[Resolved] The most stubborn virus EVER!

Hi there, I desperately need help!!!!

Let me start off with thanking you guys for this forum. My laptop is infected with a spyware type virus and I get the constant system balloon security alert pop-ups, IE browsers open up on weird pages (like www.brandarama.com , www.smileycentral.com ), I also get two shortcuts on my desktop: “Live Safety Center” and “Online Security Guide” with suspect urls.

I have been struggling for 4 days to get rid of this virus with no joy!!

The names of viruses mentioned by the fake system alerts are:

W32.myzor.fk@yf
Spyware-cyberlog-x
Networm i.virus@fp
Trojan-spy.win32.mx
Trojan-downloader.win32.agent.erf
PSW.X-vir Trojan


I’ve done everything I’ve read on forums and websites and NOTHING has worked:

I’ve turned off system restore, rebooted in Safe mode. Run fully updated antivirus (Kaspersky 7.0) and anti spywares: AVG antispyware 7.5 plus SUPERantispyware. I’ve also run ASmitfraudFix after these and rebooted………..

The popup system warning always returns after I reboot – especially when opening a browser.

Every now and again Kapersky detects another virus trying to access called: Trojan.win32.obfuscated.kp and then the trouble usually starts all over again.

I’ve also tried both VundoFix and VirtumundoBeGone which seemed to work for about 10 minutes until the above Kapersky warning comes up and the popup warnings and Browser popups start again.

Additionally, no matter what I do – there are always a few suspect IE add-ons that are enabled after I’ve rebooted, like: urqno.dll, sttxjykt.dll and owvojwwn.dll and the two shortcuts appear on my desktop again: “Live Safety Center” and “Online Security Guide”

If anyone can advise on how to get rid of this thing for good – I will be forever grateful!!

Thanks

Anton

See below my latest HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 22:12:40, on 14/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.EXE
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\DeviceListener.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\ConAppM.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Anton\Desktop\spybotsd15.exe
C:\DOCUME~1\Anton\LOCALS~1\Temp\is-J33JC.tmp\is-UD2DC.tmp
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.za/
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Save Flash - {4064EA35-578D-4073-A834-C96D82CBCF40} - C:\Program Files\Save Flash\SaveFlash.dll
O4 - HKLM\..\Run: [TotalRecorderScheduler] "C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx2\PXConsole.exe"
O4 - HKLM\..\Run: [70625938] rundll32.exe "C:\WINDOWS\system32\ypuhdshr.dll",b
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MobileConnect.EXE] C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.EXE
O4 - HKCU\..\Run: [WinAble] C:\Program Files\WinAble\winable.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Flash Decompiler SWF Capture tool - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\PROGRA~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU)
O9 - Extra 'Tools' menuitem: Flash Decompiler SWF Capture tool menu - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\PROGRA~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O17 - HKLM\System\CCS\Services\Tcpip\..\{6D78A853-2EA2-45A1-B621-C98FF625398F}: NameServer = 196.207.35.29 196.207.35.30
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" -r (file missing)
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\chkfxbli.exe (file missing)
O23 - Service: PREVXAgent - Unknown owner - C:\Program Files\Prevx2\PXAgent.exe" -f (file missing)

Hi there! Thanks a lot!

OK see below the logs - After I ran SDFIX and connected to the internet to post this message, I got another browser window popup trying to sell porn again - I checked the IE add-onns and the following .dll are there: urqno.dll and rqldxyih.dll - they always come in after reboot although I've disbled them?

Here goes: (Thanks again)



SDFix: Version 1.115

Run by [removed] on 20/11/2007 at 07:47

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting…


Normal Mode:
Checking Files:

Trojan Files Found:

C:\Temp\1cb\syscheck.log - Deleted
C:\WINDOWS\system32\pac.txt - Deleted
C:\WINDOWS\system32\TFTP1760 - Deleted



Folder C:\Program Files\Temporary - Removed
Folder C:\Program Files\WinAble - Removed
Folder C:\Temp\1cb - Removed
Folder C:\WINDOWS\system32\m2 - Removed
Folder C:\WINDOWS\system32\o1 - Removed
Folder C:\WINDOWS\system32\v4 - Removed

Removing Temp Files…

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-20 07:59:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden services & system hive …

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\1641d1a845]
"001b9841a51b"=hex:8c,f2,83,00,39,71,92,3a,99,d6,30,28,1b,5a,91,b6
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\1641d1a845]
"001b9841a51b"=hex:8c,f2,83,00,39,71,92,3a,99,d6,30,28,1b,5a,91,b6

scanning hidden registry entries …

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{499999E0-1726-3FDD-D54E-884DCD42CB67}]
"iamnmgpjejfgpbiakb"=hex:6b,61,6a,6b,67,65,63,64,61,65,6b,6d,65,63,65,67,66,6c,61,67,70,..
"hagocmpjdmlolpoc"=hex:6b,61,6a,6b,67,65,63,64,61,65,6b,6d,65,63,65,67,66,6c,61,67,70,..

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:
——————



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\uTorrent\\utorrent.exe"="C:\\Program Files\\uTorrent\\utorrent.exe:*:Enabled:æTorrent"
"C:\\Program Files\\eMule\\LinkCreator.exe"="C:\\Program Files\\eMule\\LinkCreator.exe:*:Disabled:LinkCreator"
"C:\\Program Files\\Macromedia\\FreeHand 10\\FreeHand 10.exe"="C:\\Program Files\\Macromedia\\FreeHand 10\\FreeHand 10.exe:*:Enabled:FreeHand 10"
"C:\\Program Files\\Macromedia\\Dreamweaver MX\\Dreamweaver.exe"="C:\\Program Files\\Macromedia\\Dreamweaver MX\\Dreamweaver.exe:*:Enabled:Dreamweaver MX"
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"="C:\\Program Files\\Google\\Google Talk\\googletalk.exe:*:Enabled:Google Talk"
"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"="C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe:*:Enabled:Kaspersky Anti-Virus"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\FlashGet\\flashget.exe"="C:\\Program Files\\FlashGet\\flashget.exe:*:Enabled:Flashget"
"C:\\Program Files\\CoreFTP\\coreftp.exe"="C:\\Program Files\\CoreFTP\\coreftp.exe:*:Enabled:Core FTP App"
"C:\\Program Files\\FreeFTP\\FreeFTP.exe"="C:\\Program Files\\FreeFTP\\FreeFTP.exe:*:Enabled:FreeFTP (Internet File Transfer Program)"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
"C:\\WINDOWS\\system32\\chkfxbli.exe"="C:\\WINDOWS\\system32\\chk"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files:
—————

