Spyware / Malware / Virus Removal

[Resolved] Hi! Problem with Biohazard background and constant

15 min read

Looking for the outcome? Ask AI

SonOfJun Topic Starter

Post #1October 1, 2007, 6:47 PM UTC last edited October 1, 2007, 6:55 PM UTC

Hi, I think I'm in a bit of trouble here. I can't get rid of the biohazard background and the popups and warnings regarding spyware and trojan looksky on IE (I mainly use Firefox, don't know if it matters))…at least I can't get rid of them permanently. I've read some similar things in this forum and even tried using AVG Anti-Spyware and Combofix. Combofix temporarily fixes the problem for a few hours, but the popups and the background come back after a while. Could anyone show me a step by step on how to solve this problem? Thanks in advance…

Here are the hijack log file, smitfraudfix rapport, and the combofix log respectively:

Logfile of HijackThis v1.99.1
Scan saved at 2:37:56 PM, on 10/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Razer\razertra.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Razer\razerhid.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\DAEMON Tools\daemon.exe
C:\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\ZyDAS_802.11g_Utility\ZDWlan.exe
C:\Program Files\Razer\razerofa.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\AIM95\aim.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=…6Ojg5&lid;=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: (no name) - {6E6DD93E-1FC3-4F43-8AFB-1B7B90C9D3EB} - (no file)
O2 - BHO: MSVPS System - {0D5227BF-0C5B-4EA8-833C-FE09F1496F39} - C:\WINDOWS\div32.dll
O2 - BHO: (no name) - {10955232-B671-11D7-8066-0040F6F477E4} - (no file)
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\PROGRA~1\COMMON~1\VERIZO~1\SFP\vzbb.dll (file missing)
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {6A85D97D-665D-4825-8341-9501AD9F56A3} - (no file)
O3 - Toolbar: &Google; - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\PROGRA~1\COMMON~1\VERIZO~1\SFP\vzbb.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [razertra] C:\Program Files\Razer\razertra.exe
O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\razerhid.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\RunServices: [AOL Instant Messanger] aim.exe
O4 - HKLM\..\RunServices: [stratas] lockx.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: ZDWLan Utility.lnk = C:\ZyDAS_802.11g_Utility\ZDWlan.exe
O8 - Extra context menu item: &Google; Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Yahoo;! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary; - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps; - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS; - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.bestbuy.msn.com/
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1129517327453
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {E36C5562-C4E0-4220-BCB2-1C671E3A5916} - file://E:\WEBPULL\SUPPORT\DISC\ASP\TOOLS\EN\bin\npseatools.cab
O18 - Protocol: bw+0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: offline-8876480 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: mssql - {0ED3AF62-3E78-4B77-AE5B-9C777771AAA3} - (no file)
O21 - SSODL: syscore - {408C0D9F-4FB5-4AB0-B444-2F4950FB7D5B} - (no file)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: cpuidle - Unknown owner - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\CPUIDLE\srvany.exe (file missing)
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: WMDM PMSP Service - Unknown owner - C:\WINDOWS\System32\MsPMSPSv.exe (file missing)

————————————————————————————————————————-
SmitFraudFix v2.233

Scan done at 14:32:36.90, 10/01/2007
Run from C:\Documents and Settings\Chrono1O2\Desktop\Gibbrish\GHOSTBUSTERS!\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Razer\razertra.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Razer\razerhid.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\DAEMON Tools\daemon.exe
C:\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\ZyDAS_802.11g_Utility\ZDWlan.exe
C:\Program Files\Razer\razerofa.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\AIM95\aim.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

C:\WINDOWS\div32.dll FOUND !
C:\WINDOWS\mssql.dll FOUND !
C:\WINDOWS\privacy_danger FOUND !
C:\WINDOWS\syscore.dll FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Chrono1O2

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Chrono1O2\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\CHRONO~1\FAVORI~1

C:\DOCUME~1\CHRONO~1\FAVORI~1\Error Cleaner.url FOUND !
C:\DOCUME~1\CHRONO~1\FAVORI~1\Privacy Protector.url FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

C:\DOCUME~1\CHRONO~1\Desktop\Error Cleaner.url FOUND !
C:\DOCUME~1\CHRONO~1\Desktop\Privacy Protector.url FOUND !
C:\DOCUME~1\CHRONO~1\Desktop\Spyware?Malware Protection.url FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components]
"Source"="file:///C:\\WINDOWS\\privacy_danger\\index.htm"
"SubscribedURL"=""
"FriendlyName"="Privacy Protection"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Rustock

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel® PRO/100 VE Network Connection
DNS Server Search Order: 68.87.64.146
DNS Server Search Order: 68.87.75.194

HKLM\SYSTEM\CCS\Services\Tcpip\..\{DF950A53-5058-41D3-8800-B27FFCD849ED}: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS1\Services\Tcpip\..\{147C4528-6596-4E1D-9001-1CD601CF5A8C}: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS1\Services\Tcpip\..\{DF950A53-5058-41D3-8800-B27FFCD849ED}: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS2\Services\Tcpip\..\{DF950A53-5058-41D3-8800-B27FFCD849ED}: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS3\Services\Tcpip\..\{DF950A53-5058-41D3-8800-B27FFCD849ED}: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed]

»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

———————————————————————————————————————————-
ComboFix 07-09-21.2 - "Chrono1O2" 2007-10-01 6:32:18.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.381 [GMT -4:00]
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DOCUME~1\CHRONO~1\Desktop\Error Cleaner.url
C:\DOCUME~1\CHRONO~1\Desktop\Privacy Protector.url
C:\DOCUME~1\CHRONO~1\Desktop\Spyware&Malware; Protection.url
C:\DOCUME~1\CHRONO~1\FAVORI~1\Error Cleaner.url
C:\DOCUME~1\CHRONO~1\FAVORI~1\Privacy Protector.url
C:\DOCUME~1\CHRONO~1\FAVORI~1\Spyware&Malware; Protection.url
C:\WINDOWS\dat.txt
C:\WINDOWS\privacy_danger
C:\WINDOWS\privacy_danger\images\capt.gif
C:\WINDOWS\privacy_danger\images\danger.jpg
C:\WINDOWS\privacy_danger\images\down.gif
C:\WINDOWS\privacy_danger\images\spacer.gif
C:\WINDOWS\privacy_danger\index.htm
C:\WINDOWS\rs.txt

.
((((((((((((((((((((((((( Files Created from 2007-09-01 to 2007-10-01 )))))))))))))))))))))))))))))))
.

2007-10-01 06:29 1,159,340 –a—— C:\SDFix.exe
2007-09-30 16:59 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-09-30 10:33 834 –a—— C:\WINDOWS\system32\tmp.reg
2007-09-30 10:28 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-09-30 10:28 d——– C:\AVG Anti-Spyware 7.5
2007-09-30 10:26 25,088 –a—— C:\WINDOWS\system32\WS2Fix.exe
2007-09-30 10:25 53,248 –a—— C:\WINDOWS\system32\Process.exe
2007-09-30 10:25 51,200 –a—— C:\WINDOWS\system32\dumphive.exe
2007-09-30 10:25 289,144 –a—— C:\WINDOWS\system32\VCCLSID.exe
2007-09-30 10:25 288,417 –a—— C:\WINDOWS\system32\SrchSTS.exe
2007-09-30 01:36 75,776 –a—— C:\WINDOWS\advpn.dll
2007-09-30 01:36 274,432 –a—— C:\WINDOWS\syscore.dll
2007-09-30 01:36 253,952 –a—— C:\WINDOWS\div32.dll
2007-09-30 01:36 217,088 –a—— C:\WINDOWS\mssql.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-30 20:05 ——— d——– C:\Program Files\Symantec AntiVirus
2007-09-30 09:09 ——— d——– C:\DOCUME~1\CHRONO~1\APPLIC~1\Azureus
2007-09-14 02:24 ——— d——– C:\Program Files\Verizon Online
2007-09-14 02:23 ——— d——– C:\Program Files\Common Files\Motive
2007-09-12 02:01 ——— d—s—- C:\Program Files\Xfire
2007-09-10 00:42 ——— d——– C:\DOCUME~1\CHRONO~1\APPLIC~1\Xfire
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\dllcache\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\dllcache\wucltui.dll
2007-07-30 19:19 271224 –a—— C:\WINDOWS\system32\mucltui.dll
2007-07-30 19:19 207736 –a—— C:\WINDOWS\system32\muweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\dllcache\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\wups.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\dllcache\wups.dll
2007-07-19 02:59 3583488 –a—— C:\WINDOWS\system32\dllcache\mshtml.dll
2007-07-12 19:31 765952 –a—— C:\WINDOWS\system32\dllcache\vgx.dll
2005-06-01 21:42 171796 –a—— C:\DOCUME~1\CHRONO~1\stub.exe
1997-10-24 14:20 25088 –a—— C:\WINDOWS\inf\regl3acm.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0D5227BF-0C5B-4EA8-833C-FE09F1496F39}]
2007-09-29 09:33 253952 –a—— C:\WINDOWS\div32.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{10955232-B671-11D7-8066-0040F6F477E4}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2002-11-23 02:15]
"razertra"="C:\Program Files\Razer\razertra.exe" [2005-04-06 21:32]
"razer"="C:\Program Files\Razer\razerhid.exe" [2005-05-17 19:21]
"DAEMON Tools"="C:\DAEMON Tools\daemon.exe" [2005-11-08 18:00]
"!AVG Anti-Spyware"="C:\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]
"AOL Instant Messanger"=aim.exe
"stratas"=lockx.exe

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\
ZDWLan Utility.lnk - C:\ZyDAS_802.11g_Utility\ZDWlan.exe [2007-01-04 23:18:19]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"SpecifyDefaultButtons"=0 (0x0)
"Btn_Search"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
Source= file:///C:\WINDOWS\privacy_danger\index.htm
FriendlyName= Privacy Protection

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"mssql"= {0ED3AF62-3E78-4B77-AE5B-9C777771AAA3} - C:\WINDOWS\mssql.dll [2007-09-29 09:33 217088]
"syscore"= {408C0D9F-4FB5-4AB0-B444-2F4950FB7D5B} - C:\WINDOWS\syscore.dll [2007-09-29 09:33 274432]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 8.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 8.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 8.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Clean Access Agent.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Clean Access Agent.lnk
backup=C:\WINDOWS\pss\Clean Access Agent.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^GStartup.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\GStartup.lnk
backup=C:\WINDOWS\pss\GStartup.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk
backup=C:\WINDOWS\pss\Microsoft Works Calendar Reminders.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PrecisionTime.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\PrecisionTime.lnk
backup=C:\WINDOWS\pss\PrecisionTime.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Verizon Online Dialer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Verizon Online Dialer.lnk
backup=C:\WINDOWS\pss\Verizon Online Dialer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Verizon Online Support Center.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Verizon Online Support Center.lnk
backup=C:\WINDOWS\pss\Verizon Online Support Center.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Chrono1O2^Start Menu^Programs^Startup^Finish Installing….lnk]
path=C:\Documents and Settings\Chrono1O2\Start Menu\Programs\Startup\Finish Installing….lnk
backup=C:\WINDOWS\pss\Finish Installing….lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Chrono1O2^Start Menu^Programs^Startup^PowerReg Scheduler V3.exe]
path=C:\Documents and Settings\Chrono1O2\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe
backup=C:\WINDOWS\pss\PowerReg Scheduler V3.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
"C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Instant Messanger]
aim.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
"C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Belt]
C:\WINDOWS\Belt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CC2KUI]
C:\PROGRA~1\Comet\Bin\cstray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
"C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CMESys]
"C:\Program Files\Common Files\CMEII\CMESys.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
"C:\DAEMON Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iehelper]
C:\Program Files\syslaunch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Internet Optimizer]
"C:\Program Files\Internet Optimizer\optimize.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KAZAA]
"C:\Program Files\Kazaa Lite\kpp.exe" "C:\Program Files\Kazaa Lite\kazaa.kpp" /SYSTRAY

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
\Program\

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
Logi_MwX.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Portfolio]
C:\Program Files\Microsoft Works\WksSb.exe /AllUsers

