[Closed] I Could Use Some Help

Thank you very much for your help. I completed all four steps. Here is the reports requested. Let me know if there is any thing else I should do. Step #1 VundoFix V6.5.8 Checking Java version… Java version is 1.4.2.3 Old versions of java are exploitable and should be removed. Java version is 1.5.0.6 Old versions of java are exploitable and should be removed. Scan started at 3:15:47 PM 9/17/2007 Listing files found while scanning…. C:\windows\system32\drvfah2.dll C:\WINDOWS\system32\xxyvsqq.dll Beginning removal… Attempting to delete C:\windows\system32\drvfah2.dll C:\windows\system32\drvfah2.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\xxyvsqq.dll C:\WINDOWS\system32\xxyvsqq.dll Could not be deleted. Performing Repairs to the registry. Done! VundoFix V6.5.8 Checking Java version… Java version is 1.4.2.3 Old versions of java are exploitable and should be removed. Java version is 1.5.0.6 Old versions of java are exploitable and should be removed. Scan started at 3:27:00 PM 9/17/2007 Listing files found while scanning…. C:\windows\system32\xxyvsqq.dll Beginning removal… Attempting to delete C:\windows\system32\xxyvsqq.dll C:\windows\system32\xxyvsqq.dll Has been deleted! Performing Repairs to the registry. Done!