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Mon 19 Nov 2007 343,040 …H. — "C:\Anton\Canvas\~WRL0338.tmp"
Mon 19 Nov 2007 342,016 …H. — "C:\Anton\Canvas\~WRL0762.tmp"
Mon 19 Nov 2007 342,528 …H. — "C:\Anton\Canvas\~WRL1249.tmp"
Mon 19 Nov 2007 891,904 …H. — "C:\Anton\Canvas\~WRL1605.tmp"
Mon 19 Nov 2007 342,528 …H. — "C:\Anton\Canvas\~WRL1723.tmp"
Thu 15 Nov 2007 340,992 …H. — "C:\Anton\Canvas\~WRL1802.tmp"
Wed 7 Nov 2007 891,904 …H. — "C:\Anton\Canvas\~WRL2328.tmp"
Mon 19 Nov 2007 343,040 …H. — "C:\Anton\Canvas\~WRL2593.tmp"
Mon 19 Nov 2007 342,528 …H. — "C:\Anton\Canvas\~WRL3490.tmp"
Mon 19 Nov 2007 893,440 …H. — "C:\Anton\Canvas\~WRL4067.tmp"
Mon 5 Feb 2007 59,904 …H. — "C:\Anton\STUFF\~WRL0004.tmp"
Wed 21 Feb 2007 298,496 …H. — "C:\Anton\STUFF\~WRL0010.tmp"
Wed 6 Jun 2007 56,832 …H. — "C:\Anton\STUFF\~WRL0023.tmp"
Wed 21 Feb 2007 306,176 …H. — "C:\Anton\STUFF\~WRL0031.tmp"
Wed 21 Feb 2007 306,176 …H. — "C:\Anton\STUFF\~WRL0037.tmp"
Wed 21 Feb 2007 305,152 …H. — "C:\Anton\STUFF\~WRL0051.tmp"
Wed 21 Feb 2007 305,152 …H. — "C:\Anton\STUFF\~WRL0080.tmp"
Tue 21 Aug 2007 30,720 …H. — "C:\Anton\STUFF\~WRL0084.tmp"
Wed 14 Mar 2007 24,064 …H. — "C:\Anton\STUFF\~WRL0095.tmp"
Mon 29 Jan 2007 1,462,272 …H. — "C:\Anton\STUFF\~WRL0097.tmp"
Wed 21 Feb 2007 303,104 …H. — "C:\Anton\STUFF\~WRL0102.tmp"
Mon 29 Jan 2007 20,992 …H. — "C:\Anton\STUFF\~WRL0120.tmp"
Wed 7 Feb 2007 66,048 …H. — "C:\Anton\STUFF\~WRL0148.tmp"
Wed 21 Feb 2007 307,712 …H. — "C:\Anton\STUFF\~WRL0149.tmp"
Mon 29 Jan 2007 36,864 …H. — "C:\Anton\STUFF\~WRL0175.tmp"
Wed 14 Feb 2007 95,744 …H. — "C:\Anton\STUFF\~WRL0187.tmp"
Wed 21 Feb 2007 307,712 …H. — "C:\Anton\STUFF\~WRL0188.tmp"
Tue 13 Mar 2007 353,280 …H. — "C:\Anton\STUFF\~WRL0214.tmp"
Mon 29 Jan 2007 33,792 …H. — "C:\Anton\STUFF\~WRL0224.tmp"
Wed 21 Feb 2007 310,784 …H. — "C:\Anton\STUFF\~WRL0225.tmp"
Mon 29 Jan 2007 1,463,808 …H. — "C:\Anton\STUFF\~WRL0233.tmp"
Wed 7 Feb 2007 62,464 …H. — "C:\Anton\STUFF\~WRL0236.tmp"
Wed 21 Feb 2007 304,128 …H. — "C:\Anton\STUFF\~WRL0243.tmp"
Mon 29 Jan 2007 22,016 …H. — "C:\Anton\STUFF\~WRL0249.tmp"
Mon 29 Jan 2007 32,768 …H. — "C:\Anton\STUFF\~WRL0269.tmp"
Wed 21 Feb 2007 310,784 …H. — "C:\Anton\STUFF\~WRL0280.tmp"
Thu 15 Mar 2007 362,496 …H. — "C:\Anton\STUFF\~WRL0281.tmp"
Mon 29 Jan 2007 1,462,784 …H. — "C:\Anton\STUFF\~WRL0310.tmp"
Wed 6 Jun 2007 56,320 …H. — "C:\Anton\STUFF\~WRL0334.tmp"
Thu 26 Jul 2007 71,168 …H. — "C:\Anton\STUFF\~WRL0353.tmp"
Wed 14 Mar 2007 355,840 …H. — "C:\Anton\STUFF\~WRL0365.tmp"
Mon 29 Jan 2007 1,260,544 …H. — "C:\Anton\STUFF\~WRL0368.tmp"
Wed 14 Mar 2007 28,160 …H. — "C:\Anton\STUFF\~WRL0401.tmp"
Wed 14 Mar 2007 358,912 …H. — "C:\Anton\STUFF\~WRL0428.tmp"
Mon 29 Jan 2007 1,462,272 …H. — "C:\Anton\STUFF\~WRL0447.tmp"
Tue 25 Sep 2007 32,768 …H. — "C:\Anton\STUFF\~WRL0498.tmp"
Mon 29 Jan 2007 1,262,592 …H. — "C:\Anton\STUFF\~WRL0504.tmp"
Tue 13 Feb 2007 251,392 …H. — "C:\Anton\STUFF\~WRL0572.tmp"
Wed 14 Feb 2007 253,952 …H. — "C:\Anton\STUFF\~WRL0610.tmp"
Wed 21 Feb 2007 309,248 …H. — "C:\Anton\STUFF\~WRL0611.tmp"
Wed 14 Feb 2007 251,392 …H. — "C:\Anton\STUFF\~WRL0626.tmp"
Mon 19 Mar 2007 362,496 …H. — "C:\Anton\STUFF\~WRL0670.tmp"
Tue 6 Mar 2007 330,752 …H. — "C:\Anton\STUFF\~WRL0671.tmp"
Wed 14 Mar 2007 27,136 …H. — "C:\Anton\STUFF\~WRL0680.tmp"
Wed 7 Feb 2007 63,488 …H. — "C:\Anton\STUFF\~WRL0681.tmp"
Wed 14 Feb 2007 255,488 …H. — "C:\Anton\STUFF\~WRL0708.tmp"
Wed 6 Jun 2007 57,856 …H. — "C:\Anton\STUFF\~WRL0712.tmp"
Mon 29 Jan 2007 20,480 …H. — "C:\Anton\STUFF\~WRL0715.tmp"
Mon 29 Jan 2007 35,328 …H. — "C:\Anton\STUFF\~WRL0717.tmp"
Wed 14 Feb 2007 254,976 …H. — "C:\Anton\STUFF\~WRL0718.tmp"
Wed 21 Feb 2007 298,496 …H. — "C:\Anton\STUFF\~WRL0723.tmp"
Wed 14 Feb 2007 255,488 …H. — "C:\Anton\STUFF\~WRL0748.tmp"
Wed 21 Feb 2007 306,176 …H. — "C:\Anton\STUFF\~WRL0766.tmp"
Thu 26 Jul 2007 72,704 …H. — "C:\Anton\STUFF\~WRL0771.tmp"
Wed 21 Feb 2007 300,032 …H. — "C:\Anton\STUFF\~WRL0795.tmp"
Wed 21 Feb 2007 306,176 …H. — "C:\Anton\STUFF\~WRL0805.tmp"
Wed 14 Mar 2007 356,352 …H. — "C:\Anton\STUFF\~WRL0813.tmp"
Wed 14 Feb 2007 251,904 …H. — "C:\Anton\STUFF\~WRL0821.tmp"
Mon 29 Jan 2007 35,328 …H. — "C:\Anton\STUFF\~WRL0824.tmp"
Wed 14 Mar 2007 29,184 …H. — "C:\Anton\STUFF\~WRL0835.tmp"
Wed 21 Feb 2007 296,960 …H. — "C:\Anton\STUFF\~WRL0851.tmp"
Mon 2 Jul 2007 24,064 …H. — "C:\Anton\STUFF\~WRL0873.tmp"
Mon 29 Jan 2007 33,792 …H. — "C:\Anton\STUFF\~WRL0892.tmp"
Mon 2 Jul 2007 28,672 …H. — "C:\Anton\STUFF\~WRL0897.tmp"
Tue 27 Feb 2007 329,728 …H. — "C:\Anton\STUFF\~WRL0899.tmp"
Wed 6 Jun 2007 57,344 …H. — "C:\Anton\STUFF\~WRL0935.tmp"
Thu 7 Jun 2007 24,576 …H. — "C:\Anton\STUFF\~WRL0939.tmp"
Mon 29 Jan 2007 1,260,544 …H. — "C:\Anton\STUFF\~WRL0959.tmp"
Thu 6 Sep 2007 82,944 …H. — "C:\Anton\STUFF\~WRL1008.tmp"
Fri 17 Aug 2007 3,661,312 …H. — "C:\Anton\STUFF\~WRL1024.tmp"
Wed 21 Feb 2007 296,960 …H. — "C:\Anton\STUFF\~WRL1026.tmp"
Wed 21 Feb 2007 311,808 …H. — "C:\Anton\STUFF\~WRL1033.tmp"
Wed 14 Feb 2007 253,952 …H. — "C:\Anton\STUFF\~WRL1036.tmp"
Thu 26 Jul 2007 73,216 …H. — "C:\Anton\STUFF\~WRL1040.tmp"
Wed 14 Mar 2007 29,184 …H. — "C:\Anton\STUFF\~WRL1046.tmp"
Mon 19 Mar 2007 363,008 …H. — "C:\Anton\STUFF\~WRL1053.tmp"
Mon 23 Apr 2007 147,456 …H. — "C:\Anton\STUFF\~WRL1070.tmp"
Thu 6 Sep 2007 447,488 …H. — "C:\Anton\STUFF\~WRL1071.tmp"
Wed 6 Jun 2007 57,856 …H. — "C:\Anton\STUFF\~WRL1079.tmp"
Thu 16 Aug 2007 1,360,896 …H. — "C:\Anton\STUFF\~WRL1086.tmp"
Wed 21 Feb 2007 303,104 …H. — "C:\Anton\STUFF\~WRL1087.tmp"
Wed 14 Feb 2007 256,512 …H. — "C:\Anton\STUFF\~WRL1100.tmp"
Wed 21 Feb 2007 305,152 …H. — "C:\Anton\STUFF\~WRL1104.tmp"
Mon 29 Jan 2007 35,328 …H. — "C:\Anton\STUFF\~WRL1163.tmp"
Wed 21 Feb 2007 305,152 …H. — "C:\Anton\STUFF\~WRL1164.tmp"
Mon 29 Jan 2007 1,262,080 …H. — "C:\Anton\STUFF\~WRL1175.tmp"
Wed 14 Feb 2007 91,136 …H. — "C:\Anton\STUFF\~WRL1179.tmp"
Wed 14 Mar 2007 29,696 …H. — "C:\Anton\STUFF\~WRL1198.tmp"
Mon 29 Jan 2007 46,080 …H. — "C:\Anton\STUFF\~WRL1206.tmp"
Wed 24 Jan 2007 25,088 …H. — "C:\Anton\STUFF\~WRL1207.tmp"
Thu 25 Jan 2007 52,224 …H. — "C:\Anton\STUFF\~WRL1213.tmp"
Wed 14 Mar 2007 30,208 …H. — "C:\Anton\STUFF\~WRL1225.tmp"
Wed 14 Feb 2007 89,600 …H. — "C:\Anton\STUFF\~WRL1229.tmp"
Wed 6 Jun 2007 57,344 …H. — "C:\Anton\STUFF\~WRL1237.tmp"
Wed 21 Feb 2007 309,248 …H. — "C:\Anton\STUFF\~WRL1252.tmp"
Mon 2 Jul 2007 24,064 …H. — "C:\Anton\STUFF\~WRL1255.tmp"
Mon 12 Feb 2007 85,504 …H. — "C:\Anton\STUFF\~WRL1263.tmp"
Tue 20 Feb 2007 295,424 …H. — "C:\Anton\STUFF\~WRL1264.tmp"
