Spyware / Malware / Virus Removal

[Resolved] Computer still slow after removing Antivirgear and Zlo

17 min read

Looking for the outcome? Ask AI

BobDylan Topic Starter

Post #1September 24, 2007, 12:06 AM UTC

I just picked up the Zlob/Antivirgear virus yesterday and I think I cleared them both with Spybot and the Smitfraud tool but my PC is still pretty slow and I'm not sure if there are some leftover components or if I removed stuff I shouldn't have. I think I read on this forum that if my PC wasn't really infected with Antivirgear that the desktop theme would be removed and that's what happened, but I'm still sure it was there and I'm pretty sure it's gone now. But I was hoping someone could look my HJT log over and see if there's anything else left that might slow down my PC. (Dell Dimension, Windows XP) Thanks!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:38:33 PM, on 9/23/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Skyhook Wireless\Wi-Fi Service\WPSScannerSvc.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Common Files\AOL\1124239610\ee\AOLSoftware.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\WiFiConnector\NintendoWFCReg.exe
C:\Program Files\SMC\SMC2862W-G EZ Connect g 2.4Ghz 802.11g Wireless USB 2.0 Adapter\SMCWGUTI.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Java\jre1.5.0_07\bin\jucheck.exe
C:\WINDOWS\system32\cidaemon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Grisoft\AVG Free\avgcc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Peter\Desktop\HiJackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = www.rr.com
R3 - Default URLSearchHook is missing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1124239610\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [WeatherStudio Desktop] "C:\Program Files\WeatherStudio Desktop\bin\WeatherStudio Desktop.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe -a
O4 - HKCU\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Aida] C:\Documents and Settings\LocalService\Application Data\eetu.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Web Offer] C:\WINDOWS\TEMP\oehmst.exe /UninstPOP3 C:\Program Files\Web Offer (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Aida] C:\Documents and Settings\LocalService\Application Data\eetu.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [Web Offer] C:\WINDOWS\TEMP\oehmst.exe /UninstPOP3 C:\Program Files\Web Offer (User 'Default user')
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Run Nintendo Wi-Fi USB Connector Registration Tool.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
O4 - Global Startup: SMC2862W-G EZ Connect g 802.11g Wireless USB Utility.lnk = C:\Program Files\SMC\SMC2862W-G EZ Connect g 2.4Ghz 802.11g Wireless USB 2.0 Adapter\SMCWGUTI.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 3.0\resources\en-US\local\search.html
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…html?p=ZNfox000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: www.rr.com
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr.com/install/download/tgctlcm.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/puzzlepirates/miniclipGameLoader.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} (AOL Content Update) - http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9E17A5F9-2B9C-4C66-A592-199A4BA1FBC8} - http://pictures06.aim.com/ygp/aol/plugin/u…AIM.9.5.1.8.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/…tiveXPlugin.cab
O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} (LinkSys Content Update) - http://www.linksysfix.com/netcheck/24/install/gtdownls.cab
O16 - DPF: {DECEAAA2-370A-49BB-9362-68C3A58DDC62} (SAIX) - http://static.zangocash.com/cab/Zango/ie/b…dd084361d36488e
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Adapter\WLService.exe
O23 - Service: WPS Scanner Service (WPSScannerSvc) - Skyhook Wireless - C:\Program Files\Skyhook Wireless\Wi-Fi Service\WPSScannerSvc.exe
O24 - Desktop Component 0: (no name) - http://www.gotpetsonline.com/pictures-gall…amster-0001.jpg
O24 - Desktop Component 1: (no name) - http://fenway.50g.com/firstbaseside.jpg

–
End of file - 12992 bytes

silver

Post #2September 25, 2007, 3:36 AM UTC

Hi BobDylan,

Yes there is further malware on your system.

First, move HijackThis from the desktop to it's own folder:

Open My Computer, navigate to C:\ and make a new folder named HJT
Move the HijackThis.exe program file from your desktop to C:\HJT
If you wish to place a shortcut to HijackThis on your desktop, then right-click hijackthis.exe, select Send To and choose Desktop (create shortcut)

Now open HijackThis, select Open the Misc Tools section
Press the Open Uninstall Manager… button, then press Save list…
Save the Uninstall log to your Desktop and include a copy in your next response.
Now press Back and Scan and then Save log to create and save a new HijackThis log.

Once complete, please post the uninstall list and a new HijackThis log.

BobDylan

Post #3September 25, 2007, 6:52 AM UTC

Hi Silver - thanks for helping me out with this - this is a great site!
I moved HJT to it's own file, and here are the Uninstall log and the new Hijack this log:

Adobe Flash Player 9 ActiveX
Adobe Flash Player Plugin
Adobe Reader 8.1.0
AIM 6
AIM Location Plugin 0.1.0.40
AOL Coach Version 1.0(Build:20030807.3)
AOL Coach Version 2.0(Build:20041026.5 en)
AOL Instant Messenger
AOL Toolbar 2.0
AOL Uninstaller (Choose which Products to Remove)
aspi
AVG Free Edition
Azureus
BCM V.92 56K Modem
Broadcom 802.11 Driver
Broadcom Management Programs
Buddy Icon Maker 1.0.0.1
CCHelp
CCScore
CleanUp!
Console Classix 3.8
Dell Digital Jukebox Driver
Dell Media Experience
Dell Solution Center
DellSupport
DS21Patch
Earobics Step 1 Home
EarthLink Setup Files
ESSAdpt
ESSANUP
ESSBrwr
ESSCAM
ESSCDBK
ESScore
ESSCT
ESSgui
ESShelp
ESSini
ESSPCD
ESSPDock
ESSTUTOR
ESSvpaht
ESSvpot
FlexiMusic Kids Composer
Full Tilt Poker
Google Desktop
Google Pack Screensaver
Google Toolbar for Firefox
Google Updater
Hamachi 1.0.2.2
HijackThis 2.0.2
HLPCCTR
HLPIndex
HLPPDOCK
HP Document Viewer 7.0
HP Imaging Device Functions 7.0
HP Photosmart Essential
HP Photosmart Premier Software 6.5
HP Photosmart, Officejet and Deskjet 7.0.A
HP Solution Center 7.0
HP Update
HyperCam 2
IE Host R3
Intel® Extreme Graphics Driver
iTunes
J2SE Runtime Environment 5.0 Update 3
J2SE Runtime Environment 5.0 Update 7
Jasc Paint Shop Photo Album
Jasc Paint Shop Pro 8 Dell Edition
Java 2 Runtime Environment, SE v1.4.2
Java 2 Runtime Environment, SE v1.4.2_13
Kodak EasyShare software
KSU
Learn2 Player (Uninstall Only)
LimeWire 4.12.6
Linksys Wireless-G PCI Adapter
LWAway 1.0.0.1
Macromedia Shockwave Player
Microsoft .NET Framework 1.1
Microsoft AntiSpyware
Microsoft Encarta Encyclopedia Standard 2004
Microsoft Office 2000 Premium
Microsoft Plus! Dancer LE
Microsoft Publisher 98
mkw Audio Compression Toolkit
mkw Runtime Libraries
Modem Helper
Mozilla Firefox (2.0.0.6)
Mozilla Firefox (2.0.0.7)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML4 Parser
MUSICMATCH® Jukebox
MySpaceIM
Nintendo Wi-Fi USB Connector Registration Tool
Notifier
NVIDIA Drivers
OCR Software by I.R.I.S 7.0
OpenMG AAC Add-on Module 1.0.00
OpenMG Secure Module 4.6.01
OTtBP
PCDLNCH
PDF Manual NW-S200 Series
Plaxo Toolbar for Outlook (with AIM Enhancements)
QuickTime
Reader Rabbit 2nd Grade
RealPlayer
RKAutominer 2
Road Runner Medic 5.3
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB911565)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901190)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926247)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928090)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB929969)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931768)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933566)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937143)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938829)
SFR
SFR2
Shockwave
SimPE 0.60b (alpha)
Skyhook Wireless Wi-Fi Service
SMC2862W-G EZ Connect g 2.4Ghz 802.11g Wireless USB 2.0 Adapter
Sonic DLA
SonicStage 4.2
Spybot - Search & Destroy 1.4
SpySubtract
SpywareBlaster v3.3
The Sims Deluxe Edition
TRG 0.9 Beta
TrojanHunter 4.2
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
VCAMCEN
Viewpoint Manager (Remove Only)
Viewpoint Media Player
VPRINTOL
Windows Installer 3.1 (KB893803)
Windows Installer 3.1 (KB893803)
Windows Media Format Runtime
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Windows XP Service Pack 2
WinRAR archiver
WordPerfect Office 11
Yahoo! Toolbar

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:43:55 AM, on 9/25/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\AOL\1124239610\ee\AOLSoftware.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\SMC\SMC2862W-G EZ Connect g 2.4Ghz 802.11g Wireless USB 2.0 Adapter\PRISMSVR.EXE
C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\WiFiConnector\NintendoWFCReg.exe
C:\Program Files\SMC\SMC2862W-G EZ Connect g 2.4Ghz 802.11g Wireless USB 2.0 Adapter\SMCWGUTI.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Skyhook Wireless\Wi-Fi Service\WPSScannerSvc.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre1.5.0_07\bin\jucheck.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = www.rr.com
R3 - Default URLSearchHook is missing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1124239610\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [WeatherStudio Desktop] "C:\Program Files\WeatherStudio Desktop\bin\WeatherStudio Desktop.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\Program Files\SMC\SMC2862W-G EZ Connect g 2.4Ghz 802.11g Wireless USB 2.0 Adapter\PRISMSVR.EXE" /APPLY
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe -a
O4 - HKCU\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Aida] C:\Documents and Settings\LocalService\Application Data\eetu.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Web Offer] C:\WINDOWS\TEMP\oehmst.exe /UninstPOP3 C:\Program Files\Web Offer (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Aida] C:\Documents and Settings\LocalService\Application Data\eetu.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [Web Offer] C:\WINDOWS\TEMP\oehmst.exe /UninstPOP3 C:\Program Files\Web Offer (User 'Default user')
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Run Nintendo Wi-Fi USB Connector Registration Tool.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
O4 - Global Startup: SMC2862W-G EZ Connect g 802.11g Wireless USB Utility.lnk = C:\Program Files\SMC\SMC2862W-G EZ Connect g 2.4Ghz 802.11g Wireless USB 2.0 Adapter\SMCWGUTI.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 3.0\resources\en-US\local\search.html
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…html?p=ZNfox000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: www.rr.com
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr.com/install/download/tgctlcm.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/puzzlepirates/miniclipGameLoader.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} (AOL Content Update) - http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9E17A5F9-2B9C-4C66-A592-199A4BA1FBC8} - http://pictures06.aim.com/ygp/aol/plugin/u…AIM.9.5.1.8.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/…tiveXPlugin.cab
O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} (LinkSys Content Update) - http://www.linksysfix.com/netcheck/24/install/gtdownls.cab
O16 - DPF: {DECEAAA2-370A-49BB-9362-68C3A58DDC62} (SAIX) - http://static.zangocash.com/cab/Zango/ie/b…dd084361d36488e
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Adapter\WLService.exe
O23 - Service: WPS Scanner Service (WPSScannerSvc) - Skyhook Wireless - C:\Program Files\Skyhook Wireless\Wi-Fi Service\WPSScannerSvc.exe
O24 - Desktop Component 0: (no name) - http://www.gotpetsonline.com/pictures-gall…amster-0001.jpg
O24 - Desktop Component 1: (no name) - http://fenway.50g.com/firstbaseside.jpg

–
End of file - 12873 bytes

silver

Post #4September 25, 2007, 7:55 AM UTC last edited September 25, 2007, 7:56 AM UTC

Hi BobDylan,

Next we have some uninstalls to do, please open Start->Control Panel->Add/Remove Programs and remove these:

IE Host R3
Java 2 Runtime Environment, SE v1.4.2
Java 2 Runtime Environment, SE v1.4.2_13
J2SE Runtime Environment 5.0 Update 3
J2SE Runtime Environment 5.0 Update 7
Microsoft Antispyware

The Java installations are out of date and now a security risk, you can get the latest update (version 6 update 2) from here
MS Antispyware is now called Windows Defender. For now, please remove Microsoft Antispyware and I'll advise you on installing latest version when you're clean.
IE Host R3 is adware and must be removed.

