MOUSE32A.EXE" []
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2007-07-19 22:54]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\MSMSGS.exe" [2004-11-15 16:18]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"FlashPlayerUpdate"=C:\WINDOWS\System32\Macromed\Flash\GetFlash.exe

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\
America Online 9.0 Tray Icon.lnk - C:\Program Files\America Online 9.0b\aoltray.exe [2004-08-16 07:09:20]
Billminder.lnk - C:\Program Files\QUICKENW\billmind.exe [2002-07-30 13:34:16]
DESKTOP.INI [2002-09-03 11:00:00]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2002-12-04 12:58:52]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 23:31:38]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-29 00:06:36]
Kodak EasyShare software.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2004-04-27 02:04:44]
Kodak software updater.lnk - C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe [2004-02-11 16:58:16]
Quicken Scheduled Updates.lnk - C:\Program Files\QUICKENW\bagent.exe [2002-07-30 13:34:30]
Quicken Startup.lnk - C:\Program Files\QUICKENW\QWDLLS.EXE [2002-07-30 13:34:34]

C:\DOCUME~1\Gail\STARTM~1\Programs\Startup\
DESKTOP.INI [2002-09-03 11:00:00]

C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM~1\STARTM~1\Programs\Startup\
DESKTOP.INI [2002-09-03 11:00:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

R0 SSFS0BB8;Spy Sweeper File System Filer Driver: 0BB8;C:\WINDOWS\System32\Drivers\SSFS0BB8.SYS
R1 cdudf_xp;cdudf_xp;C:\WINDOWS\System32\drivers\cdudf_xp.sys
R1 DcCam;Kodak Camera Proxy;C:\WINDOWS\System32\DRIVERS\DcCam.sys
R1 pwd_2k;pwd_2k;C:\WINDOWS\System32\drivers\pwd_2k.sys
R1 UdfReadr_xp;UdfReadr_xp;C:\WINDOWS\System32\drivers\UdfReadr_xp.sys
R2 DCFS2K;Kodak DCFS2K Driver;C:\WINDOWS\System32\drivers\dcfs2k.sys
R3 BCMModem;BCM V.92 56K Modem;C:\WINDOWS\System32\DRIVERS\BCMSM.sys
R3 mmc_2K;mmc_2K;C:\WINDOWS\System32\drivers\mmc_2K.sys
S1 Exportit;Exportit;C:\WINDOWS\System32\DRIVERS\exportit.sys
S3 DcFpoint;DcFpoint;C:\WINDOWS\System32\DRIVERS\DcFpoint.sys
S3 DcLps;Legacy Polling Service;C:\WINDOWS\System32\DRIVERS\DcLps.sys
S3 DcPTP;dcptp;C:\WINDOWS\System32\DRIVERS\DcPTP.sys
S3 dvd_2K;dvd_2K;C:\WINDOWS\System32\drivers\dvd_2K.sys
S3 Ip6FwHlp;IPv6 Internet Connection Firewall;C:\WINDOWS\System32\svchost.exe -k netsvcs

.
Contents of the 'Scheduled Tasks' folder
"2007-09-06 10:39:06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-09-10 14:01:39 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer.job"
"2007-09-10 11:57:19 C:\WINDOWS\Tasks\Symantec NetDetect.job"
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-10 10:54:49
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-10 11:01:35 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-09-10 11:01
.
— E O F —

Scotty

Post #8September 9, 2007, 3:50 PM UTC

And the Kaspersky Online Scan report?