Wed 6 Jun 2007 57,856 …H. — "C:\Anton\STUFF\~WRL1274.tmp"
Wed 21 Feb 2007 306,176 …H. — "C:\Anton\STUFF\~WRL1295.tmp"
Wed 14 Mar 2007 30,208 …H. — "C:\Anton\STUFF\~WRL1296.tmp"
Wed 21 Feb 2007 305,664 …H. — "C:\Anton\STUFF\~WRL1317.tmp"
Wed 14 Feb 2007 95,744 …H. — "C:\Anton\STUFF\~WRL1327.tmp"
Thu 22 Mar 2007 373,760 …H. — "C:\Anton\STUFF\~WRL1339.tmp"
Wed 14 Feb 2007 251,392 …H. — "C:\Anton\STUFF\~WRL1340.tmp"
Wed 14 Feb 2007 251,392 …H. — "C:\Anton\STUFF\~WRL1365.tmp"
Wed 7 Feb 2007 64,512 …H. — "C:\Anton\STUFF\~WRL1381.tmp"
Wed 14 Feb 2007 252,928 …H. — "C:\Anton\STUFF\~WRL1384.tmp"
Wed 14 Mar 2007 26,112 …H. — "C:\Anton\STUFF\~WRL1389.tmp"
Wed 14 Mar 2007 29,184 …H. — "C:\Anton\STUFF\~WRL1419.tmp"
Tue 7 Aug 2007 68,096 …H. — "C:\Anton\STUFF\~WRL1427.tmp"
Wed 14 Mar 2007 357,888 …H. — "C:\Anton\STUFF\~WRL1429.tmp"
Tue 4 Sep 2007 41,984 …H. — "C:\Anton\STUFF\~WRL1445.tmp"
Wed 14 Mar 2007 359,424 …H. — "C:\Anton\STUFF\~WRL1462.tmp"
Mon 29 Jan 2007 37,376 …H. — "C:\Anton\STUFF\~WRL1489.tmp"
Wed 14 Mar 2007 357,376 …H. — "C:\Anton\STUFF\~WRL1494.tmp"
Tue 6 Mar 2007 331,264 …H. — "C:\Anton\STUFF\~WRL1502.tmp"
Thu 26 Jul 2007 72,192 …H. — "C:\Anton\STUFF\~WRL1506.tmp"
Thu 26 Jul 2007 69,120 …H. — "C:\Anton\STUFF\~WRL1519.tmp"
Wed 14 Mar 2007 29,696 …H. — "C:\Anton\STUFF\~WRL1521.tmp"
Wed 21 Feb 2007 303,616 …H. — "C:\Anton\STUFF\~WRL1538.tmp"
Wed 7 Feb 2007 67,072 …H. — "C:\Anton\STUFF\~WRL1539.tmp"
Wed 21 Feb 2007 315,904 …H. — "C:\Anton\STUFF\~WRL1566.tmp"
Wed 6 Jun 2007 57,856 …H. — "C:\Anton\STUFF\~WRL1578.tmp"
Wed 14 Mar 2007 30,208 …H. — "C:\Anton\STUFF\~WRL1606.tmp"
Wed 21 Feb 2007 315,904 …H. — "C:\Anton\STUFF\~WRL1608.tmp"
Wed 14 Feb 2007 252,416 …H. — "C:\Anton\STUFF\~WRL1614.tmp"
Wed 14 Mar 2007 25,600 …H. — "C:\Anton\STUFF\~WRL1680.tmp"
Fri 23 Mar 2007 376,320 …H. — "C:\Anton\STUFF\~WRL1687.tmp"
Wed 14 Mar 2007 359,424 …H. — "C:\Anton\STUFF\~WRL1688.tmp"
Thu 6 Sep 2007 447,488 …H. — "C:\Anton\STUFF\~WRL1715.tmp"
Wed 21 Feb 2007 296,960 …H. — "C:\Anton\STUFF\~WRL1774.tmp"
Wed 14 Feb 2007 253,952 …H. — "C:\Anton\STUFF\~WRL1795.tmp"
Wed 6 Jun 2007 57,344 …H. — "C:\Anton\STUFF\~WRL1814.tmp"
Thu 6 Sep 2007 446,464 …H. — "C:\Anton\STUFF\~WRL1834.tmp"
Mon 2 Jul 2007 24,576 …H. — "C:\Anton\STUFF\~WRL1842.tmp"
Wed 14 Feb 2007 253,952 …H. — "C:\Anton\STUFF\~WRL1846.tmp"
Wed 14 Mar 2007 28,160 …H. — "C:\Anton\STUFF\~WRL1851.tmp"
Mon 29 Jan 2007 1,464,832 …H. — "C:\Anton\STUFF\~WRL1878.tmp"
Mon 26 Mar 2007 29,184 …H. — "C:\Anton\STUFF\~WRL1883.tmp"
Wed 21 Feb 2007 306,688 …H. — "C:\Anton\STUFF\~WRL1896.tmp"
Mon 29 Jan 2007 1,463,808 …H. — "C:\Anton\STUFF\~WRL1897.tmp"
Wed 6 Jun 2007 56,832 …H. — "C:\Anton\STUFF\~WRL1940.tmp"
Wed 7 Feb 2007 67,072 …H. — "C:\Anton\STUFF\~WRL1953.tmp"
Tue 4 Sep 2007 35,328 …H. — "C:\Anton\STUFF\~WRL1969.tmp"
Wed 7 Feb 2007 64,512 …H. — "C:\Anton\STUFF\~WRL1974.tmp"
Mon 29 Jan 2007 1,460,736 …H. — "C:\Anton\STUFF\~WRL1982.tmp"
Thu 26 Jul 2007 70,144 …H. — "C:\Anton\STUFF\~WRL1987.tmp"
Mon 19 Mar 2007 363,520 …H. — "C:\Anton\STUFF\~WRL2013.tmp"
Wed 6 Jun 2007 57,856 …H. — "C:\Anton\STUFF\~WRL2014.tmp"
Wed 14 Feb 2007 254,464 …H. — "C:\Anton\STUFF\~WRL2025.tmp"
Mon 26 Mar 2007 29,184 …H. — "C:\Anton\STUFF\~WRL2045.tmp"
Mon 29 Jan 2007 1,463,808 …H. — "C:\Anton\STUFF\~WRL2091.tmp"
Wed 14 Feb 2007 251,392 …H. — "C:\Anton\STUFF\~WRL2102.tmp"
Mon 19 Mar 2007 364,032 …H. — "C:\Anton\STUFF\~WRL2128.tmp"
Wed 14 Feb 2007 253,952 …H. — "C:\Anton\STUFF\~WRL2133.tmp"
Wed 14 Feb 2007 254,976 …H. — "C:\Anton\STUFF\~WRL2135.tmp"
Wed 14 Feb 2007 251,392 …H. — "C:\Anton\STUFF\~WRL2140.tmp"
Wed 14 Mar 2007 359,936 …H. — "C:\Anton\STUFF\~WRL2187.tmp"
Wed 21 Feb 2007 307,712 …H. — "C:\Anton\STUFF\~WRL2203.tmp"
Mon 29 Jan 2007 1,463,808 …H. — "C:\Anton\STUFF\~WRL2241.tmp"
Mon 29 Jan 2007 32,256 …H. — "C:\Anton\STUFF\~WRL2246.tmp"
Tue 23 Jan 2007 19,968 …H. — "C:\Anton\STUFF\~WRL2291.tmp"
Wed 6 Jun 2007 56,832 …H. — "C:\Anton\STUFF\~WRL2322.tmp"
Tue 4 Sep 2007 37,888 …H. — "C:\Anton\STUFF\~WRL2340.tmp"
Wed 14 Feb 2007 252,928 …H. — "C:\Anton\STUFF\~WRL2364.tmp"
Wed 6 Jun 2007 57,856 …H. — "C:\Anton\STUFF\~WRL2390.tmp"
Mon 29 Jan 2007 1,463,808 …H. — "C:\Anton\STUFF\~WRL2408.tmp"
Wed 14 Mar 2007 355,328 …H. — "C:\Anton\STUFF\~WRL2428.tmp"
Fri 17 Aug 2007 3,291,136 …H. — "C:\Anton\STUFF\~WRL2445.tmp"
Wed 14 Feb 2007 254,976 …H. — "C:\Anton\STUFF\~WRL2454.tmp"
Wed 14 Feb 2007 89,088 …H. — "C:\Anton\STUFF\~WRL2472.tmp"
Wed 21 Feb 2007 310,784 …H. — "C:\Anton\STUFF\~WRL2486.tmp"
Wed 14 Feb 2007 254,976 …H. — "C:\Anton\STUFF\~WRL2497.tmp"
Mon 29 Jan 2007 1,260,544 …H. — "C:\Anton\STUFF\~WRL2499.tmp"
Tue 4 Sep 2007 41,984 …H. — "C:\Anton\STUFF\~WRL2527.tmp"
Wed 14 Mar 2007 24,064 …H. — "C:\Anton\STUFF\~WRL2540.tmp"
Wed 21 Feb 2007 305,152 …H. — "C:\Anton\STUFF\~WRL2541.tmp"
Fri 17 Aug 2007 1,749,504 …H. — "C:\Anton\STUFF\~WRL2542.tmp"
Wed 25 Jul 2007 68,608 …H. — "C:\Anton\STUFF\~WRL2562.tmp"
Wed 14 Feb 2007 254,976 …H. — "C:\Anton\STUFF\~WRL2566.tmp"
Mon 29 Jan 2007 19,968 …H. — "C:\Anton\STUFF\~WRL2589.tmp"
Thu 26 Jul 2007 70,656 …H. — "C:\Anton\STUFF\~WRL2592.tmp"
Mon 29 Jan 2007 101,888 …H. — "C:\Anton\STUFF\~WRL2626.tmp"
Mon 29 Jan 2007 1,262,080 …H. — "C:\Anton\STUFF\~WRL2642.tmp"
Wed 21 Feb 2007 295,936 …H. — "C:\Anton\STUFF\~WRL2643.tmp"
Mon 29 Jan 2007 1,463,808 …H. — "C:\Anton\STUFF\~WRL2664.tmp"
Tue 4 Sep 2007 38,912 …H. — "C:\Anton\STUFF\~WRL2667.tmp"
Tue 6 Mar 2007 330,752 …H. — "C:\Anton\STUFF\~WRL2681.tmp"
Wed 14 Mar 2007 25,600 …H. — "C:\Anton\STUFF\~WRL2684.tmp"
Wed 7 Feb 2007 67,072 …H. — "C:\Anton\STUFF\~WRL2690.tmp"
Wed 6 Jun 2007 55,296 …H. — "C:\Anton\STUFF\~WRL2707.tmp"
Mon 29 Jan 2007 38,400 …H. — "C:\Anton\STUFF\~WRL2722.tmp"
Mon 29 Jan 2007 34,304 …H. — "C:\Anton\STUFF\~WRL2739.tmp"
Wed 14 Mar 2007 25,088 …H. — "C:\Anton\STUFF\~WRL2809.tmp"
Wed 21 Feb 2007 296,960 …H. — "C:\Anton\STUFF\~WRL2820.tmp"
Mon 19 Mar 2007 362,496 …H. — "C:\Anton\STUFF\~WRL2823.tmp"
Mon 29 Jan 2007 20,992 …H. — "C:\Anton\STUFF\~WRL2841.tmp"
Wed 14 Feb 2007 95,744 …H. — "C:\Anton\STUFF\~WRL2843.tmp"
Wed 21 Feb 2007 303,104 …H. — "C:\Anton\STUFF\~WRL2846.tmp"
Thu 6 Sep 2007 450,048 …H. — "C:\Anton\STUFF\~WRL2851.tmp"
Mon 29 Jan 2007 30,720 …H. — "C:\Anton\STUFF\~WRL2878.tmp"
Mon 29 Jan 2007 39,424 …H. — "C:\Anton\STUFF\~WRL2886.tmp"
Mon 2 Jul 2007 27,648 …H. — "C:\Anton\STUFF\~WRL2891.tmp"
Wed 14 Feb 2007 254,976 …H. — "C:\Anton\STUFF\~WRL2922.tmp"
Wed 14 Feb 2007 254,976 …H. — "C:\Anton\STUFF\~WRL2936.tmp"
Wed 14 Mar 2007 355,840 …H. — "C:\Anton\STUFF\~WRL3006.tmp"
Wed 21 Feb 2007 298,496 …H. — "C:\Anton\STUFF\~WRL3063.tmp"
