also i have a DLL file that is now missing it is pncrt.dll what is it?
ok here are the scans first the combofix
ComboFix 07-11-08.1 - Owner 2007-11-07 17:29:37.2 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2007-10-08 to 2007-11-08 )))))))))))))))))))))))))))))))
.
2007-11-07 16:36 d——– C:\Documents and Settings\All Users\Application Data\logs
2007-11-07 13:47 0 –a—— C:\WINDOWS\system32\SBRC.dat
2007-11-07 13:47 0 –a—— C:\WINDOWS\system32\SBFC.dat
2007-11-07 13:36 15,544 –a—— C:\WINDOWS\system32\drivers\sbhr.sys
2007-11-07 13:35 d——– C:\Documents and Settings\Owner\Application Data\Sunbelt Software
2007-11-07 13:34 d——– C:\Documents and Settings\All Users\Application Data\Sunbelt Software
2007-11-07 13:33 d——– C:\Program Files\Sunbelt Software
2007-11-07 12:37 d——– C:\Documents and Settings\Owner\Application Data\Uniblue
2007-11-07 12:37 d——– C:\Documents and Settings\All Users\Application Data\Uniblue
2007-11-07 11:24 d——– C:\Documents and Settings\All Users\Application Data\AOL OCP
2007-11-06 15:53 23,600 –a—— C:\WINDOWS\system32\drivers\TVICHW32.SYS
2007-11-05 19:57 d——– C:\Program Files\EsetOnlineScanner
2007-11-05 19:53 774,144 –a—— C:\Program Files\RngInterstitial.dll
2007-11-02 18:13 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-02 16:58 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-11-01 22:00 d——– C:\Documents and Settings\All Users\Application Data\InstallShield
2007-10-27 20:33 d——– C:\Documents and Settings\Owner\Application Data\Wal-Mart Digital Photo Viewer
2007-10-26 21:50 d——– C:\users
2007-10-25 22:47 d——– C:\Program Files\Windows Sidebar
2007-10-25 22:47 d——– C:\Program Files\Norton AntiVirus
2007-10-25 22:08 d——– C:\Program Files\Norton SystemWorks
2007-10-25 22:06 123,952 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-10-25 22:06 60,800 –a—— C:\WINDOWS\system32\S32EVNT1.DLL
2007-10-25 22:03 d——– C:\Program Files\Symantec
2007-10-25 20:31 d——– C:\Documents and Settings\All Users\Application Data\SupportSoft
2007-10-16 16:51 d——– C:\Program Files\MSXML 6.0
2007-10-16 16:49 d——– C:\Program Files\MSBuild
2007-10-16 16:41 d——– C:\WINDOWS\system32\XPSViewer
2007-10-16 16:39 d——– C:\Program Files\Reference Assemblies
2007-10-16 16:37 14,048 ——— C:\WINDOWS\system32\spmsg2.dll
2007-10-16 16:34 d——– C:\Program Files\Windows Media Connect 2
2007-10-16 16:30 d——– C:\WINDOWS\system32\LogFiles
2007-10-16 16:30 d——– C:\WINDOWS\system32\drivers\UMDF
2007-10-16 16:04 288,768 ——— C:\WINDOWS\system32\rhttpaa.dll
2007-10-16 16:04 116,736 ——— C:\WINDOWS\system32\aaclient.dll
2007-10-16 16:04 36,352 ——— C:\WINDOWS\system32\tsgqec.dll
2007-10-16 14:49 6,058,496 —–c— C:\WINDOWS\system32\dllcache\ieframe.dll
2007-10-16 14:49 2,455,488 —–c— C:\WINDOWS\system32\dllcache\ieapfltr.dat
2007-10-16 14:49 459,264 —–c— C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-10-16 14:49 383,488 —–c— C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-10-16 14:49 267,776 —–c— C:\WINDOWS\system32\dllcache\iertutil.dll
2007-10-16 14:49 63,488 —–c— C:\WINDOWS\system32\dllcache\icardie.dll
2007-10-16 14:49 52,224 —–c— C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-10-16 14:49 13,824 —–c— C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-10-16 13:06 6,139,760 –a—— C:\WindowsUpdateAgent30-x86.exe
2007-10-15 21:22 d——– C:\Program Files\Windows Live Safety Center
2007-10-14 18:41 d——– C:\Documents and Settings\All Users\Application Data\MumboJumbo
2007-10-14 12:00 d——– C:\Program Files\AOL 9.0a
2007-10-12 21:11 d——– C:\Program Files\Common Files\aolshare
2007-10-12 17:25 41,600 –a–c— C:\WINDOWS\system32\dllcache\weitekp9.dll
2007-10-12 17:25 31,232 –a–c— C:\WINDOWS\system32\dllcache\weitekp9.sys
2007-10-12 17:17 221,184 –a—— C:\WINDOWS\system32\wmpns.dll
2007-10-12 17:12 69,120 –a–c— C:\WINDOWS\system32\dllcache\iedw.exe
2007-10-12 17:12 32,768 –a–c— C:\WINDOWS\system32\dllcache\icwdl.dll
2007-10-12 17:08 152,576 –a—— C:\WINDOWS\system32\irftp.exe
2007-10-12 17:08 87,424 –a—— C:\WINDOWS\system32\drivers\irda.sys
