Spyware / Malware / Virus Removal

[Resolved] Omg! Kaspersky Found Over 2300 Infected Items!

93 min read

Looking for the outcome? Ask AI

Absurdny Topic Starter

Post #1September 11, 2007, 5:22 PM UTC

I do frequent scans of my computer weekly using multiple virus and adware search programs. My computer has 3 big hard drives and a lot of files so it takes kaspersky about 8 hours to do a full scan. Last night I did a full scan and this morning it showed that I had about 23 viruses, and over 2300 infected items! Most of the item were not repaired with kaspersky. It just said skipped next to them. My computer seemed like it was running weird this week. All the sudden everything is slow, I keep getting IE popups, Limewire starts itself automatically and if I close it, it starts right back up, and if I try to start my computer in safe mode, it don't work. As soon as my computer is back to normal I will be removing limewire as I think this program is very bad. As a matter of fact, I think I might even disable ths computer from a internet connection altogether. Please somebody help me. Here is my hjt log:

Logfile of HijackThis v1.99.1
Scan saved at 1:18:11 PM, on 9/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Digidesign\Drivers\MMERefresh.exe
C:\Program Files\M-Audio\Install\EvoInst.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\gearsec.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\M-Audio\Fast Track Pro\MAUSBInst.exe
G:\Apps\3ds max\mentalray\satellite\raysat_3dsmax9_32server.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Common Files\AOL\1165475229\ee\AOLSoftware.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\taskmgr.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Program Files\limewire\limewire.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=566…www.google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = C:\Program Files\AOL Toolbar\welcome.html
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1165475229\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [WinampAgent] G:\Apps\Winamp\winampa.exe
O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe
O4 - HKLM\..\RunOnce: [AAW] "C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe" "+b1"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Gadwin PrintScreen] C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash
O4 - HKCU\..\Run: [mschkdsk.exe] C:\WINDOWS\system32\mschkdsk.exe
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: taskmgr.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Download all by WellGet - C:\Program Files\WellGet\nxall.htm
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Download by &WellGet - C:\Program Files\WellGet\nxcatch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: WellGet - {35980F6E-A258-4E50-953D-813BB8556899} - C:\Program Files\WellGet\WellGet.exe
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://a1540.g.akamai.net/7/1540/52/200612…ex/qtplugin.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: bw+0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: offline-8876480 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Digidesign MME Refresh Service (DigiRefresh) - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O23 - Service: digiSPTIService - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Pro Tools\digiSPTIService.exe
O23 - Service: M-Audio Installer (EvoInstallerService) - Unknown owner - C:\Program Files\M-Audio\Install\EvoInst.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: gearsec - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: M-Audio USB Installer (MAudioUSBService) - M-Audio - C:\Program Files\M-Audio\Fast Track Pro\MAUSBInst.exe
O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - G:\Apps\3ds max\mentalray\satellite\raysat_3dsmax9_32server.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

IndiGenus

Post #2September 11, 2007, 10:17 PM UTC

Hi Absurdny and welcome to the forums.

My name is Dave. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can sometimes take a while to research so please be patient and I'd be grateful if you would note the following:

I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for this issue on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.
NOTE:Before we start: Please be aware that removing Malware is a hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

In light of this it would be wise for you to back up any files and folders that you don't want to lose before we start, if possible.

—————————-

I do have one major observation first before we begin the fix. You do not appear to have an Anti-virus program in place. You mentioned you run scans, ect…but by the time you run the scans it's too late. You need a permanent AV in place to help with real time scanning to prevent infection in the first place. Here are a few free for personal use AV's I recommend. Use only one:

Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. Here is a list of some free and evaluation versions to try: AVG AntiVirus
Avast Antivirus Home Version–Free
Antivir Personal - Free
—————————–

From the lack of 02 and 020 items in your HJT log I'm strongly suspecting a Vundo infection here.

I need you to rename Hijackthis because I suspect that you may have the Vundo infection that can hide some entries in your log.

Please go to the folder where you saved Hijackthis.exe:
Right-click on it, then select Rename.
Name it something like: FindVundo.exe (or whatever you want) - Just make sure to keep the .exe part.
Then double-click the renamed HJT to scan and then post the new logfile.

Absurdny

Post #3September 11, 2007, 11:00 PM UTC

Thank you so much for your fast reply! I would backup all my important files but I just have too many important files. I have 3 big hard drives that are almost full and it would take a lot of dvd's and a lot of time to back it all up. I think I am just going to have to take the chance. I did what you said and here is my new HJT log. I already see a lot of stuff that was not in my log before.

Logfile of HijackThis v1.99.1
Scan saved at 6:55:01 PM, on 9/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
C:\WINDOWS\TWljaGFlbCBCYXVlcg\command.exe
C:\Program Files\Digidesign\Drivers\MMERefresh.exe
C:\Program Files\M-Audio\Install\EvoInst.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\gearsec.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\M-Audio\Fast Track Pro\MAUSBInst.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\AOL\1165475229\ee\AOLSoftware.exe
C:\WINDOWS\retadpu.exe
C:\WINDOWS\system32\pipmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\pipmon.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\taskmgr.exe
C:\WINDOWS\retadpu21.exe
C:\WINDOWS\STEM32~1\javaw.exe
C:\Program Files\?ppPatch\regedit.exe
C:\Program Files\limewire\limewire.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Program Files\America Online 9.0\waol.exe
C:\Program Files\America Online 9.0\shellmon.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\chifygsr.exe
C:\Program Files\Hijackthis\FindVundo.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=566…www.google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = C:\Program Files\AOL Toolbar\welcome.html
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {203CD78F-4E66-40E4-3620-3871C17593EF} - C:\WINDOWS\system32\zma.dll
O2 - BHO: (no name) - {213ED788-1A65-18B4-6120-3871C17593ED} - C:\WINDOWS\system32\bxtnczme.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {733E9132-53CA-4C97-9AC9-145C4502FA20} - C:\WINDOWS\system32\fccdbyx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: SafeIE Utility - {B5D4581D-ED6A-4905-A267-25BAF7BE79C1} - C:\WINDOWS\system32\safeie.dll
O2 - BHO: (no name) - {BDE42684-A013-468A-A19D-F42FDA44FDBC} - C:\WINDOWS\system32\ddccc.dll
O2 - BHO: (no name) - {CF46BFB3-2ACC-441b-B82B-36B9562C7FF1} - C:\WINDOWS\system32\nshjcmdl.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1165475229\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [WinampAgent] G:\Apps\Winamp\winampa.exe
O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe
O4 - HKLM\..\Run: [p2p networking] p2pnetworking.exe
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu21.exe 61A847B5BBF72810338B2B27128065E9C084320161C4661227A755E9C2933154389A
O4 - HKLM\..\Run: [pipmon] pipmon.exe
O4 - HKLM\..\Run: [LiveProtect] "C:\Program Files\LiveProtect\LiveProtect.exe" -h
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx2\PXConsole.exe"
O4 - HKLM\..\RunServices: [p2p networking] p2pnetworking.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Gadwin PrintScreen] C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash
O4 - HKCU\..\Run: [mschkdsk.exe] C:\WINDOWS\system32\mschkdsk.exe
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKCU\..\Run: [Insider] C:\Program Files\Insider\Insider.exe
O4 - HKCU\..\Run: [Habb] "C:\WINDOWS\STEM32~1\javaw.exe" -vt yazb
O4 - HKCU\..\Run: [Ifkla] "C:\Program Files\?ppPatch\regedit.exe"
O4 - Global Startup: 1.exe
O4 - Global Startup: 2.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: taskmgr.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Download all by WellGet - C:\Program Files\WellGet\nxall.htm
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Download by &WellGet - C:\Program Files\WellGet\nxcatch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: WellGet - {35980F6E-A258-4E50-953D-813BB8556899} - C:\Program Files\WellGet\WellGet.exe
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://a1540.g.akamai.net/7/1540/52/200612…ex/qtplugin.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: bw+0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: offline-8876480 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - Winlogon Notify: fccdbyx - C:\WINDOWS\SYSTEM32\fccdbyx.dll
O20 - Winlogon Notify: WB - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\TWljaGFlbCBCYXVlcg\command.exe (file missing)
O23 - Service: Digidesign MME Refresh Service (DigiRefresh) - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O23 - Service: digiSPTIService - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Pro Tools\digiSPTIService.exe
O23 - Service: DomainService - - C:\WINDOWS\system32\chifygsr.exe
O23 - Service: M-Audio Installer (EvoInstallerService) - Unknown owner - C:\Program Files\M-Audio\Install\EvoInst.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: gearsec - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: M-Audio USB Installer (MAudioUSBService) - M-Audio - C:\Program Files\M-Audio\Fast Track Pro\MAUSBInst.exe
O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - G:\Apps\3ds max\mentalray\satellite\raysat_3dsmax9_32server.exe (file missing)
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PREVXAgent - Unknown owner - C:\Program Files\Prevx2\PXAgent.exe" -f (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