Mon 29 Jan 2007 35,328 …H. — "C:\Anton\STUFF\~WRL3084.tmp"
Mon 29 Jan 2007 1,259,008 …H. — "C:\Anton\STUFF\~WRL3101.tmp"
Mon 29 Jan 2007 1,255,424 …H. — "C:\Anton\STUFF\~WRL3120.tmp"
Wed 6 Jun 2007 56,832 …H. — "C:\Anton\STUFF\~WRL3135.tmp"
Mon 29 Jan 2007 46,080 …H. — "C:\Anton\STUFF\~WRL3161.tmp"
Wed 14 Feb 2007 252,416 …H. — "C:\Anton\STUFF\~WRL3162.tmp"
Wed 14 Mar 2007 361,472 …H. — "C:\Anton\STUFF\~WRL3163.tmp"
Wed 21 Feb 2007 309,248 …H. — "C:\Anton\STUFF\~WRL3170.tmp"
Wed 21 Feb 2007 299,008 …H. — "C:\Anton\STUFF\~WRL3180.tmp"
Wed 5 Sep 2007 88,576 …H. — "C:\Anton\STUFF\~WRL3201.tmp"
Wed 14 Mar 2007 361,472 …H. — "C:\Anton\STUFF\~WRL3203.tmp"
Wed 14 Feb 2007 95,744 …H. — "C:\Anton\STUFF\~WRL3233.tmp"
Wed 21 Feb 2007 305,664 …H. — "C:\Anton\STUFF\~WRL3238.tmp"
Mon 29 Jan 2007 1,462,784 …H. — "C:\Anton\STUFF\~WRL3251.tmp"
Thu 26 Jul 2007 73,216 …H. — "C:\Anton\STUFF\~WRL3253.tmp"
Tue 4 Sep 2007 39,424 …H. — "C:\Anton\STUFF\~WRL3261.tmp"
Thu 25 Jan 2007 19,968 …H. — "C:\Anton\STUFF\~WRL3268.tmp"
Wed 21 Feb 2007 303,104 …H. — "C:\Anton\STUFF\~WRL3271.tmp"
Wed 21 Feb 2007 303,104 …H. — "C:\Anton\STUFF\~WRL3277.tmp"
Wed 25 Apr 2007 148,992 …H. — "C:\Anton\STUFF\~WRL3287.tmp"
Wed 7 Feb 2007 67,072 …H. — "C:\Anton\STUFF\~WRL3288.tmp"
Wed 14 Feb 2007 89,600 …H. — "C:\Anton\STUFF\~WRL3310.tmp"
Thu 26 Jul 2007 70,144 …H. — "C:\Anton\STUFF\~WRL3333.tmp"
Tue 13 Feb 2007 89,088 …H. — "C:\Anton\STUFF\~WRL3423.tmp"
Mon 26 Mar 2007 29,184 …H. — "C:\Anton\STUFF\~WRL3424.tmp"
Thu 6 Sep 2007 83,968 …H. — "C:\Anton\STUFF\~WRL3445.tmp"
Wed 21 Feb 2007 306,688 …H. — "C:\Anton\STUFF\~WRL3452.tmp"
Fri 17 Aug 2007 2,373,632 …H. — "C:\Anton\STUFF\~WRL3459.tmp"
Wed 21 Feb 2007 296,960 …H. — "C:\Anton\STUFF\~WRL3460.tmp"
Mon 29 Jan 2007 45,056 …H. — "C:\Anton\STUFF\~WRL3502.tmp"
Mon 29 Jan 2007 1,464,832 …H. — "C:\Anton\STUFF\~WRL3519.tmp"
Mon 29 Jan 2007 39,424 …H. — "C:\Anton\STUFF\~WRL3520.tmp"
Mon 19 Mar 2007 365,568 …H. — "C:\Anton\STUFF\~WRL3521.tmp"
Wed 14 Feb 2007 251,392 …H. — "C:\Anton\STUFF\~WRL3544.tmp"
Mon 29 Jan 2007 1,263,104 …H. — "C:\Anton\STUFF\~WRL3553.tmp"
Thu 26 Jul 2007 70,656 …H. — "C:\Anton\STUFF\~WRL3556.tmp"
Tue 4 Sep 2007 38,400 …H. — "C:\Anton\STUFF\~WRL3581.tmp"
Thu 18 Jan 2007 62,464 …H. — "C:\Anton\STUFF\~WRL3587.tmp"
Wed 14 Feb 2007 251,904 …H. — "C:\Anton\STUFF\~WRL3599.tmp"
Wed 25 Jul 2007 68,608 …H. — "C:\Anton\STUFF\~WRL3604.tmp"
Mon 29 Jan 2007 1,260,544 …H. — "C:\Anton\STUFF\~WRL3608.tmp"
Wed 14 Feb 2007 251,392 …H. — "C:\Anton\STUFF\~WRL3618.tmp"
Wed 6 Jun 2007 58,368 …H. — "C:\Anton\STUFF\~WRL3623.tmp"
Wed 14 Feb 2007 254,976 …H. — "C:\Anton\STUFF\~WRL3624.tmp"
Wed 14 Mar 2007 358,912 …H. — "C:\Anton\STUFF\~WRL3632.tmp"
Wed 14 Feb 2007 256,512 …H. — "C:\Anton\STUFF\~WRL3692.tmp"
Wed 14 Feb 2007 251,392 …H. — "C:\Anton\STUFF\~WRL3698.tmp"
Thu 6 Sep 2007 83,456 …H. — "C:\Anton\STUFF\~WRL3701.tmp"
Mon 2 Jul 2007 28,672 …H. — "C:\Anton\STUFF\~WRL3714.tmp"
Wed 14 Mar 2007 25,600 …H. — "C:\Anton\STUFF\~WRL3725.tmp"
Tue 4 Sep 2007 35,840 …H. — "C:\Anton\STUFF\~WRL3726.tmp"
Mon 29 Jan 2007 1,263,104 …H. — "C:\Anton\STUFF\~WRL3732.tmp"
Wed 21 Feb 2007 307,200 …H. — "C:\Anton\STUFF\~WRL3737.tmp"
Mon 19 Mar 2007 363,520 …H. — "C:\Anton\STUFF\~WRL3764.tmp"
Wed 6 Jun 2007 58,880 …H. — "C:\Anton\STUFF\~WRL3786.tmp"
Wed 14 Mar 2007 361,472 …H. — "C:\Anton\STUFF\~WRL3789.tmp"
Wed 6 Jun 2007 58,368 …H. — "C:\Anton\STUFF\~WRL3805.tmp"
Wed 7 Feb 2007 64,512 …H. — "C:\Anton\STUFF\~WRL3824.tmp"
Wed 21 Feb 2007 305,152 …H. — "C:\Anton\STUFF\~WRL3826.tmp"
Wed 14 Feb 2007 89,600 …H. — "C:\Anton\STUFF\~WRL3851.tmp"
Mon 29 Jan 2007 36,864 …H. — "C:\Anton\STUFF\~WRL3870.tmp"
Wed 21 Feb 2007 306,176 …H. — "C:\Anton\STUFF\~WRL3879.tmp"
Fri 17 Aug 2007 4,176,384 …H. — "C:\Anton\STUFF\~WRL3911.tmp"
Mon 29 Jan 2007 38,400 …H. — "C:\Anton\STUFF\~WRL3918.tmp"
Wed 21 Feb 2007 299,008 …H. — "C:\Anton\STUFF\~WRL3919.tmp"
Wed 21 Feb 2007 298,496 …H. — "C:\Anton\STUFF\~WRL3920.tmp"
Thu 22 Mar 2007 64,512 …H. — "C:\Anton\STUFF\~WRL3924.tmp"
Wed 14 Mar 2007 354,816 …H. — "C:\Anton\STUFF\~WRL3951.tmp"
Wed 14 Mar 2007 357,888 …H. — "C:\Anton\STUFF\~WRL3956.tmp"
Wed 21 Feb 2007 309,248 …H. — "C:\Anton\STUFF\~WRL3982.tmp"
Thu 6 Sep 2007 443,904 …H. — "C:\Anton\STUFF\~WRL4022.tmp"
Thu 26 Jul 2007 73,216 …H. — "C:\Anton\STUFF\~WRL4033.tmp"
Thu 6 Sep 2007 84,480 …H. — "C:\Anton\STUFF\~WRL4034.tmp"
Wed 14 Feb 2007 91,648 …H. — "C:\Anton\STUFF\~WRL4066.tmp"
Wed 21 Feb 2007 305,152 …H. — "C:\Anton\STUFF\~WRL4067.tmp"
Mon 29 Jan 2007 38,400 …H. — "C:\Anton\STUFF\~WRL4071.tmp"
Wed 14 Feb 2007 95,744 …H. — "C:\Anton\STUFF\~WRL4072.tmp"
Thu 1 Feb 2007 111,104 …H. — "C:\Anton\Unison Productions\~WRL0001.tmp"
Thu 1 Feb 2007 52,224 …H. — "C:\Anton\Unison Productions\~WRL0004.tmp"
Wed 14 Feb 2007 262,656 …H. — "C:\Anton\Unison Productions\~WRL0456.tmp"
Wed 14 Feb 2007 261,120 …H. — "C:\Anton\Unison Productions\~WRL0638.tmp"
Wed 21 Feb 2007 280,064 …H. — "C:\Anton\Unison Productions\~WRL1083.tmp"
Tue 20 Feb 2007 279,552 …H. — "C:\Anton\Unison Productions\~WRL1587.tmp"
Wed 14 Feb 2007 262,656 …H. — "C:\Anton\Unison Productions\~WRL1838.tmp"
Wed 21 Feb 2007 279,552 …H. — "C:\Anton\Unison Productions\~WRL2136.tmp"
Mon 5 Feb 2007 111,104 …H. — "C:\Anton\Unison Productions\~WRL2303.tmp"
Tue 13 Feb 2007 261,632 …H. — "C:\Anton\Unison Productions\~WRL2846.tmp"
Fri 24 Aug 2007 24,064 …H. — "C:\Anton\Unison Productions\~WRL3091.tmp"
Wed 21 Feb 2007 282,112 …H. — "C:\Anton\Unison Productions\~WRL3106.tmp"
Mon 5 Feb 2007 111,104 …H. — "C:\Anton\Unison Productions\~WRL3534.tmp"
Wed 21 Feb 2007 279,552 …H. — "C:\Anton\Unison Productions\~WRL3731.tmp"
Wed 14 Feb 2007 262,144 …H. — "C:\Anton\Unison Productions\~WRL4079.tmp"
Wed 4 Aug 2004 16 …H. — "C:\WINDOWS\system32\blvw6en.dll"
Wed 14 Nov 2007 20,640 ..SH. — "C:\WINDOWS\system32\iagntqjb.dllbox"
Sat 27 Jan 2007 534,354 ..SH. — "C:\WINDOWS\system32\iijlm.tmp"
Tue 23 Jan 2007 439,346 ..SH. — "C:\WINDOWS\system32\iijlm.bak1"
Thu 8 Nov 2007 112,764 ..SH. — "C:\WINDOWS\system32\onqru.tmp"
Wed 14 Nov 2007 128,381 ..SH. — "C:\WINDOWS\system32\onqru.bak1"
Mon 19 Nov 2007 115,937 ..SH. — "C:\WINDOWS\system32\onqru.bak2"
Wed 14 Nov 2007 20,640 ..SH. — "C:\WINDOWS\system32\rwfnihyn.dllbox"
Wed 14 Nov 2007 20,640 ..SH. — "C:\WINDOWS\system32\sasuhmli.dllbox"
Wed 14 Nov 2007 20,640 ..SH. — "C:\WINDOWS\system32\uxoncaup.dllbox"
Mon 22 Jan 2007 466,599 A.SH. — "C:\WINDOWS\system32\xxxyb.tmp"
Sun 21 Jan 2007 444,160 A.SH. — "C:\WINDOWS\system32\xxxyb.bak1"