ginnyliny

Post #9September 9, 2007, 7:46 PM UTC

KASPERSKY ONLINE SCANNER REPORT Monday, September 10, 2007 3:41:55 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 1 (Build 2600) Kaspersky Online Scanner version: 5.0.93.1 Kaspersky Anti-Virus database last update: 9/09/2007 Kaspersky Anti-Virus database records: 410588 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ Scan Statistics: Total number of scanned objects: 76653 Number of viruses found: 14 Number of infected objects: 59 Number of suspicious objects: 2 Duration of the scan process: 01:36:50 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinAgentqt.zip/retadpu77.exe Suspicious: Password-protected-EXE skipped C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinAgentqt.zip ZIP: suspicious - 1 skipped C:\Documents and Settings\Gail\Cookies\INDEX.DAT Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Application Data\ApplicationHistory\hpqgalry.exe.cf8dd223.ini.inuse Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Application Data\HP\Digital Imaging\db\administrativeInfo.dbf Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.cdx Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.dbf Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.cdx Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.dbf Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Application Data\HP\Digital Imaging\db\CB_Server_Errors.txt Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.cdx Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.dbf Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.cdx Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.dbf Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.fpt Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.cdx Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.dbf Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.cdx Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.dbf Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Application Data\HP\Digital Imaging\db\managedFolderTable.dbf Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.cdx Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.dbf Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.cdx Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.dbf Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.cdx Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.dbf Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Gail\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Temp\hpodvd09.log Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Temp\me_BQTuHkBdJlrmwUY Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Temp\me_etbeowC9o25g4R2 Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Temp\me_PviuVlRaUCRqjW7 Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Temp\me_YDHmUW4Y9JgBruR Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Temp\~DF2FB.tmp Object is locked skipped C:\Documents and Settings\Gail\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Gail\ntuser.dat Object is locked skipped C:\Documents and Settings\Gail\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Data\settings.dat Object is locked skipped C:\Documents and Settings\LocalService\Cookies\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\Kodak\Kodak EasyShare software\Catalog\EasyShare.me Object is locked skipped C:\Program Files\Kodak\Kodak EasyShare software\Catalog\EasyShare.mm Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\BWKDLogs\BWTargetInf.log Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\chandir.dat Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\chandir.idx Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\chn.dat Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\chn.idx Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\D0000000.FCS Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\inuse.txt Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\L0000014.FCS Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\main.log Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs.dat Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs.idx Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_die.dat Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_die.idx Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_dnd.dat Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_dnd.idx Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_ext.dat Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_ext.idx Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_rcv.dat Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_rcv.idx Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\storydb.dat Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\storydb.idx Object is locked skipped C:\Program Files\Norton AntiVirus\Quarantine\30400864.tmp Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\777A11EB.tmp Infected: Trojan.Java.ClassLoader.Dummy.a skipped C:\Program Files\Norton AntiVirus\Quarantine\777E3BE7.tmp Infected: Trojan.Java.ClassLoader.c skipped C:\Program Files\Norton AntiVirus\Quarantine\778165E4.tmp Infected: Trojan-Downloader.Java.OpenConnection.v skipped C:\Program Files\QuickTime\qttask.exe Infected: Trojan-Downloader.Win32.Agent.awf skipped C:\Program Files\Webroot\Spy Sweeper\Masters\masters.bak Object is locked skipped C:\Program Files\Webroot\Spy Sweeper\Masters\Masters.const Object is locked skipped C:\Program Files\Webroot\Spy Sweeper\Masters\masters.mst Object is locked skipped C:\Program Files\Webroot\Spy Sweeper\Masters.base Object is locked skipped C:\qoobox\Quarantine\C\Program Files\Outerinfo\OiUninstaller.exe.vir/data0002 Infected: not-a-virus:AdWare.Win32.PurityScan.fk skipped C:\qoobox\Quarantine\C\Program Files\Outerinfo\OiUninstaller.exe.vir/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.bu skipped C:\qoobox\Quarantine\C\Program Files\Outerinfo\OiUninstaller.exe.vir NSIS: infected - 2 skipped C:\qoobox\Quarantine\C\WINDOWS\svhost.exe.vir Infected: Trojan-Proxy.Win32.VB.x skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\aiqqguyu.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\cugutkwj.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.mh skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\eijclugu.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\gwawqhgn.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\jfcebtjc.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\jlqlxxld.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\njddiodc.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\nvhipdmu.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\ogqtdjwa.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\psxkqgfi.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.mh skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\svwnvkuk.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.mh skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\ujyjsoxj.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\vkowancr.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.mh skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\vlegwahm.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.mh skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1700\A0204003.exe Infected: Trojan-Downloader.Win32.Agent.awf skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1700\A0204004.exe Infected: Trojan-Downloader.Win32.Agent.awf skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1700\A0204005.exe Infected: Trojan-Downloader.Win32.Agent.awf skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1700\A0204006.exe Infected: Trojan-Downloader.Win32.Agent.awf skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1700\A0204007.exe Infected: Trojan-Downloader.Win32.Agent.awf skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1700\A0204008.exe Infected: Trojan-Downloader.Win32.Agent.awf skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1700\A0204009.exe Infected: Trojan-Downloader.Win32.Agent.awf skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1700\A0204010.exe Infected: Trojan-Downloader.Win32.Agent.awf skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1700\A0204011.exe Infected: Trojan-Downloader.Win32.Agent.awf skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1700\A0204012.exe Infected: Trojan-Downloader.Win32.Agent.awf skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1700\A0204013.exe Infected: Trojan-Downloader.Win32.Agent.awf skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1700\A0204014.exe Infected: Trojan-Downloader.Win32.Agent.awf skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1700\A0204015.exe Infected: Trojan-Downloader.Win32.Agent.awf skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1700\A0204016.exe Infected: Trojan-Downloader.Win32.Agent.awf skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1700\A0204017.exe Infected: Trojan-Downloader.Win32.Agent.awf skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1727\A0204856.exe Infected: Trojan-Downloader.Win32.Agent.cpj skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1733\A0207830.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1733\A0207833.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.mh skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1733\A0207834.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1733\A0207836.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1733\A0207837.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1733\A0207838.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1733\A0207840.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1733\A0207841.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1733\A0207842.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1733\A0207843.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.mh skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1733\A0207847.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.mh skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1733\A0207848.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.md skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1733\A0207850.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.mh skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1733\A0207851.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.mh skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1733\A0207858.exe/data0002 Infected: not-a-virus:AdWare.Win32.PurityScan.fk skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1733\A0207858.exe/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.bu skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1733\A0207858.exe NSIS: infected - 2 skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1733\A0207870.exe Infected: Trojan-Proxy.Win32.VB.x skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1735\change.log Object is locked skipped C:\WINDOWS\cpbrkpie.ocx Infected: not-a-virus:AdWare.Win32.Coupons.h skipped C:\WINDOWS\cpbrxpie.ocx Infected: not-a-virus:AdWare.Win32.Coupons skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{03F6E779-6461-4024-8156-B136D91F1DD9}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\INDEX.DAT Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skipped C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\WIADEBUG.LOG Object is locked skipped C:\WINDOWS\WIASERVC.LOG Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed.