You have Viewpoint Media Player installed on your system. This program is not malware but it is foistware in that it is usually installed without the user's knowledge or approval, and for this reason I recommend you remove it. If you actually use this program, I recommend you try using safe and free alternatives such as VLC Player or Media Player Classic.
To remove, open find and remove Viewpoint Media Player and Viewpoint Manager (Remove Only)

You have LimeWire and Azureus, P2P file sharing programs installed on your computer. These programs do not come bundled with malware as some similar programs do, but peer-to-peer file sharing networks are one of the biggest sources of malware we see. Anything downloaded from them cannot be trusted to be clean, because even if the file appears to be what it claims to be, it can have malware embedded in it.
I recommend you remove them, but of course the choice is yours.
You can remove Limewire and Azureus via Add/Remove Programs.

Full Tilt Poker has been reported as being malware-related so I strongly recommend you remove it.
To do so, find Full Tilt Poker on the list and select Remove

————————————————————————

Next, we need to temporarily disable some protection programs which may interfere with the fix:

Open AVG Antispyware and make sure the Status screen is selected
Next to Resident Shield press Change state so that the status reads inactive
Close AVG Antispyware

Temporarily disable Trojanhunter Guard

Find the Trojanhunter Guard icon in the lower right corner of your screen - it's is a light blue magnifying glass icon with a red handle
Right click it and un-check Enabled
The icon should now show a red X
Trojanhunter Guard will be re-enabled after the next reboot

————————————————————————

Next download ComboFix to your desktop

Double click combofix.exe and follow the prompts.
Note: Do not click ComboFix's window while it's running - it may cause it to stall!
When finished, it shall produce a log for you, please post it in your next response.

————————————————————————

Once complete, please post the ComboFix report and a new HijackThis log.

BobDylan

Post #5September 26, 2007, 1:42 AM UTC

Hi Silver:
I've done all the changes and deletions (and downloaded the new version of Java) that you advised. Here are the new HijackThis and ComboFix logs.
Also, I've tried getting rid of an AIM Triton and a MySpaceIM program that automatically comes on everytime I reboot the computer, but they're still there (used msconfig in Run > Startup to delete them I think). Is there another way to get rid of them as they slow down the startup of the PC.
Thanks again for all your help.
Peter

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:28:26 PM, on 9/25/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Skyhook Wireless\Wi-Fi Service\WPSScannerSvc.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\AOL\1124239610\ee\AOLSoftware.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\WiFiConnector\NintendoWFCReg.exe
C:\Program Files\SMC\SMC2862W-G EZ Connect g 2.4Ghz 802.11g Wireless USB 2.0 Adapter\SMCWGUTI.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = www.rr.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1124239610\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [WeatherStudio Desktop] "C:\Program Files\WeatherStudio Desktop\bin\WeatherStudio Desktop.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe -a
O4 - HKCU\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Aida] C:\Documents and Settings\LocalService\Application Data\eetu.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Web Offer] C:\WINDOWS\TEMP\oehmst.exe /UninstPOP3 C:\Program Files\Web Offer (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Aida] C:\Documents and Settings\LocalService\Application Data\eetu.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [Web Offer] C:\WINDOWS\TEMP\oehmst.exe /UninstPOP3 C:\Program Files\Web Offer (User 'Default user')
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Run Nintendo Wi-Fi USB Connector Registration Tool.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
O4 - Global Startup: SMC2862W-G EZ Connect g 802.11g Wireless USB Utility.lnk = C:\Program Files\SMC\SMC2862W-G EZ Connect g 2.4Ghz 802.11g Wireless USB 2.0 Adapter\SMCWGUTI.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 3.0\resources\en-US\local\search.html
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…html?p=ZNfox000
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: www.rr.com
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr.com/install/download/tgctlcm.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/puzzlepirates/miniclipGameLoader.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} (AOL Content Update) - http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9E17A5F9-2B9C-4C66-A592-199A4BA1FBC8} - http://pictures06.aim.com/ygp/aol/plugin/u…AIM.9.5.1.8.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/…tiveXPlugin.cab
O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} (LinkSys Content Update) - http://www.linksysfix.com/netcheck/24/install/gtdownls.cab
O16 - DPF: {DECEAAA2-370A-49BB-9362-68C3A58DDC62} (SAIX) - http://static.zangocash.com/cab/Zango/ie/b…dd084361d36488e
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Adapter\WLService.exe
O23 - Service: WPS Scanner Service (WPSScannerSvc) - Skyhook Wireless - C:\Program Files\Skyhook Wireless\Wi-Fi Service\WPSScannerSvc.exe
O24 - Desktop Component 0: (no name) - http://www.gotpetsonline.com/pictures-gall…amster-0001.jpg
O24 - Desktop Component 1: (no name) - http://fenway.50g.com/firstbaseside.jpg

–
End of file - 11605 bytes

ComboFix 07-09-21.2 - "Peter" 2007-09-25 21:05:59.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.282 [GMT -5:00]
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DOCUME~1\Peter\APPLIC~1\AntiSpywareBot
C:\DOCUME~1\Peter\APPLIC~1\AntiSpywareBot\Log\2007 Sep 23 - 01_00_49 AM_812.log
C:\DOCUME~1\Peter\APPLIC~1\AntiSpywareBot\Log\2007 Sep 23 - 01_00_52 AM_328.log
C:\DOCUME~1\Peter\APPLIC~1\AntiSpywareBot\rs.dat
C:\DOCUME~1\Peter\APPLIC~1\AntiSpywareBot\Settings\CustomScan.stg
C:\DOCUME~1\Peter\APPLIC~1\AntiSpywareBot\Settings\IgnoreList.stg
C:\DOCUME~1\Peter\APPLIC~1\AntiSpywareBot\Settings\ScanInfo.stg
C:\DOCUME~1\Peter\APPLIC~1\AntiSpywareBot\Settings\ScanResults.stg
C:\DOCUME~1\Peter\APPLIC~1\AntiSpywareBot\Settings\SelectedFolders.stg
C:\DOCUME~1\Peter\APPLIC~1\AntiSpywareBot\Settings\Settings.stg
C:\DOCUME~1\Peter\APPLIC~1\FunWebProducts
C:\Program Files\Common Files\download
C:\Program Files\Common Files\download\adult1.mpg
C:\Program Files\Common Files\windows
C:\Program Files\dns
C:\Program Files\dns\affid.dat
C:\Program Files\dns\regexp.dat
C:\Program Files\dns\regexpDate.dat
C:\Program Files\dns\uid.dat
C:\Program Files\dns\urls.dat
C:\Program Files\dns\version.txt
C:\Program Files\dns\x.bmp
C:\WINDOWS\system32\ddcyw.dll
C:\WINDOWS\system32\drivers\fad.sys
C:\WINDOWS\Tasks.\AntiSpywareBot Scheduled Scan.job

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

——-\LEGACY_IPRIP
——-\Iprip

((((((((((((((((((((((((( Files Created from 2007-08-26 to 2007-09-26 )))))))))))))))))))))))))))))))
.

2007-09-25 21:05 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-09-25 20:54 68,752,792 –a—— C:\java.exe
2007-09-25 20:26 d——– C:\HJT
2007-09-23 18:33 d——– C:\Program Files\Trend Micro
2007-09-23 00:55 d——– C:\DOCUME~1\Peter\APPLIC~1\AdwareAlert
2007-09-18 12:05 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Prism
2007-09-18 11:59 357,632 -ra—— C:\WINDOWS\SYSTEM32\DRIVERS\2862WICB.sys
2007-09-18 11:58 15,781 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mdc8021x.sys
2007-09-18 11:58 d——– C:\Program Files\SMC
2007-09-16 09:21 d——– C:\Program Files\RKAutominer
2007-09-14 10:24 d——– C:\Program Files\Common Files\xing shared
2007-09-13 18:43 d——– C:\Program Files\HyCam2
2007-09-10 19:58 d——– C:\Program Files\SmartDraw 2008
2007-09-08 22:11 8,552 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\asctrm.sys
2007-08-29 19:08 d——– C:\Program Files\Hamachi
2007-08-29 17:23 d——– C:\Program Files\Ho Chi Minh Trail