Wed 14 Nov 2007 669,302 ..SH. — "C:\WINDOWS\system32\yftcgdid.tmp"
Wed 14 Nov 2007 20,640 ..SH. — "C:\WINDOWS\system32\zvngooef.dllbox"
Fri 16 Nov 2007 5,498,880 …H. — "C:\Anton\Canvas\Stockphotos\~WRL3018.tmp"
Mon 19 Mar 2007 118,784 …H. — "C:\Anton\Unison Productions\gallo\~WRL0061.tmp"
Wed 11 Apr 2007 144,384 …H. — "C:\Anton\Unison Productions\gallo\~WRL0062.tmp"
Tue 6 Mar 2007 91,648 …H. — "C:\Anton\Unison Productions\gallo\~WRL0110.tmp"
Tue 20 Mar 2007 119,808 …H. — "C:\Anton\Unison Productions\gallo\~WRL0181.tmp"
Tue 6 Mar 2007 92,160 …H. — "C:\Anton\Unison Productions\gallo\~WRL0254.tmp"
Mon 7 May 2007 173,056 …H. — "C:\Anton\Unison Productions\gallo\~WRL0273.tmp"
Wed 2 May 2007 166,912 …H. — "C:\Anton\Unison Productions\gallo\~WRL0275.tmp"
Tue 6 Mar 2007 89,600 …H. — "C:\Anton\Unison Productions\gallo\~WRL0282.tmp"
Wed 2 May 2007 165,376 …H. — "C:\Anton\Unison Productions\gallo\~WRL0305.tmp"
Mon 26 Mar 2007 124,928 …H. — "C:\Anton\Unison Productions\gallo\~WRL0314.tmp"
Thu 26 Apr 2007 163,328 …H. — "C:\Anton\Unison Productions\gallo\~WRL0316.tmp"
Tue 6 Mar 2007 91,648 …H. — "C:\Anton\Unison Productions\gallo\~WRL0543.tmp"
Wed 14 Mar 2007 117,760 …H. — "C:\Anton\Unison Productions\gallo\~WRL0569.tmp"
Tue 6 Mar 2007 97,280 …H. — "C:\Anton\Unison Productions\gallo\~WRL0574.tmp"
Tue 6 Mar 2007 90,624 …H. — "C:\Anton\Unison Productions\gallo\~WRL0621.tmp"
Thu 28 Jun 2007 285,184 …H. — "C:\Anton\Unison Productions\gallo\~WRL0692.tmp"
Mon 26 Mar 2007 119,808 …H. — "C:\Anton\Unison Productions\gallo\~WRL0720.tmp"
Thu 3 May 2007 166,912 …H. — "C:\Anton\Unison Productions\gallo\~WRL0763.tmp"
Tue 6 Mar 2007 92,160 …H. — "C:\Anton\Unison Productions\gallo\~WRL0780.tmp"
Tue 6 Mar 2007 89,088 …H. — "C:\Anton\Unison Productions\gallo\~WRL0789.tmp"
Tue 6 Mar 2007 100,864 …H. — "C:\Anton\Unison Productions\gallo\~WRL0791.tmp"
Tue 6 Mar 2007 95,232 …H. — "C:\Anton\Unison Productions\gallo\~WRL0806.tmp"
Tue 6 Mar 2007 99,840 …H. — "C:\Anton\Unison Productions\gallo\~WRL0854.tmp"
Tue 6 Mar 2007 92,160 …H. — "C:\Anton\Unison Productions\gallo\~WRL0868.tmp"
Thu 7 Jun 2007 237,056 …H. — "C:\Anton\Unison Productions\gallo\~WRL0901.tmp"
Tue 6 Mar 2007 95,232 …H. — "C:\Anton\Unison Productions\gallo\~WRL0916.tmp"
Mon 7 May 2007 173,056 …H. — "C:\Anton\Unison Productions\gallo\~WRL0947.tmp"
Mon 26 Mar 2007 122,368 …H. — "C:\Anton\Unison Productions\gallo\~WRL0992.tmp"
Tue 6 Mar 2007 102,912 …H. — "C:\Anton\Unison Productions\gallo\~WRL1048.tmp"
Tue 6 Mar 2007 95,744 …H. — "C:\Anton\Unison Productions\gallo\~WRL1055.tmp"
Wed 14 Mar 2007 116,224 …H. — "C:\Anton\Unison Productions\gallo\~WRL1056.tmp"
Mon 19 Mar 2007 118,272 …H. — "C:\Anton\Unison Productions\gallo\~WRL1058.tmp"
Thu 8 Mar 2007 111,616 …H. — "C:\Anton\Unison Productions\gallo\~WRL1270.tmp"
Thu 28 Jun 2007 285,184 …H. — "C:\Anton\Unison Productions\gallo\~WRL1299.tmp"
Mon 7 May 2007 173,056 …H. — "C:\Anton\Unison Productions\gallo\~WRL1309.tmp"
Thu 26 Apr 2007 163,840 …H. — "C:\Anton\Unison Productions\gallo\~WRL1446.tmp"
Mon 26 Mar 2007 121,856 …H. — "C:\Anton\Unison Productions\gallo\~WRL1483.tmp"
Mon 7 May 2007 168,960 …H. — "C:\Anton\Unison Productions\gallo\~WRL1540.tmp"
Tue 6 Mar 2007 103,936 …H. — "C:\Anton\Unison Productions\gallo\~WRL1544.tmp"
Tue 6 Mar 2007 100,864 …H. — "C:\Anton\Unison Productions\gallo\~WRL1579.tmp"
Mon 7 May 2007 169,984 …H. — "C:\Anton\Unison Productions\gallo\~WRL1584.tmp"
Tue 6 Mar 2007 99,840 …H. — "C:\Anton\Unison Productions\gallo\~WRL1738.tmp"
Mon 7 May 2007 176,128 …H. — "C:\Anton\Unison Productions\gallo\~WRL1805.tmp"
Mon 7 May 2007 174,592 …H. — "C:\Anton\Unison Productions\gallo\~WRL1818.tmp"
Tue 6 Mar 2007 96,768 …H. — "C:\Anton\Unison Productions\gallo\~WRL1820.tmp"
Tue 6 Mar 2007 87,040 …H. — "C:\Anton\Unison Productions\gallo\~WRL1843.tmp"
Tue 5 Jun 2007 260,096 …H. — "C:\Anton\Unison Productions\gallo\~WRL1881.tmp"
Mon 26 Mar 2007 124,928 …H. — "C:\Anton\Unison Productions\gallo\~WRL1969.tmp"
Mon 19 Mar 2007 118,272 …H. — "C:\Anton\Unison Productions\gallo\~WRL1988.tmp"
Tue 6 Mar 2007 102,912 …H. — "C:\Anton\Unison Productions\gallo\~WRL2002.tmp"
Mon 7 May 2007 174,080 …H. — "C:\Anton\Unison Productions\gallo\~WRL2006.tmp"
Mon 26 Mar 2007 121,856 …H. — "C:\Anton\Unison Productions\gallo\~WRL2084.tmp"
Mon 26 Mar 2007 123,904 …H. — "C:\Anton\Unison Productions\gallo\~WRL2101.tmp"
Mon 7 May 2007 173,056 …H. — "C:\Anton\Unison Productions\gallo\~WRL2120.tmp"
Mon 7 May 2007 171,520 …H. — "C:\Anton\Unison Productions\gallo\~WRL2166.tmp"
Tue 6 Mar 2007 102,912 …H. — "C:\Anton\Unison Productions\gallo\~WRL2201.tmp"
Mon 7 May 2007 174,592 …H. — "C:\Anton\Unison Productions\gallo\~WRL2254.tmp"
Mon 7 May 2007 174,592 …H. — "C:\Anton\Unison Productions\gallo\~WRL2289.tmp"
Tue 6 Mar 2007 92,160 …H. — "C:\Anton\Unison Productions\gallo\~WRL2312.tmp"
Tue 26 Jun 2007 284,160 …H. — "C:\Anton\Unison Productions\gallo\~WRL2321.tmp"
Mon 7 May 2007 170,496 …H. — "C:\Anton\Unison Productions\gallo\~WRL2346.tmp"
Mon 2 Apr 2007 142,848 …H. — "C:\Anton\Unison Productions\gallo\~WRL2369.tmp"
Tue 6 Mar 2007 96,768 …H. — "C:\Anton\Unison Productions\gallo\~WRL2408.tmp"
Mon 26 Mar 2007 126,464 …H. — "C:\Anton\Unison Productions\gallo\~WRL2546.tmp"
Tue 6 Mar 2007 102,912 …H. — "C:\Anton\Unison Productions\gallo\~WRL2554.tmp"
Tue 6 Mar 2007 91,136 …H. — "C:\Anton\Unison Productions\gallo\~WRL2607.tmp"
Tue 6 Mar 2007 104,448 …H. — "C:\Anton\Unison Productions\gallo\~WRL2616.tmp"
Mon 26 Mar 2007 121,856 …H. — "C:\Anton\Unison Productions\gallo\~WRL2668.tmp"
Mon 7 May 2007 172,544 …H. — "C:\Anton\Unison Productions\gallo\~WRL2675.tmp"
Tue 6 Mar 2007 92,672 …H. — "C:\Anton\Unison Productions\gallo\~WRL2760.tmp"
Mon 7 May 2007 169,472 …H. — "C:\Anton\Unison Productions\gallo\~WRL2813.tmp"
Tue 6 Mar 2007 100,864 …H. — "C:\Anton\Unison Productions\gallo\~WRL2847.tmp"
Tue 6 Mar 2007 90,624 …H. — "C:\Anton\Unison Productions\gallo\~WRL2990.tmp"
Tue 6 Mar 2007 89,088 …H. — "C:\Anton\Unison Productions\gallo\~WRL3052.tmp"
Thu 28 Jun 2007 285,184 …H. — "C:\Anton\Unison Productions\gallo\~WRL3064.tmp"
Mon 7 May 2007 169,472 …H. — "C:\Anton\Unison Productions\gallo\~WRL3067.tmp"
Mon 26 Mar 2007 128,512 …H. — "C:\Anton\Unison Productions\gallo\~WRL3109.tmp"
Tue 6 Mar 2007 103,936 …H. — "C:\Anton\Unison Productions\gallo\~WRL3134.tmp"
Mon 7 May 2007 171,520 …H. — "C:\Anton\Unison Productions\gallo\~WRL3148.tmp"
Tue 6 Mar 2007 94,720 …H. — "C:\Anton\Unison Productions\gallo\~WRL3150.tmp"
Mon 7 May 2007 171,520 …H. — "C:\Anton\Unison Productions\gallo\~WRL3155.tmp"