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]
C:\PROGRA~1\VERIZO~2\SUPPOR~1\SMARTB~1\MotiveSB.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\MSN Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NWEReboot]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Power Scan]
C:\Program Files\Power Scan\powerscan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SFP]
C:\Program Files\Common Files\Verizon Online\SFP\vzSFPWin.EXE /s

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
"C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SQConfigChecker]
C:\Program Files\Sqwire\cc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SQUpdatesChecker]
C:\Program Files\Sqwire\uc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Start WingMan Profiler]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\stratas]
lockx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TB_setup]
C:\DOCUME~1\CHRONO~1\LOCALS~1\Temp\TB_ANI~1.EXE /dcheck

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
C:\WINDOWS\Updreg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vcqppaeh]
C:\WINDOWS\miqywtyf.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr]
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vptray]
C:\PROGRA~1\SYMANT~1\VPTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VVSN]
C:\Program Files\VVSN\VVSN.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\XupiterStartup]
C:\Program Files\Xupiter\XupiterStartup.exe

R1 SSHDRV65;SSHDRV65;\??\C:\WINDOWS\system32\drivers\SSHDRV65.sys
R1 SSHDRV85;SSHDRV85;\??\C:\WINDOWS\system32\drivers\SSHDRV85.sys
R2 WinDriver;WinDriver;C:\WINDOWS\system32\drivers\WINDRVR.SYS
R3 itchfltr;iTouch Keyboard Filter;C:\WINDOWS\system32\DRIVERS\itchfltr.sys
R3 Razerlow;Razerlow USB Filter Driver;C:\WINDOWS\system32\Drivers\Razerlow.sys
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver;C:\WINDOWS\system32\drivers\WmBEnum.sys
R3 WmXlCore;Logitech WingMan Translation Layer Driver;C:\WINDOWS\system32\drivers\WmXlCore.sys
S2 cpuidle;cpuidle;C:\WINDOWS\SYSTEM32\DRIVERS\ETC\CPUIDLE\srvany.exe
S3 Aldebaran;Aldebaran - Storage Filter Drivers;\??\C:\WINDOWS\system32\Drivers\Aldebaran.sys
S3 BRGSp50;BRGSp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\BRGSp50.sys
S3 LCcfltr;Logitech USB Filter Driver;C:\WINDOWS\system32\Drivers\LCcFltr.Sys
S3 wdpnp;WinDriver USB Client;C:\WINDOWS\system32\Drivers\wdpnp.sys
S3 WmFilter;Logitech WingMan HID Filter Driver;C:\WINDOWS\system32\drivers\WmFilter.sys
S3 WmVirHid;Logitech Virtual Hid Device Driver;C:\WINDOWS\system32\drivers\WmVirHid.sys
S3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2ee12b48-2567-11da-a271-00038a000015}]
AutoRun\command- F:\JDSecure\Windows\JDSecure20.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3518b3b5-5fcf-11da-a295-00038a000015}]
AutoRun\command- E:\kochstart\kochstart.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7c302549-45a1-11da-a286-00038a000015}]
AutoRun\command- F:\LaunchBFII.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d74d7241-20fd-11d6-9f64-806d6172696f}]
AutoRun\command- E:\autoplay.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ed750314-6aa0-11da-a2a5-00038a000015}]
AutoRun\command- F:\setup.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-09-24 20:22:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-01 06:37:11
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
AOL Instant Messanger = aim.exe?

scanning hidden files …

C:\WINDOWS\WIN.QTW
C:\WINDOWS\winamp.ini
C:\WINDOWS\winbpupd.exe
C:\WINDOWS\Windows Update Setup Files
C:\WINDOWS\Windows Update.log
C:\WINDOWS\WindowsUpdate.log
C:\WINDOWS\winhelp.exe
C:\WINDOWS\winhlp32.exe
C:\WINDOWS\WININI.QTW
C:\WINDOWS\winnt.bmp
C:\WINDOWS\winnt256.bmp
C:\WINDOWS\WINNT32.LOG
C:\WINDOWS\winpoet_postinstallation.txt
C:\WINDOWS\winpoet_preinstallation.txt
C:\WINDOWS\winros.ini
C:\WINDOWS\winset.ini
C:\WINDOWS\WinSxS
C:\WINDOWS\WMFDist11.log
C:\WINDOWS\wmp11.log
C:\WINDOWS\wmsetup.log
C:\WINDOWS\wmsetup10.log
C:\WINDOWS\WMSysPr9.prx
C:\WINDOWS\WMSysPrx.prx
C:\WINDOWS\WORDPAD.INI
C:\WINDOWS\wt
C:\WINDOWS\Wudf01000Inst.log
C:\WINDOWS\xaudio.dll
C:\WINDOWS\xobglu16.dll
C:\WINDOWS\xobglu32.dll
C:\WINDOWS\xpsp1hfm.log
C:\WINDOWS\Zapotec.bmp
C:\WINDOWS\zip_var.ini
C:\WINDOWS\_default.pif
C:\WINDOWS\WindowsShell.Manifest
C:\WINDOWS\winww

scan completed successfully
hidden files: 35

**************************************************************************
.
Completion time: 2007-10-01 6:39:09
C:\ComboFix-quarantined-files.txt … 2007-10-01 06:38
C:\ComboFix2.txt … 2007-09-30 17:42
.
— E O F —

Thank you!

LDTate

Post #2October 1, 2007, 9:42 PM UTC

Lets do this the correct way.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press Enter

[external image: Posted Image]

This program will scan large amounts of files on your computer for known patterns so please be patient while it works. It will create a file named:
c:\rapport.txt

IMPORTANT: Do NOT run any other options until you are asked to do so!

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

Please post:
C:\rapport.txt

SonOfJun

Post #3October 1, 2007, 10:31 PM UTC

Thanks! Here it is. SmitFraudFix v2.233 Scan done at 18:27:21.60, 10/01/2007 Run from C:\Documents and Settings\Chrono1O2\Desktop\Gibbrish\GHOSTBUSTERS!\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Process C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\devldr32.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Symantec AntiVirus\SavRoam.exe C:\Program Files\Logitech\iTouch\iTouch.exe C:\Program Files\Razer\razertra.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Razer\razerhid.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\DAEMON Tools\daemon.exe C:\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\system32\ctfmon.exe C:\ZyDAS_802.11g_Utility\ZDWlan.exe C:\Program Files\Razer\razerofa.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\AIM95\aim.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\notepad.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\cmd.exe »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS C:\WINDOWS\div32.dll FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Chrono1O2 »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Chrono1O2\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\CHRONO~1\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components] "Source"="file:///C:\\WINDOWS\\privacy_danger\\index.htm" "SubscribedURL"="" "FriendlyName"="Privacy Protection" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Rustock »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: Intel® PRO/100 VE Network Connection DNS Server Search Order: 68.87.64.146 DNS Server Search Order: 68.87.75.194 HKLM\SYSTEM\CCS\Services\Tcpip\..\{DF950A53-5058-41D3-8800-B27FFCD849ED}: DhcpNameServer=[removed] [removed] HKLM\SYSTEM\CS1\Services\Tcpip\..\{147C4528-6596-4E1D-9001-1CD601CF5A8C}: DhcpNameServer=[removed] [removed] HKLM\SYSTEM\CS1\Services\Tcpip\..\{DF950A53-5058-41D3-8800-B27FFCD849ED}: DhcpNameServer=[removed] [removed] HKLM\SYSTEM\CS2\Services\Tcpip\..\{DF950A53-5058-41D3-8800-B27FFCD849ED}: DhcpNameServer=[removed] [removed] HKLM\SYSTEM\CS3\Services\Tcpip\..\{DF950A53-5058-41D3-8800-B27FFCD849ED}: DhcpNameServer=[removed] [removed] HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed] HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed] »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End

LDTate

Post #4October 1, 2007, 10:33 PM UTC

Running the Clean

Warning: running option #2 on a non infected computer will remove your Desktop background.

Please print out or copy these instructions/tutorial to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below. If there's anything that you don't understand, ask your question(s) before moving on with the fixes.

Reboot your computer in Safe Mode.

If the computer is running, shut down Windows, and then turn off the power.
Wait 30 seconds, and then turn the computer on.
Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
Ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.
Login on your usual account.

______________________________

Open the SmitfraudFix Folder, then double-click smitfraudfix.cmd file to start the tool.
Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.

[external image: Posted Image]

The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. Reboot in Safe Mode.

The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.
______________________________

Clean out your Temporary Internet files. Proceed like this:

Quit Internet Explorer and quit any instances of Windows Explorer.
Click Start, click Control Panel, and then double-click Internet Options.
On the General tab, click Delete Files under Temporary Internet Files.
In the Delete Files dialog box, tick the Delete all offline content check box , and then click OK.
On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
Click OK.

Next Click Start, click Control Panel and then double-click Display. Click on the Desktop tab, then click the Customize Desktop button. Click on the Web tab. Under Web Pages you should see a checked entry called Security info or something similar. If it is there, select that entry and click the Delete button. Click Ok then Apply and Ok.

Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.
______________________________

Please post:
1.c:\rapport.txt
2.A new HijackThis log

SonOfJun

Post #5October 5, 2007, 12:34 AM UTC

Hey! Sorry I haven't responded, haven't been home in a while. Did this today, so far so good, everything seems to be ok!
Here are the rapport and the hijack log.

SmitFraudFix v2.233

Scan done at 20:14:00.06, 10/04/2007
Run from C:\Documents and Settings\Chrono1O2\Desktop\Gibbrish\GHOSTBUSTERS!\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel® PRO/100 VE Network Connection
DNS Server Search Order: 68.87.64.146
DNS Server Search Order: 68.87.75.194

HKLM\SYSTEM\CCS\Services\Tcpip\..\{DF950A53-5058-41D3-8800-B27FFCD849ED}: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS1\Services\Tcpip\..\{147C4528-6596-4E1D-9001-1CD601CF5A8C}: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS1\Services\Tcpip\..\{DF950A53-5058-41D3-8800-B27FFCD849ED}: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS2\Services\Tcpip\..\{DF950A53-5058-41D3-8800-B27FFCD849ED}: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS3\Services\Tcpip\..\{DF950A53-5058-41D3-8800-B27FFCD849ED}: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed]

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

———————————————————————————————————————————————
Logfile of HijackThis v1.99.1
Scan saved at 8:29:50 PM, on 10/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Razer\razertra.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Razer\razerhid.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\DAEMON Tools\daemon.exe
C:\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\ZyDAS_802.11g_Utility\ZDWlan.exe
C:\Program Files\Razer\razerofa.exe
C:\Program Files\AIM95\aim.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\SiteAdvisor\6172\SAService.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\McAfee\MSK\MskAgent.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZSTC07.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\notepad.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: (no name) - {6E6DD93E-1FC3-4F43-8AFB-1B7B90C9D3EB} - (no file)
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O2 - BHO: (no name) - {10955232-B671-11D7-8066-0040F6F477E4} - (no file)
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\PROGRA~1\COMMON~1\VERIZO~1\SFP\vzbb.dll (file missing)
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {6A85D97D-665D-4825-8341-9501AD9F56A3} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\PROGRA~1\COMMON~1\VERIZO~1\SFP\vzbb.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [razertra] C:\Program Files\Razer\razertra.exe
O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\razerhid.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
O4 - HKLM\..\RunServices: [AOL Instant Messanger] aim.exe
O4 - HKLM\..\RunServices: [stratas] lockx.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: ZDWLan Utility.lnk = C:\ZyDAS_802.11g_Utility\ZDWlan.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.bestbuy.msn.com/
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1129517327453
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {E36C5562-C4E0-4220-BCB2-1C671E3A5916} - file://E:\WEBPULL\SUPPORT\DISC\ASP\TOOLS\EN\bin\npseatools.cab
O18 - Protocol: bw+0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: offline-8876480 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: McAfee Application Installer Cleanup (0024731191300123) (0024731191300123mcinstcleanup) - Unknown owner - C:\DOCUME~1\CHRONO~1\LOCALS~1\Temp\2473~1.EXE (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: cpuidle - Unknown owner - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\CPUIDLE\srvany.exe (file missing)
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: WMDM PMSP Service - Unknown owner - C:\WINDOWS\System32\MsPMSPSv.exe (file missing)

Will there be anything else I need to do? Thank you so much, LTDate! =)

LDTate

Post #6October 5, 2007, 9:46 PM UTC

O4 - HKLM\..\RunServices: [stratas] lockx.exe <–Indicates a serious problem

Your computer is very seriously infected.
Do you use this pc for any financial use like banking?