IndiGenus

Post #4September 12, 2007, 12:54 AM UTC

Hi Absurdny,

WOW!!! A lot more than just the 02's and 020's has shown up. Yes, Vundo, along with many other nasties including SDBots, PurityScan, Smitfraud, and god knows what else. After seeing all this I need to give you the following "canned speech" regarding the findings. While there are some great tools out there to help us clean these infections there is no way I can guarantee anything here. If you would like to continue I am more than willing to help you fix this though.

Your computer is infected by a variant of the Sdbot trojan, which has Backdoor functionality. This can give intruders complete control of your computer, logging key strokes, stealing information, etc…

You are strongly advised to do the following immediately!:

Disconnect infected computer from the internet and from any networked computers until the computer can be cleaned.
Call all of your banks, credit card companies, financial institutions and inform them that you may be a victim of identity theft and to put a watch on your accounts or change all your account numbers.
From a clean computer, change *all* of your online passwords – for ISP login, email, banks, financial accounts, PayPal, eBay, online companies, and any online forums or groups you belong to.Do NOT change passwords or do any transactions while using the infected computer because the attacker will get the new passwords and transaction information.

Because of its backdoor functionality, your PC is very likely compromised and there is no way to be sure it can ever again be trusted. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be a reformat and reinstall of the OS. However, if you do not have the resources to reinstall your OS and would like me to attempt to clean your machine, I will be happy to do so.

To help you make a more informed decision, please read the following articles:

Danger: Remote Access Trojans.
When should I re-format? How should I reinstall?
How Do I Handle Possible Identify Theft, Internet Fraud and Credit Card Fraud?

Should you have any questions, please feel free to ask

Please let me know your decision and we'll get started with clean up if that's what you choose.

Absurdny

Post #5September 12, 2007, 2:00 AM UTC last edited September 12, 2007, 2:02 AM UTC

Ok I will change all my passwords. Thank god I don't ever do my banking online. I will like you to help clean my system. I cannot reformat just yet. In a couple months I will be able to. also, I am hooked up to a home network. can the other computers in my home network get infected too and is it safe to change my passwords from a computer that is on the infected computers home network? And this "live protect" thing keeps popping up in my taskbar and the icon is by the clock.

IndiGenus

Post #6September 12, 2007, 2:13 AM UTC

Ok I will change all my passwords. Thank god I don't ever do my banking online. I will like you to help clean my system. I cannot reformat just yet. In a couple months I will be able to. also,

Okay…good enough for me…

I am hooked up to a home network. can the other computers in my home network get infected too and is it safe to change my passwords from a computer that is on the infected computers home network?

Yes, they can and may also very well be infected. I would try to find a computer you know is at least hopefully OK.

And this "live protect" thing keeps popping up in my taskbar and the icon is by the clock.

That's no surprise…you are heavily infected here. I will post back in a while with the first round of fixes.

IndiGenus

Post #7September 12, 2007, 2:15 AM UTC

Please download SDFix and save it to your Desktop.

You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Double click on SDFix.exe. It should automatically extract a folder called SDFix to your system drive (usually C:\). Please reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.

Open the SDFix folder and double click on RunThis.bat to start the script.
Type Y and press Enter to begin the script.
It will start cleaning your PC and then prompt you to press any key to Reboot.
Press any key to restart the PC.
Your system will take longer than normal to restart as the fixtool will be removing files.
When the desktop loads the Fixtool will complete the removal and display Finished.
Press any key to end the script and to load your desktop icons.
A text file should automatically open, so please copy the contents and post them here. We also need you to post a new HijackThis log

————————

Download and Run ComboFix

Download this file from below:
Here
Disconnect from the Internet, than disable your Anti-virus and any real-time Anti-spyware monitors that are running.
Then double click Combofix.exe & follow the prompts.
When finished, it shall produce a log for you. Post that log in your next reply with a new HijackThis log.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
Note 2:Remember to re-enable your Anti-virus and Anti-spyware before reconnecting to the Internet.

Absurdny

Post #8September 12, 2007, 4:15 AM UTC last edited September 12, 2007, 4:21 AM UTC

Ok I am trying to restart in safe mode but I'm having trouble. I have tried over and over again and it just does not work. I am using a wireless usb keyboard. Could it have something to do with that *Update. Nevermind about me not being able to get into safe mode. I found out how to do it through msconfig. I will complete the actions you said to.

IndiGenus

Post #9September 12, 2007, 12:53 PM UTC

Okay…for reasons described in this thread this is not a good idea with XP. Hopefully this doesn't/didn't happen to you.

http://www.bleepingcomputer.com/tutorials/…#force_safemode

Absurdny

Post #10September 12, 2007, 7:46 PM UTC last edited September 12, 2007, 7:56 PM UTC

No I can get into windows but I do have a problem, After disconnecting from the internet and running combofix, the computer needed to restart. I restarted the computer and now windows is telling me that I need to activate my copy of windows. It said something like "your computer hardware was changed since you first installed windows and microsoft needs to activate this copy of windows". I am on a different computer right now but I will post my hjt and all other logs in a little while. Also, should I run combofix in safe mode and do you think the usb keyboard is affecting booting up in safe mode? I noticed on the wireless reciever, the f lock light stays on even if I press it.