Tue 6 Mar 2007 103,936 …H. — "C:\Anton\Unison Productions\gallo\~WRL3181.tmp"
Mon 7 May 2007 175,104 …H. — "C:\Anton\Unison Productions\gallo\~WRL3232.tmp"
Mon 7 May 2007 176,128 …H. — "C:\Anton\Unison Productions\gallo\~WRL3252.tmp"
Mon 7 May 2007 175,104 …H. — "C:\Anton\Unison Productions\gallo\~WRL3265.tmp"
Thu 26 Apr 2007 163,840 …H. — "C:\Anton\Unison Productions\gallo\~WRL3299.tmp"
Mon 7 May 2007 173,056 …H. — "C:\Anton\Unison Productions\gallo\~WRL3318.tmp"
Mon 5 Mar 2007 86,016 …H. — "C:\Anton\Unison Productions\gallo\~WRL3385.tmp"
Tue 6 Mar 2007 94,720 …H. — "C:\Anton\Unison Productions\gallo\~WRL3452.tmp"
Mon 7 May 2007 173,568 …H. — "C:\Anton\Unison Productions\gallo\~WRL3479.tmp"
Mon 7 May 2007 169,472 …H. — "C:\Anton\Unison Productions\gallo\~WRL3480.tmp"
Wed 14 Mar 2007 117,760 …H. — "C:\Anton\Unison Productions\gallo\~WRL3520.tmp"
Mon 19 Mar 2007 118,272 …H. — "C:\Anton\Unison Productions\gallo\~WRL3534.tmp"
Mon 7 May 2007 173,568 …H. — "C:\Anton\Unison Productions\gallo\~WRL3559.tmp"
Tue 24 Apr 2007 162,816 …H. — "C:\Anton\Unison Productions\gallo\~WRL3570.tmp"
Mon 7 May 2007 174,592 …H. — "C:\Anton\Unison Productions\gallo\~WRL3584.tmp"
Tue 6 Mar 2007 99,840 …H. — "C:\Anton\Unison Productions\gallo\~WRL3603.tmp"
Mon 26 Mar 2007 121,856 …H. — "C:\Anton\Unison Productions\gallo\~WRL3647.tmp"
Tue 6 Mar 2007 97,792 …H. — "C:\Anton\Unison Productions\gallo\~WRL3667.tmp"
Mon 7 May 2007 176,128 …H. — "C:\Anton\Unison Productions\gallo\~WRL3716.tmp"
Tue 6 Mar 2007 91,648 …H. — "C:\Anton\Unison Productions\gallo\~WRL3728.tmp"
Wed 11 Apr 2007 144,384 …H. — "C:\Anton\Unison Productions\gallo\~WRL3741.tmp"
Wed 2 May 2007 166,912 …H. — "C:\Anton\Unison Productions\gallo\~WRL3742.tmp"
Tue 6 Mar 2007 99,840 …H. — "C:\Anton\Unison Productions\gallo\~WRL3781.tmp"
Mon 26 Mar 2007 123,904 …H. — "C:\Anton\Unison Productions\gallo\~WRL3825.tmp"
Mon 7 May 2007 171,520 …H. — "C:\Anton\Unison Productions\gallo\~WRL3915.tmp"
Mon 7 May 2007 175,104 …H. — "C:\Anton\Unison Productions\gallo\~WRL3919.tmp"
Wed 2 May 2007 166,400 …H. — "C:\Anton\Unison Productions\gallo\~WRL3944.tmp"
Tue 6 Mar 2007 88,576 …H. — "C:\Anton\Unison Productions\gallo\~WRL4026.tmp"
Wed 11 Apr 2007 31,744 …H. — "C:\Anton\Unison Productions\Studio Work\~WRL0234.tmp"
Wed 11 Apr 2007 29,696 …H. — "C:\Anton\Unison Productions\Studio Work\~WRL0475.tmp"
Wed 11 Apr 2007 30,208 …H. — "C:\Anton\Unison Productions\Studio Work\~WRL0647.tmp"
Wed 11 Apr 2007 31,744 …H. — "C:\Anton\Unison Productions\Studio Work\~WRL1083.tmp"
Wed 11 Apr 2007 31,232 …H. — "C:\Anton\Unison Productions\Studio Work\~WRL1145.tmp"
Wed 11 Apr 2007 29,696 …H. — "C:\Anton\Unison Productions\Studio Work\~WRL1267.tmp"
Wed 11 Apr 2007 29,696 …H. — "C:\Anton\Unison Productions\Studio Work\~WRL1314.tmp"
Wed 11 Apr 2007 30,720 …H. — "C:\Anton\Unison Productions\Studio Work\~WRL1633.tmp"
Wed 11 Apr 2007 31,232 …H. — "C:\Anton\Unison Productions\Studio Work\~WRL1749.tmp"
Wed 11 Apr 2007 29,696 …H. — "C:\Anton\Unison Productions\Studio Work\~WRL2216.tmp"
Wed 11 Apr 2007 33,792 …H. — "C:\Anton\Unison Productions\Studio Work\~WRL2352.tmp"
Wed 11 Apr 2007 30,720 …H. — "C:\Anton\Unison Productions\Studio Work\~WRL2394.tmp"
Wed 11 Apr 2007 31,744 …H. — "C:\Anton\Unison Productions\Studio Work\~WRL2794.tmp"
Wed 11 Apr 2007 32,256 …H. — "C:\Anton\Unison Productions\Studio Work\~WRL2974.tmp"
Wed 11 Apr 2007 31,744 …H. — "C:\Anton\Unison Productions\Studio Work\~WRL2979.tmp"
Wed 11 Apr 2007 29,696 …H. — "C:\Anton\Unison Productions\Studio Work\~WRL3035.tmp"
Tue 10 Apr 2007 26,112 …H. — "C:\Anton\Unison Productions\Studio Work\~WRL3171.tmp"
Wed 11 Apr 2007 33,792 …H. — "C:\Anton\Unison Productions\Studio Work\~WRL3273.tmp"
Wed 11 Apr 2007 31,744 …H. — "C:\Anton\Unison Productions\Studio Work\~WRL3789.tmp"
Wed 11 Apr 2007 31,744 …H. — "C:\Anton\Unison Productions\Studio Work\~WRL3818.tmp"
Wed 11 Apr 2007 33,792 …H. — "C:\Anton\Unison Productions\Studio Work\~WRL3880.tmp"
Wed 11 Apr 2007 30,720 …H. — "C:\Anton\Unison Productions\Studio Work\~WRL3900.tmp"
Sat 27 Jan 2007 30,720 …H. — "C:\Documents and Settings\Anton\Desktop\~WRL0001.tmp"
Mon 5 Dec 2005 106,496 A..H. — "C:\Program Files\FriendAdder Combo Pack\Friend Adder\jpegtcl10.dll"
Tue 19 Jul 2005 28,672 A..H. — "C:\Program Files\FriendAdder Combo Pack\Friend Adder\tbcload14.dll"
Thu 20 Oct 2005 154,624 A..H. — "C:\Program Files\FriendAdder Combo Pack\Friend Adder\tile072t.dll"
Mon 5 Dec 2005 24,576 A..H. — "C:\Program Files\FriendAdder Combo Pack\Friend Adder\tkimg13.dll"
Mon 5 Dec 2005 24,576 A..H. — "C:\Program Files\FriendAdder Combo Pack\Friend Adder\tkimgjpeg13.dll"
Mon 5 Dec 2005 106,496 A..H. — "C:\Program Files\FriendAdder Combo Pack\Friend Commenter\jpegtcl10.dll"
Tue 19 Jul 2005 28,672 A..H. — "C:\Program Files\FriendAdder Combo Pack\Friend Commenter\tbcload14.dll"
Thu 20 Oct 2005 154,624 A..H. — "C:\Program Files\FriendAdder Combo Pack\Friend Commenter\tile072t.dll"
Mon 5 Dec 2005 24,576 A..H. — "C:\Program Files\FriendAdder Combo Pack\Friend Commenter\tkimg13.dll"
Mon 5 Dec 2005 24,576 A..H. — "C:\Program Files\FriendAdder Combo Pack\Friend Commenter\tkimgjpeg13.dll"
Mon 5 Dec 2005 106,496 A..H. — "C:\Program Files\FriendAdder Combo Pack\Friend Messenger\jpegtcl10.dll"
Tue 19 Jul 2005 28,672 A..H. — "C:\Program Files\FriendAdder Combo Pack\Friend Messenger\tbcload14.dll"
Thu 20 Oct 2005 154,624 A..H. — "C:\Program Files\FriendAdder Combo Pack\Friend Messenger\tile072t.dll"
Mon 5 Dec 2005 24,576 A..H. — "C:\Program Files\FriendAdder Combo Pack\Friend Messenger\tkimg13.dll"
Mon 5 Dec 2005 24,576 A..H. — "C:\Program Files\FriendAdder Combo Pack\Friend Messenger\tkimgjpeg13.dll"
Fri 27 Feb 2004 233,472 A..H. — "C:\Program Files\Image-Line\FL Studio 7\REX Shared Library.dll"
Thu 8 Nov 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico38.tmp"
Thu 8 Nov 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico39.tmp"
Thu 8 Nov 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico3A.tmp"
Thu 8 Nov 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico3B.tmp"
Thu 8 Nov 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico3C.tmp"
Fri 12 Nov 2004 37,376 …H. — "C:\Program Files\Common Files\Adobe\ESD\DLMCleanup.exe"
Mon 5 Mar 2007 52,224 …H. — "C:\Anton\Unison Productions\press release\english\5fm\~WRL2009.tmp"
Thu 6 Sep 2007 82,432 …H. — "C:\Documents and Settings\Anton\Application Data\Microsoft\Word\~WRL2363.tmp"
Tue 30 Oct 2007 2,668 A..H. — "C:\Program Files\Adobe\Adobe Photoshop CS2\Plug-Ins\KPT Collection\MetaImage.dll"