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-25 21:17 ——— d——– C:\Program Files\Plaxo
2007-09-25 20:50 ——— d——– C:\Program Files\Full Tilt Poker
2007-09-25 20:49 ——— d——– C:\Program Files\LimeWire
2007-09-25 20:48 ——— d——– C:\Program Files\Azureus
2007-09-25 20:46 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
2007-09-25 20:42 ——— d——– C:\Program Files\Microsoft AntiSpyware
2007-09-25 20:36 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
2007-09-18 11:24 ——— d——– C:\Program Files\Incomplete
2007-09-15 21:23 ——— d——– C:\DOCUME~1\Peter\APPLIC~1\Real
2007-09-14 10:23 ——— d——– C:\Program Files\Common Files\Real
2007-09-13 17:35 ——— d——– C:\DOCUME~1\CHRIST~1\APPLIC~1\Gtek
2007-09-08 23:26 ——— d——– C:\Program Files\Common Files\AOL
2007-09-08 23:26 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL Downloads
2007-09-08 22:10 ——— d——– C:\Program Files\Real
2007-08-29 19:09 ——— d——– C:\DOCUME~1\Peter\APPLIC~1\Hamachi
2007-08-24 16:51 25544 –a—— C:\WINDOWS\system32\drivers\hamachi.sys
2007-08-17 14:20 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-08-15 10:50 ——— d–h—– C:\DOCUME~1\Peter\APPLIC~1\GTek
2007-08-15 10:50 ——— d–h—– C:\DOCUME~1\Alex\APPLIC~1\Gtek
2007-08-15 10:50 ——— d——– C:\DOCUME~1\Kim\APPLIC~1\Gtek
2007-08-15 10:50 ——— d——– C:\DOCUME~1\ERICAM~1\APPLIC~1\Gtek
2007-08-15 10:48 ——— d——– C:\Program Files\DellSupport
2007-08-15 09:11 ——— d——– C:\Program Files\Lavasoft
2007-08-14 19:08 ——— d——– C:\Program Files\WiFiConnector
2007-08-13 15:26 ——— d——– C:\Program Files\Support.com
2007-08-08 13:18 ——— d——– C:\Program Files\Maxis
2006-01-03 23:08 212849 –a—— C:\Program Files\hijackthis.zip
2006-01-02 15:56 6224992 –a—— C:\Program Files\TrojanHunter.exe
2005-12-19 18:17 212992 –a—— C:\Program Files\MallTycoon3Setup-dm.exe
2005-12-18 20:18 15271071 –a—— C:\Program Files\thesims2_update_cd.zip
2005-12-18 20:15 444161 –a—— C:\Program Files\TS2SysReqc.zip
2005-12-18 01:55 10940595 –a—— C:\Program Files\GP5DEMO.exe
2005-12-15 10:50 10537576 –a—— C:\Program Files\zlsSetup_61_737_000_en.exe
2005-12-11 15:51 5037072 –a—— C:\Program Files\spybotsd14.exe
2005-12-10 11:08 561810 –a—— C:\Program Files\country_cottage.zip
2005-12-09 15:57 12820430 –a—— C:\Program Files\atgset.zip
2005-12-09 15:52 66218 –a—— C:\Program Files\k860slava_lamp_4.zip
2005-12-08 18:29 49011 –a—— C:\Program Files\k8sprwall6.zip
2005-12-08 18:27 2989597 –a—— C:\Program Files\sprset.zip
2005-12-07 23:54 703 –a—— C:\Program Files\DelTypedURL.inf
2005-03-28 23:36 276408 –a—— C:\Program Files\CleanUp312.exe
2005-03-27 03:05 76551 –a—— C:\Program Files\bholist.txt
2005-03-25 23:51 42171 –a—— C:\Program Files\KillBox.zip
2005-03-20 13:09 320000 –a—— C:\Program Files\IE-SPYAD2.exe
2005-03-20 12:48 5205858 –a—— C:\Program Files\ZoneAlarm.exe
2005-03-19 16:10 2179792 –a—— C:\Program Files\CWShredder.exe
2005-01-29 07:44 168 –a—— C:\Program Files\AdbeRdr70_enu_full_FEAD_error.log
2005-01-29 03:28 20798256 –a—— C:\Program Files\AdbeRdr70_enu_full.exe
2005-01-29 00:13 2606037 –a—— C:\Program Files\692509.pdf
2005-01-28 18:47 12404 –a—— C:\Program Files\WildChild.ttf
2005-03-01 15:25:21 417,792 –sha-r C:\WINDOWS\SYSTEM32\w?nlogon.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-04-07 01:19]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 01:07]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 04:59 C:\WINDOWS\BCMSMMSG.exe]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2003-08-06 02:04]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2003-08-26 20:47]
"mmtask"="c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe" [2003-10-06 11:05]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2004-10-29 03:50]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-09-14 08:17]
"AVG7_EMC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe" [2007-08-17 08:15]
"HostManager"="C:\Program Files\Common Files\AOL\1124239610\ee\AOLSoftware.exe" [2006-09-25 19:52]
"THGuard"="C:\Program Files\TrojanHunter 4.2\THGuard.exe" [2005-02-19 16:36]
"IPHSend"="C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe" [2006-02-17 11:59]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 01:41]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 18:58]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-08-14 10:46]
"WeatherStudio Desktop"="C:\Program Files\WeatherStudio Desktop\bin\WeatherStudio Desktop.exe" []
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-09-14 10:22]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" [2006-09-25 19:52]
"PlaxoUpdate"="C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe" [2006-11-16 12:42]
"SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2006-11-02 13:43]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-04-19 21:27]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"Web Offer"=C:\WINDOWS\TEMP\oehmst.exe /UninstPOP3 C:\Program Files\Web Offer

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Aida"=C:\Documents and Settings\LocalService\Application Data\eetu.exe

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\
DESKTOP.INI [2002-09-03 10:00:00]
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-03-04 18:44:15]
Run Nintendo Wi-Fi USB Connector Registration Tool.lnk - C:\Program Files\WiFiConnector\NintendoWFCReg.exe [2007-08-14 19:08:46]
SMC2862W-G EZ Connect g 802.11g Wireless USB Utility.lnk - C:\Program Files\SMC\SMC2862W-G EZ Connect g 2.4Ghz 802.11g Wireless USB 2.0 Adapter\SMCWGUTI.exe [2005-10-17 16:10:34]

C:\DOCUME~1\Alex\Desktop\Programs\Startup\
DESKTOP.INI [2002-09-03 10:00:00]

C:\DOCUME~1\CHRIST~1\STARTM~1\Programs\Startup\
DESKTOP.INI [2002-09-03 10:00:00]

C:\DOCUME~1\ERICAM~1\STARTM~1\Programs\Startup\
DESKTOP.INI [2002-09-03 10:00:00]

C:\DOCUME~1\Kim\STARTM~1\Programs\Startup\
DESKTOP.INI [2002-09-03 10:00:00]

C:\DOCUME~1\Peter\STARTM~1\Programs\Startup\
DESKTOP.INI [2002-09-03 10:00:00]
hamachi.lnk - C:\Program Files\Hamachi\hamachi.exe [2007-08-24 16:51:02]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"= c:\Program Files\interMute\SpySubtract\sshook.dll [2005-03-19 16:16 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Notification Packages"= :\WINDOWS\syste

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk
backup=C:\WINDOWS\pss\HP Photosmart Premier Fast Start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak software updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk
backup=C:\WINDOWS\pss\Kodak software updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SpySubtract.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SpySubtract.lnk
backup=C:\WINDOWS\pss\SpySubtract.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Peter^Start Menu^Programs^Startup^Greetings Workshop Reminders.lnk]
path=C:\Documents and Settings\Peter\Start Menu\Programs\Startup\Greetings Workshop Reminders.lnk
backup=C:\WINDOWS\pss\Greetings Workshop Reminders.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
C:\Program Files\AIM\aim.exe -cnetwait.odl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ApacheAirAssault_Setup.exe]
C:\DOWNLO~1\APACHE~1.EXE /r

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
C:\Program Files\MySpace\IM\MySpaceIM.exe

R1 DcCam;Kodak Camera Proxy;C:\WINDOWS\system32\DRIVERS\DcCam.sys
R2 DCFS2K;Kodak DCFS2K Driver;C:\WINDOWS\system32\drivers\dcfs2k.sys
R3 BCMModem;BCM V.92 56K Modem;C:\WINDOWS\system32\DRIVERS\BCMSM.sys
R3 SMC2862W;SMC2862W-G EZ Connect g 2.4Ghz 802.11g Wireless USB 2.0 Adapter Driver;C:\WINDOWS\system32\DRIVERS\2862WICB.sys
R3 Wpsnuio;WPS NDIS Usermode I/O Protocol;C:\WINDOWS\system32\DRIVERS\wpsnuio.sys
S1 Exportit;Exportit;C:\WINDOWS\system32\DRIVERS\exportit.sys
S3 cdiskdun;cdiskdun;\??\C:\DOCUME~1\Peter\LOCALS~1\Temp\cdiskdun.sys
S3 DcFpoint;DcFpoint;C:\WINDOWS\system32\DRIVERS\DcFpoint.sys
S3 DcLps;Legacy Polling Service;C:\WINDOWS\system32\DRIVERS\DcLps.sys
S3 DcPTP;dcptp;C:\WINDOWS\system32\DRIVERS\DcPTP.sys
S3 epstw2k;SCM Parallel Port SCSI Driver;C:\WINDOWS\system32\DRIVERS\epstw2k.sys
S3 p2pgasvc;Peer Networking Group Authentication;C:\WINDOWS\System32\svchost.exe -k p2psvc
S3 p2pimsvc;Peer Networking Identity Manager;C:\WINDOWS\System32\svchost.exe -k p2psvc
S3 p2psvc;Peer Networking;C:\WINDOWS\System32\svchost.exe -k p2psvc
S3 PNRPSvc;Peer Name Resolution Protocol;C:\WINDOWS\System32\svchost.exe -k p2psvc
S3 scsiscan;SCSI Scanner Driver;C:\WINDOWS\system32\DRIVERS\scsiscan.sys
S3 USB Wireless USB Adapter®;USB Wireless USB Adapter® Service for Wireless USB Adapter;C:\WINDOWS\system32\DRIVERS\vnetusbr.sys

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc p2psvc p2pimsvc p2pgasvc PNRPSvc

.
Contents of the 'Scheduled Tasks' folder
"2007-09-25 08:00:00 C:\WINDOWS\Tasks\AdwareAlert Scheduled Scan.job"
- C:\Program Files\AdwareAlert\AdwareAlert.exe
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-25 21:17:24
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-25 21:19:20 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-09-25 21:19
.
— E O F —

silver

Post #6September 26, 2007, 3:43 AM UTC

Hi BobDylan,

Also, I've tried getting rid of an AIM Triton and a MySpaceIM program that automatically comes on everytime I reboot the computer, but they're still there (used msconfig in Run > Startup to delete them I think). Is there another way to get rid of them as they slow down the startup of the PC.

Do you want to completely remove these programs or just stop them from starting automatically?

————————————————————————

Please download Suspicious File Packer to your Desktop.