IndiGenus

Post #11September 12, 2007, 8:13 PM UTC

After disconnecting from the internet and running combofix, the computer needed to restart. I restarted the computer and now windows is telling me that I need to activate my copy of windows. It said something like "your computer hardware was changed since you first installed windows and microsoft needs to activate this copy of windows".

Yikes! I have never seen that happen. And to my knowledge there's nothing in these tools that will affect hardware in any way.

Also, should I run combofix in safe mode

No, Combofix should be run in Normal Mode.

do you think the usb keyboard is affecting booting up in safe mode? I noticed on the wireless reciever, the f lock light stays on even if I press it.

Probably, the driver does not load until after that point, and/or there is a port issue. One way to check is if you have a spare known good wired keyboard you could try and use that. Did the safeboot option work for running SDFix? If so can you post that report?

Again, you don't need to run combofix in Safe Mode.

Absurdny

Post #12September 12, 2007, 8:36 PM UTC

Yes the safeboot option did work and I have the log file for sdfix. I will post it in about a half hour when i am back by that computer. I was just worried about the windows activation thing so I figured I would ask.l I guess I will just have to activate windows again. I hope this don't cause any problems.

Absurdny

Post #13September 12, 2007, 10:02 PM UTC

Ok here are my logs:
—————————————————————————————————————————————
SDFix:

SDFix: Version 1.104

Run by [removed] on Wed 09/12/2007 at 12:49 AM

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\PROGRA~1\SDFIX\SDFix

Safe Mode:
Checking Services:

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting…

Normal Mode:
Checking Files:

No Trojan Files Found

Folder C:\Program Files\InetGet2 - Removed
Folder C:\Program Files\WinPop - Removed
Folder C:\Temp\fse - Removed

Removing Temp Files…

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.

Final Check:

Remaining Services:
——————

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"C:\\Program Files\\Gigabyte\\ET5\\update.exe"="C:\\Program Files\\Gigabyte\\ET5\\update.exe:*:Enabled:ftptest"
"C:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe"="C:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe:*:Enabled:Yahoo! Music Jukebox"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Documents and Settings\\Michael\\Desktop\\utorrent.exe"="C:\\Documents and Settings\\Michael\\Desktop\\utorrent.exe:*:Enabled:æTorrent"
"G:\\Games\\Rainbow Six Vegas\\Binaries\\R6Vegas_Game.exe"="G:\\Games\\Rainbow Six Vegas\\Binaries\\R6Vegas_Game.exe:*:Enabled:Rainbow Six Vegas"
"G:\\Games\\Rainbow Six Vegas\\Binaries\\R6Vegas_Launcher.exe"="G:\\Games\\Rainbow Six Vegas\\Binaries\\R6Vegas_Launcher.exe:*:Enabled:Rainbow Six Vegas Updater"
"G:\\Apps\\3ds max\\3dsmax.exe"="G:\\Apps\\3ds max\\3dsmax.exe:*:Enabled:Autodesk 3ds Max 9 32-bit"
"C:\\Program Files\\AIM6\\aim6.exe"="C:\\Program Files\\AIM6\\aim6.exe:*:Enabled:AIM"
"C:\\Program Files\\SuperTV\\supernettv.exe"="C:\\Program Files\\SuperTV\\supernettv.exe:*:Enabled:supernettv"
"C:\\Program Files\\Common Files\\AOL\\TopSpeed\\3.0\\aoltpsd3.exe"="C:\\Program Files\\Common Files\\AOL\\TopSpeed\\3.0\\aoltpsd3.exe:*:Enabled:AOL TopSpeed"
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL Connectivity Service Dialer"
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe:*:Enabled:AOL Connectivity Service"
"C:\\Program Files\\Common Files\\AOL\\1165475229\\EE\\aolsoftware.exe"="C:\\Program Files\\Common Files\\AOL\\1165475229\\EE\\aolsoftware.exe:*:Enabled:AOL Shared Components"
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader"
"C:\\Program Files\\Common Files\\AOL\\1165475229\\EE\\AOLHelix.exe"="C:\\Program Files\\Common Files\\AOL\\1165475229\\EE\\AOLHelix.exe:*:Enabled:AOL Helix"
"G:\\Games\\Brothers in Arms\\LA_Street_Racing__Epidem.ru_\\LASR\\LASR.exe"="G:\\Games\\Brothers in Arms\\LA_Street_Racing__Epidem.ru_\\LASR\\LASR.exe:*:Enabled:LASR"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\WINDOWS\\system32\\sqhsoijm.exe"="C:\\WINDOWS\\system32\\sqh"
"C:\\WINDOWS\\system32\\chifygsr.exe"="C:\\WINDOWS\\system32\\chi"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:
—————

Files with Hidden Attributes:

C:\Program Files\Autodesk\Autodesk DWF Viewer\_Setupx.dll
C:\Program Files\Image-Line\FL Studio 7\REX Shared Library.dll
C:\Program Files\Thugs at Bay\Zwei-Stein\14_43260.DLL
C:\Program Files\Thugs at Bay\Zwei-Stein\28_83260.DLL
C:\Program Files\Thugs at Bay\Zwei-Stein\AUTH3260.DLL
C:\Program Files\Thugs at Bay\Zwei-Stein\BASC3260.DLL
C:\Program Files\Thugs at Bay\Zwei-Stein\COKR3260.DLL
C:\Program Files\Thugs at Bay\Zwei-Stein\COOK3260.DLL
C:\Program Files\Thugs at Bay\Zwei-Stein\DNET3260.DLL
C:\Program Files\Thugs at Bay\Zwei-Stein\EDNT3260.DLL
C:\Program Files\Thugs at Bay\Zwei-Stein\ENCN3260.DLL
C:\Program Files\Thugs at Bay\Zwei-Stein\ENLV3260.DLL
C:\Program Files\Thugs at Bay\Zwei-Stein\ERV13260.DLL
C:\Program Files\Thugs at Bay\Zwei-Stein\ERV23260.DLL
C:\Program Files\Thugs at Bay\Zwei-Stein\ESPR3260.DLL
C:\Program Files\Thugs at Bay\Zwei-Stein\jpeglib.dll
C:\Program Files\Thugs at Bay\Zwei-Stein\PNCRT.DLL
C:\Program Files\Thugs at Bay\Zwei-Stein\PNGU3264.DLL
C:\Program Files\Thugs at Bay\Zwei-Stein\PNRS3260.DLL
C:\Program Files\Thugs at Bay\Zwei-Stein\RMBE3260.DLL
C:\Program Files\Thugs at Bay\Zwei-Stein\RMME3260.DLL
C:\Program Files\Thugs at Bay\Zwei-Stein\RMTO3260.DLL
C:\Program Files\Thugs at Bay\Zwei-Stein\RN5A3260.DLL
C:\Program Files\Thugs at Bay\Zwei-Stein\RNCO3260.DLL
C:\Program Files\Thugs at Bay\Zwei-Stein\RV103260.DLL
C:\Program Files\Thugs at Bay\Zwei-Stein\RV203260.DLL
C:\Program Files\Thugs at Bay\Zwei-Stein\SDPP3260.DLL
C:\Program Files\Thugs at Bay\Zwei-Stein\SIPR3260.DLL
C:\Program Files\Thugs at Bay\Zwei-Stein\tablib.dll
C:\Program Files\Thugs at Bay\Zwei-Stein\tassdll.dll
C:\Program Files\Thugs at Bay\Zwei-Stein\thereal.dll
C:\Program Files\Thugs at Bay\Zwei-Stein\vidfowin.dll
C:\Program Files\Thugs at Bay\Zwei-Stein\wavout.dll
C:\Program Files\Thugs at Bay\Zwei-Stein\wmfwrite.dll
C:\WINDOWS\TWljaGFlbCBCYXVlcg\asappsrv.dll
C:\Program Files\America Online 9.0\AOLphx.exe
C:\Program Files\America Online 9.0\rbm.exe
C:\Program Files\Autodesk\Autodesk DWF Viewer\Setup.exe
C:\Program Files\Common Files\Yazzle1122OinAdmin.exe
C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe
C:\Program Files\Common Files\Yazzle1396OinAdmin.exe
C:\Program Files\Common Files\Yazzle1396OinUninstaller.exe
C:\Program Files\Common Files\Adobe\ESD\DLMCleanup.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\àppPatch\regedit.exe
C:\Program Files\?ssembly\userinit.exe
C:\WINDOWS\winlo.exe
C:\WINDOWS\system32\??sembly\csrss.exe
C:\WINDOWS\TWljaGFlbCBCYXVlcg\command.exe~
C:\WINDOWS\??stem32\javaw.exe
C:\WINDOWS\??stem32\javaw.exe~
C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp
C:\Documents and Settings\Michael\Local Settings\Temp\BIT1B.tmp
C:\Documents and Settings\Michael\Local Settings\Temp\Free Download Manager\tic17B.tmp
C:\Documents and Settings\Michael\Local Settings\Temp\Free Download Manager\tic17C.tmp
C:\WINDOWS\system32\config\SAM.tmp.LOG
C:\WINDOWS\system32\config\SECURITY.tmp.LOG
C:\WINDOWS\TWljaGFlbCBCYXVlcg\nq53u3I5vF1Fsrp5w0.vbs