All in one post was to long so each step will be in a seperate post. Step #2 SDFix: Version 1.105 Run by [removed] on Mon 09/17/2007 at 03:45 PM Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting… Normal Mode: Checking Files: Trojan Files Found: C:\Documents and Settings\HP_Administrator\Local Settings\Temp\win19B3.tmp.exe - Deleted C:\Documents and Settings\HP_Administrator\Local Settings\Temp\win19B9.tmp.exe - Deleted C:\Documents and Settings\HP_Administrator\Local Settings\Temp\win19C3.tmp.exe - Deleted C:\WINDOWS\temp\win5FB2.tmp.exe - Deleted C:\WINDOWS\Temp\win5FB2.tmp.exe - Deleted C:\Program Files\Common Files\Yazzle1162OinUninstaller.exe - Deleted C:\Documents and Settings\HP_Administrator\Application Data\Install.dat - Deleted Removing Temp Files… ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: —————— Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Updates from HP\\309731\\Program\\Updates from HP.exe"="C:\\Program Files\\Updates from HP\\309731\\Program\\Updates from HP.exe:*:Enabled:BackWeb for Pavilion" "C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"="C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe:*:Enabled:Earthlink" "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger" "C:\\Program Files\\Google\\Google Talk\\googletalk.exe"="C:\\Program Files\\Google\\Google Talk\\googletalk.exe:*:Enabled:Google Talk" "C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe:*:Enabled:Yahoo! Messenger" "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server" "C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"="C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe:*:Enabled:Sid Meier's Civilization 4" "C:\\Program Files\\Yahoo!\\Yahoo! Music Engine\\YahooMusicEngine.exe"="C:\\Program Files\\Yahoo!\\Yahoo! Music Engine\\YahooMusicEngine.exe:*:Enabled:Yahoo! Music Engine" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0" "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\MostFun\\Bin\\MostFun.exe"="C:\\Program Files\\MostFun\\Bin\\MostFun.exe:*:Enabled:MostFun" "C:\\DOCUME~1\\HP_ADM~1\\LOCALS~1\\Temp\\win19B1.tmp.exe"="C:\\DOCUME~1\\HP_ADM~1\\LOCALS~1\\Temp\\win19B1.tmp.exe:*:Enabled:win19B1.tmp" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%ProgramFiles%\\iTunes\\iTunes.exe"="%ProgramFiles%\\iTunes\\iTunes.exe:*:enabled:iTunes" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0" "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" Remaining Files: ————— File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes: C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\pokemon\Thumbs.db C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Thumbs.db C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\online HighSchool\fitness\~$ssignment 2.doc C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\online HighSchool\fitness\~$sssignment 1.doc C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\pokemon\Thumbs.db C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Servatrixians(Trixies)\Thumbs.db C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\site.memzit.com\pictures\Thumbs.db C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\site.memzit.com\test\~$Main.mht C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Thumbs.db C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Thumbs.db C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-07-01-1148-20\Thumbs.db C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-07-01-1155-24\Thumbs.db C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-07-01-1157-01\Thumbs.db C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-07-01-1203-01\Thumbs.db C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-07-30-1746-33\Thumbs.db C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-07-30-1758-16\Thumbs.db C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-09-02-1950-00\Thumbs.db C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-09-06-1422-28\Thumbs.db C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-09-06-1430-27\Thumbs.db C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\david archuleta\Thumbs.db C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-07-01-1148-20\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-07-01-1155-24\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-07-01-1157-01\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-07-01-1203-01\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-07-30-1746-33\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-07-30-1758-16\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-09-02-1950-00\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-09-06-1422-28\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-09-06-1430-27\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Alanis Morissette\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Alanis Morissette\Everything - Single\AlbumArtSmall.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Alanis Morissette\Everything - Single\AlbumArt_{C7E1B9A5-9538-4D43-8B9C-229EF2B87B36}_Large.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Alanis Morissette\Everything - Single\AlbumArt_{C7E1B9A5-9538-4D43-8B9C-229EF2B87B36}_Small.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Alanis Morissette\Everything - Single\desktop.ini C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Alanis Morissette\Everything - Single\Folder.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Cherie Call\desktop.ini C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Cherie Call\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Cherie Call\Beneath These Stars\AlbumArtSmall.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Cherie Call\Beneath These Stars\AlbumArt_{CC8F8FBE-EEE2-4FB5-ACB6-0C830E445C49}_Large.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Cherie Call\Beneath These Stars\AlbumArt_{CC8F8FBE-EEE2-4FB5-ACB6-0C830E445C49}_Small.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Cherie Call\Beneath These Stars\desktop.ini C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Cherie Call\Beneath These Stars\Folder.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Cherie Call\Beneath These Stars\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Cherie Call\The Oceans in Me\AlbumArtSmall.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Cherie Call\The Oceans in Me\AlbumArt_{0ED0EBCB-018E-4485-8FE5-63090F5504BA}_Large.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Cherie Call\The Oceans in Me\AlbumArt_{0ED0EBCB-018E-4485-8FE5-63090F5504BA}_Small.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Cherie Call\The Oceans in Me\desktop.ini C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Cherie Call\The Oceans in Me\Folder.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Cherie Call\The Oceans in Me\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\david archuleta\AlbumArtSmall.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\david archuleta\AlbumArt_{A2C10397-54EC-49D4-A5A2-179A01520BC0}_Large.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\david archuleta\AlbumArt_{A2C10397-54EC-49D4-A5A2-179A01520BC0}_Small.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\david archuleta\desktop.ini C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\david archuleta\Folder.