Scotty

Post #10September 9, 2007, 7:50 PM UTC

Hi

Please download FindAWF here:
http://noahdfear.geekstogo.com/FindAWF.exe
Save to desktop and run
The output is awf.txt, save the text file to your desktop. Post the report in your next reply.

ginnyliny

Post #11September 9, 2007, 9:23 PM UTC

Find AWF report by noahdfear ©2006 Version 1.40 The current date is: Mon 09/10/2007 The current time is: 15:52:18.42 bak folders found ~~~~~~~~~~~ Directory of C:\PROGRA~1\DELLSU~1\BAK 07/19/2004 08:51 AM 306,688 DSAgnt.exe 1 File(s) 306,688 bytes Directory of C:\PROGRA~1\ITUNES\BAK 10/30/2006 10:36 AM 256,576 iTunesHelper.exe 1 File(s) 256,576 bytes Directory of C:\PROGRA~1\NORTON~1\BAK 02/27/2002 01:27 PM 75,384 navapw32.exe 1 File(s) 75,384 bytes Directory of C:\PROGRA~1\QUICKT~1\BAK 10/25/2006 07:58 PM 282,624 qttask.exe 1 File(s) 282,624 bytes Directory of C:\PROGRA~1\SYMNET~1\BAK 06/02/2005 10:29 PM 100,056 SNDMon.exe 1 File(s) 100,056 bytes Directory of C:\WINDOWS\SYSTEM32\BAK 06/20/2002 04:05 AM 114,688 hkcmd.exe 06/20/2002 04:14 AM 155,648 igfxtray.exe 2 File(s) 270,336 bytes Directory of C:\PROGRA~1\COMMON~1\ZING\BAK 08/02/2002 04:39 PM 200,704 ZingSpooler.exe 1 File(s) 200,704 bytes Directory of C:\PROGRA~1\GOOGLE\GOOGLE~1\BAK 10/16/2006 06:12 AM 190,464 GoogleDesktop.exe 1 File(s) 190,464 bytes Directory of C:\PROGRA~1\HP\HPCORE~1\BAK 05/12/2004 04:18 PM 241,664 hpcmpmgr.exe 1 File(s) 241,664 bytes Directory of C:\PROGRA~1\HP\HPSOFT~1\BAK 02/12/2004 02:38 PM 49,152 HPWuSchd2.exe 1 File(s) 49,152 bytes Directory of C:\PROGRA~1\MUSICM~1\MUSICM~1\BAK 08/14/2002 07:29 PM 90,112 mm_tray.exe 1 File(s) 90,112 bytes Directory of C:\PROGRA~1\WEBROOT\SPYSWE~1\BAK 12/09/2004 07:34 PM 3,545,088 SpySweeper.exe 1 File(s) 3,545,088 bytes Directory of C:\PROGRA~1\COMMON~1\AOL\ACS\BAK 04/07/2004 12:07 PM 496,752 AOLDial.exe 1 File(s) 496,752 bytes Directory of C:\PROGRA~1\COMMON~1\REAL\UPDATE~1\BAK 10/08/2006 07:34 PM 180,269 realsched.exe 1 File(s) 180,269 bytes Directory of C:\PROGRA~1\GIGAWARE\GIGAWA~1\4.06\BAK 11/09/2001 02:47 AM 356,352 MOUSE32A.EXE 1 File(s) 356,352 bytes Directory of C:\PROGRA~1\JAVA\JRE15~1.0_0\BIN\BAK 07/26/2006 04:03 AM 49,263 jusched.exe 1 File(s) 49,263 bytes 04/10/2002 06:44 PM 679,936 DirectCD.exe 1 File(s) 679,936 bytes Directory of C:\PROGRA~1\COMMON~1\AOL\116838~1\EE\BAK 03/10/2006 06:22 PM 48,280 AOLSoftware.exe 1 File(s) 48,280 bytes Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ 306688 Jul 19 2004 "C:\Program Files\Dell Support\bak\DSAgnt.exe" 256576 Oct 30 2006 "C:\Program Files\iTunes\bak\iTunesHelper.exe" 102400 Nov 17 2006 "C:\WINDOWS\Installer\{446DBFFA-4088-48E3-8932-74316BA4CAE4}\iTunesIco.exe" 108096 Oct 30 2006 "C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.0.2.16\iTunesSetupAdmin.exe" 75384 Feb 27 2002 "C:\Program Files\Norton AntiVirus\bak\navapw32.exe" 24588 Feb 6 2007 "C:\Program Files\QuickTime\qttask.exe" 282624 Oct 25 2006 "C:\Program Files\QuickTime\bak\qttask.exe" 100056 Jun 2 2005 "C:\Program Files\SymNetDrv\bak\SNDMon.exe" 114688 Jun 20 2002 "C:\DRIVERS\VIDEO\HKCMD.EXE" 114688 Jun 20 2002 "C:\WINDOWS\SYSTEM32\bak\hkcmd.exe" 114688 Jun 20 2002 "C:\WINDOWS\SYSTEM32\ReinstallBackups\00\DriverFiles\hkcmd.exe" 155648 Jun 20 2002 "C:\DRIVERS\VIDEO\IGFXTRAY.EXE" 155648 Jun 20 2002 "C:\WINDOWS\SYSTEM32\bak\igfxtray.exe" 155648 Jun 20 2002 "C:\WINDOWS\SYSTEM32\ReinstallBackups\00\DriverFiles\igfxtray.exe" 200704 Aug 2 2002 "C:\Program Files\Common Files\Zing\bak\ZingSpooler.exe" 743016 Apr 15 2005 "C:\Program Files\Google\Google Desktop Search\GoogleDesktopSearchSetup.exe" 559784 Oct 8 2006 "C:\Program Files\Common Files\Real\GToolbar\GoogleToolbarInstaller.exe" 190464 Oct 16 2006 "C:\Program Files\Google\Google Desktop Search\bak\GoogleDesktop.exe" 559784 Apr 17 2006 "C:\Documents and Settings\Gail\Application Data\Real\GOOGLE_TOOLBAR\googletoolbarinstaller.exe" 241664 May 12 2004 "C:\Program Files\HP\hpcoretech\bak\hpcmpmgr.exe" 49152 Feb 12 2004 "C:\Program Files\HP\HP Software Update\bak\HPWuSchd2.exe" 90112 Aug 14 2002 "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\bak\mm_tray.exe" 5361464 Jul 19 2007 "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" 13035366 Aug 22 2007 "C:\Documents and Settings\Gail\Desktop\Downloads\SpySweeperSNRSetup_EN.exe" 3545088 Dec 9 2004 "C:\Program Files\Webroot\Spy Sweeper\bak\SpySweeper.exe" 496752 Apr 7 2004 "C:\Program Files\Common Files\AOL\ACS\bak\AOLDial.exe" 180269 Oct 8 2006 "C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe" 356352 Nov 9 2001 "C:\Program Files\Gigaware\Gigaware Driver\4.06\bak\MOUSE32A.EXE" 49263 Jul 26 2006 "C:\Program Files\Java\jre1.5.0_08\bin\bak\jusched.exe" 679936 Apr 10 2002 "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\bak\DirectCD.exe" 48280 Mar 10 2006 "C:\Program Files\Common Files\AOL\1168389143\ee\bak\AOLSoftware.exe" end of report