2007-10-12 17:08 27,136 –a—— C:\WINDOWS\system32\irmon.dll
2007-10-12 17:08 8,192 –a—— C:\WINDOWS\system32\wshirda.dll
2007-10-12 17:01 19,584 –a—— C:\WINDOWS\system32\drivers\rasirda.sys
2007-10-12 16:54 24,661 –a—— C:\WINDOWS\system32\spxcoins.dll
2007-10-12 16:54 24,661 –a–c— C:\WINDOWS\system32\dllcache\spxcoins.dll
2007-10-12 16:54 13,312 –a—— C:\WINDOWS\system32\irclass.dll
2007-10-12 16:54 13,312 –a–c— C:\WINDOWS\system32\dllcache\irclass.dll
2007-10-12 12:35 d——– C:\WINDOWS\Provisioning
2007-10-12 12:35 d——– C:\WINDOWS\PeerNet
2007-10-12 11:24 d——– C:\WINDOWS\Media
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-07 16:26 ——— d—–w C:\Program Files\Common Files\AOL
2007-11-07 16:26 ——— d—–w C:\Documents and Settings\All Users\Application Data\AOL
2007-11-07 16:18 ——— d—–w C:\Documents and Settings\All Users\Application Data\AOL Downloads
2007-11-06 22:01 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2007-11-06 00:52 ——— d—–w C:\Program Files\Real
2007-11-04 15:37 ——— d—–w C:\Program Files\iMesh Light 5
2007-11-02 02:59 ——— d—–w C:\Program Files\Common Files\InstallShield
2007-10-26 04:38 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-10-26 04:38 10,740 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-10-26 03:50 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2007-10-14 17:05 ——— d—–w C:\Documents and Settings\Owner\Application Data\AOL
2007-10-13 02:14 ——— d—–w C:\Documents and Settings\All Users\Application Data\Viewpoint
2007-09-27 11:08 ——— d—–w C:\Program Files\Microsoft Windows OneCare Live
2007-09-21 01:58 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-09-21 01:57 ——— d—–w C:\Program Files\Creative
2007-09-21 01:34 ——— d—–w C:\Documents and Settings\Owner\Application Data\Creative
2007-09-21 01:21 ——— d—–w C:\Program Files\AOD
2007-09-21 01:20 ——— d–h–w C:\Program Files\Creative Installation Information
2007-09-21 01:17 ——— d—–w C:\Program Files\Common Files\Creative
2007-09-18 18:44 10,662 —-a-w C:\WINDOWS\system32\drivers\srtspx.cat
2007-09-18 18:44 10,662 —-a-w C:\WINDOWS\system32\drivers\srtspl.cat
2007-09-18 18:44 10,658 —-a-w C:\WINDOWS\system32\drivers\srtsp.cat
2007-09-18 18:44 1,430 —-a-w C:\WINDOWS\system32\drivers\srtspl.inf
2007-09-18 18:44 1,421 —-a-w C:\WINDOWS\system32\drivers\srtspx.inf
2007-09-18 18:44 1,415 —-a-w C:\WINDOWS\system32\drivers\srtsp.inf
2007-09-18 18:43 43,696 —-a-w C:\WINDOWS\system32\drivers\srtspx.sys
2007-09-18 18:43 317,616 —-a-w C:\WINDOWS\system32\drivers\srtspl.sys
2007-09-18 18:43 278,576 —-a-w C:\WINDOWS\system32\drivers\srtsp.sys
2007-08-29 18:18 577,928 —-a-w C:\WINDOWS\system32\SymNeti.dll
2007-08-23 23:57 207,240 —-a-w C:\WINDOWS\system32\SymRedir.dll
2007-08-21 06:15 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
2007-08-13 22:54 413,696 —-a-w C:\WINDOWS\system32\vbscript.dll
2007-08-13 22:54 156,160 —-a-w C:\WINDOWS\system32\msls31.dll
2007-08-13 22:45 78,336 —-a-w C:\WINDOWS\system32\ieencode.dll
2007-08-13 22:44 40,960 —-a-w C:\WINDOWS\system32\licmgr10.dll
2007-08-13 22:39 71,680 —-a-w C:\WINDOWS\system32\admparse.dll
2007-08-13 22:39 55,296 —-a-w C:\WINDOWS\system32\iesetup.dll
2007-08-13 22:36 36,352 —-a-w C:\WINDOWS\system32\imgutil.dll
2007-08-13 22:32 45,568 —-a-w C:\WINDOWS\system32\mshta.exe
2007-08-13 22:01 48,128 —-a-w C:\WINDOWS\system32\mshtmler.dll
2007-08-08 21:30 19,456 —-a-w C:\WINDOWS\system32\OnlineScannerLang.dll
2006-01-18 05:38 62,104 —-a-w C:\Documents and Settings\Owner\Application Data\GDIPFONTCACHEV1.DAT
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
2007-10-25 22:52 116088 –a—— C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-07-07 00:28]
"RCSystem"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-11-04 17:07]
"AudioDrvEmulator"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-11-04 17:07]
"CTSysVol"="C:\Program Files\Creative\SBLive 24-Bit External\Surround Mixer\CTSysVol.exe" [2005-10-31 09:51]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 00:00]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-10-23 15:18]