Right-click sfp.zip, choose Extract All… and extract sfp.exe to your Desktop
Double-click sfp.exe to start the program
Copy and Paste the following file list into the text box of the program:

C:\WINDOWS\SYSTEM32\w?nlogon.exe
A file called requested-files[YYYY-MM-DD_MM_ss].cab will appear on your Desktop.
Now open this page in your browser
Press Browse and browse to the requested-files[YYYY-MM-DD_MM_ss].cab file on your Desktop, fill in the other fields as appropriate then press Send File

————————————————————————

If TrojanHunter Guard is active again, please temporarily de-activate it:

Find the Trojanhunter Guard icon in the lower right corner of your screen - it's is a light blue magnifying glass icon with a red handle
Right click it and un-check Enabled
The icon should now show a red X
Trojanhunter Guard will be re-enabled after the next reboot

————————————————————————

Then, open HijackThis, choose Do a system scan only and place a checkmark next to the following lines:

O4 - HKLM\..\Run: [WeatherStudio Desktop] "C:\Program Files\WeatherStudio Desktop\bin\WeatherStudio Desktop.exe"
O4 - HKUS\S-1-5-18\..\Run: [Aida] C:\Documents and Settings\LocalService\Application Data\eetu.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Web Offer] C:\WINDOWS\TEMP\oehmst.exe /UninstPOP3 C:\Program Files\Web Offer (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Aida] C:\Documents and Settings\LocalService\Application Data\eetu.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [Web Offer] C:\WINDOWS\TEMP\oehmst.exe /UninstPOP3 C:\Program Files\Web Offer (User 'Default user')
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…html?p=ZNfox000
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/puzzlepirates/miniclipGameLoader.dll
O16 - DPF: {DECEAAA2-370A-49BB-9362-68C3A58DDC62} (SAIX) - http://static.zangocash.com/cab/Zango/ie/b…dd084361d36488e

You have the rr.com domain in your Internet Explorer Trusted Zone. rr.com isn't a malicious website, however the security settings which apply to websites that are in the Trusted Zone are much more permissive than normal, so sites should only be added if they are trusted and if it is necessary. If you need to keep this domain in your Trusted Zone so that it functions normally then leave it in place, if it is not necessary then please check this line also:

O15 - Trusted Zone: www.rr.com

Then close all open windows apart from HijackThis, press Fix checked, OK the prompt and close HijackThis.

————————————————————————

Check that ComboFix.exe is on your Desktop

Then open Notepad: press Start->Run, type notepad and click OK

Copy/paste the contents of the below code box into Notepad:

File::
C:\WINDOWS\Tasks\AdwareAlert Scheduled Scan.job
C:\Documents and Settings\LocalService\Application Data\eetu.exe
C:\WINDOWS\TEMP\oehmst.exe 

Folder::
C:\Program Files\AdwareAlert
C:\Program Files\WeatherStudio Desktop
C:\Program Files\Web Offer

Registry::
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00

Save this to your Desktop as CFScript.

[external image: Posted Image]
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

Note: Do not click ComboFix's window while it's running - it may cause it to stall!

————————————————————————

Once complete, reboot your computer, create a new HijackThis log and post it along with the new ComboFix report.

BobDylan

Post #7September 27, 2007, 3:58 AM UTC

Hi Silver:
Everything's done as per your instructions, and I sent that SuspiciousFilePacket to bleepingcomputer. I did delete the www.rr.com from the Trusted Sites as I don't need that anymore (that was my previous ISP Roadrunner, and I've since moved and changed to Comcast.net).
I've pasted the new HijackThis and ComboFix logs below, but is it okay if I ask a few random things as we go along.
You asked - "Do you want to completely remove these programs (AIM/MySpaceIM)or just stop them from starting automatically?"
My son uses these from time to time, so I guess I would just like to stop them from starting up automatically.

Also, with these fixes, the Comcast.net desktop icon I have no longer works to bring up it's homepage - comes up with the error message "Windows cannot find ' http://www.comcast.net/home'. Make sure you typed the name correctly . . . " However, if I click on Comcast in my Favorites or type it in the IE browser it comes up fine - did I delete something I shouldn't have?

And last, besides the AIM/Myspace things that automatically start up with rebooting, there's a box that says "Hamachi client could not be loaded. Click to exit. "(or something close to that). I can click it and it goes away and everything works fine, but I think I tried deleting all Hamachi files once and I couldn't connect to the internet - is that something need for my wireless connection, or can I safely get rid of it as i'm not sure which hardware or software that's from.

We can answer these things at the end if it's too much for now - otherwise the PC is running okay, still a little slow at times though.
And finally, here's the logs:

ComboFix 07-09-21.2 - "Peter" 2007-09-26 23:09:46.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.325 [GMT -5:00]
* Created a new restore point

FILE::
C:\WINDOWS\Tasks\AdwareAlert Scheduled Scan.job
C:\Documents and Settings\LocalService\Application Data\eetu.exe
C:\WINDOWS\TEMP\oehmst.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\Tasks\AdwareAlert Scheduled Scan.job

.
((((((((((((((((((((((((( Files Created from 2007-08-27 to 2007-09-27 )))))))))))))))))))))))))))))))
.

2007-09-26 20:19 d——– C:\WINDOWS\LastGood
2007-09-26 20:19 d——– C:\Program Files\Viewpoint
2007-09-25 21:05 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-09-25 20:54 68,752,792 –a—— C:\java.exe
2007-09-25 20:26 d——– C:\HJT
2007-09-23 18:33 d——– C:\Program Files\Trend Micro
2007-09-23 00:55 d——– C:\DOCUME~1\Peter\APPLIC~1\AdwareAlert
2007-09-18 12:05 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Prism
2007-09-18 11:59 357,632 -ra—— C:\WINDOWS\SYSTEM32\DRIVERS\2862WICB.sys
2007-09-18 11:58 15,781 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mdc8021x.sys
2007-09-18 11:58 d——– C:\Program Files\SMC
2007-09-16 09:21 d——– C:\Program Files\RKAutominer
2007-09-14 10:24 d——– C:\Program Files\Common Files\xing shared
2007-09-13 18:43 d——– C:\Program Files\HyCam2
2007-09-10 19:58 d——– C:\Program Files\SmartDraw 2008
2007-09-08 22:11 8,552 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\asctrm.sys
2007-08-29 19:08 d——– C:\Program Files\Hamachi
2007-08-29 17:23 d——– C:\Program Files\Ho Chi Minh Trail

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-26 21:36 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
2007-09-26 20:20 ——— d——– C:\Program Files\AIM
2007-09-26 20:19 ——— d——– C:\Program Files\AOD
2007-09-26 20:19 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
2007-09-25 21:17 ——— d——– C:\Program Files\Plaxo
2007-09-25 20:50 ——— d——– C:\Program Files\Full Tilt Poker
2007-09-25 20:49 ——— d——– C:\Program Files\LimeWire
2007-09-25 20:48 ——— d——– C:\Program Files\Azureus
2007-09-25 20:42 ——— d——– C:\Program Files\Microsoft AntiSpyware
2007-09-18 11:24 ——— d——– C:\Program Files\Incomplete
2007-09-15 21:23 ——— d——– C:\DOCUME~1\Peter\APPLIC~1\Real
2007-09-14 10:23 ——— d——– C:\Program Files\Common Files\Real
2007-09-13 17:35 ——— d——– C:\DOCUME~1\CHRIST~1\APPLIC~1\Gtek
2007-09-08 23:26 ——— d——– C:\Program Files\Common Files\AOL
2007-09-08 23:26 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL Downloads
2007-09-08 22:10 ——— d——– C:\Program Files\Real
2007-08-29 19:09 ——— d——– C:\DOCUME~1\Peter\APPLIC~1\Hamachi
2007-08-24 16:51 25544 –a—— C:\WINDOWS\system32\drivers\hamachi.sys
2007-08-17 14:20 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-08-15 10:50 ——— d–h—– C:\DOCUME~1\Peter\APPLIC~1\GTek
2007-08-15 10:50 ——— d–h—– C:\DOCUME~1\Alex\APPLIC~1\Gtek
2007-08-15 10:50 ——— d——– C:\DOCUME~1\Kim\APPLIC~1\Gtek
2007-08-15 10:50 ——— d——– C:\DOCUME~1\ERICAM~1\APPLIC~1\Gtek
2007-08-15 10:48 ——— d——– C:\Program Files\DellSupport
2007-08-15 09:11 ——— d——– C:\Program Files\Lavasoft
2007-08-14 19:08 ——— d——– C:\Program Files\WiFiConnector
2007-08-13 15:26 ——— d——– C:\Program Files\Support.com
2007-08-08 13:18 ——— d——– C:\Program Files\Maxis
2007-07-30 19:19 92504 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\cdm.dll
2007-07-30 19:19 92504 –a—— C:\WINDOWS\SYSTEM32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\SYSTEM32\wuapi.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\SYSTEM32\wuauclt.exe
2007-07-30 19:19 53080 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\SYSTEM32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\SYSTEM32\wucltui.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\wucltui.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\SYSTEM32\wuweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\SYSTEM32\wuaueng.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\SYSTEM32\wups.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\wups.dll
2007-06-26 10:13 851968 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\vgx.dll
2007-06-26 09:09 658944 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\wininet.dll
2007-06-26 01:08 1104896 –a—— C:\WINDOWS\SYSTEM32\msxml3.dll
2007-06-26 01:08 1104896 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\msxml3.dll
2006-02-19 02:28 12288 –a—— C:\WINDOWS\Fonts\RandFont.dll
2006-01-03 23:08 212849 –a—— C:\Program Files\hijackthis.zip
2006-01-02 15:56 6224992 –a—— C:\Program Files\TrojanHunter.exe
2005-12-19 18:17 212992 –a—— C:\Program Files\MallTycoon3Setup-dm.exe
2005-12-18 20:18 15271071 –a—— C:\Program Files\thesims2_update_cd.zip
2005-12-18 20:15 444161 –a—— C:\Program Files\TS2SysReqc.zip
2005-12-18 01:55 10940595 –a—— C:\Program Files\GP5DEMO.exe
2005-12-15 10:50 10537576 –a—— C:\Program Files\zlsSetup_61_737_000_en.exe
2005-12-11 15:51 5037072 –a—— C:\Program Files\spybotsd14.exe
2005-12-10 11:08 561810 –a—— C:\Program Files\country_cottage.zip
2005-12-09 15:57 12820430 –a—— C:\Program Files\atgset.zip
2005-12-09 15:52 66218 –a—— C:\Program Files\k860slava_lamp_4.zip
2005-12-08 18:29 49011 –a—— C:\Program Files\k8sprwall6.zip
2005-12-08 18:27 2989597 –a—— C:\Program Files\sprset.zip
2005-12-07 23:54 703 –a—— C:\Program Files\DelTypedURL.inf
2005-03-28 23:36 276408 –a—— C:\Program Files\CleanUp312.exe
2005-03-27 03:05 76551 –a—— C:\Program Files\bholist.txt
2005-03-25 23:51 42171 –a—— C:\Program Files\KillBox.zip
2005-03-20 13:09 320000 –a—— C:\Program Files\IE-SPYAD2.exe
2005-03-20 12:48 5205858 –a—— C:\Program Files\ZoneAlarm.exe
2005-03-19 16:10 2179792 –a—— C:\Program Files\CWShredder.exe
2005-01-29 07:44 168 –a—— C:\Program Files\AdbeRdr70_enu_full_FEAD_error.log
2005-01-29 03:28 20798256 –a—— C:\Program Files\AdbeRdr70_enu_full.exe
2005-01-29 00:13 2606037 –a—— C:\Program Files\692509.pdf
2005-01-28 18:47 12404 –a—— C:\Program Files\WildChild.ttf
2005-03-01 15:25:21 417,792 –sha-r C:\WINDOWS\SYSTEM32\w?nlogon.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-04-07 01:19]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 01:07]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 04:59 C:\WINDOWS\BCMSMMSG.exe]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2003-08-06 02:04]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2003-08-26 20:47]
"mmtask"="c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe" [2003-10-06 11:05]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2004-10-29 03:50]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-09-14 08:17]
"AVG7_EMC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe" [2007-08-17 08:15]
"HostManager"="C:\Program Files\Common Files\AOL\1124239610\ee\AOLSoftware.exe" [2006-09-25 19:52]
"THGuard"="C:\Program Files\TrojanHunter 4.2\THGuard.exe" [2005-02-19 16:36]
"IPHSend"="C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe" [2006-02-17 11:59]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 01:41]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 18:58]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-08-14 10:46]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-09-14 10:22]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" [2006-09-25 19:52]
"PlaxoUpdate"="C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe" [2006-11-16 12:42]
"SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2006-11-02 13:43]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-04-19 21:27]
"AIM"="C:\PROGRA~1\AIM\aim.exe" [2006-08-01 15:35]