Finished!



———————————————————————————————————————————————————————




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:20:39, on 20/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.EXE
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\DeviceListener.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\ConAppM.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.za/
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Save; Flash - {4064EA35-578D-4073-A834-C96D82CBCF40} - C:\Program Files\Save Flash\SaveFlash.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\qfchkbwy.dll (file missing)
O4 - HKLM\..\Run: [TotalRecorderScheduler] "C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx2\PXConsole.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [70625938] rundll32.exe "C:\WINDOWS\system32\ucceqhuv.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MobileConnect.EXE] C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.EXE
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [WinAble] C:\Program Files\WinAble\winable.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Flash Decompiler SWF Capture tool - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\PROGRA~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU)
O9 - Extra 'Tools' menuitem: Flash Decompiler SWF Capture tool menu - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\PROGRA~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU)
O17 - HKLM\System\CCS\Services\Tcpip\..\{6D78A853-2EA2-45A1-B621-C98FF625398F}: NameServer = 196.207.35.29 196.207.35.30
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\chkfxbli.exe (file missing)
O23 - Service: PREVXAgent - Unknown owner - C:\Program Files\Prevx2\PXAgent.exe (file missing)

–
End of file - 6672 bytes

Thanks man, there you go:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:08:12, on 20/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.EXE
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\DeviceListener.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\ConAppM.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\WINDOWS\system32\sndvol32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Acrobat.exe
C:\DOCUME~1\Anton\LOCALS~1\Temp\Adobelm_Cleanup.0001
C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
C:\DOCUME~1\Anton\LOCALS~1\Temp\Adobelm_Cleanup.0001
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\FindVundo.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.za/
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {04A50AA9-E066-4168-B8F9-670D744492C8} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0f68a09b-ce1a-4581-939c-69384dd8e0fb} - (no file)
O2 - BHO: (no name) - {20c39dc0-cfe4-4e48-b3f6-6dae93b09383} - (no file)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {25A12E63-12C4-4526-8BB5-D9E72167CF92} - (no file)
O2 - BHO: {49e1f78d-5c64-016a-8664-bcab92d4f7a4} - {4a7f4d29-bacb-4668-a610-46c5d87f1e94} - C:\WINDOWS\system32\pdpbpdeb.dll
O2 - BHO: (no name) - {5027D158-47A4-46B3-A07C-A9FB0D7D0799} - C:\WINDOWS\system32\urqno.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
O2 - BHO: (no name) - {599cb252-b932-491c-b1be-207786fb76a4} - (no file)
O2 - BHO: (no name) - {6020c6ca-08d1-4876-9cf3-a0aa8e916910} - (no file)
O2 - BHO: (no name) - {624694C5-D9E3-4534-AA84-E80368A9A308} - C:\Program Files\Adobe\mexokaroC:\WINDOWS\system32\v4\caws83122.exe.dll (file missing)
O2 - BHO: (no name) - {6B53F42F-BA41-419E-A427-B567DC09C967} - (no file)
O2 - BHO: (no name) - {6E0F8E72-16A9-4430-BA7B-B028570D516F} - (no file)
O2 - BHO: (no name) - {8D911365-4A3C-452E-B3F0-CC2D750FDFC7} - (no file)
O2 - BHO: (no name) - {9B22B9D1-7F1F-42F9-81E5-1606DE23708D} - (no file)
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\qfchkbwy.dll (file missing)
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {b47dbfba-e866-4b1e-a167-af88b635a5b3} - (no file)
O2 - BHO: (no name) - {c5834da1-2720-4ccc-93a7-5c30d25ceb29} - (no file)
O2 - BHO: (no name) - {c58a6214-9035-4965-bf16-d4fbb076a104} - (no file)
O2 - BHO: (no name) - {C932B390-4685-49D7-8458-F8E6166DA9C1} - (no file)
O2 - BHO: (no name) - {D951DD00-0AE7-4593-AD43-D91457AD1C69} - (no file)
O2 - BHO: (no name) - {E08400A7-CF77-40C1-8246-05A721367985} - (no file)
O2 - BHO: (no name) - {e5115a54-83a6-4246-9c06-37336abb1609} - (no file)
O2 - BHO: (no name) - {F5434312-49C4-41B7-A59D-16C1B94958BA} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Save Flash - {4064EA35-578D-4073-A834-C96D82CBCF40} - C:\Program Files\Save Flash\SaveFlash.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\qfchkbwy.dll (file missing)
O4 - HKLM\..\Run: [TotalRecorderScheduler] "C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx2\PXConsole.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [70625938] rundll32.exe "C:\WINDOWS\system32\kuwsbvbn.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MobileConnect.EXE] C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.EXE
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [WinAble] C:\Program Files\WinAble\winable.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Flash Decompiler SWF Capture tool - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\PROGRA~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU)
O9 - Extra 'Tools' menuitem: Flash Decompiler SWF Capture tool menu - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\PROGRA~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU)
O17 - HKLM\System\CCS\Services\Tcpip\..\{6D78A853-2EA2-45A1-B621-C98FF625398F}: NameServer = 196.207.35.29 196.207.35.30
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: byxxx - C:\WINDOWS\system32\byxxx.dll (file missing)
O20 - Winlogon Notify: mljii - C:\WINDOWS\system32\mljii.dll (file missing)
O20 - Winlogon Notify: nnnklmk - nnnklmk.dll (file missing)
O20 - Winlogon Notify: qfchkbwy - C:\WINDOWS\
O20 - Winlogon Notify: tuvspnl - C:\WINDOWS\
O20 - Winlogon Notify: uxoncaup - uxoncaup.dll (file missing)
O20 - Winlogon Notify: winkgg32 - winkgg32.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\chkfxbli.exe (file missing)
O23 - Service: PREVXAgent - Unknown owner - C:\Program Files\Prevx2\PXAgent.exe (file missing)

–
End of file - 10371 bytes

OK, yikes, there it is. I know you tried Vundofix before and it didn't completely remove it. But I would like you to run it again. There will likely need to be some steps to take after running it to keep this from coming back. Unfortunately, one of the best tools we have for dealing with this is not available at the moment. Remove your current version of Vundofix and download a new one. I will also need you to run a Deckards scan after.

Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to run it.
• Click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click Yes
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will reboot your computer, click OK.
• Please post the contents of C:\vundofix.txt.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from Click the Scan for Vundo button when VundoFix appears at reboot.

———————————————————————-

Please download Deckard's System Scanner (DSS) and save it to your Desktop.

• Close all other windows before proceeding.
• Double-click on dss.exe and follow the prompts.
• When it has finished, dss will open two Notepads main.txt and extra.txt – please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

Hey there,

See below: The other suspect dll's in my IE add-onns are now gone, but there is a new one (without publisher details) : pdpbpdeb.dll

Thanks once again!


Main.txt:

Deckard's System Scanner v20071014.68
Run by [removed] on 2007-11-20 15:29:54
Computer is in Normal Mode.
——————————————————————————–

– System Restore ————————————————————–

Failed to create restore point; System Restore is disabled (service is not running).