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\david archuleta\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Deardorf Peterson Group\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Deardorf Peterson Group\Portal\AlbumArtSmall.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Deardorf Peterson Group\Portal\AlbumArt_{651FD0C7-7D65-4BC5-8B0D-E71DFD4192EC}_Large.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Deardorf Peterson Group\Portal\AlbumArt_{651FD0C7-7D65-4BC5-8B0D-E71DFD4192EC}_Small.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Deardorf Peterson Group\Portal\desktop.ini C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Deardorf Peterson Group\Portal\Folder.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Enya\desktop.ini C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Enya\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Enya\Shepherd Moons\AlbumArtSmall.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Enya\Shepherd Moons\AlbumArt_{5843046C-FE53-452E-AAD2-CFC9187B6BAB}_Large.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Enya\Shepherd Moons\AlbumArt_{5843046C-FE53-452E-AAD2-CFC9187B6BAB}_Small.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Enya\Shepherd Moons\desktop.ini C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Enya\Shepherd Moons\Folder.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Enya\Shepherd Moons\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Fall Out Boy\desktop.ini C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Fall Out Boy\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Fall Out Boy\From Under the Cork Tree\AlbumArtSmall.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Fall Out Boy\From Under the Cork Tree\AlbumArt_{BEC47316-A373-4054-8368-7D8D139252D7}_Large.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Fall Out Boy\From Under the Cork Tree\AlbumArt_{BEC47316-A373-4054-8368-7D8D139252D7}_Small.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Fall Out Boy\From Under the Cork Tree\desktop.ini C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Fall Out Boy\From Under the Cork Tree\Folder.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\From Under the Cork Tree\AlbumArtSmall.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\From Under the Cork Tree\AlbumArt_{BEC47316-A373-4054-8368-7D8D139252D7}_Large.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\From Under the Cork Tree\AlbumArt_{BEC47316-A373-4054-8368-7D8D139252D7}_Small.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\From Under the Cork Tree\desktop.ini C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\From Under the Cork Tree\Folder.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\From Under the Cork Tree\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\iTunes\iTunes Music\Avril Lavigne\desktop.ini C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\iTunes\iTunes Music\Avril Lavigne\Let Go\AlbumArtSmall.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\iTunes\iTunes Music\Avril Lavigne\Let Go\AlbumArt_{DF37EBF1-2582-4663-B52A-CBB2957E32C9}_Large.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\iTunes\iTunes Music\Avril Lavigne\Let Go\AlbumArt_{DF37EBF1-2582-4663-B52A-CBB2957E32C9}_Small.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\iTunes\iTunes Music\Avril Lavigne\Let Go\desktop.ini C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\iTunes\iTunes Music\Avril Lavigne\Let Go\Folder.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\iTunes\iTunes Music\Unknown Artist\Unknown Album\AlbumArtSmall.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\iTunes\iTunes Music\Unknown Artist\Unknown Album\AlbumArt_{6675FC7C-41B9-4BB4-83E4-1E0F68C78F62}_Large.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\iTunes\iTunes Music\Unknown Artist\Unknown Album\AlbumArt_{6675FC7C-41B9-4BB4-83E4-1E0F68C78F62}_Small.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\iTunes\iTunes Music\Unknown Artist\Unknown Album\desktop.ini C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\iTunes\iTunes Music\Unknown Artist\Unknown Album\Folder.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\King Sunny Ade & His African Beats\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\King Sunny Ade & His African Beats\Synchro Series\AlbumArtSmall.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\King Sunny Ade & His African Beats\Synchro Series\AlbumArt_{67B7BD5D-DB1C-42D6-94CE-ED833733EA9A}_Large.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\King Sunny Ade & His African Beats\Synchro Series\AlbumArt_{67B7BD5D-DB1C-42D6-94CE-ED833733EA9A}_Small.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\King Sunny Ade & His African Beats\Synchro Series\desktop.ini C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\King Sunny Ade & His African Beats\Synchro Series\Folder.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Mark Knopfler\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Mark Knopfler\shangri-la\AlbumArtSmall.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Mark Knopfler\shangri-la\AlbumArt_{C48DCAF6-2F16-4907-B5EF-48950D78A7B5}_Large.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Mark Knopfler\shangri-la\AlbumArt_{C48DCAF6-2F16-4907-B5EF-48950D78A7B5}_Small.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Mark Knopfler\shangri-la\desktop.ini C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Mark Knopfler\shangri-la\Folder.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Original Broadway Cast\desktop.ini C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Original Broadway Cast\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Original Broadway Cast\Wicked\AlbumArtSmall.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Original Broadway Cast\Wicked\AlbumArt_{A4E73CDB-B1D6-4B42-8D73-D947C9B04288}_Large.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Original Broadway Cast\Wicked\AlbumArt_{A4E73CDB-B1D6-4B42-8D73-D947C9B04288}_Small.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Original Broadway Cast\Wicked\desktop.ini C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Original Broadway Cast\Wicked\Folder.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Original Broadway Cast\Wicked\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Original Soundtrack\desktop.ini C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Original Soundtrack\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Original Soundtrack\Anastasia [Atlantic]\AlbumArtSmall.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Original Soundtrack\Anastasia [Atlantic]\AlbumArt_{6675FC7C-41B9-4BB4-83E4-1E0F68C78F62}_Large.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Original Soundtrack\Anastasia [Atlantic]\AlbumArt_{6675FC7C-41B9-4BB4-83E4-1E0F68C78F62}_Small.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Original Soundtrack\Anastasia [Atlantic]\desktop.ini C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Original Soundtrack\Anastasia [Atlantic]\Folder.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Original Soundtrack\Anastasia [Atlantic]\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Robert Randolph & the Family Band\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Robert Randolph & the Family Band\Unclassified\AlbumArtSmall.