Finished!

—————————————————————————————————————————————————————–
Combofix:

ComboFix 07-09-12.4 - "Michael" 2007-09-12 17:27:36.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2668 [GMT -4:00]
.

((((((((((((((((((((((((( Files Created from 2007-08-12 to 2007-09-12 )))))))))))))))))))))))))))))))
.

2007-09-12 15:54 d——– C:\DOCUME~1\ADMINI~1\APPLIC~1\Lavasoft
2007-09-12 02:02 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-09-12 01:45 244,448 –a—— C:\WINDOWS\system32\73dd9e74.sys
2007-09-12 01:33 d——– C:\DOCUME~1\ONLINE~1.ABS\APPLIC~1\Prevx
2007-09-12 00:48 d——– C:\Program Files\SDFIX
2007-09-12 00:24 d——– C:\WINDOWS\ERUNT
2007-09-11 18:53 122,944 –a—— C:\WINDOWS\system32\chifygsr.exe
2007-09-11 18:35 d——– C:\DOCUME~1\Michael\APPLIC~1\Prevx
2007-09-11 18:34 d——– C:\Program Files\Prevx2
2007-09-11 18:34 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Prevx
2007-09-11 18:07 d——– C:\4fcf5627ce92a45714b3332de2c58906
2007-09-11 17:57 760,882 –a—— C:\WINDOWS\system32\LiveProtectSetup.exe
2007-09-11 17:40 235 –a—— C:\DOCUME~1\Michael\8036.bat
2007-09-11 17:39 13,312 –a—— C:\DOCUME~1\Michael\lim.exe
2007-09-11 15:08 d–hs—- C:\WINDOWS\TWljaGFlbCBCYXVlcg
2007-09-11 15:08 d——– C:\WINDOWS\rkiu
2007-09-11 15:08 d——– C:\Program Files\Common Files\rkiu
2007-09-11 15:08 d——– C:\DOCUME~1\LOCALS~1\APPLIC~1\NetMon
2007-09-11 15:04 241 –a—— C:\DOCUME~1\ONLINE~1.ABS\1114.bat
2007-09-11 15:04 13,312 –a—— C:\DOCUME~1\ONLINE~1.ABS\lim.exe
2007-09-11 15:03 9,814 –a—— C:\DOCUME~1\ONLINE~1.ABS\loo.exe
2007-09-11 15:03 53,773 ——— C:\DOCUME~1\ONLINE~1.ABS\lo.exe
2007-09-11 15:03 48,704 –a—— C:\WINDOWS\system32\hltvlylk.exe
2007-09-11 15:03 36,864 –a—— C:\DOCUME~1\ONLINE~1.ABS\winlogo.exe
2007-09-11 14:51 98,816 –a—— C:\mcdumrks.exe
2007-09-11 14:51 39,452 –a—— C:\voqw.exe
2007-09-11 14:51 d——– C:\WINDOWS\system32\dbl22
2007-09-11 14:51 d——– C:\WINDOWS\system32\cf2
2007-09-11 14:51 d——– C:\WINDOWS\system32\capcon
2007-09-11 14:50 65,549 –a—— C:\WINDOWS\system32\lo.exe
2007-09-11 14:50 56,406 –a—— C:\WINDOWS\system32\loo.exe
2007-09-11 14:50 221 –a—— C:\WINDOWS\system32\8163.bat
2007-09-11 14:50 13,312 –a—— C:\WINDOWS\system32\lim.exe
2007-09-11 14:50 d——– C:\Program Files\Insider
2007-09-11 14:18 209,920 –a—— C:\WINDOWS\system32\advert.dll
2007-09-11 14:18 1,812 –a—— C:\WINDOWS\system32\mp3rec.dll
2007-09-11 14:18 d——– C:\Mp3SRec
2007-09-10 16:27 d——– C:\Program Files\Enigma Software Group
2007-09-09 19:50 157 –a—— C:\WINDOWS\system32\2343.bat
2007-09-09 12:40 157 –a—— C:\DOCUME~1\Michael\8129.bat
2007-09-08 05:10 7,680 –a—— C:\WINDOWS\system32\ff_vfw.dll
2007-09-08 05:10 60,273 –a—— C:\WINDOWS\system32\pthreadGC2.dll
2007-09-08 05:10 d——– C:\Program Files\ffdshow
2007-09-08 05:07 d——– C:\Program Files\AVIcodec
2007-09-08 05:05 d——– C:\DOCUME~1\Michael\APPLIC~1\Media Player Classic
2007-09-08 03:05 d——– C:\Program Files\WellGet
2007-09-08 03:01 d——– C:\Program Files\wxDownload Fast
2007-09-08 01:22 147,456 –a—— C:\WINDOWS\system32\vbzip10.dll
2007-09-01 20:00 14,604 –a—— C:\WINDOWS\system32\drivers\pfc.sys
2007-08-25 23:21 d——– C:\Program Files\DVD Shrink
2007-08-25 21:04 706,048 –a—— C:\WINDOWS\system32\libmcl-3.1.1.dll
2007-08-25 21:04 3,423,744 –a—— C:\WINDOWS\system32\libfilefmt-1.1.0.dll
2007-08-25 21:04 20,480 –a—— C:\WINDOWS\system32\libavi-dd-1.2.0.dll
2007-08-25 21:04 d——– C:\Program Files\AVI to MPEG Converter
2007-08-25 18:37 6,475,776 –a—— C:\WINDOWS\system32\PSP VintageWarmer2.dll
2007-08-25 18:37 d——– C:\Program Files\PSPaudioware
2007-08-23 21:27 d——– C:\DOCUME~1\Michael\APPLIC~1\Alien Skin
2007-08-23 21:22 159,744 –a—— C:\WINDOWS\AVUNTOOL.EXE
2007-08-23 21:13 d——– C:\Program Files\Alien Skin
2007-08-23 16:16 338,432 –a—— C:\WINDOWS\IsUn0415.exe
2007-08-22 23:51 d——– C:\Program Files\Project64 1.6
2007-08-22 20:21 d——– C:\Program Files\Common Files\Invictus
2007-08-22 20:16 d——– C:\DOCUME~1\Michael\APPLIC~1\Gearbox Software
2007-08-21 17:06 584,704 –a—— C:\WINDOWS\system32\PSNetwork.dll
2007-08-21 17:06 403,456 –a—— C:\WINDOWS\system32\PowerPlayer.dll
2007-08-21 17:06 130 –a—— C:\Iotmrd.sys
2007-08-21 17:06 d——– C:\Program Files\SuperTV
2007-08-21 17:06 d——– C:\DOCUME~1\Michael\APPLIC~1\ppStream
2007-08-17 00:46 d——– C:\Program Files\Winamp
2007-08-16 17:44 d——– C:\Program Files\Gadwin Systems
2007-08-16 03:03 d——– C:\Program Files\MSXML 6.0
2007-08-14 20:19 d——– C:\Program Files\Maxis
2007-08-14 00:46 442,368 -ra—— C:\WINDOWS\system32\vp6vfw.dll
2007-08-13 23:06 d——– C:\DOCUME~1\Michael\APPLIC~1\MixMeister Technology