Scotty

Post #12September 9, 2007, 10:24 PM UTC

Hi

Please open FindAWF again. This time, press the number 2.

Notepad will open. Please copy and paste the following in the Code box into this Notepad file. Make sure that it's after the line, not before.

"C:\Program Files\Dell Support\bak\DSAgnt.exe"
"C:\Program Files\iTunes\bak\iTunesHelper.exe"
"C:\Program Files\Norton AntiVirus\bak\navapw32.exe"
"C:\Program Files\QuickTime\bak\qttask.exe"
"C:\Program Files\SymNetDrv\bak\SNDMon.exe"
"C:\Program Files\Common Files\Zing\bak\ZingSpooler.exe"
"C:\Program Files\Google\Google Desktop Search\bak\GoogleDesktop.exe"
"C:\Program Files\HP\hpcoretech\bak\hpcmpmgr.exe"
"C:\Program Files\HP\HP Software Update\bak\HPWuSchd2.exe"
"C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\bak\mm_tray.exe"
"C:\Program Files\Webroot\Spy Sweeper\bak\SpySweeper.exe"
"C:\Program Files\Common Files\AOL\ACS\bak\AOLDial.exe"
"C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe"
"C:\Program Files\Gigaware\Gigaware Driver\4.06\bak\MOUSE32A.EXE"
"C:\Program Files\Java\jre1.5.0_08\bin\bak\jusched.exe"
"C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\bak\DirectCD.exe"
"C:\Program Files\Common Files\AOL\1168389143\ee\bak\AOLSoftware.exe"

Click on File > Save. Do not choose the Save As… option.

FindAWF will now start removing the bad files. When done, a log will be produced. Do not close this log file.

Next, press the number 4. Once done, the tool will return to the main menu.

Press E to close FindAWF.

Please post the FindAWF log file and a new HijackThis log in your next reply.