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Robert Randolph & the Family Band\Unclassified\AlbumArt_{26A33310-6993-4A56-8C9C-9D6EF06F3FCC}_Large.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Robert Randolph & the Family Band\Unclassified\AlbumArt_{26A33310-6993-4A56-8C9C-9D6EF06F3FCC}_Small.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Robert Randolph & the Family Band\Unclassified\desktop.ini C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Robert Randolph & the Family Band\Unclassified\Folder.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Rosie Thomas\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Rosie Thomas\Only With Laughter Can You Win\AlbumArtSmall.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Rosie Thomas\Only With Laughter Can You Win\AlbumArt_{A4D1E22A-5BA7-4371-BD03-036A45194952}_Large.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Rosie Thomas\Only With Laughter Can You Win\AlbumArt_{A4D1E22A-5BA7-4371-BD03-036A45194952}_Small.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Rosie Thomas\Only With Laughter Can You Win\desktop.ini C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Rosie Thomas\Only With Laughter Can You Win\Folder.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Sample Music\AlbumArtSmall.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Sample Music\AlbumArt_{08115859-E625-4BCD-83A8-57E01873B42F}_Large.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Sample Music\AlbumArt_{08115859-E625-4BCD-83A8-57E01873B42F}_Small.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Sample Music\AlbumArt_{EFFDEB51-C913-4EE1-8B2A-C80112057955}_Large.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Sample Music\AlbumArt_{EFFDEB51-C913-4EE1-8B2A-C80112057955}_Small.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Sample Music\desktop.ini C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Sample Music\Folder.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Sample Music\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Sample Playlists\desktop.ini C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\The Shins\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\The Shins\Chutes Too Narrow\AlbumArtSmall.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\The Shins\Chutes Too Narrow\AlbumArt_{0777EFA4-BE8E-4322-947F-86D4AFD96B62}_Large.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\The Shins\Chutes Too Narrow\AlbumArt_{0777EFA4-BE8E-4322-947F-86D4AFD96B62}_Small.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\The Shins\Chutes Too Narrow\desktop.ini C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\The Shins\Chutes Too Narrow\Folder.jpg C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-07-01-1148-20\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-07-01-1155-24\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-07-01-1157-01\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-07-01-1203-01\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-07-30-1746-33\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-07-30-1758-16\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-09-02-1950-00\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-09-06-1422-28\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-09-06-1430-27\Thumbs.db C:\Documents and Settings\Marie\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\david archuleta\Thumbs.db C:\Documents and Settings\Nyles\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\Thumbs.db C:\Documents and Settings\Nyles\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-07-01-1148-20\Thumbs.db C:\Documents and Settings\Nyles\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-07-01-1155-24\Thumbs.db C:\Documents and Settings\Nyles\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-07-01-1157-01\Thumbs.db C:\Documents and Settings\Nyles\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-07-01-1203-01\Thumbs.db C:\Documents and Settings\Nyles\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-07-30-1746-33\Thumbs.db C:\Documents and Settings\Nyles\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-07-30-1758-16\Thumbs.db C:\Documents and Settings\Nyles\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-09-02-1950-00\Thumbs.db C:\Documents and Settings\Nyles\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-09-06-1422-28\Thumbs.db C:\Documents and Settings\Nyles\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\2006-09-06-1430-27\Thumbs.db C:\Documents and Settings\Nyles\Local Settings\Application Data\Microsoft\Messenger\[removed]\Sharing Folders\[removed]\david archuleta\Thumbs.db C:\WINDOWS\SMINST\HPCD.sys C:\Documents and Settings\All Users\Documents\Recorded TV\TempRec\TempSBE\SBE1.tmp C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Word\~WRL0002.tmp C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Word\~WRL0003.tmp C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Word\~WRL0314.tmp C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Word\~WRL0345.tmp C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Word\~WRL0357.tmp C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Word\~WRL0730.tmp C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Word\~WRL0883.tmp C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Word\~WRL0976.tmp C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Word\~WRL1248.tmp C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Word\~WRL1512.tmp C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Word\~WRL1728.tmp C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Word\~WRL2128.tmp C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Word\~WRL2359.tmp C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Word\~WRL2360.tmp C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Word\~WRL2402.tmp C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Word\~WRL2438.tmp C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Word\~WRL2999.tmp C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Word\~WRL3095.tmp C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Word\~WRL3486.tmp C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Word\~WRL3994.tmp C:\Documents and Settings\HP_Administrator\My Documents\~WRL0334.tmp C:\Documents and Settings\HP_Administrator\My Documents\~WRL0949.tmp C:\Documents and Settings\HP_Administrator\My Documents\~WRL1167.tmp C:\Documents and Settings\HP_Administrator\My Documents\~WRL1670.tmp C:\Documents and Settings\HP_Administrator\My Documents\~WRL2801.tmp C:\Documents and Settings\HP_Administrator\My Documents\~WRL2930.tmp C:\Documents and Settings\HP_Administrator\My Documents\~WRL3665.tmp C:\Documents and Settings\HP_Administrator\My Documents\~WRL3979.tmp C:\Documents and Settings\HP_Administrator\My Documents\~WRL4067.tmp C:\Documents and Settings\Marie\My Documents\~WRL0001.tmp C:\Program Files\InterActual\InterActual Player\iti58.tmp C:\~BCWipe.stu\DOCUME~1_HP_ADM~1_LOCALS~1_Temp\shl27E.tmp C:\~BCWipe.stu\DOCUME~1_HP_ADM~1_LOCALS~1_Temp\shl5.tmp C:\~BCWipe.stu\DOCUME~1_HP_ADM~1_LOCALS~1_Temp\~$RD1933.tmp C:\~BCWipe.stu\DOCUME~1_HP_ADM~1_LOCALS~1_Temp\~$RD3066.tmp Finished!