"NSWosCheck"="C:\Program Files\Norton SystemWorks\osCheck.exe" [2007-09-18 07:22]
"osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [2007-08-24 23:53]
"SbUsb AudCtrl"="sbusbdll.dll" [2005-05-26 04:52 C:\WINDOWS\system32\sbusbdll.dll]
"HostManager"="C:\Program Files\Common Files\AOL\1149263314\ee\AOLSoftware.exe" [2007-04-12 16:23]
"SBCSTray"="C:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe" [2007-06-15 15:17]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00]
"AOL Fast Start"="C:\Program Files\AOL 9.0a\AOL.exe" [2007-04-18 01:49]
"AWMON"="C:\Program Files\Lavasoft\Ad-Aware SE Plus\bak\Ad-Watch.exe" [2005-05-25 12:12]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Norton SystemWorks"="C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
hp psc 1000 series.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [2003-04-06 01:17:18]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^desktop.ini]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini
backup=C:\WINDOWS\pss\desktop.iniCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digimax Viewer 2.0.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digimax Viewer 2.0.lnk
backup=C:\WINDOWS\pss\Digimax Viewer 2.0.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^desktop.ini]
path=C:\Documents and Settings\Owner\Start Menu\Programs\Startup\desktop.ini
backup=C:\WINDOWS\pss\desktop.iniStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start]
"C:\Program Files\America Online 9.0a\AOL.EXE" -b
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AWMON]
"C:\Program Files\Lavasoft\Ad-Aware SE Plus\bak\Ad-Watch.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
C:\Program Files\Common Files\AOL\1149263314\ee\AOLSoftware.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstallShieldSetup]
C:\PROGRA~1\INSTAL~1\{70093~1\setup.exe -rebootC:\PROGRA~1\INSTAL~1\{70093~1\reboot.ini -l0x9
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
"C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerDirector]
C:\Documents and Settings\All Users\Application Data\AOL Downloads\ssc_suite_installer_1.10.7.1\setup.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SWHelper]
"C:\WINDOWS\System32\Macromed\Shockwave 10\PostUpdate.exe" 1014020
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Userinit]
C:\WINDOWS\system32\userinit.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AOL ACS"=2 (0x2)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
R0 ALiAGP;ALi AGP Bus Filter Driver;C:\WINDOWS\system32\DRIVERS\ALiAGP.sys
R0 SBHR;SBHR;C:\WINDOWS\system32\drivers\sbhr.sys
R2 LiveUpdate Notice;LiveUpdate Notice;"C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon
R3 CALIAUD;HP ALI 3D Environmental Audio;C:\WINDOWS\system32\drivers\caliaud.sys
R3 CALIHALA;CALIHALA;C:\WINDOWS\system32\drivers\calihal.sys
R3 DP83815;National Semiconductor Corp. DP83815 NDIS 5.0 Miniport Driver;C:\WINDOWS\system32\DRIVERS\DP83815.SYS
R3 NPDriver;Norton UnErase Protection Driver;\??\C:\WINDOWS\system32\Drivers\NPDRIVER.SYS
R3 SBAPIFS;SBAPIFS;\??\C:\WINDOWS\system32\drivers\sbapifs.sys
R3 sbusb;Sound Blaster USB Audio Driver;C:\WINDOWS\system32\DRIVERS\sbusb.sys
R3 SymIMMP;SymIMMP;C:\WINDOWS\system32\DRIVERS\SymIM.sys
S3 ALiIRDA;ALi Infrared Device Driver;C:\WINDOWS\system32\DRIVERS\aliirda.sys
S3 COH_Mon;COH_Mon;\??\C:\WINDOWS\system32\Drivers\COH_Mon.sys
S3 LEX_NIC_SERVICE;IEEE 802.11 Wireless NIC Win2000 Driver;C:\WINDOWS\system32\DRIVERS\Express.sys
S3 SDdriver;SDdriver;\??\C:\WINDOWS\system32\Drivers\sddriver.sys
S3 SymIM;Symantec Network Security Intermediate Filter Service;C:\WINDOWS\system32\DRIVERS\SymIM.sys
S3 USB_RNDIS_XP;Westell WireSpeed Dual Connect Modem;C:\WINDOWS\system32\DRIVERS\usb8023.sys
S3 WUSB54GPV4SRV;Linksys Home Wireless-G USB Adaptor Driver;C:\WINDOWS\system32\DRIVERS\rt2500usb.sys
*Newly Created Service* - SBAPIFS
*Newly Created Service* - SBCSSVC
*Newly Created Service* - SBHR
.