W32/Rbot-KL
W32/Rbot-KL is a worm which attempts to spread to remote network shares and also contains backdoor Trojan functionality allowing unauthorised remote access to the infected computer.

How it spreads: Network shares

Affected operating systems: Windows

Turns off anti-virus applications
Allows others to access the computer
Downloads code from the internet
Records keystrokes
Installs itself in the Registry
Exploits system or software vulnerabilities

First off all, you need to be informed that your computer might be seriously compromised, you have a trojan of the Rbot/Sbot family, below is a general description of this family. You must be aware that if you have a system that has been completely compromised, the only thing you can do is to flatten the system (reformat the system disk) and rebuild it from scratch (reinstall Windows and your applications)

Backdoor.Rbot is a family of Trojan programs for Windows, which offer the user remote access to victim machines. The Trojans are controlled via IRC, and have the following functions:

monitor networks for interesting data packets (i.e. those containing passwords to FTP servers, and e-payment systems such as PayPal etc.)
scan networks for machines which have unpatched common vulnerabilties (RPC DCOM, UPnP, WebDAV and others); for machines infected by Trojan programs (Backdoor.Optix, Backdoor.NetDevil, Backdoor.SubSeven and others) and by the Trojan components of worms (I-Worm.Mydoom, I-Worm.Bagle); for machines with weak system passwords
conduct DoS attacks
launch SOCKS and HTTP servers on infected machines
send the user of the program detailed information about the victim machine, including passwords to a range of computer games

Evidence in your log:
O4 - HKLM\..\RunServices: [stratas] lockx.exe

IMHO, You need to disconnect this PC from the internet and from your network if it is on a network. Use it as less a possible.

What is a backdoor or remote access trojan?
Read this article.
Danger: Remote Access Trojans
http://www.microsoft.com/technet/security/…o/virusrat.mspx

Can you please post a new Hijackthis log please since this malware changes very fast especially when you reboot.

SonOfJun

Post #7October 6, 2007, 3:25 AM UTC

Sure thing.

Here it is.

Logfile of HijackThis v1.99.1
Scan saved at 11:17:12 PM, on 10/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\notepad.exe
C:\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\Program Files\Razer\razertra.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\Program Files\Razer\razerhid.exe
C:\DAEMON Tools\daemon.exe
C:\Program Files\McAfee\MSK\MskAgent.exe
C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\Program Files\Razer\razerofa.exe
C:\ZyDAS_802.11g_Utility\ZDWlan.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\SiteAdvisor\6172\SAService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\AIM95\aim.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: (no name) - {6E6DD93E-1FC3-4F43-8AFB-1B7B90C9D3EB} - (no file)
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O2 - BHO: (no name) - {10955232-B671-11D7-8066-0040F6F477E4} - (no file)
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\PROGRA~1\COMMON~1\VERIZO~1\SFP\vzbb.dll (file missing)
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {6A85D97D-665D-4825-8341-9501AD9F56A3} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\PROGRA~1\COMMON~1\VERIZO~1\SFP\vzbb.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [razertra] C:\Program Files\Razer\razertra.exe
O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\razerhid.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunServices: [AOL Instant Messanger] aim.exe
O4 - HKLM\..\RunServices: [stratas] lockx.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: ZDWLan Utility.lnk = C:\ZyDAS_802.11g_Utility\ZDWlan.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.bestbuy.msn.com/
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1129517327453
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {E36C5562-C4E0-4220-BCB2-1C671E3A5916} - file://E:\WEBPULL\SUPPORT\DISC\ASP\TOOLS\EN\bin\npseatools.cab
O18 - Protocol: bw+0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: offline-8876480 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: McAfee Application Installer Cleanup (0123221191584101) (0123221191584101mcinstcleanup) - McAfee, Inc. - C:\WINDOWS\TEMP12322~1.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: cpuidle - Unknown owner - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\CPUIDLE\srvany.exe (file missing)
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: WMDM PMSP Service - Unknown owner - C:\WINDOWS\System32\MsPMSPSv.exe (file missing)

This sounds very scary to me. So the only thing I can really do to fix it is reformatting, eh? The only concern about that is that I'm afraid of losing a lot of files and such. But on the same token, I don't want just anyone having access to these things either. Yeah, you can tell that I've never reformatted before, right? I'll see if I can get someone I know to help me out with this…

But if there's anything I can do myself right now before I really have to reformat, please let me know. I appreciate your help!

LDTate

Post #8October 6, 2007, 9:59 AM UTC

We can see what we can do.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.

Please do not delete anything unless instructed to.

1.Click Start > Settings > Control Panel.
2.Next, open Add/Remove Programs and remove if listed:
Logitech\Desktop Messenger

Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:

Download ComboFix from Here to your Desktop.

Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you, combofix.txt. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick while its running. That may cause it to stall

SonOfJun

Post #9October 6, 2007, 5:32 PM UTC

Okay, here is the combofix log and a new hijackthis log.

ComboFix 07-10-06.3 - Chrono1O2 2007-10-06 6:15:12.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.346 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\Desktop\Gibbrish\GHOSTBUSTERS!\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\advpn.dll
C:\WINDOWS\dat.txt
C:\WINDOWS\rs.txt
C:\WINDOWS\search_res.txt

.
((((((((((((((((((((((((( Files Created from 2007-09-06 to 2007-10-06 )))))))))))))))))))))))))))))))
.

2007-10-05 07:34 d——– C:\WINDOWS\LastGood.Tmp
2007-10-04 20:13 53,248 –a—— C:\WINDOWS\system32\Process.exe
2007-10-02 22:31 d——– C:\Program Files\Certification Preparation
2007-10-02 22:25 d——– C:\Certification Preparation
2007-10-02 00:44 d——– C:\Program Files\SiteAdvisor
2007-10-02 00:44 d——– C:\Documents and Settings\LocalService\Application Data\SiteAdvisor
2007-10-02 00:44 d——– C:\Documents and Settings\Chrono1O2\Application Data\SiteAdvisor
2007-10-02 00:44 d——– C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2007-10-02 00:43 143,360 –a—— C:\WINDOWS\system32\dunzip32.dll
2007-10-02 00:42 71,496 –a—— C:\WINDOWS\system32\drivers\mfeavfk.sys
2007-10-02 00:42 37,480 –a—— C:\WINDOWS\system32\drivers\mfesmfk.sys
2007-10-02 00:42 34,184 –a—— C:\WINDOWS\system32\drivers\mfebopk.sys
2007-10-02 00:42 32,008 –a—— C:\WINDOWS\system32\drivers\mferkdk.sys
2007-10-02 00:42 171,240 –a—— C:\WINDOWS\system32\drivers\mfehidk.sys
2007-10-02 00:42 109,608 –a—— C:\WINDOWS\system32\drivers\Mpfp.sys
2007-10-02 00:41 d——– C:\Program Files\McAfee.com
2007-10-02 00:41 d——– C:\Program Files\McAfee
2007-10-02 00:41 d——– C:\Program Files\Common Files\McAfee
2007-10-02 00:36 d——– C:\Documents and Settings\All Users\Application Data\McAfee
2007-10-01 06:29 1,159,340 –a—— C:\SDFix.exe
2007-09-30 16:59 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-09-30 10:33 1,092 –a—— C:\WINDOWS\system32\tmp.reg
2007-09-30 10:28 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-09-30 10:28 d——– C:\AVG Anti-Spyware 7.5
2007-09-30 10:25 51,200 –a—— C:\WINDOWS\system32\dumphive.exe
2007-09-30 10:25 289,144 –a—— C:\WINDOWS\system32\VCCLSID.exe
2007-09-30 10:25 288,417 –a—— C:\WINDOWS\system32\SrchSTS.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-06 06:21 ——— d——– C:\Program Files\Symantec AntiVirus
2007-10-05 07:31 ——— d——– C:\Documents and Settings\Chrono1O2\Application Data\Azureus
2007-09-14 02:24 ——— d——– C:\Program Files\Verizon Online
2007-09-14 02:23 ——— d——– C:\Program Files\Common Files\Motive
2007-09-12 02:01 ——— d—s—- C:\Program Files\Xfire
2007-09-10 00:42 ——— d——– C:\Documents and Settings\Chrono1O2\Application Data\Xfire
2005-06-01 21:42 171796 –a—— C:\Documents and Settings\Chrono1O2\stub.exe
.

((((((((((((((((((((((((((((( snapshot_2007-09-30_174112.45 )))))))))))))))))))))))))))))))))))))))))
.
—-a-w 135,168 2007-09-28 13:06:08 C:\WINDOWS\catchme.exe
—-a-w 279,552 2007-10-05 14:07:31 C:\WINDOWS\system32\swreg.exe
.
—-a-w 109,056 2007-07-20 04:47:22 C:\WINDOWS\catchme.exe
—-a-w 279,552 2007-07-22 22:39:27 C:\WINDOWS\system32\swreg.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{10955232-B671-11D7-8066-0040F6F477E4}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2002-11-23 02:15]
"razertra"="C:\Program Files\Razer\razertra.exe" [2005-04-06 21:32]
"razer"="C:\Program Files\Razer\razerhid.exe" [2005-05-17 19:21]
"DAEMON Tools"="C:\DAEMON Tools\daemon.exe" [2005-11-08 18:00]
"MskAgentexe"="C:\Program Files\McAfee\MSK\MskAgent.exe" [2007-01-17 15:30]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [2007-08-24 17:57]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 00:56]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]
"AOL Instant Messanger"=aim.exe
"stratas"=lockx.exe

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
ZDWLan Utility.lnk - C:\ZyDAS_802.11g_Utility\ZDWlan.exe [2007-01-04 23:18:19]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"SpecifyDefaultButtons"=0 (0x0)
"Btn_Search"=0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 8.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 8.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 8.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Clean Access Agent.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Clean Access Agent.lnk
backup=C:\WINDOWS\pss\Clean Access Agent.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^GStartup.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\GStartup.lnk
backup=C:\WINDOWS\pss\GStartup.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk
backup=C:\WINDOWS\pss\Microsoft Works Calendar Reminders.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PrecisionTime.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\PrecisionTime.lnk
backup=C:\WINDOWS\pss\PrecisionTime.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Verizon Online Dialer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Verizon Online Dialer.lnk
backup=C:\WINDOWS\pss\Verizon Online Dialer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Verizon Online Support Center.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Verizon Online Support Center.lnk
backup=C:\WINDOWS\pss\Verizon Online Support Center.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Chrono1O2^Start Menu^Programs^Startup^Finish Installing….lnk]
path=C:\Documents and Settings\Chrono1O2\Start Menu\Programs\Startup\Finish Installing….lnk
backup=C:\WINDOWS\pss\Finish Installing….lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Chrono1O2^Start Menu^Programs^Startup^PowerReg Scheduler V3.exe]
path=C:\Documents and Settings\Chrono1O2\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe
backup=C:\WINDOWS\pss\PowerReg Scheduler V3.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
"C:\AVG Anti-Spyware 7.5\avgas.exe" /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
"C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Instant Messanger]
aim.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
"C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Belt]
C:\WINDOWS\Belt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CC2KUI]
C:\PROGRA~1\Comet\Bin\cstray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
"C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CMESys]
"C:\Program Files\Common Files\CMEII\CMESys.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
"C:\DAEMON Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iehelper]
C:\Program Files\syslaunch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Internet Optimizer]
"C:\Program Files\Internet Optimizer\optimize.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KAZAA]
"C:\Program Files\Kazaa Lite\kpp.exe" "C:\Program Files\Kazaa Lite\kazaa.kpp" /SYSTRAY

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
\Program\

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
Logi_MwX.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Portfolio]
C:\Program Files\Microsoft Works\WksSb.exe /AllUsers

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]
C:\PROGRA~1\VERIZO~2\SUPPOR~1\SMARTB~1\MotiveSB.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\MSN Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NWEReboot]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Power Scan]
C:\Program Files\Power Scan\powerscan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SFP]
C:\Program Files\Common Files\Verizon Online\SFP\vzSFPWin.EXE /s