Step #3 SmitFraudFix v2.225 Scan done at 16:22:17.32, Mon 09/17/2007 Run from C:\Documents and Settings\HP_Administrator\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Process C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Norton Internet Security\ISSVC.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe c:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\System32\snmp.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\WINDOWS\SOUNDMAN.EXE C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe C:\HP\KBD\KBD.EXE C:\windows\system\hpsysdrv.exe C:\WINDOWS\system32\hphmon06.exe C:\WINDOWS\ehome\ehtray.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\eHome\ehmsas.exe C:\WINDOWS\ALCWZRD.EXE C:\WINDOWS\ALCMTR.EXE C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Updates from HP\309731\Program\Updates from HP.exe C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe C:\Program Files\MostFun\Bin\MostFun.exe C:\WINDOWS\system32\wbem\unsecapp.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\cmd.exe C:\Program Files\Messenger\msmsgs.exe »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\HP_Administrator »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\HP_Administrator\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\HP_ADM~1\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{89aef01d-d237-49c7-84dc-4e1904c1fd31}"="AutoDisc Ware" [HKEY_CLASSES_ROOT\CLSID\{89aef01d-d237-49c7-84dc-4e1904c1fd31}\InProcServer32] @="C:\WINDOWS\system32\sbnudh.dll" [HKEY_CURRENT_USER\Software\Classes\CLSID\{89aef01d-d237-49c7-84dc-4e1904c1fd31}\InProcServer32] @="C:\WINDOWS\system32\sbnudh.dll" »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="HookDLL.DLL" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Rustock »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: Realtek RTL8139/810x Family Fast Ethernet NIC - Packet Scheduler Miniport DNS Server Search Order: 205.246.172.215 DNS Server Search Order: 24.221.208.5 HKLM\SYSTEM\CCS\Services\Tcpip\..\{6DC692FA-CD57-43DF-AFDA-B96CF3372F0E}: NameServer=205.246.172.215,24.221.208.5 HKLM\SYSTEM\CS1\Services\Tcpip\..\{6DC692FA-CD57-43DF-AFDA-B96CF3372F0E}: NameServer=205.246.172.215,24.221.208.5 HKLM\SYSTEM\CS3\Services\Tcpip\..\{6DC692FA-CD57-43DF-AFDA-B96CF3372F0E}: NameServer=205.246.172.215,24.221.208.5 »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End