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-12 16:39 ——— d——– C:\Program Files\CB Model Pro
2007-09-11 18:15 ——— d——– C:\Program Files\Google
2007-09-11 15:18 ——— d——– C:\DOCUME~1\ONLINE~1.ABS\APPLIC~1\LimeWire
2007-09-11 15:16 10 –a—— C:\Program Files\.autoreg
2007-09-01 20:00 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-08-22 18:38 ——— d——– C:\Program Files\Free Download Manager
2007-08-22 17:00 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
2007-08-22 16:58 ——— d——– C:\Program Files\Viewpoint
2007-08-22 16:58 ——— d——– C:\Program Files\Common Files\AOL
2007-08-22 16:58 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
2007-08-22 16:55 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL Downloads
2007-08-13 21:13 ——— d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-08-09 23:01 ——— d——– C:\Program Files\Common Files\Sandlot Shared
2007-08-09 23:01 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sandlot Games
2007-08-09 23:00 ——— d——– C:\Program Files\ReflexiveArcade
2007-08-09 00:16 ——— d——– C:\Program Files\FriendBlasterPro
2007-08-09 00:09 ——— d——– C:\Program Files\PC Optimizer Pro
2007-08-08 18:44 ——— d——– C:\DOCUME~1\Michael\APPLIC~1\Sony
2007-08-07 20:47 ——— d——– C:\Program Files\Common Files\Cosmi
2007-08-07 20:47 ——— d——– C:\Program Files\Common Files\Borland Shared
2007-08-07 15:28 ——— d——– C:\Program Files\iColorFolder
2007-08-05 23:42 ——— d——– C:\Program Files\Common Files\Autodesk Shared
2007-08-05 23:41 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Autodesk
2007-08-02 21:53 107888 –a—— C:\WINDOWS\system32\CmdLineExt.dll
2007-08-02 21:38 ——— d——– C:\Program Files\QuickTime
2007-08-02 21:00 ——— d——– C:\Program Files\Ubisoft
2007-08-01 19:47 ——— dr-h—– C:\DOCUME~1\Michael\APPLIC~1\SecuROM
2007-08-01 08:13 33384 –a—— C:\WINDOWS\system32\drivers\atwpkt264.sys
2007-08-01 08:13 24960 –a—— C:\WINDOWS\system32\drivers\atwpkt2.sys
2007-08-01 08:13 103808 –a—— C:\WINDOWS\system32\AOLDial.dll
2007-07-31 17:01 ——— d——– C:\Program Files\t-racks
2007-07-31 16:42 ——— d——– C:\Program Files\Image-Line
2007-07-31 15:52 ——— d——– C:\Program Files\Quadro Uneraser 2.5
2007-07-31 15:42 ——— d——– C:\Program Files\DiskInternals
2007-07-31 15:24 ——— d——– C:\Program Files\MSN Messenger
2007-07-30 22:41 ——— d——– C:\Program Files\ProxyFinder
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\wups.dll
2007-07-29 17:08 ——— d——– C:\Program Files\ProxyFinderEnterprise
2007-07-28 16:06 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\nView_Profiles
2007-07-28 12:06 ——— d——– C:\DOCUME~1\Michael\APPLIC~1\uTorrent
2007-07-27 20:11 ——— d——– C:\Program Files\Syncrosoft
2007-07-27 17:45 ——— d——– C:\Program Files\TruePoker
2007-07-27 17:45 ——— d——– C:\Program Files\GameTop.com
2007-07-27 17:35 ——— d——– C:\Program Files\CCleaner
2007-07-27 15:52 ——— d——– C:\Program Files\Duplicate File Remover
2007-07-27 15:28 ——— d——– C:\Program Files\Magix
2007-07-27 03:46 ——— d——– C:\Program Files\Electronic Arts
2007-07-26 21:02 ——— d——– C:\Program Files\SpeedFan
2007-07-25 19:39 40136 –a—— C:\WINDOWS\system32\drivers\ET5Drv.sys
2007-07-25 18:02 ——— d——– C:\Program Files\AVI DivX to DVD SVCD VCD Converter
2007-07-25 17:39 ——— d——– C:\Program Files\LimeWire
2007-07-24 23:28 ——— d——– C:\Program Files\GoldWave
2007-07-24 20:45 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-07-24 16:02 ——— d——– C:\Program Files\TechSmith
2007-07-24 16:02 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\TechSmith
2007-07-23 18:45 ——— d——– C:\DOCUME~1\Michael\APPLIC~1\Azureus
2007-07-23 16:03 ——— d——– C:\Program Files\Azureus
2007-07-23 16:03 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
2007-07-20 22:03 ——— d——– C:\Program Files\Common Files\Native Instruments
2007-07-20 18:56 ——— d——– C:\Program Files\IK Multimedia
2007-07-20 18:51 ——— d——– C:\DOCUME~1\Michael\APPLIC~1\InstallShield
2007-07-20 03:50 294912 –a—— C:\WINDOWS\dsdxirmv.exe
2007-07-18 18:16 ——— d——– C:\Program Files\AIM6
2007-07-18 18:16 ——— d——– C:\DOCUME~1\Michael\APPLIC~1\acccore
2007-07-18 10:27 ——— d——– C:\Program Files\DC++
2007-07-18 01:07 ——— d——– C:\DOCUME~1\Michael\APPLIC~1\Propellerhead Software
2007-07-18 01:05 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Propellerhead Software
2007-07-18 01:03 ——— d——– C:\Program Files\Propellerhead
2007-07-17 19:59 ——— d——– C:\Program Files\RapidCheck
2007-07-12 18:18 50520 –a—— C:\WINDOWS\system32\csvidcap.dll
2007-07-12 04:54 107864 –a—— C:\WINDOWS\system32\tsccvid.dll
2007-06-26 02:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-19 09:31 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-13 06:23 1044480 –a—— C:\WINDOWS\explorer.exe
2007-04-04 17:46 87608 –a—— C:\DOCUME~1\Michael\APPLIC~1\ezpinst.exe
2007-04-04 17:46 47360 –a—— C:\DOCUME~1\Michael\APPLIC~1\pcouffin.sys
2006-01-01 04:30 108 –a—— C:\Program Files\piconfig.lx
2005-07-29 20:24:26 472 –sha-r C:\WINDOWS\TWljaGFlbCBCYXVlcg\nq53u3I5vF1Fsrp5w0.vbs
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0B99F297-B0C1-483B-90A8-61E45BA8322A}]
C:\WINDOWS\system32\ddccc.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{203CD78F-4E66-40E4-3620-3871C17593EF}]
C:\WINDOWS\system32\zma.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{213ED788-1A65-18B4-6120-3871C17593ED}]
C:\WINDOWS\system32\bxtnczme.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{733E9132-53CA-4C97-9AC9-145C4502FA20}]
C:\WINDOWS\system32\fccdbyx.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2005-10-16 22:31 C:\WINDOWS\system32\nwiz.exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-05-20 14:46 C:\WINDOWS\KHALMNPR.Exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-10-16 22:31]
"NvMediaCenter"="NvMCTray.dll" [2005-10-16 22:31 C:\WINDOWS\system32\nvmctray.dll]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"HostManager"="C:\Program Files\Common Files\AOL\1165475229\ee\AOLSoftware.exe" [2007-05-25 13:16]
"WinampAgent"="G:\Apps\Winamp\winampa.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-03-23 17:11]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:00]
"Free Download Manager"="C:\Program Files\Free Download Manager\fdm.exe" []
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-07-09 16:05]
"Gadwin PrintScreen"="C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe" [2007-07-02 04:15]
"mschkdsk.exe"="C:\WINDOWS\system32\mschkdsk.exe" []
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-08-13 20:04]
"Insider"="C:\Program Files\Insider\Insider.exe" []
"Habb"="C:\WINDOWS\STEM32~1\javaw.exe" []
"Ifkla"="C:\Program Files\?ppPatch\regedit.exe" []