Contents of the 'Scheduled Tasks' folder
"2006-04-12 04:20:22 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1136664729.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe
"2007-11-06 02:18:09 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Owner.job"
- C:\Program Files\Norton AntiVirus\Navw32.exe
"2007-11-05 18:19:37 C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job"
"2007-11-07 18:16:35 C:\WINDOWS\Tasks\Uniblue SpyEraser.job"
- C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
.
**************************************************************************
catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-11-08 17:40:09
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
**************************************************************************
.
Completion time: 2007-11-08 17:43:27
C:\ComboFix2.txt … 2007-11-02 17:10
.
— E O F —
and now the HjT
Logfile of HijackThis v1.99.1
Scan saved at 5:45:48 PM, on 11/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\system32\HPConfig.exe
C:\WINDOWS\system32\LxrJD31s.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\RadioSvr.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\Program Files\Creative\SBLive 24-Bit External\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBLive 24-Bit External\Entertainment Center\EAXLoadr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Common Files\AOL\1149263314\ee\AOLSoftware.exe
C:\Program Files\Lavasoft\Ad-Aware SE Plus\bak\Ad-Watch.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe
C:\Program Files\Norton SystemWorks\Process Viewer\PrcView.exe
C:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe
C:\Program Files\AOL 9.0a\waol.exe
C:\Program Files\AOL 9.0a\shellmon.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.wyff4.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: &hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [RCSystem] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBLive 24-Bit External\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NSWosCheck] "C:\Program Files\Norton SystemWorks\osCheck.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [SbUsb AudCtrl] RunDll32 sbusbdll.dll,RCMonitor
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1149263314\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [SBCSTray] C:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.0a\AOL.EXE" -b
O4 - HKCU\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Plus\bak\Ad-Watch.exe"
O4 - Global Startup: hp psc 1000 series.lnk = ?
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) -
https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} -
https://www-secure.symantec.com/techsupp/as…rl/LSSupCtl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) -
http://lads.myspace.com/upload/MySpaceUploader.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} -
http://cdn.scan.onecare.live.com/resource/…lscbase2474.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://www.update.microsoft.com/windowsupd…b?1192566547588
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsoftupdat…b?1168022299959
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O16 - DPF: {87056D28-9730-4A47-B9F9-7E890B62C58A} (WildfireActiveXHost Class) -
http://aolsvc.aol.com/onlinegames/ghtumblebugs/axhost.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - https://www-secure.symantec.com/techsupp/as…rl/SymAData.cab
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) -
http://aolsvc.aol.com/onlinegames/pandacraze/gpcontrol.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) -
http://driveragent.com/files/driveragent.cab
O16 - DPF: {EF148DBB-5B6D-4130-B2A1-661571E86260} (Playtime Games Launcher) -
http://aolsvc.aol.com/onlinegames/oberonma…ameLauncher.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) -
http://www.creative.com/su2/CTL_V02002/ocx/15030/CTPID.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HP RF Device Service (HpRfDev) - Hewlett-Packard - C:\WINDOWS\system32\HpRfDev.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Lexar JD31 (LxrJD31s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrJD31s.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: RadioSvr - Hewlett-Packard - C:\WINDOWS\system32\RadioSvr.exe
O23 - Service: Sunbelt CounterSpy Antispyware (SBCSSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