Step #4
Directories/Files moved to C:\Deckard\System Scanner\backup

2007-09-17 16:05:16 0 d——– C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\10164$System.Windows.Forms.dll$v2.0.50727
2007-09-17 16:05:16 0 d——– C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\1068$System.Drawing.dll$v2.0.50727
2007-05-09 18:07:04 0 d——– C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\23dziuhr.zob
2007-05-13 11:43:13 0 d——– C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\2573wrdata.~lk
2007-09-12 19:49:34 0 d——– C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\2NO6PHCS
2007-08-02 11:45:28 0 d——– C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\2ygw42co.ww5
2007-09-17 16:05:16 0 d——– C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\3644$CommonLanguageRuntimeLibrary$v2.0.50727
2007-09-17 16:05:16 0 d——– C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\4816$CommonLanguageRuntimeLibrary$v2.0.50727
2007-09-17 16:05:16 0 d——– C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\4816$System.Windows.Forms.dll$v2.0.50727
2007-08-01 09:42:15 0 d——– C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\4mzbvp32.gp1
2007-09-04 11:34:03 0 d——– C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\51fu0hgx.ger
2007-03-01 10:46:31 0 d——– C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\5h00hqwy.qps
2007-09-17 16:05:16 0 d——– C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\6044$CommonLanguageRuntimeLibrary$v2.0.50727
2007-09-17 16:05:16 0 d——– C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\8352$System.Windows.Forms.dll$v2.0.50727
2007-09-17 16:05:16 0 d——– C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\9244$System.Windows.Forms.dll$v2.0.50727
2007-04-25 11:21:12 0 d——– C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\Adobe
2007-08-30 19:17:38 0 d——– C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\cqsjlng3.xsl
2007-01-30 19:23:32 0 d——– C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\Creative
2007-01-24 11:10:15 0 d——– C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\Deployment
2007-09-17 16:05:16 0 d——– C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\Excel8.0
2007-09-04 11:44:37 0 d——– C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\gluepjru.1ww
2007-08-03 05:46:19 0 d——– C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\Google Toolbar
2007-08-16 14:17:22 0 d——– C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\hekujbhk.wz4
2007-09-03 08:32:46 0 d——– C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\hsperfdata_HP_Administrator
2007-02-14 09:23:58 0 d——– C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\hvvpn2al.3uh
2005-03-15 14:51:28 24613 –a—— C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll

Memzit,

Step #1

Please go to Start > Control Panel > Add/Remove Programs and remove the following (if present):

Outerinfo
Security Toolbar

If you get any problem while uninstalling the programs please let me know.

Please note any other programs that you don't recognize in that list in your next response

Step #2

1. Download combofix from one of these links:
Link1
Link2
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

In your next post please include the following reports:

• ComboFix report
• New HijackThis log

Let me know how the things went.