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-01-17 22:53:37]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2007-03-23 17:11:51]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-03-23 17:11:11]

C:\DOCUME~1\ONLINE~1.ABS\STARTM~1\Programs\Startup\
LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2007-07-24 16:07:57]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{733E9132-53CA-4C97-9AC9-145C4502FA20}"= C:\WINDOWS\system32\fccdbyx.dll [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fccdbyx]
fccdbyx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll 2001-12-20 22:34 24576 C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\\WINDOWS\\system32\\pmnno

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
backup=C:\WINDOWS\pss\AutoCAD Startup Accelerator.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Michael^Start Menu^Programs^Startup^Yahoo! Widget Engine.lnk]
backup=C:\WINDOWS\pss\Yahoo! Widget Engine.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
"C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start]
"C:\Program Files\America Online 9.0\AOL.EXE" -b

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Spyware Protection]
"C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DigidesignMMERefresh]
C:\Program Files\Digidesign\Drivers\MMERefresh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
"C:\Program Files\Electronic Arts\EA Link\Core.exe" -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyTuneV]
C:\Program Files\Gigabyte\ET5\GUI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
C:\Program Files\Common Files\AOL\1165475229\ee\AOLSoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
C:\Program Files\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MediaLifeService]
"C:\Program Files\Logitech\MediaLife\MediaLifeService.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceNotifier]
C:\Program Files\MySpace Notifier\MySpace Notifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Peer Impact]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pure Networks Port Magic]
"C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RapidCheck]
C:\Program Files\RapidCheck\RapidCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RocketDock]
"C:\Program Files\RocketDock\RocketDock.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
RTHDCPL.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
SkyTel.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
"C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
"C:\Program Files\Windows Defender\MSASCui.exe" -hide

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFlyer32.dll]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
"C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

R0 DigiFilter;DigiFilter;C:\WINDOWS\system32\drivers\DigiFilt.sys
R0 PrevxDriver;PREVX Kernel Mode Agent;C:\WINDOWS\system32\DRIVERS\pxfsf.sys
R1 PREVXTdi;PREVX TDI filter;C:\WINDOWS\system32\DRIVERS\pxtdi.sys
R1 PXRDDriver;PREVX Rootkitscan driver;C:\WINDOWS\system32\DRIVERS\pxrd.sys
R2 EvoInstallerService;M-Audio Installer;C:\Program Files\M-Audio\Install\EvoInst.exe
R2 gearsec;gearsec;C:\WINDOWS\system32\gearsec.exe
R2 MAudioUSBService;M-Audio USB Installer;C:\Program Files\M-Audio\Fast Track Pro\MAUSBInst.exe
R3 MAUSB;Service for M-Audio Fast Track Pro Driver (WDM);C:\WINDOWS\system32\DRIVERS\mausb.sys
S2 InCDsrvR;InCD Helper (read only);C:\Program Files\Ahead\InCD\InCDsrv.exe -r
S3 EVOLUSB;%EVOL_USB.SvcDesc%;C:\WINDOWS\system32\drivers\evolusb.sys
S3 MagixASIODrv;MAGIX_ASIO_BoostDriver;\??\C:\Program Files\Magix\Samplitude_V8_professional\mxasio.sys
S3 MarkFun_NT;MarkFun_NT;\??\C:\Program Files\Gigabyte\ET5\markfun.w32
S3 Point32;Microsoft IntelliPoint Filter Driver;C:\WINDOWS\system32\DRIVERS\point32.sys
S3 PREVXEmulator;PREVX Emulator driver;C:\WINDOWS\system32\DRIVERS\PxEmu.sys
S3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-09-08 12:45:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-09-12 21:21:55 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-12 17:30:52
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwOpenFile

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-12 17:32:25
C:\ComboFix-quarantined-files.txt … 2007-09-12 17:32
.
— E O F —
————————————————————————————————————————————————

HJT:

Logfile of HijackThis v1.99.1
Scan saved at 5:58:59 PM, on 9/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Digidesign\Drivers\MMERefresh.exe
C:\Program Files\M-Audio\Install\EvoInst.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\gearsec.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\M-Audio\Fast Track Pro\MAUSBInst.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Prevx2\PXAgent.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Common Files\AOL\1165475229\ee\AOLSoftware.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wpabaln.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\retadpu21.exe
C:\WINDOWS\system32\f03WtR\f03WtR1066.exe
C:\Program Files\Web Buying\v1.8.3\webbuying.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\3.exe
C:\Program Files\Network Monitor\netmon.exe
C:\WINDOWS\TWljaGFlbCBCYXVlcg\command.exe
C:\Program Files\iWin\howyk22011.exe
C:\WINDOWS\retadpu1000106.exe
C:\WINDOWS\system32\win32.exe
C:\WINDOWS\system32\win321.exe
C:\WINDOWS\system32\pipmon.exe
C:\WINDOWS\system32\pipmon.exe
C:\WINDOWS\system32\dwwin.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijackthis\FindVundo.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=566…www.google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = C:\Program Files\AOL Toolbar\welcome.html
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0B99F297-B0C1-483B-90A8-61E45BA8322A} - C:\WINDOWS\system32\ddccc.dll (file missing)
O2 - BHO: BhoApp Class - {0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} - C:\WINDOWS\system32\bho.dll
O2 - BHO: (no name) - {203CD78F-4E66-40E4-3620-3871C17593EF} - C:\WINDOWS\system32\zma.dll (file missing)
O2 - BHO: (no name) - {213ED788-1A65-18B4-6120-3871C17593ED} - C:\WINDOWS\system32\bxtnczme.dll (file missing)
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {733E9132-53CA-4C97-9AC9-145C4502FA20} - C:\WINDOWS\system32\fccdbyx.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {8c60345b-a7fe-4236-88eb-d0dcc43db0ff} - C:\WINDOWS\system32\khwdkbg.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: 0 - {A677F917-6C3C-4B0C-3FBC-338194D069A0} - C:\Program Files\Windows NT\labunuwir.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1165475229\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [WinampAgent] G:\Apps\Winamp\winampa.exe
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu1000106.exe 61A847B5BBF72813329B385772FF01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310
O4 - HKLM\..\Run: [howyk] C:\Program Files\iWin\howyk22011.exe
O4 - HKLM\..\Run: [pipmon] pipmon.exe
O4 - HKLM\..\Run: [Windows Framework] C:\DOCUME~1\Michael\LOCALS~1\Temp\frmwrk.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Gadwin PrintScreen] C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash
O4 - HKCU\..\Run: [mschkdsk.exe] C:\WINDOWS\system32\mschkdsk.exe
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKCU\..\Run: [Insider] C:\Program Files\Insider\Insider.exe
O4 - HKCU\..\Run: [Habb] "C:\WINDOWS\STEM32~1\javaw.exe" -vt yazb
O4 - HKCU\..\Run: [Ifkla] "C:\Program Files\?ppPatch\regedit.exe"
O4 - HKCU\..\Run: [WebBuying] C:\Program Files\Web Buying\v1.8.3\webbuying.exe
O4 - Global Startup: 1.exe
O4 - Global Startup: 2.exe
O4 - Global Startup: 3.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Download all by WellGet - C:\Program Files\WellGet\nxall.htm
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Download by &WellGet - C:\Program Files\WellGet\nxcatch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://a1540.g.akamai.net/7/1540/52/200612…ex/qtplugin.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: bw+0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: offline-8876480 - {13808911-B9AF-4043-AFBA-81F7C73A9305} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - Winlogon Notify: fccdbyx - fccdbyx.dll (file missing)
O20 - Winlogon Notify: WB - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\TWljaGFlbCBCYXVlcg\command.exe
O23 - Service: Digidesign MME Refresh Service (DigiRefresh) - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O23 - Service: digiSPTIService - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Pro Tools\digiSPTIService.exe
O23 - Service: M-Audio Installer (EvoInstallerService) - Unknown owner - C:\Program Files\M-Audio\Install\EvoInst.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: gearsec - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: M-Audio USB Installer (MAudioUSBService) - M-Audio - C:\Program Files\M-Audio\Fast Track Pro\MAUSBInst.exe
O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - G:\Apps\3ds max\mentalray\satellite\raysat_3dsmax9_32server.exe (file missing)
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PREVXAgent - Unknown owner - C:\Program Files\Prevx2\PXAgent.exe" -f (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

———————————————————————————————————————————————————————-

By the way, it seems like my computer is getting worse everytime I connect to the internet again. Are these viruses multiplying?

IndiGenus

Post #14September 12, 2007, 10:55 PM UTC

By the way, it seems like my computer is getting worse everytime I connect to the internet again. Are these viruses multiplying?

No surprise, this is one of the most infected computers I've ever worked on or seen. I will put together the next part of the fix for you. In the meantime, please provide me a list of installed programs using HJT. Honestly if this were my computer and I was looking at a reformat/re-install in the near future I would just do it now. But I'll try and do my best to get this as clean as possible in the meantime, again, no guarantees here on this one. Please be patient the next step of the fix will likely take me quite some time to put together. But post the list from below in the meantime and I'll incorporate that into the fix.1. Open HijackThis and click on the Config… button in the "Other stuff" section (lower right hand corner).
2. Click on the Misc Tools button.
3. Click on the Open Uninstall Manager… button.
4. Click on the Save list… button.
5. Save the file uninstall_list.txt to a convinient location. This should open Notepad with the list.
6. Please Copy and Paste the list into your next reply.

Absurdny

Post #15September 12, 2007, 11:31 PM UTC last edited September 12, 2007, 11:32 PM UTC

this is one of the most infected computers I've ever worked on or seen. I will put together the next part of the fix for you. In the meantime, please provide me a list of installed programs using HJT. Honestly if this were my computer and I was looking at a reformat/re-install in the near future I would just do it now. But I'll try and do my best to get this as clean as possible in the meantime, again, no guarantees here on this one. Please be patient the next step of the fix will likely take me quite some time to put together. But post the list from below in the meantime and I'll incorporate that into the fix.
1. Open HijackThis and click on the Config… button

I have fate in you!