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
"C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SQConfigChecker]
C:\Program Files\Sqwire\cc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SQUpdatesChecker]
C:\Program Files\Sqwire\uc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Start WingMan Profiler]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\stratas]
lockx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TB_setup]
C:\DOCUME~1\CHRONO~1\LOCALS~1\Temp\TB_ANI~1.EXE /dcheck

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
C:\WINDOWS\Updreg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vcqppaeh]
C:\WINDOWS\miqywtyf.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr]
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vptray]
C:\PROGRA~1\SYMANT~1\VPTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VVSN]
C:\Program Files\VVSN\VVSN.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\XupiterStartup]
C:\Program Files\Xupiter\XupiterStartup.exe

S3 Aldebaran;Aldebaran - Storage Filter Drivers;\??\C:\WINDOWS\system32\Drivers\Aldebaran.sys
S3 BRGSp50;BRGSp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\BRGSp50.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2ee12b48-2567-11da-a271-00038a000015}]
AutoRun\command- F:\JDSecure\Windows\JDSecure20.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3518b3b5-5fcf-11da-a295-00038a000015}]
AutoRun\command- E:\kochstart\kochstart.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7c302549-45a1-11da-a286-00038a000015}]
AutoRun\command- F:\LaunchBFII.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d74d7241-20fd-11d6-9f64-806d6172696f}]
AutoRun\command- E:\autoplay.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ed750314-6aa0-11da-a2a5-00038a000015}]
AutoRun\command- F:\setup.exe

*Newly Created Service* - 0123221191584101MCINSTCLEANUP
.
Contents of the 'Scheduled Tasks' folder
"2007-10-01 20:22:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
"2007-10-02 04:41:55 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
"2007-10-02 04:41:54 C:\WINDOWS\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-06 06:32:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
AOL Instant Messanger = aim.exe?

scanning hidden files …

C:\WINDOWS\WIN.QTW
C:\WINDOWS\winamp.ini
C:\WINDOWS\winbpupd.exe
C:\WINDOWS\Windows Update Setup Files
C:\WINDOWS\Windows Update.log
C:\WINDOWS\WindowsUpdate.log
C:\WINDOWS\winhelp.exe
C:\WINDOWS\winhlp32.exe
C:\WINDOWS\WININI.QTW
C:\WINDOWS\winnt.bmp
C:\WINDOWS\winnt256.bmp
C:\WINDOWS\WINNT32.LOG
C:\WINDOWS\winpoet_postinstallation.txt
C:\WINDOWS\winpoet_preinstallation.txt
C:\WINDOWS\winros.ini
C:\WINDOWS\winset.ini
C:\WINDOWS\WinSxS
C:\WINDOWS\WMFDist11.log
C:\WINDOWS\wmp11.log
C:\WINDOWS\wmsetup.log
C:\WINDOWS\wmsetup10.log
C:\WINDOWS\WMSysPr9.prx
C:\WINDOWS\WMSysPrx.prx
C:\WINDOWS\WORDPAD.INI
C:\WINDOWS\wt
C:\WINDOWS\Wudf01000Inst.log
C:\WINDOWS\xaudio.dll
C:\WINDOWS\xobglu16.dll
C:\WINDOWS\xobglu32.dll
C:\WINDOWS\xpsp1hfm.log
C:\WINDOWS\Zapotec.bmp
C:\WINDOWS\zip_var.ini
C:\WINDOWS\_default.pif
C:\WINDOWS\WindowsShell.Manifest
C:\WINDOWS\winww

scan completed successfully
hidden files: 35

**************************************************************************
.
Completion time: 2007-10-06 6:41:11 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-10-06 06:40
C:\ComboFix2.txt … 2007-10-01 06:39
C:\ComboFix3.txt … 2007-09-30 17:42
.
— E O F —
——————————————————————————————————————————————————————–

Logfile of HijackThis v1.99.1
Scan saved at 1:28:22 PM, on 10/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Razer\razertra.exe
C:\Program Files\Razer\razerhid.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\DAEMON Tools\daemon.exe
C:\Program Files\McAfee\MSK\MskAgent.exe
C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Razer\razerofa.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\ZyDAS_802.11g_Utility\ZDWlan.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\Program Files\SiteAdvisor\6172\SAService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: (no name) - {6E6DD93E-1FC3-4F43-8AFB-1B7B90C9D3EB} - (no file)
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O2 - BHO: (no name) - {10955232-B671-11D7-8066-0040F6F477E4} - (no file)
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\PROGRA~1\COMMON~1\VERIZO~1\SFP\vzbb.dll (file missing)
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {6A85D97D-665D-4825-8341-9501AD9F56A3} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\PROGRA~1\COMMON~1\VERIZO~1\SFP\vzbb.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [razertra] C:\Program Files\Razer\razertra.exe
O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\razerhid.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunServices: [AOL Instant Messanger] aim.exe
O4 - HKLM\..\RunServices: [stratas] lockx.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: ZDWLan Utility.lnk = C:\ZyDAS_802.11g_Utility\ZDWlan.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.bestbuy.msn.com/
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1129517327453
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {E36C5562-C4E0-4220-BCB2-1C671E3A5916} - file://E:\WEBPULL\SUPPORT\DISC\ASP\TOOLS\EN\bin\npseatools.cab
O18 - Protocol: bw+0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: offline-8876480 - {731C4941-4E3B-4C16-A61A-C98268F0296C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: McAfee Application Installer Cleanup (0255141191678450) (0255141191678450mcinstcleanup) - McAfee, Inc. - C:\WINDOWS\TEMP25514~1.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: cpuidle - Unknown owner - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\CPUIDLE\srvany.exe (file missing)
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: WMDM PMSP Service - Unknown owner - C:\WINDOWS\System32\MsPMSPSv.exe (file missing)

LDTate

Post #10October 6, 2007, 9:15 PM UTC

download & run this file - Flash_Disinfector.exe
Please insert your Flash Drive / Memory Stick

Next:

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\lockx.exe
C:\Program Files\syslaunch.exe
C:\Program Files\Sqwire\cc.exe
C:\Program Files\Sqwire\uc.exe
C:\WINDOWS\miqywtyf.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\VVSN\VVSN.exe

Folder::
C:\Program Files\Sqwire
C:\Program Files\Viewpoint\Viewpoint Manager
C:\Program Files\Viewpoint
C:\Program Files\VVSN
C:\Program Files\Logitech\Desktop Messenger

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{10955232-B671-11D7-8066-0040F6F477E4}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]
"AOL Instant Messanger"=-
"stratas"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iehelper]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SQConfigChecker]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SQUpdatesChecker]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\stratas]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vcqppaeh]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VVSN]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2ee12b48-2567-11da-a271-00038a000015}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3518b3b5-5fcf-11da-a295-00038a000015}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7c302549-45a1-11da-a286-00038a000015}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d74d7241-20fd-11d6-9f64-806d6172696f}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ed750314-6aa0-11da-a2a5-00038a000015}]

Save this as Save this as "CFScript"

[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log

LDTate

Post #11October 11, 2007, 12:32 AM UTC

How are you doing with the fix?

SonOfJun

Post #12October 12, 2007, 1:30 AM UTC

Hey! Sorry, haven't really been home in a while again. I'll try and find my flash and get right on this right now. Be right back shortly with the results.

LDTate

Post #13October 12, 2007, 1:31 AM UTC

SonOfJun

Post #14October 12, 2007, 2:26 AM UTC

ComboFix 07-10-06.3 - Chrono1O2 2007-10-11 22:05:56.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.330 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\Desktop\Gibbrish\GHOSTBUSTERS!\ComboFix.exe
Command switches used :: C:\Documents and Settings\Chrono1O2\Desktop\Gibbrish\GHOSTBUSTERS!\CFScript.txt