ginnyliny

Post #13September 10, 2007, 12:38 AM UTC

Find AWF report by noahdfear ©2006 Version 1.40 Option 2 run successfully The current date is: Mon 09/10/2007 The current time is: 18:52:34.32 bak folders found ~~~~~~~~~~~ Directory of C:\PROGRA~1\DELLSU~1\BAK 07/19/2004 08:51 AM 306,688 DSAgnt.exe 1 File(s) 306,688 bytes Directory of C:\PROGRA~1\ITUNES\BAK 10/30/2006 10:36 AM 256,576 iTunesHelper.exe 1 File(s) 256,576 bytes Directory of C:\PROGRA~1\NORTON~1\BAK 02/27/2002 01:27 PM 75,384 navapw32.exe 1 File(s) 75,384 bytes Directory of C:\PROGRA~1\QUICKT~1\BAK 10/25/2006 07:58 PM 282,624 qttask.exe 1 File(s) 282,624 bytes Directory of C:\PROGRA~1\SYMNET~1\BAK 06/02/2005 10:29 PM 100,056 SNDMon.exe 1 File(s) 100,056 bytes Directory of C:\WINDOWS\SYSTEM32\BAK 06/20/2002 04:05 AM 114,688 hkcmd.exe 06/20/2002 04:14 AM 155,648 igfxtray.exe 2 File(s) 270,336 bytes Directory of C:\PROGRA~1\COMMON~1\ZING\BAK 08/02/2002 04:39 PM 200,704 ZingSpooler.exe 1 File(s) 200,704 bytes Directory of C:\PROGRA~1\GOOGLE\GOOGLE~1\BAK 10/16/2006 06:12 AM 190,464 GoogleDesktop.exe 1 File(s) 190,464 bytes Directory of C:\PROGRA~1\HP\HPCORE~1\BAK 05/12/2004 04:18 PM 241,664 hpcmpmgr.exe 1 File(s) 241,664 bytes Directory of C:\PROGRA~1\HP\HPSOFT~1\BAK 02/12/2004 02:38 PM 49,152 HPWuSchd2.exe 1 File(s) 49,152 bytes Directory of C:\PROGRA~1\MUSICM~1\MUSICM~1\BAK 08/14/2002 07:29 PM 90,112 mm_tray.exe 1 File(s) 90,112 bytes Directory of C:\PROGRA~1\WEBROOT\SPYSWE~1\BAK 12/09/2004 07:34 PM 3,545,088 SpySweeper.exe 1 File(s) 3,545,088 bytes Directory of C:\PROGRA~1\COMMON~1\AOL\ACS\BAK 04/07/2004 12:07 PM 496,752 AOLDial.exe 1 File(s) 496,752 bytes Directory of C:\PROGRA~1\COMMON~1\REAL\UPDATE~1\BAK 10/08/2006 07:34 PM 180,269 realsched.exe 1 File(s) 180,269 bytes Directory of C:\PROGRA~1\GIGAWARE\GIGAWA~1\4.06\BAK 11/09/2001 02:47 AM 356,352 MOUSE32A.EXE 1 File(s) 356,352 bytes Directory of C:\PROGRA~1\JAVA\JRE15~1.0_0\BIN\BAK 07/26/2006 04:03 AM 49,263 jusched.exe 1 File(s) 49,263 bytes 04/10/2002 06:44 PM 679,936 DirectCD.exe 1 File(s) 679,936 bytes Directory of C:\PROGRA~1\COMMON~1\AOL\116838~1\EE\BAK 03/10/2006 06:22 PM 48,280 AOLSoftware.exe 1 File(s) 48,280 bytes Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ 306688 Jul 19 2004 "C:\Program Files\Dell Support\DSAgnt.exe" 306688 Jul 19 2004 "C:\Program Files\Dell Support\bak\DSAgnt.exe" 256576 Oct 30 2006 "C:\Program Files\iTunes\iTunesHelper.exe" 256576 Oct 30 2006 "C:\Program Files\iTunes\bak\iTunesHelper.exe" 102400 Nov 17 2006 "C:\WINDOWS\Installer\{446DBFFA-4088-48E3-8932-74316BA4CAE4}\iTunesIco.exe" 108096 Oct 30 2006 "C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.0.2.16\iTunesSetupAdmin.exe" 75384 Feb 27 2002 "C:\Program Files\Norton AntiVirus\navapw32.exe" 75384 Feb 27 2002 "C:\Program Files\Norton AntiVirus\bak\navapw32.exe" 282624 Oct 25 2006 "C:\Program Files\QuickTime\qttask.exe" 282624 Oct 25 2006 "C:\Program Files\QuickTime\bak\qttask.exe" 100056 Jun 2 2005 "C:\Program Files\SymNetDrv\SNDMon.exe" 100056 Jun 2 2005 "C:\Program Files\SymNetDrv\bak\SNDMon.exe" 114688 Jun 20 2002 "C:\DRIVERS\VIDEO\HKCMD.EXE" 114688 Jun 20 2002 "C:\WINDOWS\SYSTEM32\bak\hkcmd.exe" 114688 Jun 20 2002 "C:\WINDOWS\SYSTEM32\ReinstallBackups\00\DriverFiles\hkcmd.exe" 155648 Jun 20 2002 "C:\DRIVERS\VIDEO\IGFXTRAY.EXE" 155648 Jun 20 2002 "C:\WINDOWS\SYSTEM32\bak\igfxtray.exe" 155648 Jun 20 2002 "C:\WINDOWS\SYSTEM32\ReinstallBackups\00\DriverFiles\igfxtray.exe" 200704 Aug 2 2002 "C:\Program Files\Common Files\Zing\ZingSpooler.exe" 200704 Aug 2 2002 "C:\Program Files\Common Files\Zing\bak\ZingSpooler.exe" 743016 Apr 15 2005 "C:\Program Files\Google\Google Desktop Search\GoogleDesktopSearchSetup.exe" 559784 Oct 8 2006 "C:\Program Files\Common Files\Real\GToolbar\GoogleToolbarInstaller.exe" 190464 Oct 16 2006 "C:\Program Files\Google\Google Desktop Search\bak\GoogleDesktop.exe" 559784 Apr 17 2006 "C:\Documents and Settings\Gail\Application Data\Real\GOOGLE_TOOLBAR\googletoolbarinstaller.exe" 241664 May 12 2004 "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" 241664 May 12 2004 "C:\Program Files\HP\hpcoretech\bak\hpcmpmgr.exe" 49152 Feb 12 2004 "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" 49152 Feb 12 2004 "C:\Program Files\HP\HP Software Update\bak\HPWuSchd2.exe" 90112 Aug 14 2002 "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe" 90112 Aug 14 2002 "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\bak\mm_tray.exe" 5361464 Jul 19 2007 "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" 13035366 Aug 22 2007 "C:\Documents and Settings\Gail\Desktop\Downloads\SpySweeperSNRSetup_EN.exe" 3545088 Dec 9 2004 "C:\Program Files\Webroot\Spy Sweeper\bak\SpySweeper.exe" 496752 Apr 7 2004 "C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" 496752 Apr 7 2004 "C:\Program Files\Common Files\AOL\ACS\bak\AOLDial.exe" 180269 Oct 8 2006 "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" 180269 Oct 8 2006 "C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe" 356352 Nov 9 2001 "C:\Program Files\Gigaware\Gigaware Driver\4.06\MOUSE32A.EXE" 356352 Nov 9 2001 "C:\Program Files\Gigaware\Gigaware Driver\4.06\bak\MOUSE32A.EXE" 49263 Jul 26 2006 "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe" 49263 Jul 26 2006 "C:\Program Files\Java\jre1.5.0_08\bin\bak\jusched.exe" 679936 Apr 10 2002 "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" 679936 Apr 10 2002 "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\bak\DirectCD.exe" 48280 Mar 10 2006 "C:\Program Files\Common Files\AOL\1168389143\ee\AOLSoftware.exe" 48280 Mar 10 2006 "C:\Program Files\Common Files\AOL\1168389143\ee\bak\AOLSoftware.exe"4 end of report