Here is the uninstall list:

@BIOS
3D Home Architect Home Design Deluxe 6
3ivx D4 4.5.1 (remove only)
6000 Sound Effects
Able Batch Converter 1.9
Ad-Aware SE Personal
Adder Robot [SCK]
Adder Robot [SCK]
Adder Robot [SCK]
Adder Robot [SCK]
Adder Robot [WB]
Adder Robot [WB]
Adder Robot [WB]
Adder Robot 3.0.9
Adder Robot 3.1
Adobe Download Manager 2.0 (Remove Only)
Adobe Illustrator CS
Adobe Photoshop 7.0
Adobe Premiere Pro
Adobe Reader 7.0.8
Adobe SVG Viewer 3.0
AIM 6
Alibre Design
Alibre Design Help
Alien Skin Eye Candy 5 Textures
Amazing Slow Downer (remove only)
America's Army
AmpliTube Jimi Hendrix
AnalogX Vocoder
Antares Kantos v1.0
AOL Coach Version 2.0(Build:20041026.5 en)
AOL Deskbar
AOL Registration
AOL Spyware Protection
AOL Toolbar
AOL Uninstaller (Choose which Products to Remove)
Apple Software Update
Athlon 64 Processor Driver
AutoCAD 2007 - English
Autodesk 3ds Max 9 32-bit
Autodesk DWF Viewer
AV Bros. Page Curl 1.2 (Remove Only)
AV Bros. Puzzle Pro 1.2 (Remove Only)
AVI DivX to DVD SVCD VCD Converter 3.0.0512
AVI to MPEG Converter
AVIcodec (remove only)
Azureus
Azureus Vuze
Brothers In Arms
Cakewalk VST Adapter [removed]
Camtasia Studio 4
Canon S200
CCleaner (remove only)
Command
DC++ 0.698
Deckadance
Digidesign Pro Tools M-Powered Demo 7.1
Digidesign Shared Plug-Ins 7.0
DMIView
DreamStation DXi2
Driver
Duplicate File Remover 1.2
DVD Ripper Platinum 4
DVD Shrink 3.2
EA Link
Easy Avi/Divx/Xvid to DVD Burner 2.4.7
EasyTune5
Eye Candy 4000
Face-wizard
Fast Track Pro
FastStone Capture 5.2
ffdshow [rev 1463] [2007-09-05]
FL Studio 5
FL Studio 7
FLAC Installer 1.1.3b (remove only)
Forex Learn to Trade ver 1.0
Fre(a)koscope
FriendBlasterPro
FXhome EffectsLab Pro (remove only)
Gadwin PrintScreen
G-Force
GoldWave v4.26
GoldWave v5.20
Google Toolbar for Internet Explorer
Gran Paradiso (3.0a1)
GTA San Andreas
Half-Life
HALion v1.0 VSTi
High Definition Audio Driver Package - KB835221
High Definition Audio Driver Package - KB888111
Hijackthis 1.99.1
HijackThis 1.99.1
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB896344)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
iColorFolder
IL Download Manager
InterLok Driver Kit
Java™ 6 Update 2
Kaspersky Online Scanner
KGB Hunter
Korg Legacy Collection VSTi v1.0.02
KORG TR Voice Name List
KORG USB-MIDI Driver Tools for Windows XP
LA Street Racing
LimeWire PRO 4.13.13
Logitech Desktop Messenger
Logitech SetPoint
Macromedia Dreamweaver 8
Macromedia Extension Manager
Macromedia Fireworks 8
Macromedia Flash 8
Macromedia Flash 8 Video Encoder
Macromedia Flash Player 8
Macromedia Flash Player 8
Macromedia Flash Player 8 Plugin
Madden NFL 07
Magix Samplitude Professional v8.01
Mario Forever v 2.16 !
M-Audio Enigma
MediaLife
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0
Microsoft .NET Framework 3.0
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Text-to-Speech Engine 4.0 (English)
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Windows Media Video 9 VCM
MIKSOFT Mobile 3GP converter
mIRC
Miroslav Philharmonik
MixMeister BPM Analyzer 1.0
MixMeister Fusion
Mozilla Firefox (2.0.0.6)
Mp3 Stream Recorder
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 6.0 Parser (KB933579)
MusicLab RealGuitar v1.5
Musicmatch® Jukebox
MySpace Notifier
MySpaceIM
N.I Pro-53 v3.0
Native Instruments - Traktor 1.06
Native Instruments Battery VSTi v2.1.5
Native Instruments ElektrikPiano (remove only)
Native Instruments FM7 VSTi v1.1.3.4
Native Instruments Komplete 4 DXi
Native Instruments Kontakt
Native Instruments Pro52 v2.2
Nero Suite
Network Monitor
NoteTab Light (Remove only)
NVIDIA Drivers
NVIDIA ForceWare Network Access Manager
OpD2d
PC Optimizer Pro ver.4.3.3
PFConfig 1.0.146
PhatBuzz Freeware Version
Prevx 2.0 Agent
Project64 1.6
Proxy Finder
Proxy Finder Enterprise Edition
PSP VintageWarmer 2.0.0
Punch! Home Design - AS4000
Pure Networks Port Magic
Quadro Uneraser 2.5
Quick Screen Recorder 1.5
QuickTime
RapidCheck v0.5
Real Pool
RealPlayer Basic
Reason 3.0
ReCycle 2.0
Refresher
Registry Mechanic 6.0
Rhapsody Player Engine
Rhythm'n'Chords 2 Pro CW
Rob Papen BLUE Version 1.6.3b
RocketDock 1.2.5
SampleTank 2.2
Sandlot Games Client Services 1.2.2
SC Video Converter 4.2.0.0
Scarface: The World is Yours
Security Update for Microsoft .NET Framework 2.0 (KB928365)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB938829)
Sim City 4 - Rush Hour
SmartUtils FastChords Lite 3.0
SoftSkies
Soldier of Fortune II - Double Helix GOLD
SONAR 6 Producer Edition
Sonic Foundry CD Architect 5.0
Sonik Synth 2
Sony DVD Architect 3.0
SpeedFan (remove only)
Steinberg Mastering Edition v1.0
Steinberg The Grand
Super Granny 3
SuperTV 5.8
Syncrosoft's License Control
The Sims 2
Timeworks Mastering EQ
Tom Clancy's Rainbow Six Vegas
Tom Clancy's Rainbow Six: Lockdown
Tony Hawk's American Wasteland ™
T-RackS Plug-in
T-RackS Plug-in
Trailer Park Tycoon
TriEdPro 2.6
Triton Sound Editor v1.0
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB900930)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920342)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB925720)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB933360)
Update for Windows XP (KB938828)
URGE
Viewpoint Media Player
Virtual Earth 3D (Beta)
VSO Image Resizer 1.0.11
Waves Native Gold Bundle v3.01
Web Buying
WhiteCap
Winamp (remove only)
WindowBlinds
Windows Communication Foundation
Windows Defender
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Format SDK Hotfix - KB891122
Windows Media Player 11
Windows Media Player 11
Windows Presentation Foundation
Windows Vista Upgrade Advisor
Windows Workflow Foundation
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
WinRAR archiver
Wisdom-soft AutoScreenRecorder 2.1 Pro
wxDownload Fast 0.6.0
Xara Xtreme Pro
Xara3D6
Xara3D6
Xenofex 1.0
XML Paper Specification Essentials Pack
XML Paper Specification Essentials Pack 1.0
XML Paper Specification Shared Components Pack 1.0
Yahoo! Browser Services
Yahoo! Install Manager
Yahoo! Internet Mail
Yahoo! Messenger
Yahoo! Music Jukebox
Yahoo! Toolbar
Yahoo! Widgets
Zwei-Stein Video Compositor 3.01 (Beta 2).

Also, do you think I sould reactivate windows like its asking me to?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Omg! Kaspersky Found Over 2300 Infected Items!

✨ Ask AI

Ask AI