FILE::
C:\lockx.exe
C:\Program Files\Sqwire\cc.exe
C:\Program Files\Sqwire\uc.exe
C:\Program Files\syslaunch.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\VVSN\VVSN.exe
C:\WINDOWS\miqywtyf.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Logitech\Desktop Messenger
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Install\bwUnin.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Install\LiteInst.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Install\readme.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Install\win2000.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Plugins\Npavi32.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\backweb.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\backweb.tlb
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\BWCHelpr.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\BWCmndr.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\BWDocMapExt.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\bwfiles.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\bwlang.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\bwmib.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\BWOfflineUrlAccessor.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\BWPlugProtocol.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\BWPortalPlugin.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\BWScriptExt.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\bwsec.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\BWXMLOffline.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\bwxtext.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\clntutil.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\Cpuinf32.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\ding.wav
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\ClientRc.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\CommStatus\remedy_strings.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\CommStatus\remedy_strings_override.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\CommStatus\strings.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\CommStatus\strings_override.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\Navigation\navigation_strings.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\Navigation\navigation_strings_override.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\arrow_left.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\arrow_right.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\BULLET1.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\closing_the_notification_in.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\deleting_notifications.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\DIAMOND1.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\elements_of_the_statusbar.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\help.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\homebutton_gray.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image003.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image005.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image007.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image009.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image010.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image012.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image014.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image016.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image017.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image018.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image020.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image024.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image025.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\inbox.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\managing_notifications.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\marking_notifications.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\opening_the_notification_in.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\overview.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\preferences.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\ProactivePortal_Notification_Inbox_Help.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\refreshing_the_notification.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\setting_proactiveportal_not.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\sorting_information_in_the_.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\the_proactiveportal_notific.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\viewing_data_in_the_notific.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\viewing_full_stories.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\viewing_the_availability_of.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\viewing_the_notification_s_.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\viewing_the_notification_su.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\help\xbutton.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\notification_strings.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\NotificationMgr\notification_strings_override.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\resources\global_strings.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\resources\global_strings_override.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\arrow_left.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\arrow_right.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\BULLET1.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\button_edit.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\button_sendagain.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\closing_the_forms_outbox.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\deleting_form_submissions.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\details.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\DIAMOND1.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\form_submission_scheduling.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\help.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\home.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\homebutton_gray.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\how_does_proactiveportal_se.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\image003_forms.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\image005_forms.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\image007_forms.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\image011_forms.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\image013_forms.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\image014_forms.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\image016_forms.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\image019_forms.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\image020_forms.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\managing_form_submissions.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\marking_form_submissions.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\modifying_a_submitted_form.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\modifying_a_submitted_form.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\opening_the_forms_outbox.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\outbox.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\overview_1.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\preferences.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\ProactivePortal_Forms_Outbox_Help.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\refreshing_the_forms_outbox.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\ResponseAvailable.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\resubmitting_a_form.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\send_again.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\setting_form_submission_pre.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\sorting_form_submissions.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\SubmissionCompleted.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\SubmissionFailed.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\the_forms_outbox.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\the_progress_bar.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\the_status_bar.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\the_status_column.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\viewing_data_in_the_forms_o.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\viewing_form_submission_details.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\viewing_form_submission_res.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\viewing_form_submission_sta.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\viewing_submission_details.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\what_are_forms_.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\xbutton.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\submission_strings.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\PortalUI\SubmissionMgr\submission_strings_override.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\registerRC.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\SpriteRC.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\EN\UninstallRC.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\GAPlugProtocol.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\IAdHide.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\loading.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\pacsupport.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\CommStatus\functions.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\CommStatus\remedy_functions.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\background.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\BWPortalPlugin.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\CommProblem.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\CommProblem.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\CommStatus.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\decorations.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\disableforms.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\fillFormsForResubmit.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\navigation.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\navigation_override.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\ProactivePortalBrokenLink.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\ProactivePortalBrokenLink.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\ProactivePortalClientInactive.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\ProactivePortalFormError.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\ProactivePortalFormStatus.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\ProactivePortalFormSuccess.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\ProactivePortalGoOnline.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\ProactivePortalGoOnline.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\ProactivePortalGoOnlineTesterMode.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\ProactivePortalMsgConfig.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\ProactivePortalNoClient.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\ProactivePortalNoDoc.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\ProactivePortalNoDoc.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\ProactivePortalNotRegistered.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\ProactivePortalNotRegistered.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\ProactivePortalNotSupportedURL.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\ProactivePortalNotSupportedURL.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\ProactivePortalNoUI.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\ProactivePortalNoUI.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\ProactivePortalOldDoc.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\Navigation\ProactivePortalOldDoc.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\not.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\NotificationMgr\link_header.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\NotificationMgr\link_header_MO.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\NotificationMgr\notification.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\NotificationMgr\notification_override.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\NotificationMgr\notification_params.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\NotificationMgr\notification_params_override.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\NotificationMgr\NotificationDetailedStatus.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\NotificationMgr\NotificationMgrUI.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\NotificationMgr\offline_link.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\NotificationMgr\offline_link_MO.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\NotificationMgr\online_link.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\NotificationMgr\online_link_MO.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\NotificationMgr\preferences.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\NotificationMgr\priority.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\NotificationMgr\priority_header.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\NotificationMgr\priority_header_MO.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\NotificationMgr\utilities.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\OfflineMgr.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\OfflineSearch.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\preferences.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\arr_end.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\arr_end_mo.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\arr_end_na.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\arr_next.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\arr_next_mo.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\arr_next_na.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\arr_prev.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\arr_prev_mo.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\arr_prev_na.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\arr_start.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\arr_start_mo.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\arr_start_na.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\background.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\Exit.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\footer.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\global.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\global_override.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\global_params.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\global_params_override.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\header.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\Help.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\help_MO.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\helper.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\preferences.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\preferences.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\preferences_icon.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\preferences_MO.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\Propert.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\sort_ascending.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\sort_descending.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\table.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\tabs.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\resources\utilities.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\sub.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\SubmissionMgr\AddSubmissionMgrLink.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\SubmissionMgr\FormDeleted.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\SubmissionMgr\FormError.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\SubmissionMgr\FormOK.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\SubmissionMgr\FormPending.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\SubmissionMgr\FormProcess.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\SubmissionMgr\FormSuspended.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\SubmissionMgr\FormUpload.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\SubmissionMgr\preferences.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\SubmissionMgr\ResponseAvialable.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\SubmissionMgr\ResponseAvialable_MO.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\SubmissionMgr\submission.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\SubmissionMgr\submission_override.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\SubmissionMgr\submission_params.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\SubmissionMgr\submission_params_override.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\SubmissionMgr\SubmissionCompleted.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\SubmissionMgr\SubmissionCompleted_MO.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\SubmissionMgr\SubmissionDetailedStatus.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\SubmissionMgr\SubmissionFailed.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\SubmissionMgr\SubmissionFailed_MO.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\SubmissionMgr\SubmissionMgrUI.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\SubmissionMgr\SubmissionStatus.inc
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PortalUI\SubmissionMgr\utilities.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\Pre6Import.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\PUI_Launcher.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\register.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\Restart.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\runner.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\runner.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\Sprite6.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\temp\IadHide5.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\wtsisctd.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\clasid.bak
C:\Program Files\Logitech\Desktop Messenger\8876480\enabled.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\background.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\browser.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\cert.db
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\chandir.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\chandir.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\chn.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\chn.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\DefPrefs.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\GenFlash\1\gen.bif
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\GenFlash\1\gen.bis
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\GenFlash\1\info.iad
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\InfoCenter.GIF
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\InfoCenter.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\main.wkg
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\UpgradePubKey.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\UsrPrefs.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\PlaceHolder.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\8876480\Chrono1O2\InstallerResult.log
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWCHelpr-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWCmndr-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWDocMapExt-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWfiles-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWOfflineUrlAccessor-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPortalPlugin-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\bwscriptext-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWXmlOffline-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrchs.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrcht.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrdan.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrdeu.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmresp.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrfin.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrfra.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrita.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrjpn.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrkor.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrnld.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrnor.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrptb.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrsve.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LiteInstActivator.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LiteInstActivator.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogiLdmC.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogiLdmW.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogiLdmW.tlb
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe.appid.8876480
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\Enable_OAS\enableOAS.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\AuthLib1.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\AuthLib2.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\CRules1.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\EventLib1.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\EventLib2.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\EventMgr1.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\EventMgr2.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\payload1.pub
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\RuleLib1.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\RuleLib2.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\SyncExt.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\readme.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Cleanup.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\25e3\10bc4513\_bwfindx.zip
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\25e3\10bc4513\125MD.ipk
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\25e3\10bc4513\info.iad
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\25e3\10bc4513\main.bis
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\25e3\BWEvents.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\25e3\chninfo.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\25e3\ChnReg.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\25e3\segrules.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\25e3\series.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\25e3\Stats.tmp
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\25e3\submissions.old
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\25e3\submissions.xml
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\25e3\UserProf.bak
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\25e3\UserProf.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\626b\10685d92\_bwfindx.zip
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\626b\10685d92\info.iad
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\626b\10685d92\LDM Release Multi\bwsetup.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\626b\10685d92\LDM Release Multi\cert.db
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\626b\10685d92\LDM Release Multi\DefPrefs.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\626b\10685d92\main.wkg
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\626b\a9a3e36\_bwfindx.zip
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\626b\a9a3e36\info.iad
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\626b\a9a3e53\_bwfindx.zip
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\626b\a9a3e53\info.iad
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\626b\a9a3e54\_bwfindx.zip
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\626b\a9a3e54\info.iad
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\626b\a9a3ef0\_bwfindx.zip
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\626b\a9a3ef0\info.iad
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\626b\a9a3f17\_bwfindx.zip
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\626b\a9a3f17\info.iad
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\626b\a9a3f18\_bwfindx.zip
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\626b\a9a3f1860SM.ipk
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\626b\a9a3f18\action.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\626b\a9a3f18\info.iad
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\626b\a9a3f18\main.bis
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\626b\BWEvents.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\626b\chninfo.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\626b\ChnReg.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\626b\segrules.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\626b\Stats.tmp
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\626b\UserProf.bak
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\626b\UserProf.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\706e\BWEvents.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\706e\chninfo.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\706e\ChnReg.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\706e\segrules.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\706e\Stats.tmp
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\706e\UserProf.bak
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\706e\UserProf.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\background.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\browser.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\BWDocMap.pht
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\BWInfopakMap.pht
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\bwppipmd.xml
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\bwsetup.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\cache.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\cert.db
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\chandir.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\chandir.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\chn.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\chn.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\DefPrefs.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\GenFlash\1\gen.bif
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\GenFlash\1\gen.bis
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\GenFlash\1\info.iad
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\HostCache.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\InfoCenter.GIF
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\InfoCenter.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\inuse.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\L0000001.FCS
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\L0000002.FCS
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\L0000003.FCS
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\localHost.js
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\main.log
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\player.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\prs.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\prs.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\prs_die.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\prs_die.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\prs_dnd.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\prs_dnd.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\prs_ext.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\prs_ext.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\prs_rcv.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\prs_rcv.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\S0000000.FCS
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\S0000001.FCS
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\shopping.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\storydb.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\storydb.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\upgrade.log
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\UpgradePubKey.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\UsrPrefs.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Data\wg1.wkg
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Misc\Backup\chandir.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Chrono1O2\Misc\Backup\chandir.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\DataSets.ini
C:\Program Files\Viewpoint
C:\Program Files\Viewpoint\Viewpoint Manager\VETScriptInterpreter.dll
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCP.cpl
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\s.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_header_av.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_header_cp.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_header_up.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_inner_bg.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_inner_bottom.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab_bg.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab1_off.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab1_on.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab2_off.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab2_on.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vwpt_logo.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\options.ini
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\viewpoint.ico
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\vmctrl.html
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgrCore.dll
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgrInstaller.exe
C:\Program Files\Viewpoint\Viewpoint Media Player\AxMetaStream.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\AxMetaStream_0302021C.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\AxMetaStream_0302021C_.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\AxMetaStream_0305000D.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\ClassIDs.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\ComponentMgr_0305000D.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\ComponentRegistry.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\AOLUserShell.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\Cursors.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\JpegReader.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\Mts3Reader.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\SceneComponent.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\SreeDMMX.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\SWFView.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\VMgr.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\VMPSpeech.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\VMPVideo.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\VMPVideo2.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\WaveletReader.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\DownLoadHist.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\HostRegistry.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\MetaStreamConfig.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\MetaStreamID.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\MtsAxInstaller.exe
C:\Program Files\Viewpoint\Viewpoint Media Player\MTSDownloadSites.txt

.
((((((((((((((((((((((((( Files Created from 2007-09-12 to 2007-10-12 )))))))))))))))))))))))))))))))
.

2007-10-11 22:01 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-10-11 22:01 drahs—- C:\autorun.inf
2007-10-11 03:33 d——– C:\WINDOWS\LastGood.Tmp
2007-10-10 03:04 582,656 ——— C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-10-04 20:13 53,248 –a—— C:\WINDOWS\system32\Process.exe
2007-10-02 22:31 d——– C:\Program Files\Certification Preparation
2007-10-02 22:25 d——– C:\Certification Preparation
2007-10-02 00:44 d——– C:\Program Files\SiteAdvisor
2007-10-02 00:44 d——– C:\Documents and Settings\LocalService\Application Data\SiteAdvisor
2007-10-02 00:44 d——– C:\Documents and Settings\Chrono1O2\Application Data\SiteAdvisor
2007-10-02 00:44 d——– C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2007-10-02 00:43 143,360 –a—— C:\WINDOWS\system32\dunzip32.dll
2007-10-02 00:42 71,496 –a—— C:\WINDOWS\system32\drivers\mfeavfk.sys
2007-10-02 00:42 37,480 –a—— C:\WINDOWS\system32\drivers\mfesmfk.sys
2007-10-02 00:42 34,184 –a—— C:\WINDOWS\system32\drivers\mfebopk.sys
2007-10-02 00:42 32,008 –a—— C:\WINDOWS\system32\drivers\mferkdk.sys
2007-10-02 00:42 171,240 –a—— C:\WINDOWS\system32\drivers\mfehidk.sys
2007-10-02 00:42 109,608 –a—— C:\WINDOWS\system32\drivers\Mpfp.sys
2007-10-02 00:41 d——– C:\Program Files\McAfee.com
2007-10-02 00:41 d——– C:\Program Files\McAfee
2007-10-02 00:41 d——– C:\Program Files\Common Files\McAfee
2007-10-02 00:36 d——– C:\Documents and Settings\All Users\Application Data\McAfee
2007-10-01 06:29 1,159,340 –a—— C:\SDFix.exe
2007-09-30 10:33 1,092 –a—— C:\WINDOWS\system32\tmp.reg
2007-09-30 10:28 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-09-30 10:28 d——– C:\AVG Anti-Spyware 7.5
2007-09-30 10:25 51,200 –a—— C:\WINDOWS\system32\dumphive.exe
2007-09-30 10:25 289,144 –a—— C:\WINDOWS\system32\VCCLSID.exe
2007-09-30 10:25 288,417 –a—— C:\WINDOWS\system32\SrchSTS.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-11 22:14 ——— d——– C:\Program Files\Logitech
2007-10-11 16:51 ——— d——– C:\Documents and Settings\Chrono1O2\Application Data\Azureus
2007-10-10 06:16 ——— d——– C:\Program Files\AIM95
2007-10-09 16:33 ——— d——– C:\Program Files\Symantec
2007-10-09 16:33 ——— d——– C:\Program Files\Common Files\Symantec Shared
2007-10-09 16:33 ——— d——– C:\Documents and Settings\All Users\Application Data\Symantec
2007-10-06 15:39 ——— d——– C:\Documents and Settings\All Users\Application Data\AOL Downloads
2007-09-14 02:24 ——— d——– C:\Program Files\Verizon Online
2007-09-14 02:23 ——— d——– C:\Program Files\Common Files\Motive
2007-09-12 02:01 ——— d—s—- C:\Program Files\Xfire
2007-09-10 00:42 ——— d——– C:\Documents and Settings\Chrono1O2\Application Data\Xfire
2005-06-01 21:42 171796 –a—— C:\Documents and Settings\Chrono1O2\stub.exe
.