ginnyliny

Post #14September 10, 2007, 12:41 AM UTC

Here is the new log- thank you so much for all the time and help!!!!

Logfile of HijackThis v1.99.1
Scan saved at 8:36:29 PM, on 9/10/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://disboards.com/forumdisplay.php?f=33
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\bak\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Gigaware\Gigaware Driver\4.06\MOUSE32A.EXE
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - Startup: Tycoon City_ New York Registration.lnk = C:\Documents and Settings\Gail\Local Settings\Temp\{173D001A-B43B-4F40-AFD5-37BD22E13EC1}\{A5101403-2C42-40E0-8D9E-5E49E7C3B89E}\ATR1.EXE
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0b\aoltray.exe
O4 - Global Startup: Billminder.lnk = C:\Program Files\QUICKENW\billmind.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\QUICKENW\bagent.exe
O4 - Global Startup: Quicken Startup.lnk = C:\Program Files\QUICKENW\QWDLLS.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: RemindU - {16BF42FD-CA0A-4f48-819D-B0343254DD67} - file://C:\Program Files\UpromiseRemindU\System\Temp\upromise_script0.htm (file missing) (HKCU)
O9 - Extra button: (no name) - {2863ACA1-9AA0-4432-8CFE-88C12B3B2E5E} - file://C:\Program Files\Upromise_RemindU\Sy1050\Tp1050\scri1050a.htm (file missing) (HKCU)
O16 - DPF: 6th Street Omaha Poker by pogo - http://game1.pogo.com/applet-6.4.3.36/omah…a-ob-assets.cab
O16 - DPF: Aces Up! by pogo - http://game1.pogo.com/applet-8.0.5.48/aces/aces-en_US.cab
O16 - DPF: Ali Baba Slots TM by pogo - http://game1.pogo.com/applet-6.3.0.53/slot…a-ob-assets.cab
O16 - DPF: Backgammon by pogo - http://game1.pogo.com/applet-6.3.3.38/back…n-ob-assets.cab
O16 - DPF: Blackjack by pogo - http://game1.pogo.com/applet-8.0.3.20/blac…kjack-en_US.cab
O16 - DPF: Blackjack Carnival by pogo - http://game1.pogo.com/applet-6.8.1.38/vbja…jack2-en_US.cab
O16 - DPF: Blooop by pogo - http://game1.pogo.com/applet-6.9.4.41/casc…scade-en_US.cab
O16 - DPF: Bowling by pogo - http://game1.pogo.com/applet-8.0.7.27/bowl…wling-en_US.cab
O16 - DPF: Buckaroo Blackjack TM by pogo - http://game1.pogo.com/applet-6.7.3.23/vide…kjack-en_US.cab
O16 - DPF: Canasta by pogo - http://game1.pogo.com/applet-8.0.5.48/cana…nasta-en_US.cab
O16 - DPF: Checkers by pogo - http://game1.pogo.com/applet-6.4.0.34/chec…s-ob-assets.cab
O16 - DPF: Chess by pogo - http://game1.pogo.com/applet-6.5.0.45/ches…2-ob-assets.cab
O16 - DPF: Dice City Roller by pogo - http://game1.pogo.com/applet-8.0.4.32/ytz/ytz-en_US.cab
O16 - DPF: Dice Derby by pogo - http://game1.pogo.com/applet-8.0.1.23/chec…dflag-en_US.cab
O16 - DPF: Dice Derby by pogo.com - http://checkeredflag.pogo.com/applet/check…g-ob-assets.cab
O16 - DPF: Dominoes by pogo - http://game1.pogo.com/applet-6.5.5.29/domi…omino-en_US.cab
O16 - DPF: Double Deuce Poker by pogo - http://game1.pogo.com/applet-6.7.0.32/vide…deuce-en_US.cab
O16 - DPF: Euchre by pogo - http://game1.pogo.com/applet-6.5.2.26/euch…uchre-en_US.cab
O16 - DPF: First Class Solitaire by pogo - http://game1.pogo.com/applet-8.0.4.32/firs…lass2-en_US.cab
O16 - DPF: Fortune Bingo by pogo - http://game1.pogo.com/applet-8.0.5.30/supe…bingo-en_US.cab
O16 - DPF: Greenback Bayou by pogo - http://game1.pogo.com/applet-8.0.3.20/gree…nback-en_US.cab
O16 - DPF: Greenback Bayou by pogo.com - http://greenback.pogo.com/applet/greenback…k-ob-assets.cab
O16 - DPF: Hangman Hijinks by pogo - http://game1.pogo.com/applet-8.0.1.32/hang…ngman-en_US.cab
O16 - DPF: Harvest Mania by pogo - http://game1.pogo.com/applet-6.8.2.23/harv…rvest-en_US.cab
O16 - DPF: Hearts by pogo - http://game1.pogo.com/applet-8.0.5.48/hear…earts-en_US.cab
O16 - DPF: High Stakes Poker by pogo - http://game1.pogo.com/applet-6.8.4.51/draw…poker-en_US.cab
O16 - DPF: High Stakes Pool by pogo - http://game1.pogo.com/applet-6.6.2.21/pool2/pool-en_US.cab
O16 - DPF: Hog Heaven Slots by pogo - http://game1.pogo.com/applet-8.0.5.30/fancy/fancy-en_US.cab
O16 - DPF: Jigsaw Detective by pogo - http://game1.pogo.com/applet-6.3.2.25/jigs…w-ob-assets.cab
O16 - DPF: Jungle Gin by pogo - http://game1.pogo.com/applet-6.8.3.35/gin2/gin2-en_US.cab
O16 - DPF: Keno by pogo - http://game1.pogo.com/applet-6.7.3.30/keno/keno-en_US.cab
O16 - DPF: Lost Temple Poker by pogo - http://game1.pogo.com/applet-8.0.6.59/mhpo…poker-en_US.cab
O16 - DPF: Lottso by pogo - http://game1.pogo.com/applet-8.0.5.30/lott…ottso-en_US.cab
O16 - DPF: Mah Jong Garden by pogo - http://game1.pogo.com/applet-8.0.6.49/mahj…jong2-en_US.cab
O16 - DPF: Makeover Madness by pogo - http://game1.pogo.com/applet-8.0.4.41/shoes/shoes-en_US.cab
O16 - DPF: Multiline Slots by pogo - http://game1.pogo.com/applet-6.6.4.29/mlsl…slots-en_US.cab