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\
DESKTOP.INI [2002-09-03 10:00:00]
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-03-04 18:44:15]
Run Nintendo Wi-Fi USB Connector Registration Tool.lnk - C:\Program Files\WiFiConnector\NintendoWFCReg.exe [2007-08-14 19:08:46]
SMC2862W-G EZ Connect g 802.11g Wireless USB Utility.lnk - C:\Program Files\SMC\SMC2862W-G EZ Connect g 2.4Ghz 802.11g Wireless USB 2.0 Adapter\SMCWGUTI.exe [2005-10-17 16:10:34]

C:\DOCUME~1\Alex\Desktop\Programs\Startup\
DESKTOP.INI [2002-09-03 10:00:00]

C:\DOCUME~1\CHRIST~1\STARTM~1\Programs\Startup\
DESKTOP.INI [2002-09-03 10:00:00]

C:\DOCUME~1\ERICAM~1\STARTM~1\Programs\Startup\
DESKTOP.INI [2002-09-03 10:00:00]

C:\DOCUME~1\Kim\STARTM~1\Programs\Startup\
DESKTOP.INI [2002-09-03 10:00:00]

C:\DOCUME~1\Peter\STARTM~1\Programs\Startup\
DESKTOP.INI [2002-09-03 10:00:00]
hamachi.lnk - C:\Program Files\Hamachi\hamachi.exe [2007-08-24 16:51:02]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"= c:\Program Files\interMute\SpySubtract\sshook.dll [2005-03-19 16:16 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Notification Packages"= :\WINDOWS\syste

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk
backup=C:\WINDOWS\pss\HP Photosmart Premier Fast Start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak software updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk
backup=C:\WINDOWS\pss\Kodak software updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SpySubtract.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SpySubtract.lnk
backup=C:\WINDOWS\pss\SpySubtract.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Peter^Start Menu^Programs^Startup^Greetings Workshop Reminders.lnk]
path=C:\Documents and Settings\Peter\Start Menu\Programs\Startup\Greetings Workshop Reminders.lnk
backup=C:\WINDOWS\pss\Greetings Workshop Reminders.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
C:\Program Files\AIM\aim.exe -cnetwait.odl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ApacheAirAssault_Setup.exe]
C:\DOWNLO~1\APACHE~1.EXE /r

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
C:\Program Files\MySpace\IM\MySpaceIM.exe

R1 DcCam;Kodak Camera Proxy;C:\WINDOWS\system32\DRIVERS\DcCam.sys
R2 DCFS2K;Kodak DCFS2K Driver;C:\WINDOWS\system32\drivers\dcfs2k.sys
R3 BCMModem;BCM V.92 56K Modem;C:\WINDOWS\system32\DRIVERS\BCMSM.sys
R3 SMC2862W;SMC2862W-G EZ Connect g 2.4Ghz 802.11g Wireless USB 2.0 Adapter Driver;C:\WINDOWS\system32\DRIVERS\2862WICB.sys
R3 Wpsnuio;WPS NDIS Usermode I/O Protocol;C:\WINDOWS\system32\DRIVERS\wpsnuio.sys
S1 Exportit;Exportit;C:\WINDOWS\system32\DRIVERS\exportit.sys
S3 cdiskdun;cdiskdun;\??\C:\DOCUME~1\Peter\LOCALS~1\Temp\cdiskdun.sys
S3 DcFpoint;DcFpoint;C:\WINDOWS\system32\DRIVERS\DcFpoint.sys
S3 DcLps;Legacy Polling Service;C:\WINDOWS\system32\DRIVERS\DcLps.sys
S3 DcPTP;dcptp;C:\WINDOWS\system32\DRIVERS\DcPTP.sys
S3 epstw2k;SCM Parallel Port SCSI Driver;C:\WINDOWS\system32\DRIVERS\epstw2k.sys
S3 p2pgasvc;Peer Networking Group Authentication;C:\WINDOWS\System32\svchost.exe -k p2psvc
S3 p2pimsvc;Peer Networking Identity Manager;C:\WINDOWS\System32\svchost.exe -k p2psvc
S3 p2psvc;Peer Networking;C:\WINDOWS\System32\svchost.exe -k p2psvc
S3 PNRPSvc;Peer Name Resolution Protocol;C:\WINDOWS\System32\svchost.exe -k p2psvc
S3 scsiscan;SCSI Scanner Driver;C:\WINDOWS\system32\DRIVERS\scsiscan.sys
S3 USB Wireless USB Adapter®;USB Wireless USB Adapter® Service for Wireless USB Adapter;C:\WINDOWS\system32\DRIVERS\vnetusbr.sys

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc p2psvc p2pimsvc p2pgasvc PNRPSvc

.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-26 23:15:18
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************
.
Completion time: 2007-09-26 23:17:19
C:\ComboFix-quarantined-files.txt … 2007-09-26 23:16
C:\ComboFix2.txt … 2007-09-25 21:19
.
— E O F —

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:51:31 PM, on 9/26/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\AOL\1124239610\ee\AOLSoftware.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\PROGRA~1\AIM\aim.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\WiFiConnector\NintendoWFCReg.exe
C:\Program Files\SMC\SMC2862W-G EZ Connect g 2.4Ghz 802.11g Wireless USB 2.0 Adapter\SMCWGUTI.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Skyhook Wireless\Wi-Fi Service\WPSScannerSvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = www.rr.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1124239610\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe -a
O4 - HKCU\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Run Nintendo Wi-Fi USB Connector Registration Tool.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
O4 - Global Startup: SMC2862W-G EZ Connect g 802.11g Wireless USB Utility.lnk = C:\Program Files\SMC\SMC2862W-G EZ Connect g 2.4Ghz 802.11g Wireless USB 2.0 Adapter\SMCWGUTI.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 3.0\resources\en-US\local\search.html
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr.com/install/download/tgctlcm.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} (AOL Content Update) - http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9E17A5F9-2B9C-4C66-A592-199A4BA1FBC8} - http://pictures06.aim.com/ygp/aol/plugin/u…AIM.9.5.1.8.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/…tiveXPlugin.cab
O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} (LinkSys Content Update) - http://www.linksysfix.com/netcheck/24/install/gtdownls.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Adapter\WLService.exe
O23 - Service: WPS Scanner Service (WPSScannerSvc) - Skyhook Wireless - C:\Program Files\Skyhook Wireless\Wi-Fi Service\WPSScannerSvc.exe
O24 - Desktop Component 0: (no name) - http://www.gotpetsonline.com/pictures-gall…amster-0001.jpg
O24 - Desktop Component 1: (no name) - http://fenway.50g.com/firstbaseside.jpg

–
End of file - 10757 bytes

silver

Post #8September 27, 2007, 8:17 AM UTC

Hi BobDylan,

Random questions are just fine

Re AIM & MySpaceIM:
Usually the best way to disable programs from auto-starting is from within the program itself, so I recommend you check the settings to see if this is possible.

It looks to me like MySpace is currently not automatically starting, as you have disabled it using MSConfig - please confirm whether this is the case.
We can disable AIM using HijackThis:

Open HijackThis, choose Do a system scan only and place a checkmark next to the following lines:

O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl

Then close all open windows apart from HijackThis, press Fix checked, OK the prompt and close HijackThis.

Re Comcast Icon:
At this stage I don't know why that has happened. Please try this:
Right-click the Desktop and select New->Shortcut
Copy the desired path into the white box and press Next:
http://www.comcast.net/home
Name the shortcut Comcast Home Page or whatever you like and press Finish
Then, double-click the shortcut and see if it works.

Re Hamachi:
Hamachi is a virtual private network client, and it's almost certainly not necessary for your wireless connection. You can disable it from running with HijackThis as follows:
Open HijackThis, choose Do a system scan only and place a checkmark next to the following lines:

O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe

Then close all open windows apart from HijackThis, press Fix checked, OK the prompt and close HijackThis.

If you are sure you don't want this program any longer, then uninstall it by opening Start->Control Panel->Add/Remove Programs, find Hamachi 1.0.2.2 and select Remove

————————————————————————

Backup Your Registry with ERUNT:

Download erunt.zip to your Desktop from here:
http://aumha.org/downloads/erunt.zip
Right-click erunt.zip, select Extract All… and follow the prompts to extract ERUNT to a new folder on your Desktop
Inside the new folder, double-click ERUNT.exe to start the program
OK all the prompts to back up your registry to the default location.

Note: to restore your registry, go to the backup folder and start ERDNT.exe

————————————————————————

Open Notepad: press Start->Run, type notepad into the box and press OK
Copy/paste the following quote box into Notepad. Before starting select Format from the top menu and make sure Word Wrap is NOT checked.

echo REGEDIT4 > C:\import.reg
echo.>>C:\import.reg
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] >>C:\import.reg
echo "Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00 >>C:\import.reg
echo.>>C:\import.reg
regedit /s C:\import.reg
del C:\import.reg
regedit /a "%userprofile%\desktop\regcheck.txt" HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

Go to the menu at the top of the Notepad File and Save as
Save it to your Desktop as "runme.bat" (you MUST include the quotes)
Locate runme.bat on your Desktop and double-click it. Another text file should appear on your Desktop called regcheck.txt, post the contents of this file in your next response.