((((((((((((((((((((((((((((( snapshot_2007-09-30_174112.45 )))))))))))))))))))))))))))))))))))))))))
.
—-a-w 135,168 2007-09-28 13:06:08 C:\WINDOWS\catchme.exe
—-a-w 14,048 2007-03-06 01:22:36 C:\WINDOWS\$hf_mig$\KB939653-IE7\spmsg.dll
—-a-w 213,216 2007-03-06 01:22:41 C:\WINDOWS\$hf_mig$\KB939653-IE7\spuninst.exe
—-a-w 124,928 2007-08-20 10:02:09 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\advpack.dll
—-a-w 214,528 2007-08-20 10:02:11 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\dxtrans.dll
—-a-w 132,608 2007-08-20 10:02:09 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\extmgr.dll
—-a-w 63,488 2007-08-20 10:02:09 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\icardie.dll
—-a-w 70,656 2007-08-17 10:12:34 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\ie4uinit.exe
—-a-w 153,088 2007-08-20 10:02:09 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\ieakeng.dll
—-a-w 230,400 2007-08-20 10:02:09 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\ieaksie.dll
—-a-w 161,792 2007-08-17 07:29:55 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\ieakui.dll
—-a-w 2,455,488 2007-04-17 09:28:12 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\ieapfltr.dat
—-a-w 383,488 2007-08-20 10:02:09 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\ieapfltr.dll
—-a-w 387,584 2007-08-20 10:02:09 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\iedkcs32.dll
—-a-w 6,066,176 2007-08-20 10:02:10 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\ieframe.dll
—-a-w 44,544 2007-08-20 10:02:10 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\iernonce.dll
—-a-w 267,776 2007-08-20 10:02:10 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\iertutil.dll
—-a-w 13,824 2007-08-17 10:12:35 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\ieudinit.exe
—-a-w 625,152 2007-08-17 10:12:49 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\iexplore.exe
—-a-w 27,648 2007-08-20 10:02:10 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\jsproxy.dll
—-a-w 459,264 2007-08-20 10:02:10 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\msfeeds.dll
—-a-w 52,224 2007-08-20 10:02:10 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\msfeedsbs.dll
—-a-w 3,592,192 2007-08-20 10:02:11 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\mshtml.dll
—-a-w 478,208 2007-08-20 10:02:11 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\mshtmled.dll
—-a-w 193,024 2007-08-20 10:02:11 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\msrating.dll
—-a-w 671,232 2007-08-20 10:02:11 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\mstime.dll
—-a-w 102,400 2007-08-20 10:02:11 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\occache.dll
—-a-w 105,984 2007-08-20 10:02:11 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\url.dll
—-a-w 1,161,728 2007-08-20 10:02:11 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\urlmon.dll
—-a-w 232,960 2007-08-20 10:02:11 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\webcheck.dll
—-a-w 825,344 2007-08-20 10:02:11 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\wininet.dll
—-a-w 22,752 2007-03-06 01:22:34 C:\WINDOWS\$hf_mig$\KB939653-IE7\update\spcustom.dll
—-a-w 716,000 2007-03-06 01:22:59 C:\WINDOWS\$hf_mig$\KB939653-IE7\update\update.exe
—-a-w 371,424 2007-03-06 01:23:51 C:\WINDOWS\$hf_mig$\KB939653-IE7\update\updspapi.dll
—-a-w 14,048 2007-03-06 01:22:36 C:\WINDOWS\$hf_mig$\KB941202\spmsg.dll
—-a-w 213,216 2007-03-06 01:22:41 C:\WINDOWS\$hf_mig$\KB941202\spuninst.exe
—-a-w 683,520 2007-08-21 06:25:02 C:\WINDOWS\$hf_mig$\KB941202\SP2QFE\inetcomm.dll
—-a-w 22,752 2007-03-06 01:22:34 C:\WINDOWS\$hf_mig$\KB941202\update\spcustom.dll
—-a-w 716,000 2007-03-06 01:22:59 C:\WINDOWS\$hf_mig$\KB941202\update\update.exe
—-a-w 371,424 2007-03-06 01:23:51 C:\WINDOWS\$hf_mig$\KB941202\update\updspapi.dll
-c—-w 581,120 2004-08-04 04:56:46 C:\WINDOWS\$NtUninstallKB933729$\rpcrt4.dll
-c—-w 248,320 2007-03-09 11:28:00 C:\WINDOWS\$NtUninstallKB933729$\xpsp3res.dll
-c—-w 213,216 2005-10-12 23:12:26 C:\WINDOWS\$NtUninstallKB933729$\spuninst\spuninst.exe
-c—-w 371,424 2005-10-12 23:12:33 C:\WINDOWS\$NtUninstallKB933729$\spuninst\updspapi.dll
-c—-w 683,520 2007-05-16 15:12:02 C:\WINDOWS\$NtUninstallKB941202$\inetcomm.dll
-c—-w 213,216 2007-03-06 01:22:41 C:\WINDOWS\$NtUninstallKB941202$\spuninst\spuninst.exe
-c—-w 371,424 2007-03-06 01:23:51 C:\WINDOWS\$NtUninstallKB941202$\spuninst\updspapi.dll
-c—-w 124,928 2007-06-27 14:34:51 C:\WINDOWS\ie7updates\KB939653-IE7\advpack.dll
-c—-w 214,528 2006-10-17 17:57:50 C:\WINDOWS\ie7updates\KB939653-IE7\dxtrans.dll
-c—-w 132,608 2007-06-27 14:34:51 C:\WINDOWS\ie7updates\KB939653-IE7\extmgr.dll
-c—-w 61,952 2006-10-17 17:58:20 C:\WINDOWS\ie7updates\KB939653-IE7\icardie.dll
-c—-w 63,488 2007-06-27 08:27:04 C:\WINDOWS\ie7updates\KB939653-IE7\ie4uinit.exe
-c—-w 153,088 2007-06-27 14:34:51 C:\WINDOWS\ie7updates\KB939653-IE7\ieakeng.dll
-c—-w 230,400 2007-06-27 14:34:51 C:\WINDOWS\ie7updates\KB939653-IE7\ieaksie.dll
-c—-w 161,792 2007-06-27 07:00:33 C:\WINDOWS\ie7updates\KB939653-IE7\ieakui.dll
-c—-w 383,488 2007-06-27 14:34:51 C:\WINDOWS\ie7updates\KB939653-IE7\ieapfltr.dll
-c—-w 384,512 2007-06-27 14:34:51 C:\WINDOWS\ie7updates\KB939653-IE7\iedkcs32.dll
-c—-w 6,058,496 2007-06-27 14:34:55 C:\WINDOWS\ie7updates\KB939653-IE7\ieframe.dll
-c—-w 44,544 2007-06-27 14:34:55 C:\WINDOWS\ie7updates\KB939653-IE7\iernonce.dll
-c—-w 267,776 2007-06-27 14:34:55 C:\WINDOWS\ie7updates\KB939653-IE7\iertutil.dll
-c—-w 13,824 2007-06-27 08:27:05 C:\WINDOWS\ie7updates\KB939653-IE7\ieudinit.exe
-c—-w 625,152 2007-06-27 08:27:30 C:\WINDOWS\ie7updates\KB939653-IE7\iexplore.exe
-c—-w 27,648 2007-06-27 14:34:56 C:\WINDOWS\ie7updates\KB939653-IE7\jsproxy.dll
-c—-w 459,264 2007-06-27 14:34:56 C:\WINDOWS\ie7updates\KB939653-IE7\msfeeds.dll
-c—-w 52,224 2007-06-27 14:34:56 C:\WINDOWS\ie7updates\KB939653-IE7\msfeedsbs.dll
-c—-w 3,583,488 2007-07-19 06:59:59 C:\WINDOWS\ie7updates\KB939653-IE7\mshtml.dll
-c—-w 477,696 2007-06-27 14:34:57 C:\WINDOWS\ie7updates\KB939653-IE7\mshtmled.dll
-c—-w 193,024 2007-06-27 14:34:58 C:\WINDOWS\ie7updates\KB939653-IE7\msrating.dll
-c—-w 671,232 2007-06-27 14:34:58 C:\WINDOWS\ie7updates\KB939653-IE7\mstime.dll
-c—-w 102,400 2007-06-27 14:34:58 C:\WINDOWS\ie7updates\KB939653-IE7\occache.dll
-c—-w 105,984 2007-06-27 14:34:58 C:\WINDOWS\ie7updates\KB939653-IE7\url.dll
-c—-w 1,152,000 2007-06-27 14:34:58 C:\WINDOWS\ie7updates\KB939653-IE7\urlmon.dll
-c—-w 232,960 2007-06-27 14:34:59 C:\WINDOWS\ie7updates\KB939653-IE7\webcheck.dll
-c—-w 823,808 2007-06-27 14:34:59 C:\WINDOWS\ie7updates\KB939653-IE7\wininet.dll
-c—-w 213,216 2007-03-06 01:22:41 C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe
-c—-w 371,424 2007-03-06 01:23:51 C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\updspapi.dll
—-a-w 14,048 2005-10-12 23:12:25 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\spmsg.dll
—-a-w 213,216 2005-10-12 23:12:26 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\spuninst.exe
—-a-w 584,192 2007-07-09 13:09:42 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\SP2GDR\rpcrt4.dll
—-a-w 115,712 2007-06-13 06:53:14 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\SP2GDR\xpsp3res.dll
—-a-w 582,656 2007-07-09 13:16:16 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\SP2QFE\rpcrt4.dll
—-a-w 350,720 2007-06-19 07:24:36 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\SP2QFE\xpsp3res.dll
—-a-w 22,752 2005-10-12 23:12:25 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\update\spcustom.dll
—-a-w 716,000 2005-10-12 23:12:28 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\update\update.exe
—-a-w 371,424 2005-10-12 23:12:33 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\update\updspapi.dll
—-a-w 14,048 2007-03-06 01:22:36 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\spmsg.dll
—-a-w 213,216 2007-03-06 01:22:41 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\spuninst.exe
—-a-w 124,928 2007-08-20 10:04:34 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2gdr\advpack.dll
—-a-w 214,528 2007-08-20 10:04:34 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2gdr\dxtrans.dll
—-a-w 132,608 2007-08-20 10:04:34 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2gdr\extmgr.dll
—-a-w 63,488 2007-08-20 10:04:34 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2gdr\icardie.dll
—-a-w 63,488 2007-08-17 10:20:54 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2gdr\ie4uinit.exe
—-a-w 153,088 2007-08-20 10:04:34 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2gdr\ieakeng.dll
—-a-w 230,400 2007-08-20 10:04:35 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2gdr\ieaksie.dll
—-a-w 161,792 2007-08-17 07:34:25 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2gdr\ieakui.dll
—-a-w 383,488 2007-08-20 10:04:35 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2gdr\ieapfltr.dll
—-a-w 384,512 2007-08-20 10:04:35 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2gdr\iedkcs32.dll
—-a-w 6,058,496 2007-08-20 10:04:37 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2gdr\ieframe.dll
—-a-w 44,544 2007-08-20 10:04:38 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2gdr\iernonce.dll
—-a-w 267,776 2007-08-20 10:04:38 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2gdr\iertutil.dll
—-a-w 13,824 2007-08-17 10:20:54 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2gdr\ieudinit.exe
—-a-w 625,152 2007-08-17 10:21:21 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2gdr\iexplore.exe
—-a-w 27,648 2007-08-20 10:04:39 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2gdr\jsproxy.dll
—-a-w 459,264 2007-08-20 10:04:39 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2gdr\msfeeds.dll
—-a-w 52,224 2007-08-20 10:04:39 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2gdr\msfeedsbs.dll
—-a-w 3,584,512 2007-08-20 10:04:41 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2gdr\mshtml.dll
—-a-w 477,696 2007-08-20 10:04:41 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2gdr\mshtmled.dll
—-a-w 193,024 2007-08-20 10:04:41 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2gdr\msrating.dll
—-a-w 671,232 2007-08-20 10:04:42 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2gdr\mstime.dll
—-a-w 102,400 2007-08-20 10:04:42 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2gdr\occache.dll
—-a-w 105,984 2007-08-20 10:04:42 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2gdr\url.dll
—-a-w 1,152,000 2007-08-20 10:04:42 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2gdr\urlmon.dll
—-a-w 232,960 2007-08-20 10:04:42 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2gdr\webcheck.dll
—-a-w 824,832 2007-08-20 10:04:43 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2gdr\wininet.dll
—-a-w 124,928 2007-08-20 10:02:09 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2qfe\advpack.dll
—-a-w 214,528 2007-08-20 10:02:11 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2qfe\dxtrans.dll
—-a-w 132,608 2007-08-20 10:02:09 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2qfe\extmgr.dll
—-a-w 63,488 2007-08-20 10:02:09 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2qfe\icardie.dll
—-a-w 70,656 2007-08-17 10:12:34 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2qfe\ie4uinit.exe
—-a-w 153,088 2007-08-20 10:02:09 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2qfe\ieakeng.dll
—-a-w 230,400 2007-08-20 10:02:09 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2qfe\ieaksie.dll
—-a-w 161,792 2007-08-17 07:29:55 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2qfe\ieakui.dll
—-a-w 2,455,488 2007-04-17 09:28:12 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2qfe\ieapfltr.dat
—-a-w 383,488 2007-08-20 10:02:09 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2qfe\ieapfltr.dll
—-a-w 387,584 2007-08-20 10:02:09 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2qfe\iedkcs32.dll
—-a-w 6,066,176 2007-08-20 10:02:10 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2qfe\ieframe.dll
—-a-w 44,544 2007-08-20 10:02:10 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2qfe\iernonce.dll
—-a-w 267,776 2007-08-20 10:02:10 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2qfe\iertutil.dll
—-a-w 13,824 2007-08-17 10:12:35 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2qfe\ieudinit.exe
—-a-w 625,152 2007-08-17 10:12:49 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2qfe\iexplore.exe
—-a-w 27,648 2007-08-20 10:02:10 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2qfe\jsproxy.dll
—-a-w 459,264 2007-08-20 10:02:10 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2qfe\msfeeds.dll
—-a-w 52,224 2007-08-20 10:02:10 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2qfe\msfeedsbs.dll
—-a-w 3,592,192 2007-08-20 10:02:11 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2qfe\mshtml.dll
—-a-w 478,208 2007-08-20 10:02:11 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2qfe\mshtmled.dll
—-a-w 193,024 2007-08-20 10:02:11 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2qfe\msrating.dll
—-a-w 671,232 2007-08-20 10:02:11 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2qfe\mstime.dll