Regards,

Hello Memzit

Step #1

Open notepad and copy/paste the text in the codebox below into it:

File::
C:\WINDOWS\system32\sbnudh.dll

Folder::
C:\WINDOWS\system32\srvuqsja
C:\Program Files\Wpsgzplxqqqqqq
C:\WINDOWS\system32\ogvhbfee
C:\Program Files\ydobcrotqqqqqq
C:\Program Files\Fawkjxva

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{55EDB93B-6FCC-2A25-DA97-095A187E5D18}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{89aef01d-d237-49c7-84dc-4e1904c1fd31}"=-
[-HKEY_CLASSES_ROOT\CLSID\{55EDB93B-6FCC-2A25-DA97-095A187E5D18}]
[-HKEY_CLASSES_ROOT\CLSID\{89aef01d-d237-49c7-84dc-4e1904c1fd31}]

Save this as "CFScript"


[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

Step #2

- Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 only

• - Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
  http://www.ewido.net/en/download/
  • Install AVG Anti-Spyware by double clicking the installer.
  • Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
  • On the main screen under Your Computer's security.
  • Click on Change state next to Resident shield. It should now change to inactive.
  • Click on Change state next to Automatic updates. It should now change to inactive.
  • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
  • Wait until you see the Update succesfull message.
• Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
• Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.

- Reboot your computer in Safe Mode.

• If the computer is running, shut down Windows, and then turn off the power.
• Wait 30 seconds, and then turn the computer on.
• Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
• Ensure that the Safe Mode option is selected.
• Press Enter. The computer then begins to start in Safe mode.
• Login on your usual account.

- Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

- Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.

• Click on Scanner on the toolbar.
• Click on the Settings tab.
  • Under How to act?
    • Click on Recommended Action and choose Quarantine from the popup menu.
  • Under How to scan?
    • All checkboxes should be ticked.
  • Under Possibly unwanted software:
    • All checkboxes should be ticked.
  • Under Reports:
    • Select Automatically generate report after every scan and uncheck Only if threats were found.
  • Under What to scan?
    • Select Scan every file.
• Click on the Scan tab.
• Click on Complete System Scan to start the scan process.
• Let the program scan the machine.
• When the scan has finished, follow the instructions below.
  IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
  • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
  • At the bottom of the window click on the Apply all Actions button. (3)
    [external image: Posted Image]
• When done, click the Save Scan Report button. (4)
  • Click the Save Report as button.
  • Save the report to your Desktop.
• Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

Reboot in Normal Mode.

Step #3

Download and Save Blacklight to your desktop (choose "I ACCEPT" then click "DOWNLOAD" on the website).

Double-click fsbl.exe then accept the agreement, click > "Scan" then > "Next".

You'll see a list of all items found. There will also be a log on your desktop with the name "fsbl.xxxxxxxxxxxxxx.log" (the xxxxxxxxxxxxxx stand for numbers).

Copy and paste this log in your next reply. Don't choose the rename option yet! I want to see the log first, because legitimate items can also be present there, such as "wbemtest.exe"

In your next post please include the following reports:

• ComboFix report
• AVG Anti-Spyware report
• Blacklight
• New HijackThis log.

Let me know how the things went.

Regards,

Hello Memzit

You have posted wrong combofix report -> 2007-09-17 20:20:45.1 <- this one is old, could you please post the newest combofix report.

Also, i see this in AVG report:

HKLM\SOFTWARE\Classes\CLSID\{06E962DD-B18A-0606-5CE6-C7D5A96BA3AA} -> Adware.CoolWebSearch : Ignored.
HKU\S-1-5-21-391007031-1749074558-2869225544-1008\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{736B5468-BDAD-41BE-92D0-22AE2DDF7BCB} -> Adware.Generic : Ignored.
HKU\S-1-5-21-391007031-1749074558-2869225544-1008\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F79FD28E-36EE-4989-AA61-9DD8E30A82FA} -> Trojan.Small : Ignored.

If you haven't changed set Recommended Action to Quarantine before you clicked the Apply all Actions button, please follow the same steps for running scan with AVG Antispyware and post the report back here. Please make sure that you set Recommended Action to Quarantine.


Please re-open HiJackThis and click on "Do a system scan only". Check the boxes next to all the entries listed below.

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://as.starware.com/dp/search?x=wKX1ILE…iULOFVWlEm6xshe

Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis.

Please post the combofix report and AVG Antispyware report so i can make sure that the threats are not present anymore, also new HIjackThis log.

Thanks.

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log