————————————————————————

Make hidden/system files and folders visible:
Click Start -> My Computer
Select the Tools menu, click Folder Options and select the View tab
Under the Hidden files and folders heading SELECT Show hidden files and folders
UNCHECK the Hide extensions for known file types option
UNCHECK the Hide protected operating system files (recommended) option
Click Yes to confirm and press OK

Next, there is a file we want to delete called w?nlogon.exe. This may appear on your machine as winlogon.exe which is also the name of an important legitimate file - the easiest way to tell them apart is by checking the file size.
You can check the size of a file by right-clicking it and selecting Properties - the file size will be displayed in the Properties dialog box.

Use Windows Explorer (right-click Start, select Explore) to navigate to this folder:

C:\WINDOWS\system32

Then, look for a file named w?nlogon.exe or winlogon.exe that has a size of 417,792 bytes and delete it (right-click, select Delete and OK)
The legitimate winlogon.exe has a different file size, so please check carefully before you delete.

If you have trouble deleting it or can't find it please let me know in your next response.

————————————————————————

Next, download, install, and update AVG Anti-Spyware 7.5
Download the installer from this page:
http://www.ewido.net/en/download/

Save the installer to desktop
Double click the installer, select your language, and then select OK
Click through to install the program and once you press Finish the main screen will open
Next to Resident Shield, click Change state so that active changes to inactive
Right-click the AVG Antispyware tray icon, select Start with Windows to remove the check-mark and OK the prompt
Click the Update tab at the top, an update should be under way, if not, then under Manual Update click Start update.
After the update finishes the status bar at the bottom will display Update successful
If for any reason you cannot update from within the program, download and install the full database package from here: http://www.ewido.net/en/download/updates/
Close AVG Anti-Spyware. Do not run a scan yet.

Reboot your computer into Safe Mode
To boot into Safe Mode, please restart your computer. Tap F8 before Windows loads.
Select Safe Mode at the top, on the screen that appears.
Sign in with your normal user account

Once in safe mode:

Run AVG Anti-Spyware 7.5 and click on the Scanner tab at the top
Click the Settings tab and under How to act, change Recommended actions to Quarantine and under Reports select Do not automatically generate reports
Click back to the Scan tab and then click on Complete System Scan.
This scan can take quite a while to run, so be prepared.
AVG Anti-Spyware 7.5 will list any infections found on the left hand side.
When the scan is complete, make sure Set all elements to: is set to Quarantine, if not, click the setting and choose Quarantine
Click the Apply all actions button. AVG Anti-Spyware 7.5 will display All actions have been applied on the right hand side.
Click on Save Report, then Save Report As. This will create a text file. Make sure you know where to find this file again (like on the Desktop).

Now reboot your computer normally

————————————————————————

Once complete, please post the regcheck.txt output, the AVG Antispyware report and a new HijackThis log.

BobDylan

Post #9September 28, 2007, 5:14 AM UTC

Hey Silver:
Well, that was a fun scan . . .one hour and over 200 threats later . . . .! But I think I've done everything correctly, and I've posted the new HijackThis log, the regcheck.txt output, and the AVG Antispyware report below.

As for the random things - the MySpace isn't auto starting but the AIM still is. I think I checked the right box in the program setting preferences for AIM, but it still pops up on reboots - I think I see which box in the HJT log to check, but could you point it out to me again. And I didn't do the Hamachi thing yet, but I'll do that next time also.
And I still can't get the Comcast and some other icons to work from the desktop - but I'll worry about those later.
One other thing - when I was playing with The TrojanHunter icon that we disabled, and I tried to enable it, I realized that that was a trial version I had downloaded some time ago which has expired and I can't enable now. When the time comes, will I need to get a working version of TrojanHunter and if so is there a place I can download it again?

And here are the logs(good luck with all these!):

regcheck.txt

REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00
"Bounds"=hex:00,30,00,00,00,20,00,00
"Security Packages"=hex(7):6b,65,72,62,65,72,6f,73,00,6d,73,76,31,5f,30,00,73,\
63,68,61,6e,6e,65,6c,00,77,64,69,67,65,73,74,00,00
"LsaPid"=dword:00000488
"SecureBoot"=dword:00000001
"auditbaseobjects"=dword:00000000
"crashonauditfail"=dword:00000000
"disabledomaincreds"=dword:00000000
"everyoneincludesanonymous"=dword:00000000
"fipsalgorithmpolicy"=dword:00000000
"forceguest"=dword:00000001
"fullprivilegeauditing"=hex:00
"limitblankpassworduse"=dword:00000001
"lmcompatibilitylevel"=dword:00000000
"nodefaultadminowner"=dword:00000001
"nolmhash"=dword:00000000
"restrictanonymous"=dword:00000000
"restrictanonymoussam"=dword:00000001
"Notification Packages"=hex(7):00,3a,5c,57,49,4e,44,4f,57,53,5c,73,79,73,74,65
"ImpersonatePrivilegeUpgradeToolHasRun"=dword:00000001
"enabledcom"="y"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\AccessProviders]
"ProviderOrder"=hex(7):57,69,6e,64,6f,77,73,20,4e,54,20,41,63,63,65,73,73,20,\
50,72,6f,76,69,64,65,72,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\AccessProviders\Windows NT Access Provider]
"ProviderPath"=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,6e,74,6d,61,72,74,61,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Audit]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Audit\PerUserAuditing]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Audit\PerUserAuditing\System]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Data]
"Pattern"=hex:f6,31,79,3f,5c,88,38,ce,5f,b7,4e,75,37,81,79,23,35,64,63,64,33,\
62,66,39,00,00,00,00,01,00,00,00,b4,01,00,00,b8,01,00,00,34,ca,06,00,45,9d,\
bf,71,04,00,00,00,10,00,00,00,00,00,00,00,51,d7,42,9b

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\GBG]
"GrafBlumGroup"=hex:71,78,92,8d,44,ba,1d,56,51

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\JD]
"Lookup"=hex:e8,fe,64,ea,38,f4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Domains]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\SidCache]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\msv1_0]
"ntlmminclientsec"=dword:00000000
"ntlmminserversec"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Skew1]
"SkewMatrix"=hex:11,d6,e5,be,30,30,97,b1,30,f6,47,59,d3,00,a1,a3

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SSO]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SSO\Passport1.4]
"SSOURL"="http://www.passport.com"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache]
"Time"=hex:b2,28,53,82,3d,28,c5,01

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\digest.dll]
"Name"="Digest"
"Comment"="Digest SSPI Authentication Package"
"Capabilities"=dword:00004050
"RpcId"=dword:0000ffff
"Version"=dword:00000001
"TokenSize"=dword:0000ffff
"Time"=hex:00,d9,4a,94,f8,79,c4,01
"Type"=dword:00000031

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msapsspc.dll]
"Name"="DPA"
"Comment"="DPA Security Package"
"Capabilities"=dword:00000037
"RpcId"=dword:00000011
"Version"=dword:00000001
"TokenSize"=dword:00000300
"Time"=hex:00,d9,4a,94,f8,79,c4,01
"Type"=dword:00000031

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msnsspc.dll]
"Name"="MSN"
"Comment"="MSN Security Package"
"Capabilities"=dword:00000037
"RpcId"=dword:00000012
"Version"=dword:00000001
"TokenSize"=dword:00000300
"Time"=hex:80,6f,e3,94,f8,79,c4,01
"Type"=dword:00000031

AVG Antispyware report

———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 11:43:14 PM 9/27/2007

+ Scan result:

C:\WINDOWS\SYSTEM32\Cache\180SAInstaller.exe/ClientAX.dll -> Adware.180Solutions : Cleaned with backup (quarantined).
C:\Program Files\Common Files\Java\bpcv2_inst.exe -> Adware.Broadcap : Cleaned with backup (quarantined).
C:\Program Files\Common Files\Java\bpt.cfg -> Adware.Broadcap : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\broadcastpc.exe -> Adware.Broadcap : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\btcrwujd.exe -> Adware.Broadcap : Cleaned with backup (quarantined).
HKLM\SOFTWARE\BPT -> Adware.BroadCastPC : Cleaned with backup (quarantined).
HKLM\SOFTWARE\BPT\131.zip -> Adware.BroadCastPC : Cleaned with backup (quarantined).
HKLM\SOFTWARE\BPT\134.zip -> Adware.BroadCastPC : Cleaned with backup (quarantined).
HKLM\SOFTWARE\BPT\28.exe -> Adware.BroadCastPC : Cleaned with backup (quarantined).
HKLM\SOFTWARE\BPT\64.exe -> Adware.BroadCastPC : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\Uninstaller.exe -> Adware.DealHelper : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Dvx -> Adware.Delfin : Cleaned with backup (quarantined).
HKLM\SOFTWARE\skin -> Adware.Delfin : Cleaned with backup (quarantined).
HKU\S-1-5-21-1511319073-2591443367-2869321682-1008\Software\Dvx -> Adware.Delfin : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\mssysapps\ezsys.exe.tcf -> Adware.EZula : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\gtdownls_95.ocx -> Adware.Gdown : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\Cache\trgen_fran-162813.exe -> Adware.HotSearchBar : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-1511319073-2591443367-2869321682-1008\Dc18.exe -> Adware.MediaTickets : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\70tovmto.ini -> Adware.Sahat : Cleaned with backup (quarantined).
HKU\.DEFAULT\Software\WinUpdt -> Adware.SecondThought : Cleaned with backup (quarantined).
HKU\S-1-5-18\Software\WinUpdt -> Adware.SecondThought : Cleaned with backup (quarantined).
C:\Documents and Settings\Peter\Desktop\SkiResortTycoon_Setup-dm.exe -> Adware.Trymedia : Cleaned with backup (quarantined).
C:\Documents and Settings\Peter\My Documents\My Music\From Internet\SkiResortSetup-dm.exe -> Adware.Trymedia : Cleaned with backup (quarantined).
C:\Documents and Settings\Peter\My Documents\My Music\From Internet\SkiResortTycoon_Setup-dm.exe -> Adware.Trymedia : Cleaned with backup (quarantined).
C:\Downloads\ApacheAirAssault_Setup-dm[1].exe -> Adware.Trymedia : Cleaned with backup (quarantined).
C:\Downloads\LemonadeTycoonSetup-dm[1].exe -> Adware.Trymedia : Cleaned with backup (quarantined).
C:\Downloads\LuxuryLinerTycoon_Setup-dm[1].exe -> Adware.Trymedia : Cleaned with backup (quarantined).
C:\Downloads\RollerCoasterTycoon-dm[1].exe -> Adware.Trymedia : Cleaned with backup (quarantined).
C:\Program Files\MallTycoon3Setup-dm.exe -> Adware.Trymedia : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP572\A0513918.exe -> Adware.UrlSpy : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP572\A0513920.exe -> Adware.UrlSpy : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP573\A0513931.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\ddcyw.dll.vir -> Adware.Virtumonde : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Adware.WebRebates : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ope\dlcl.edp -> Backdoor.Zapchast : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ope\zwqw -> Backdoor.Zapchast : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ciluayqt\gypexkar.dll -> Downloader.Agent.lg : Cleaned with backup (quarantined).
C:\WINDOWS\Downloaded Program Files\rist.exe.tcf -> Downloader.Small.yl : Cleaned with backup (quarantined).
:mozilla.100:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.101:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.102:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.6:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\w0hih2mb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.7:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\w0hih2mb.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.109:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned.
:mozilla.450:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned.
:mozilla.451:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned.
:mozilla.452:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned.
:mozilla.453:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned.
:mozilla.120:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.121:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.122:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Alex\Cookies\alex@admarketplace[1].txt -> TrackingCookie.Admarketplace : Cleaned.
:mozilla.33:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\w0hih2mb.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.804:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Burstbeacon : Cleaned.
:mozilla.38:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\w0hih2mb.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.84:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.85:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.86:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.74:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.75:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.76:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.77:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.78:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\Peter\Cookies\[removed][1].txt -> TrackingCookie.Cnn : Cleaned.
:mozilla.236:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.237:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\Alex\Cookies\alex@com[1].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\Peter\Cookies\peter@com[1].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\Peter\Cookies\[removed][2].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\Peter\Cookies\[removed][1].txt -> TrackingCookie.Com : Cleaned.
:mozilla.249:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Dealtime : Cleaned.
C:\Documents and Settings\Alex\Cookies\alex@dealtime[1].txt -> TrackingCookie.Dealtime : Cleaned.
C:\Documents and Settings\Alex\Cookies\[removed][2].txt -> TrackingCookie.Dealtime : Cleaned.
C:\Documents and Settings\Alex\Cookies\[removed][2].txt -> TrackingCookie.Dealtime : Cleaned.
C:\Documents and Settings\Peter\Cookies\peter@dealtime[1].txt -> TrackingCookie.Dealtime : Cleaned.
C:\Documents and Settings\Peter\Cookies\[removed][2].txt -> TrackingCookie.Dealtime : Cleaned.
C:\Documents and Settings\Peter\Cookies\[removed][1].txt -> TrackingCookie.Directnetadvertising : Cleaned.
C:\Documents and Settings\Peter\Cookies\[removed][2].txt -> TrackingCookie.Directnetadvertising : Cleaned.
:mozilla.29:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\w0hih2mb.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.271:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.272:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.273:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.274:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.275:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.276:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.277:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.278:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.279:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.280:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.281:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.282:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.283:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.284:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.285:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.286:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.287:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.288:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.289:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.290:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.291:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.292:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.293:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.294:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.295:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.87:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.88:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.89:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.90:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.91:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
C:\Documents and Settings\Alex\Cookies\[removed][2].txt -> TrackingCookie.Euroclick : Cleaned.
C:\Documents and Settings\Erica Marie\Cookies\erica [removed][2].txt -> TrackingCookie.Euroclick : Cleaned.
C:\Documents and Settings\Peter\Cookies\[removed][2].txt -> TrackingCookie.Euroclick : Cleaned.
C:\Documents and Settings\Peter\Cookies\peter@fortunecity[2].txt -> TrackingCookie.Fortunecity : Cleaned.
:mozilla.827:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.828:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.370:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.371:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.31:C:\Documents and Settings\Christopher\Application Data\Mozilla\Firefox\Profiles\540cspoh.default\cookies.txt -> TrackingCookie.Information : Cleaned.
C:\Documents and Settings\Christopher\Cookies\[removed][1].txt -> TrackingCookie.Information : Cleaned.
C:\Documents and Settings\Peter\Cookies\[removed][2].txt -> TrackingCookie.Information : Cleaned.
C:\Documents and Settings\Alex\Cookies\[removed][1].txt -> TrackingCookie.Live : Cleaned.
C:\Documents and Settings\Peter\Cookies\[removed][1].txt -> TrackingCookie.Live : Cleaned.
:mozilla.759:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.760:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.761:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.762:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.764:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.765:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.766:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\Alex\Cookies\[removed][2].txt -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\Peter\Cookies\[removed][1].txt -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\Peter\Cookies\[removed][1].txt -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\Christopher\Cookies\[removed][1].txt -> TrackingCookie.Msn : Cleaned.
C:\Documents and Settings\Peter\Cookies\[removed][1].txt -> TrackingCookie.Msn : Cleaned.
C:\Documents and Settings\Alex\Cookies\[removed][2].txt -> TrackingCookie.Netflame : Cleaned.
C:\Documents and Settings\Peter\Cookies\[removed][2].txt -> TrackingCookie.Netflame : Cleaned.
:mozilla.35:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Paypal : Cleaned.
C:\Documents and Settings\Alex\Cookies\[removed][2].txt -> TrackingCookie.Paypal : Cleaned.
C:\Documents and Settings\Peter\Cookies\[removed][1].txt -> TrackingCookie.Paypal : Cleaned.
:mozilla.124:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.125:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.126:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.127:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.539:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Pro-market : Cleaned.
:mozilla.540:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Pro-market : Cleaned.
C:\Documents and Settings\Peter\Cookies\[removed][2].txt -> TrackingCookie.Real : Cleaned.
C:\Documents and Settings\Peter\Cookies\[removed][2].txt -> TrackingCookie.Real : Cleaned.
:mozilla.555:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.556:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.557:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.558:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.559:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.560:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.561:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.563:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Revenue : Cleaned.
:mozilla.24:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\w0hih2mb.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.25:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\w0hih2mb.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.25:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.28:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.29:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.30:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.31:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.32:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.33:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.719:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
C:\Documents and Settings\Alex\Cookies\alex@revsci[2].txt -> TrackingCookie.Revsci : Cleaned.
C:\Documents and Settings\Peter\Cookies\peter@revsci[2].txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.211:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.599:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.600:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.601:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.602:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.603:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.23:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.24:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.26:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.27:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.726:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.727:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Alex\Cookies\[removed][2].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Alex\Cookies\[removed][2].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Alex\Cookies\alex@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Christopher\Cookies\christopher@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Erica Marie\Cookies\erica [removed][2].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Erica Marie\Cookies\erica [removed][1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Erica Marie\Cookies\erica marie@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Peter\Cookies\[removed][2].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Peter\Cookies\[removed][1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Peter\Cookies\peter@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.43:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\w0hih2mb.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.657:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.746:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Webtrends : Cleaned.
:mozilla.92:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.93:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.94:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.95:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.96:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.97:C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\hom35zvs.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Alex\My Documents\WinFixer2006FreeInstall.exe -> Trojan.Fakealert : Cleaned with backup (quarantined).

::Report end

HijackThis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:51:30 PM, on 9/27/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\AOL\1124239610\ee\AOLSoftware.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\WiFiConnector\NintendoWFCReg.exe
C:\Program Files\SMC\SMC2862W-G EZ Connect g 2.4Ghz 802.11g Wireless USB 2.0 Adapter\SMCWGUTI.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Skyhook Wireless\Wi-Fi Service\WPSScannerSvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = www.rr.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1124239610\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe -a
O4 - HKCU\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Run Nintendo Wi-Fi USB Connector Registration Tool.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
O4 - Global Startup: SMC2862W-G EZ Connect g 802.11g Wireless USB Utility.lnk = C:\Program Files\SMC\SMC2862W-G EZ Connect g 2.4Ghz 802.11g Wireless USB 2.0 Adapter\SMCWGUTI.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 3.0\resources\en-US\local\search.html
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr.com/install/download/tgctlcm.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} (AOL Content Update) - http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9E17A5F9-2B9C-4C66-A592-199A4BA1FBC8} - http://pictures06.aim.com/ygp/aol/plugin/u…AIM.9.5.1.8.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/…tiveXPlugin.cab
O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} (LinkSys Content Update) - http://www.linksysfix.com/netcheck/24/install/gtdownls.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Adapter\WLService.exe
O23 - Service: WPS Scanner Service (WPSScannerSvc) - Skyhook Wireless - C:\Program Files\Skyhook Wireless\Wi-Fi Service\WPSScannerSvc.exe
O24 - Desktop Component 0: (no name) - http://www.gotpetsonline.com/pictures-gall…amster-0001.jpg
O24 - Desktop Component 1: (no name) - http://fenway.50g.com/firstbaseside.jpg

–
End of file - 10929 bytes

silver

Post #10September 28, 2007, 12:58 PM UTC

Hi BobDylan,

There was a lot of malware removed by AVG, you need to be very careful what programs you install on your computer if you wish to avoid a repeat of this infestation - I'll give you some tips to help with this shortly.

Did you find and delete the w?nlogon.exe file successfully? Any problems?

Random questions:

Re AIM - please see if these instructions help:

Right-click the AOL System Tray icon, select AOL 9.0, and choose Start-Up Settings. From the AOL Start-Up Settings dialog box, deselect the Enable Fast Start option, click Save, and close AOL. After you reboot, AOL will be gone from your startup routine.

To fix Hamachi, open HijackThis, choose Do a system scan only and place a checkmark next to the following line:

O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe

Then close all open windows apart from HijackThis, press Fix checked, OK the prompt and close HijackThis.

Re TrojanHunter: you could try reinstalling the trial but it probably won't work, trials often leave entries behind so it can detect whether you have already trialled the software or not. I recommend you uninstall it via Add/Remove Programs for now and I'll give you some software recommendations shortly.

Your logs look good, how is your computer running now?

Please post another HijackThis log and let me know about the questions I've asked.