O16 - DPF: Pai Gow by pogo - http://game1.pogo.com/applet-6.9.0.43/paig…aigow-en_US.cab
O16 - DPF: Payday FreeCell by pogo - http://game1.pogo.com/applet-6.9.0.43/free…ecell-en_US.cab
O16 - DPF: Payday Freecell Solitaire by pogo - http://game1.pogo.com/applet-6.9.4.34/free…cell2-en_US.cab
O16 - DPF: Penguin Blocks by pogo - http://game1.pogo.com/applet-8.0.5.30/peng…guins-en_US.cab
O16 - DPF: Perfect Pair Solitaire by pogo - http://game1.pogo.com/applet-8.0.5.48/wate…wheel-en_US.cab
O16 - DPF: Phlinx by pogo - http://game1.pogo.com/applet-8.0.4.32/flin…inger-en_US.cab
O16 - DPF: Pinochle by pogo - http://game1.pogo.com/applet-6.6.3.34/pino…ochle-en_US.cab
O16 - DPF: Pop Fu by pogo - http://game1.pogo.com/applet-6.9.3.49/popfu/popfu-en_US.cab
O16 - DPF: Pop Fu by pogo.com - http://popfu.pogo.com/applet/popfu/popfu-ob-assets.cab
O16 - DPF: PoppaZoppa by pogo - http://game1.pogo.com/applet-6.9.1.32/popp…zoppa-en_US.cab
O16 - DPF: Poppit by pogo - http://game1.pogo.com/applet-8.0.2.32/popp…ppit2-en_US.cab
O16 - DPF: Quick Quack by pogo - http://game1.pogo.com/applet-6.7.4.35/hots…treak-en_US.cab
O16 - DPF: QWERTY by pogo - http://game1.pogo.com/applet-6.6.2.21/squa…uares-en_US.cab
O16 - DPF: Ride The Tide by pogo - http://game1.pogo.com/applet-6.6.2.21/ride/ride-en_US.cab
O16 - DPF: Showbiz Slots 2 by pogo - http://game1.pogo.com/applet-6.8.0.32/slot…wbiz2-en_US.cab
O16 - DPF: Showbiz Slots by pogo - http://game1.pogo.com/applet-6.4.2.30/slot…z-ob-assets.cab
O16 - DPF: Shuffle Bump by pogo - http://game1.pogo.com/applet-6.7.0.32/puck/puck-en_US.cab
O16 - DPF: Spades 2 by pogo - http://game1.pogo.com/applet-8.0.2.32/spad…ades2-en_US.cab
O16 - DPF: Spider Solitaire by pogo - http://game1.pogo.com/applet-8.0.0.20/spid…pider-en_US.cab
O16 - DPF: Squelchies by pogo - http://game1.pogo.com/applet-8.0.6.49/sque…chies-en_US.cab
O16 - DPF: Stax by pogo - http://game1.pogo.com/applet-8.0.7.27/stax/stax-en_US.cab
O16 - DPF: Stellar Sweeper by pogo - http://game1.pogo.com/applet-6.9.3.39/swee…eeper-en_US.cab
O16 - DPF: Sweet Tooth TM by pogo - http://game1.pogo.com/applet-8.0.7.27/swee…tooth-en_US.cab
O16 - DPF: Texas Hold'em Poker by pogo - http://game1.pogo.com/applet-8.0.4.32/hold…oldem-en_US.cab
O16 - DPF: Top Down Baseball Challenge by pogo - http://game1.pogo.com/applet-6.4.4.27/topd…2-ob-assets.cab
O16 - DPF: Tri-Peaks by pogo - http://game1.pogo.com/applet-8.0.5.48/peaks/peaks-en_US.cab
O16 - DPF: Tumble Bees by pogo - http://game1.pogo.com/applet-8.0.4.32/tumb…mbee2-en_US.cab
O16 - DPF: Turbo 21 TM by pogo - http://game1.pogo.com/applet-6.3.2.25/turb…1-ob-assets.cab
O16 - DPF: Turbo 21 v2 by pogo - http://game1.pogo.com/applet-8.0.0.20/turb…rbo22-en_US.cab
O16 - DPF: Wonderland Memories by pogo - http://game1.pogo.com/applet-8.0.5.30/memo…ories-en_US.cab
O16 - DPF: Word Craft by pogo - http://game1.pogo.com/applet-6.9.4.34/babb…abble-en_US.cab
O16 - DPF: Word Search Daily by pogo - http://game1.pogo.com/applet-8.0.7.27/word…earch-en_US.cab
O16 - DPF: Word Whomp by pogo - http://game1.pogo.com/applet-8.0.5.30/word…homp2-en_US.cab
O16 - DPF: Word Whomp Whackdown by pogo - http://game1.pogo.com/applet-8.0.6.59/whac…kdown-en_US.cab
O16 - DPF: WordJong by pogo - http://game1.pogo.com/applet-8.0.5.30/word…djong-en_US.cab
O16 - DPF: World Class Solitaire by pogo - http://game1.pogo.com/applet-8.0.6.49/worl…class-en_US.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} (AOL Content Update) - http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab
O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} - http://install.wildtangent.com/ActiveLaunc…iveLauncher.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.costcophotocenter.com/CostcoActivia.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/11edaa929534aae9b605/…ip/RdxIE601.cab
O16 - DPF: {5E943D9C-F8DC-4258-8E3F-A61BB3405A33} (ZingBatchAXDwnl Class) - http://www.imagestation.com/common/classes…ion=4,3,2,20802
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://floridakeysmedia.tv/axiscam/Codebas…sCamControl.ocx
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/1452/ftp…02/cpbrkpie.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/…loadcontrol.cab
O16 - DPF: {C6B086D2-146B-47A4-A218-B82DCAF2D872} (cpbrxpie Control) - http://a19.g.akamai.net/7/19/7125/1433/ftp…20/cpbrxpie.cab
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://clubgames.pogo.com/online2/pogop/di…sh.1.0.0.80.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://aol131.pogo.com/game/deluxe/zuma/popcaploader_v5.cab
O16 - DPF: {E6EB803E-DD89-11D3-80C4-0050DA2E09D0} (LightSurfUploadCtl Class) - http://prints.picturecenter.kodak.com/acti…loadControl.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