—-a-w 102,400 2007-08-20 10:02:11 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2qfe\occache.dll
—-a-w 105,984 2007-08-20 10:02:11 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2qfe\url.dll
—-a-w 1,161,728 2007-08-20 10:02:11 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2qfe\urlmon.dll
—-a-w 232,960 2007-08-20 10:02:11 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2qfe\webcheck.dll
—-a-w 825,344 2007-08-20 10:02:11 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\sp2qfe\wininet.dll
—-a-w 22,752 2007-03-06 01:22:34 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\update\spcustom.dll
—-a-w 716,000 2007-03-06 01:22:59 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\update\update.exe
—-a-w 371,424 2007-03-06 01:23:51 C:\WINDOWS\SoftwareDistribution\Download\6915af3cf644e553ca6da8ed6ca50d4f\update\updspapi.dll
—-a-w 14,048 2007-03-06 01:22:36 C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\spmsg.dll
—-a-w 213,216 2007-03-06 01:22:41 C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\spuninst.exe
—-a-w 683,520 2007-08-21 06:15:44 C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\sp2gdr\inetcomm.dll
—-a-w 683,520 2007-08-21 06:25:02 C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\sp2qfe\inetcomm.dll
—-a-w 22,752 2007-03-06 01:22:34 C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\update\spcustom.dll
—-a-w 716,000 2007-03-06 01:22:59 C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\update\update.exe
—-a-w 371,424 2007-03-06 01:23:51 C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\update\updspapi.dll
—-a-w 124,928 2007-08-20 10:04:34 C:\WINDOWS\system32\advpack.dll
—-a-w 214,528 2007-08-20 10:04:34 C:\WINDOWS\system32\dxtrans.dll
—-a-w 132,608 2007-08-20 10:04:34 C:\WINDOWS\system32\extmgr.dll
—-a-w 63,488 2007-08-20 10:04:34 C:\WINDOWS\system32\icardie.dll
—-a-w 63,488 2007-08-17 10:20:54 C:\WINDOWS\system32\ie4uinit.exe
—-a-w 153,088 2007-08-20 10:04:34 C:\WINDOWS\system32\ieakeng.dll
—-a-w 230,400 2007-08-20 10:04:35 C:\WINDOWS\system32\ieaksie.dll
—-a-w 161,792 2007-08-17 07:34:25 C:\WINDOWS\system32\ieakui.dll
—-a-w 383,488 2007-08-20 10:04:35 C:\WINDOWS\system32\ieapfltr.dll
—-a-w 384,512 2007-08-20 10:04:35 C:\WINDOWS\system32\iedkcs32.dll
—-a-w 6,058,496 2007-08-20 10:04:37 C:\WINDOWS\system32\ieframe.dll
—-a-w 44,544 2007-08-20 10:04:38 C:\WINDOWS\system32\iernonce.dll
—-a-w 267,776 2007-08-20 10:04:38 C:\WINDOWS\system32\iertutil.dll
—-a-w 13,824 2007-08-17 10:20:54 C:\WINDOWS\system32\ieudinit.exe
—-a-w 683,520 2007-08-21 06:15:44 C:\WINDOWS\system32\inetcomm.dll
—-a-w 27,648 2007-08-20 10:04:39 C:\WINDOWS\system32\jsproxy.dll
—-a-w 18,089,592 2007-09-28 05:19:39 C:\WINDOWS\system32\MRT.exe
—-a-w 459,264 2007-08-20 10:04:39 C:\WINDOWS\system32\msfeeds.dll
—-a-w 52,224 2007-08-20 10:04:39 C:\WINDOWS\system32\msfeedsbs.dll
—-a-w 3,584,512 2007-08-20 10:04:41 C:\WINDOWS\system32\mshtml.dll
—-a-w 477,696 2007-08-20 10:04:41 C:\WINDOWS\system32\mshtmled.dll
—-a-w 193,024 2007-08-20 10:04:41 C:\WINDOWS\system32\msrating.dll
—-a-w 671,232 2007-08-20 10:04:42 C:\WINDOWS\system32\mstime.dll
—-a-w 102,400 2007-08-20 10:04:42 C:\WINDOWS\system32\occache.dll
—-a-w 582,656 2007-07-09 13:16:16 C:\WINDOWS\system32\rpcrt4.dll
—-a-w 279,552 2007-10-05 14:07:31 C:\WINDOWS\system32\swreg.exe
—-a-w 105,984 2007-08-20 10:04:42 C:\WINDOWS\system32\url.dll
—-a-w 1,152,000 2007-08-20 10:04:42 C:\WINDOWS\system32\urlmon.dll
—-a-w 232,960 2007-08-20 10:04:42 C:\WINDOWS\system32\webcheck.dll
—-a-w 824,832 2007-08-20 10:04:43 C:\WINDOWS\system32\wininet.dll
—-a-w 350,720 2007-06-19 07:24:36 C:\WINDOWS\system32\xpsp3res.dll
——w 124,928 2007-08-20 10:04:34 C:\WINDOWS\system32\dllcache\advpack.dll
—-a-w 214,528 2007-08-20 10:04:34 C:\WINDOWS\system32\dllcache\dxtrans.dll
—-a-w 132,608 2007-08-20 10:04:34 C:\WINDOWS\system32\dllcache\extmgr.dll
——w 63,488 2007-08-20 10:04:34 C:\WINDOWS\system32\dllcache\icardie.dll
——w 63,488 2007-08-17 10:20:54 C:\WINDOWS\system32\dllcache\ie4uinit.exe
——w 153,088 2007-08-20 10:04:34 C:\WINDOWS\system32\dllcache\ieakeng.dll
——w 230,400 2007-08-20 10:04:35 C:\WINDOWS\system32\dllcache\ieaksie.dll
—-a-w 161,792 2007-08-17 07:34:25 C:\WINDOWS\system32\dllcache\ieakui.dll
——w 383,488 2007-08-20 10:04:35 C:\WINDOWS\system32\dllcache\ieapfltr.dll
——w 384,512 2007-08-20 10:04:35 C:\WINDOWS\system32\dllcache\iedkcs32.dll
——w 6,058,496 2007-08-20 10:04:37 C:\WINDOWS\system32\dllcache\ieframe.dll
——w 44,544 2007-08-20 10:04:38 C:\WINDOWS\system32\dllcache\iernonce.dll
——w 267,776 2007-08-20 10:04:38 C:\WINDOWS\system32\dllcache\iertutil.dll
——w 13,824 2007-08-17 10:20:54 C:\WINDOWS\system32\dllcache\ieudinit.exe
——w 625,152 2007-08-17 10:21:21 C:\WINDOWS\system32\dllcache\iexplore.exe
——w 683,520 2007-08-21 06:15:44 C:\WINDOWS\system32\dllcache\inetcomm.dll
—-a-w 27,648 2007-08-20 10:04:39 C:\WINDOWS\system32\dllcache\jsproxy.dll
——w 459,264 2007-08-20 10:04:39 C:\WINDOWS\system32\dllcache\msfeeds.dll
——w 52,224 2007-08-20 10:04:39 C:\WINDOWS\system32\dllcache\msfeedsbs.dll
—-a-w 3,584,512 2007-08-20 10:04:41 C:\WINDOWS\system32\dllcache\mshtml.dll
—-a-w 477,696 2007-08-20 10:04:41 C:\WINDOWS\system32\dllcache\mshtmled.dll
—-a-w 193,024 2007-08-20 10:04:41 C:\WINDOWS\system32\dllcache\msrating.dll
—-a-w 671,232 2007-08-20 10:04:42 C:\WINDOWS\system32\dllcache\mstime.dll
——w 102,400 2007-08-20 10:04:42 C:\WINDOWS\system32\dllcache\occache.dll
——w 105,984 2007-08-20 10:04:42 C:\WINDOWS\system32\dllcache\url.dll
—-a-w 1,152,000 2007-08-20 10:04:42 C:\WINDOWS\system32\dllcache\urlmon.dll
——w 232,960 2007-08-20 10:04:42 C:\WINDOWS\system32\dllcache\webcheck.dll
—-a-w 824,832 2007-08-20 10:04:43 C:\WINDOWS\system32\dllcache\wininet.dll
—-a-w 306,528 2007-08-28 17:34:18 C:\WINDOWS\temp194861192088013mcinst.exe
.
—-a-w 109,056 2007-07-20 04:47:22 C:\WINDOWS\catchme.exe
—-a-w 124,928 2007-06-27 14:34:51 C:\WINDOWS\system32\advpack.dll
—-a-w 214,528 2006-10-17 17:57:50 C:\WINDOWS\system32\dxtrans.dll
—-a-w 132,608 2007-06-27 14:34:51 C:\WINDOWS\system32\extmgr.dll
——w 61,952 2006-10-17 17:58:20 C:\WINDOWS\system32\icardie.dll
—-a-w 63,488 2007-06-27 08:27:04 C:\WINDOWS\system32\ie4uinit.exe
—-a-w 153,088 2007-06-27 14:34:51 C:\WINDOWS\system32\ieakeng.dll
—-a-w 230,400 2007-06-27 14:34:51 C:\WINDOWS\system32\ieaksie.dll
—-a-w 161,792 2007-06-27 07:00:33 C:\WINDOWS\system32\ieakui.dll
—-a-w 383,488 2007-06-27 14:34:51 C:\WINDOWS\system32\ieapfltr.dll
—-a-w 384,512 2007-06-27 14:34:51 C:\WINDOWS\system32\iedkcs32.dll
—-a-w 6,058,496 2007-06-27 14:34:55 C:\WINDOWS\system32\ieframe.dll
—-a-w 44,544 2007-06-27 14:34:55 C:\WINDOWS\system32\iernonce.dll
—-a-w 267,776 2007-06-27 14:34:55 C:\WINDOWS\system32\iertutil.dll
—-a-w 13,824 2007-06-27 08:27:05 C:\WINDOWS\system32\ieudinit.exe
—-a-w 683,520 2007-05-16 15:12:02 C:\WINDOWS\system32\inetcomm.dll
—-a-w 27,648 2007-06-27 14:34:56 C:\WINDOWS\system32\jsproxy.dll
—-a-w 17,474,680 2007-09-06 02:50:42 C:\WINDOWS\system32\MRT.exe
—-a-w 459,264 2007-06-27 14:34:56 C:\WINDOWS\system32\msfeeds.dll
—-a-w 52,224 2007-06-27 14:34:56 C:\WINDOWS\system32\msfeedsbs.dll
—-a-w 3,583,488 2007-07-19 06:59:59 C:\WINDOWS\system32\mshtml.dll
—-a-w 477,696 2007-06-27 14:34:57 C:\WINDOWS\system32\mshtmled.dll
—-a-w 193,024 2007-06-27 14:34:58 C:\WINDOWS\system32\msrating.dll
—-a-w 671,232 2007-06-27 14:34:58 C:\WINDOWS\system32\mstime.dll
—-a-w 102,400 2007-06-27 14:34:58 C:\WINDOWS\system32\occache.dll
—-a-w 581,120 2004-08-04 04:56:46 C:\WINDOWS\system32\rpcrt4.dll
—-a-w 279,552 2007-07-22 22:39:27 C:\WINDOWS\system32\swreg.exe
—-a-w 105,984 2007-06-27 14:34:58 C:\WINDOWS\system32\url.dll
—-a-w 1,152,000 2007-06-27 14:34:58 C:\WINDOWS\system32\urlmon.dll
—-a-w 232,960 2007-06-27 14:34:59 C:\WINDOWS\system32\webcheck.dll
—-a-w 823,808 2007-06-27 14:34:59 C:\WINDOWS\system32\wininet.dll
—-a-w 248,320 2007-03-09 11:28:00 C:\WINDOWS\system32\xpsp3res.dll
——w 124,928 2007-06-27 14:34:51 C:\WINDOWS\system32\dllcache\advpack.dll
—-a-w 214,528 2006-10-17 17:57:50 C:\WINDOWS\system32\dllcache\dxtrans.dll
—-a-w 132,608 2007-06-27 14:34:51 C:\WINDOWS\system32\dllcache\extmgr.dll
——w 63,488 2007-06-27 08:27:04 C:\WINDOWS\system32\dllcache\ie4uinit.exe
——w 153,088 2007-06-27 14:34:51 C:\WINDOWS\system32\dllcache\ieakeng.dll
——w 230,400 2007-06-27 14:34:51 C:\WINDOWS\system32\dllcache\ieaksie.dll
—-a-w 161,792 2007-06-27 07:00:33 C:\WINDOWS\system32\dllcache\ieakui.dll
——w 383,488 2007-06-27 14:34:51 C:\WINDOWS\system32\dllcache\ieapfltr.dll
——w 384,512 2007-06-27 14:34:51 C:\WINDOWS\system32\dllcache\iedkcs32.dll
——w 6,058,496 2007-06-27 14:34:55 C:\WINDOWS\system32\dllcache\ieframe.dll
——w 44,544 2007-06-27 14:34:55 C:\WINDOWS\system32\dllcache\iernonce.dll
——w 267,776 2007-06-27 14:34:55 C:\WINDOWS\system32\dllcache\iertutil.dll
——w 13,824 2007-06-27 08:27:05 C:\WINDOWS\system32\dllcache\ieudinit.exe
——w 625,152 2007-06-27 08:27:30 C:\WINDOWS\system32\dllcache\iexplore.exe
——w 683,520 2007-05-16 15:12:02 C:\WINDOWS\system32\dllcache\inetcomm.dll
—-a-w 27,648 2007-06-27 14:34:56 C:\WINDOWS\system32\dllcache\jsproxy.dll
——w 459,264 2007-06-27 14:34:56 C:\WINDOWS\system32\dllcache\msfeeds.dll
——w 52,224 2007-06-27 14:34:56 C:\WINDOWS\system32\dllcache\msfeedsbs.dll
—-a-w 3,583,488 2007-07-19 06:59:59 C:\WINDOWS\system32\dllcache\mshtml.dll
—-a-w 477,696 2007-06-27 14:34:57 C:\WINDOWS\system32\dllcache\mshtmled.dll
—-a-w 193,024 2007-06-27 14:34:58 C:\WINDOWS\system32\dllcache\msrating.dll
—-a-w 671,232 2007-06-27 14:34:58 C:\WINDOWS\system32\dllcache\mstime.dll
——w 102,400 2007-06-27 14:34:58 C:\WINDOWS\system32\dllcache\occache.dll
——w 105,984 2007-06-27 14:34:58 C:\WINDOWS\system32\dllcache\url.dll
—-a-w 1,152,000 2007-06-27 14:34:58 C:\WINDOWS\system32\dllcache\urlmon.dll
——w 232,960 2007-06-27 14:34:59 C:\WINDOWS\system32\dllcache\webcheck.dll
—-a-w 823,808 2007-06-27 14:34:59 C:\WINDOWS\system32\dllcache\wininet.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2002-11-23 02:15]
"razertra"="C:\Program Files\Razer\razertra.exe" [2005-04-06 21:32]
"razer"="C:\Program Files\Razer\razerhid.exe" [2005-05-17 19:21]
"DAEMON Tools"="C:\DAEMON Tools\daemon.exe" [2005-11-08 18:00]
"MskAgentexe"="C:\Program Files\McAfee\MSK\MskAgent.exe" [2007-01-17 15:30]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [2007-08-24 17:57]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 00:56]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
ZDWLan Utility.lnk - C:\ZyDAS_802.11g_Utility\ZDWlan.exe [2007-01-04 23:18:19]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"SpecifyDefaultButtons"=0 (0x0)
"Btn_Search"=0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 8.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 8.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 8.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Clean Access Agent.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Clean Access Agent.lnk
backup=C:\WINDOWS\pss\Clean Access Agent.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^GStartup.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\GStartup.lnk
backup=C:\WINDOWS\pss\GStartup.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk
backup=C:\WINDOWS\pss\Microsoft Works Calendar Reminders.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PrecisionTime.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\PrecisionTime.lnk
backup=C:\WINDOWS\pss\PrecisionTime.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Verizon Online Dialer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Verizon Online Dialer.lnk
backup=C:\WINDOWS\pss\Verizon Online Dialer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Verizon Online Support Center.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Verizon Online Support Center.lnk
backup=C:\WINDOWS\pss\Verizon Online Support Center.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Chrono1O2^Start Menu^Programs^Startup^Finish Installing….lnk]
path=C:\Documents and Settings\Chrono1O2\Start Menu\Programs\Startup\Finish Installing….lnk
backup=C:\WINDOWS\pss\Finish Installing….lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Chrono1O2^Start Menu^Programs^Startup^PowerReg Scheduler V3.exe]
path=C:\Documents and Settings\Chrono1O2\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe
backup=C:\WINDOWS\pss\PowerReg Scheduler V3.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
"C:\AVG Anti-Spyware 7.5\avgas.exe" /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
"C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Instant Messanger]
aim.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
"C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Belt]
C:\WINDOWS\Belt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CC2KUI]
C:\PROGRA~1\Comet\Bin\cstray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
"C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CMESys]
"C:\Program Files\Common Files\CMEII\CMESys.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
"C:\DAEMON Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Internet Optimizer]
"C:\Program Files\Internet Optimizer\optimize.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KAZAA]
"C:\Program Files\Kazaa Lite\kpp.exe" "C:\Program Files\Kazaa Lite\kazaa.kpp" /SYSTRAY