BobDylan

Post #11September 29, 2007, 4:45 AM UTC

Hi Silver:
The computer seems to be running pretty clean right now (thanks!) - but still having problems with the StartUp stuff, and after that gets all cleaned up it's fine.
I was able to remove the correct winlogon.exe file - it didn't have a ? in the file name, but the file size was exactly like you said it would be, and the other was different.
I also got rid of the Hamachi popup thing at start-up and it didn't affect the wireless connection (as you said).
And I uninstalled TrojanHunter - I do remember trying to reinstall that before and it wouldn't let me as it remembered me (as you said).
Not sure if you can tell from the HijackThis log, but there's actually more stuff coming up now when I restart. I may have made a mistake as I was playing around with the msconfig thing and something popped up saying I should change it from Selective Startup to Normal startup (under the General tab). After I tried that, I now get MySpace popping up again, along with Aim still and now SpySubtract, a question about Kodak, and something else I think. I have since put it back to Selective, but those things are still popping up. I can play around with it, but if you have any advice, I'll surely take it.
And anything you can suggest to replace TrojanHunter and settings on the AVG, firewalls, etc. to prevent me picking up so much malware again would be greatly appreciated..
Thanks so much again for your time and advice, and here's the latest HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:37:15 AM, on 9/29/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program Files\Common Files\AOL\1124239610\ee\AOLSoftware.exe
C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\WiFiConnector\NintendoWFCReg.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\Program Files\SMC\SMC2862W-G EZ Connect g 2.4Ghz 802.11g Wireless USB 2.0 Adapter\SMCWGUTI.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\interMute\SpySubtract\SpySub.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Skyhook Wireless\Wi-Fi Service\WPSScannerSvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = www.rr.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1124239610\ee\AOLSoftware.exe
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe -a
O4 - HKCU\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKCU\..\Run: [ApacheAirAssault_Setup.exe] C:\DOWNLO~1\APACHE~1.EXE /r
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Run Nintendo Wi-Fi USB Connector Registration Tool.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
O4 - Global Startup: SMC2862W-G EZ Connect g 802.11g Wireless USB Utility.lnk = C:\Program Files\SMC\SMC2862W-G EZ Connect g 2.4Ghz 802.11g Wireless USB 2.0 Adapter\SMCWGUTI.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 3.0\resources\en-US\local\search.html
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr.com/install/download/tgctlcm.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} (AOL Content Update) - http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9E17A5F9-2B9C-4C66-A592-199A4BA1FBC8} - http://pictures06.aim.com/ygp/aol/plugin/u…AIM.9.5.1.8.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/…tiveXPlugin.cab
O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} (LinkSys Content Update) - http://www.linksysfix.com/netcheck/24/install/gtdownls.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Adapter\WLService.exe
O23 - Service: WPS Scanner Service (WPSScannerSvc) - Skyhook Wireless - C:\Program Files\Skyhook Wireless\Wi-Fi Service\WPSScannerSvc.exe
O24 - Desktop Component 0: (no name) - http://www.gotpetsonline.com/pictures-gall…amster-0001.jpg
O24 - Desktop Component 1: (no name) - http://fenway.50g.com/firstbaseside.jpg

–
End of file - 12223 bytes

silver

Post #12September 29, 2007, 6:50 AM UTC

Hi BobDylan,

OK that sounds great. We have two issues left then, startup programs and software recommendations.

Startup Programs

I recommend you try using a different program to handle startup programs. Open MSConfig and change the setting to Normal Startup so everything is re-enabled.

Next, download Winpatrol from here:
http://www.winpatrol.com/wpsetup.exe

Double-click wpsetup.exe and follow the prompts to install the program.
You will now see a new icon in your System Tray - this is Scotty the Windows watchdog!
Next we'll use WinPatrol to manage startup programs - double-click Scotty to open WinPatrol
Select the Startup Programs tab - this will show you all the currently auto-starting programs on your system
To disable a program - highlight it and press Disable, to re-enable - highlight it and press Enable
If you aren't sure what a program is, highlight it and press Info - this will give you more information to help you decide.
You can use this program to disable MySpace IM by disabling this entry:
MySpaceIM MySpaceIM.exe
Please take great care when disabling programs and I strongly recommend you don't remove any - if you only disable programs then any mistakes can be rectified - if you delete then the entries are gone forever and you may have to reinstall the software.
Also have a look at this tutorial to help you get started with the program.

Final Steps:
At this stage your computer looks clean of malware, however these final steps are very important:

Re-hide hidden/system files and folders:
Click Start -> My Computer
Select the Tools menu, click Folder Options and select the View tab
Under the Hidden files and folders heading SELECT Do not show hidden files and folders
CHECK the Hide extensions for known file types option
CHECK the Hide protected operating system files (recommended) option
Press OK

Create a new, clean System Restore point which you can use in case of future system problems:
Press Start->All Programs->Accessories->System Tools->System Restore
Select Create a restore point, then Next, type a name like All Clean then press the Create button and once it's done press Close

Now remove old, infected System Restore points:
Next click Start->Run and type cleanmgr in the box and press OK
Ensure the boxes for Temporary Files and Temporary Internet Files are checked, you can choose to check other boxes if you wish but they are not required.
Select the More Options tab, under System Restore press Clean up… and say Yes to the prompt
Press OK and Yes to confirm

Software recommendations:

I think you now have installed the following:
AVG Antivirus
Spybot S&D
SpySubtract
Spyware Blaster
AVG Antispyware (free version)

Your antivirus program is fine as long as it is active and updated daily. If you wish to try an alternative then you could look at Antivir however make sure you uninstall AVG before installing another antivirus program.

You now have AVG Antispyware installed which is an excellent program, however it's real-time protection functionality is not free. I recommend you consider purchasing the full version of the program, but if you choose not to, you should install another antispyware program with real-time protection - there are several free programs available with this capability, one I can recommend is Windows Defender, available here:
http://www.microsoft.com/athome/security/s…re/default.mspx

With Windows Defender, AVG Antispyware and WinPatrol, you probably don't need TrojanHunter or SpySubtract so I'd recommend not reinstalling TrojanHunter and removing SpySubtract.

Spyware Blaster is an excellent program and I recommend you continue to use it.

You should consider installing a Personal Firewall program. Even if you are behind a NAT router, I recommend you use firewall software as it will improve the security of your computer by monitoring and controlling outbound connections to the internet as well as inbound. There are various free packages available, such as Comodo and Zone Alarm:
http://www.personalfirewall.comodo.com/
http://www.zonelabs.com/
A tutorial on firewalls to help you get started:
http://www.bleepingcomputer.com/tutorials/tutorial60.html

Operating system vulnerabilities can easily be exploited by malware so please ensure your operating system is automatically kept up to date by using Windows Update:
Go to Start->Control Panel->Automatic Updates
Select Automatic and select a suitable schedule
Also, check that your antivirus and antispyware programs are set to automatically update daily.

Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

Please take care when downloading programs. One of the easiest ways to be infected is to download freeware/shareware programs which come laden with malware - this includes allowing websites to install browser plug-ins orActiveX controls. Before downloading, it is crucial to check whether the source is reputable.
One way to check is to use McAfee SiteAdvisor. Copy the domain name into the space provided and SiteAdvisor will give you a report on the website which can help you decide if it is safe. They also have a toolbar for IE and Firefox which adds this functionality to your browser.

Find out more about how to prevent infection in the future
http://forum.malwareremoval.com/viewtopic.php?p=33687

Please post back to let me know that you have read this, and if there are any further issues.

BobDylan

Post #13September 29, 2007, 7:16 PM UTC

Hi Silver; Just wanted to let you know I've read your recommendations - they should keep me busy for a while. I'll work on them today and look over the tutorials and try to get most of that software installed. ( I was sure I had ZoneLabs already installed but I must have deleted it somewhere along the way.) And just to check, we had diabled the Resident Shield in AVG, is it okay to enable that now or should I wait til later? Otherwise, I'll get back to you when all the software's in or if I have any problems along the way. Thanks! Peter

BobDylan

Post #14September 30, 2007, 5:33 AM UTC

Hi Silver:
Just a quick update. I've got all of the programs you suggested installed - WinPatrol, Windows Defender, ZoneLabs, MVPSHosts (I think), along with the Spware Blaster, Spybot S&D, AVG Antivirus and AVG antispyware that were there before, and I uninstalled the SpySubtract and TrojanHunter.
The WinPatrol took care of all the startup programs - there is an hourglass there for about 30-60secs but that's it upon startup.
The PC is running quite a bit faster now so everything looks good I think. I posted one last HijackThis log just to make sure nothing popped up since the last one.
And last, or I can post in a different forum - can you advise me, or is there a good program, to help clean up the desktop. I had quite a few icons there before, most of which I'm sure I don't need, and now there's a lot more that we've added - I'm guessing it's okay to get rid of most of the icon's and programs that we used along the way, but just wanted to run it by you.
Thanks so much again!
Peter

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:25:16 AM, on 9/30/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Skyhook Wireless\Wi-Fi Service\WPSScannerSvc.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\SMC\SMC2862W-G EZ Connect g 2.4Ghz 802.11g Wireless USB 2.0 Adapter\PRISMSVR.EXE
C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\WiFiConnector\NintendoWFCReg.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\svchost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = www.rr.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\Program Files\SMC\SMC2862W-G EZ Connect g 2.4Ghz 802.11g Wireless USB 2.0 Adapter\PRISMSVR.EXE" /APPLY
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe -a
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ApacheAirAssault_Setup.exe] C:\DOWNLO~1\APACHE~1.EXE /r
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Run Nintendo Wi-Fi USB Connector Registration Tool.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
O4 - Global Startup: SMC2862W-G EZ Connect g 802.11g Wireless USB Utility.lnk = C:\Program Files\SMC\SMC2862W-G EZ Connect g 2.4Ghz 802.11g Wireless USB 2.0 Adapter\SMCWGUTI.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 3.0\resources\en-US\local\search.html
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr.com/install/download/tgctlcm.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} (AOL Content Update) - http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9E17A5F9-2B9C-4C66-A592-199A4BA1FBC8} - http://pictures06.aim.com/ygp/aol/plugin/u…AIM.9.5.1.8.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/…tiveXPlugin.cab
O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} (LinkSys Content Update) - http://www.linksysfix.com/netcheck/24/install/gtdownls.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Adapter\WLService.exe
O23 - Service: WPS Scanner Service (WPSScannerSvc) - Skyhook Wireless - C:\Program Files\Skyhook Wireless\Wi-Fi Service\WPSScannerSvc.exe
O24 - Desktop Component 0: (no name) - http://www.gotpetsonline.com/pictures-gall…amster-0001.jpg
O24 - Desktop Component 1: (no name) - http://fenway.50g.com/firstbaseside.jpg

–
End of file - 11201 bytes

silver

Post #15September 30, 2007, 5:46 AM UTC

Hi BobDylan,

You're most welcome and it's good to hear everything went OK - your log looks fine.

You should now delete sfp.zip and ComboFix.exe from your Desktop, also delete this folder:

C:\QooBox

Also please do this:
Next click Start->Run and type cleanmgr in the box and press OK
Ensure the boxes for Recycle Bin, Temporary Files and Temporary Internet Files are checked, you can choose to check other boxes if you wish but they are not required.
Press OK and Yes to confirm

You only need one antispyware program active in real-time. While AVG's resident shield is excellent, unless you buy the paid-for version it's only available for a trial, so I'd turn it off and use Windows Defender for real-time protection. I recommend you keep the AVG free version on your machine and scan with it regularly.

If however you are going to buy AVG then you should turn on the resident shield and in that case you don't need to have Windows Defender at all.

You should be able to delete any icons you want from the Desktop, just be careful not to delete anything important. If you are talking about shortcuts that open programs, like the new shortcut to AVG Antispyware, then go ahead and delete it - you can always open it via the Start menu.

If you have any other non-malware issues, feel free to post in the other forums here at WhatTheTech - there are forums which cover most issues with computers.

Please post back to let me know that you have read this and if you have any further issues or questions

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Computer still slow after removing Antivirgear and Zlo

✨ Ask AI

Ask AI