Scotty

Post #15September 10, 2007, 8:39 AM UTC

Morning

Step 1:
Run HijackThis, select Do a system scan only and place checks against the following entries (if they are still present):
O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} - http://install.wildtangent.com/ActiveLaunc…iveLauncher.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/11edaa929534aae9b605/…ip/RdxIE601.cab

WITH ALL OTHER WINDOWS CLOSED Click on Fix Checked and exit HijackThis.

Step 2:
Delete the FindAWF and Combofix icons from your Desktop.

Step 3:
Navigate to and delete the following files and/or folders (if they are present):

Files:
C:\WINDOWS\cpbrkpie.ocx
C:\WINDOWS\cpbrxpie.ocx

Folders:
C:\Qoobox
C:\Combofix

Step 4:
This is my usual speech for when you are clean, which you appear to be.

Please follow these simple steps in order to keep your computer clean and secure:
Disable and Enable System Restore.

Click Start | Help and Support | Undo changes to your computer with System Restore.
Click Create A Restore Point then click Next. Give it a name it and then click Create, then Close.
Close the Help and Support Center box.
Click Start | Run and type Cleanmgr
Select (C: ) then click OK.
Click the More Options tab.
Click Clean Up in the System Restore Section.

This will remove all previous restore points except the newly created one.

Here are some free programs, I recommend.

Install Spyware Guard
Download it from here
Find here the tutorial on how to use Spyware Guard here

Install SpyWare Blaster
Download it from here
Find here the tutorial on how to use Spyware Blaster here

Install WinPatrol
Download it from here
Here you can find information about how WinPatrol works here

Make sure your Windows is ALWAYS up to date!

An unpatched Windows is vulnerable and even with the "best" Antivirus and Firewall installed, malware will find its way through.
So visit http://windowsupdate.microsoft.com/ to download and install the latest updates.

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Please check out Tony Klein's article "How did I get infected in the first place?"

Follow this list and your potential for being infected again will reduce dramatically.

Glad I was able to help.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Help With Log Please!

✨ Ask AI

Ask AI