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
\Program\

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
Logi_MwX.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Portfolio]
C:\Program Files\Microsoft Works\WksSb.exe /AllUsers

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]
C:\PROGRA~1\VERIZO~2\SUPPOR~1\SMARTB~1\MotiveSB.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\MSN Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NWEReboot]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Power Scan]
C:\Program Files\Power Scan\powerscan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SFP]
C:\Program Files\Common Files\Verizon Online\SFP\vzSFPWin.EXE /s

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
"C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Start WingMan Profiler]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TB_setup]
C:\DOCUME~1\CHRONO~1\LOCALS~1\Temp\TB_ANI~1.EXE /dcheck

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
C:\WINDOWS\Updreg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vptray]
C:\PROGRA~1\SYMANT~1\VPTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\XupiterStartup]
C:\Program Files\Xupiter\XupiterStartup.exe

R1 SSHDRV65;SSHDRV65;\??\C:\WINDOWS\system32\drivers\SSHDRV65.sys
R1 SSHDRV85;SSHDRV85;\??\C:\WINDOWS\system32\drivers\SSHDRV85.sys
R2 WinDriver;WinDriver;C:\WINDOWS\system32\drivers\WINDRVR.SYS
R3 Razerlow;Razerlow USB Filter Driver;C:\WINDOWS\system32\Drivers\Razerlow.sys
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver;C:\WINDOWS\system32\drivers\WmBEnum.sys
R3 WmXlCore;Logitech WingMan Translation Layer Driver;C:\WINDOWS\system32\drivers\WmXlCore.sys
S2 cpuidle;cpuidle;C:\WINDOWS\SYSTEM32\DRIVERS\ETC\CPUIDLE\srvany.exe
S3 Aldebaran;Aldebaran - Storage Filter Drivers;\??\C:\WINDOWS\system32\Drivers\Aldebaran.sys
S3 BRGSp50;BRGSp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\BRGSp50.sys
S3 LCcfltr;Logitech USB Filter Driver;C:\WINDOWS\system32\Drivers\LCcFltr.Sys
S3 wdpnp;WinDriver USB Client;C:\WINDOWS\system32\Drivers\wdpnp.sys
S3 WmFilter;Logitech WingMan HID Filter Driver;C:\WINDOWS\system32\drivers\WmFilter.sys
S3 WmVirHid;Logitech Virtual Hid Device Driver;C:\WINDOWS\system32\drivers\WmVirHid.sys
S3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-10-08 20:22:06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
"2007-10-02 04:41:55 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
"2007-10-02 04:41:54 C:\WINDOWS\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-11 22:19:18
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

C:\WINDOWS\WIN.QTW
C:\WINDOWS\winamp.ini
C:\WINDOWS\winbpupd.exe
C:\WINDOWS\Windows Update Setup Files
C:\WINDOWS\Windows Update.log
C:\WINDOWS\WindowsUpdate.log
C:\WINDOWS\winhelp.exe
C:\WINDOWS\winhlp32.exe
C:\WINDOWS\WININI.QTW
C:\WINDOWS\winnt.bmp
C:\WINDOWS\winnt256.bmp
C:\WINDOWS\WINNT32.LOG
C:\WINDOWS\winpoet_postinstallation.txt
C:\WINDOWS\winpoet_preinstallation.txt
C:\WINDOWS\winros.ini
C:\WINDOWS\winset.ini
C:\WINDOWS\WinSxS
C:\WINDOWS\WMFDist11.log
C:\WINDOWS\wmp11.log
C:\WINDOWS\wmsetup.log
C:\WINDOWS\wmsetup10.log
C:\WINDOWS\WMSysPr9.prx
C:\WINDOWS\WMSysPrx.prx
C:\WINDOWS\WORDPAD.INI
C:\WINDOWS\wt
C:\WINDOWS\Wudf01000Inst.log
C:\WINDOWS\xaudio.dll
C:\WINDOWS\xobglu16.dll
C:\WINDOWS\xobglu32.dll
C:\WINDOWS\xpsp1hfm.log
C:\WINDOWS\Zapotec.bmp
C:\WINDOWS\zip_var.ini
C:\WINDOWS\_default.pif
C:\WINDOWS\WindowsShell.Manifest
C:\WINDOWS\winww
**************************************************************************
.
Completion time: 2007-10-11 22:25:53 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-10-11 22:25
C:\ComboFix2.txt … 2007-10-06 06:41
C:\ComboFix3.txt … 2007-10-01 06:39
.
— E O F —

Thank you for keeping track of this thread. I really appreciate your help, LDTate! =)

LDTate

Post #15October 12, 2007, 2:32 AM UTC

"copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Hi! Problem with Biohazard background and constant

✨ Ask AI

Ask AI