Backed up registry hives.
Performed disk cleanup.

System Drive C: has 3.61 GiB (less than 15%) free.


– HijackThis (run as Anton.exe) ———————————————–

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:30:47, on 20/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\DeviceListener.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\ConAppM.exe
C:\Documents and Settings\Anton\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Anton.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.za/
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {04A50AA9-E066-4168-B8F9-670D744492C8} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0f68a09b-ce1a-4581-939c-69384dd8e0fb} - (no file)
O2 - BHO: (no name) - {20c39dc0-cfe4-4e48-b3f6-6dae93b09383} - (no file)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {25A12E63-12C4-4526-8BB5-D9E72167CF92} - (no file)
O2 - BHO: {49e1f78d-5c64-016a-8664-bcab92d4f7a4} - {4a7f4d29-bacb-4668-a610-46c5d87f1e94} - C:\WINDOWS\system32\pdpbpdeb.dll
O2 - BHO: (no name) - {5027D158-47A4-46B3-A07C-A9FB0D7D0799} - C:\WINDOWS\system32\urqno.dll (file missing)
O2 - BHO: (no name) - {51deea14-4a45-4ab8-bc22-de0889aeecfd} - (no file)
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
O2 - BHO: (no name) - {599cb252-b932-491c-b1be-207786fb76a4} - (no file)
O2 - BHO: (no name) - {6020c6ca-08d1-4876-9cf3-a0aa8e916910} - (no file)
O2 - BHO: (no name) - {624694C5-D9E3-4534-AA84-E80368A9A308} - C:\Program Files\Adobe\mexokaroC:\WINDOWS\system32\v4\caws83122.exe.dll (file missing)
O2 - BHO: (no name) - {6B53F42F-BA41-419E-A427-B567DC09C967} - (no file)
O2 - BHO: (no name) - {6E0F8E72-16A9-4430-BA7B-B028570D516F} - (no file)
O2 - BHO: (no name) - {8D911365-4A3C-452E-B3F0-CC2D750FDFC7} - (no file)
O2 - BHO: (no name) - {9B22B9D1-7F1F-42F9-81E5-1606DE23708D} - (no file)
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - (no file)
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {b47dbfba-e866-4b1e-a167-af88b635a5b3} - (no file)
O2 - BHO: (no name) - {c5834da1-2720-4ccc-93a7-5c30d25ceb29} - (no file)
O2 - BHO: (no name) - {c58a6214-9035-4965-bf16-d4fbb076a104} - (no file)
O2 - BHO: (no name) - {C932B390-4685-49D7-8458-F8E6166DA9C1} - (no file)
O2 - BHO: (no name) - {D951DD00-0AE7-4593-AD43-D91457AD1C69} - (no file)
O2 - BHO: (no name) - {E08400A7-CF77-40C1-8246-05A721367985} - (no file)
O2 - BHO: (no name) - {e5115a54-83a6-4246-9c06-37336abb1609} - (no file)
O2 - BHO: (no name) - {F5434312-49C4-41B7-A59D-16C1B94958BA} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Save; Flash - {4064EA35-578D-4073-A834-C96D82CBCF40} - C:\Program Files\Save Flash\SaveFlash.dll
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [TotalRecorderScheduler] "C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx2\PXConsole.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [70625938] rundll32.exe "C:\WINDOWS\system32\cilttncb.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MobileConnect.EXE] C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.EXE
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [WinAble] C:\Program Files\WinAble\winable.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Flash Decompiler SWF Capture tool - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\PROGRA~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU)
O9 - Extra 'Tools' menuitem: Flash Decompiler SWF Capture tool menu - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\PROGRA~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: byxxx - C:\WINDOWS\system32\byxxx.dll (file missing)
O20 - Winlogon Notify: mljii - C:\WINDOWS\system32\mljii.dll (file missing)
O20 - Winlogon Notify: nnnklmk - nnnklmk.dll (file missing)
O20 - Winlogon Notify: qfchkbwy - C:\WINDOWS\
O20 - Winlogon Notify: tuvspnl - C:\WINDOWS\
O20 - Winlogon Notify: uxoncaup - C:\WINDOWS\
O20 - Winlogon Notify: winkgg32 - winkgg32.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\chkfxbli.exe (file missing)
O23 - Service: PREVXAgent - Unknown owner - C:\Program Files\Prevx2\PXAgent.exe (file missing)

–
End of file - 9608 bytes

– File Associations ———————————————————–

.js - JSFile - DefaultIcon - C:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe,2
.js - JSFile - shell\open\command - "C:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe" "%1"
.reg - regfile - shell\open\command - "regedit.exe" "%1"


– Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ———————

R1 SASDIFSV - c:\program files\superantispyware\sasdifsv.sys
R1 SASKUTIL - c:\program files\superantispyware\saskutil.sys
R1 SCDEmu - c:\windows\system32\drivers\scdemu.sys

Yeah, I don't think I got this from torrents….I'm sure it was from a website by accident (malware type one…)

OK logs to follow - (Deckard's only did a main.txt this time?)

Thanks agaon for your time - much appreciated!


OTMoveIt:

File/Folder C:\WINDOWS\system32\pdpbpdeb.dll not found.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\kuwsbvbn.dll
C:\WINDOWS\system32\kuwsbvbn.dll NOT unregistered.
C:\WINDOWS\system32\kuwsbvbn.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\amgstxww.dll
C:\WINDOWS\system32\amgstxww.dll NOT unregistered.
C:\WINDOWS\system32\amgstxww.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\vnmeuouj.dll
C:\WINDOWS\system32\vnmeuouj.dll NOT unregistered.
C:\WINDOWS\system32\vnmeuouj.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\rqldxyih.dll
C:\WINDOWS\system32\rqldxyih.dll NOT unregistered.
C:\WINDOWS\system32\rqldxyih.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\clexyrqh.dll
C:\WINDOWS\system32\clexyrqh.dll NOT unregistered.
C:\WINDOWS\system32\clexyrqh.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\awendgnl.dll
C:\WINDOWS\system32\awendgnl.dll NOT unregistered.
C:\WINDOWS\system32\awendgnl.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\mkenxuic.dll
C:\WINDOWS\system32\mkenxuic.dll NOT unregistered.
C:\WINDOWS\system32\mkenxuic.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\hfscmmpp.dll
C:\WINDOWS\system32\hfscmmpp.dll NOT unregistered.
C:\WINDOWS\system32\hfscmmpp.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\plsttrlq.dll
C:\WINDOWS\system32\plsttrlq.dll NOT unregistered.
C:\WINDOWS\system32\plsttrlq.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\jduuxsei.dll
C:\WINDOWS\system32\jduuxsei.dll NOT unregistered.
C:\WINDOWS\system32\jduuxsei.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\vcrtseos.dll
C:\WINDOWS\system32\vcrtseos.dll NOT unregistered.
C:\WINDOWS\system32\vcrtseos.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\ojwgnnda.dll
C:\WINDOWS\system32\ojwgnnda.dll NOT unregistered.
C:\WINDOWS\system32\ojwgnnda.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\mvfxnvoi.dll
C:\WINDOWS\system32\mvfxnvoi.dll NOT unregistered.
C:\WINDOWS\system32\mvfxnvoi.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\gipgwmqh.dll
C:\WINDOWS\system32\gipgwmqh.dll NOT unregistered.
C:\WINDOWS\system32\gipgwmqh.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\ydwwrygv.dll
C:\WINDOWS\system32\ydwwrygv.dll NOT unregistered.
C:\WINDOWS\system32\ydwwrygv.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\cbfreggo.dll
C:\WINDOWS\system32\cbfreggo.dll NOT unregistered.
C:\WINDOWS\system32\cbfreggo.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\mwejeovx.dll
C:\WINDOWS\system32\mwejeovx.dll NOT unregistered.
C:\WINDOWS\system32\mwejeovx.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\povfvrmc.dll
C:\WINDOWS\system32\povfvrmc.dll NOT unregistered.
C:\WINDOWS\system32\povfvrmc.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\hhwgnqoh.dll
C:\WINDOWS\system32\hhwgnqoh.dll NOT unregistered.
C:\WINDOWS\system32\hhwgnqoh.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\ndtshlxd.dll
C:\WINDOWS\system32\ndtshlxd.dll NOT unregistered.
C:\WINDOWS\system32\ndtshlxd.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\xbpsfoua.dll
C:\WINDOWS\system32\xbpsfoua.dll NOT unregistered.
C:\WINDOWS\system32\xbpsfoua.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\hhjpnrdq.dll
C:\WINDOWS\system32\hhjpnrdq.dll NOT unregistered.
C:\WINDOWS\system32\hhjpnrdq.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\snbvvepg.dll
C:\WINDOWS\system32\snbvvepg.dll NOT unregistered.
C:\WINDOWS\system32\snbvvepg.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\rbqvhejf.dll
C:\WINDOWS\system32\rbqvhejf.dll NOT unregistered.
C:\WINDOWS\system32\rbqvhejf.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\owvojwwm.dll
C:\WINDOWS\system32\owvojwwm.dll NOT unregistered.
C:\WINDOWS\system32\owvojwwm.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\ieemvpfy.dll
C:\WINDOWS\system32\ieemvpfy.dll NOT unregistered.
C:\WINDOWS\system32\ieemvpfy.dll moved successfully.

Created on 11/21/2007 08:34:25



Deckard's System Scanner v20071014.68
Run by [removed] on 2007-11-21 08:42:45
Computer is in Normal Mode.
——————————————————————————–

System Drive C: has 3.5 GiB (less than 15%) free.


– HijackThis (run as Anton.exe) ———————————————–

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:42:53, on 21/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\DeviceListener.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\ConAppM.exe
C:\Documents and Settings\Anton\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Anton.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.za/
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {04A50AA9-E066-4168-B8F9-670D744492C8} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0f68a09b-ce1a-4581-939c-69384dd8e0fb} - (no file)
O2 - BHO: (no name) - {20c39dc0-cfe4-4e48-b3f6-6dae93b09383} - (no file)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {25A12E63-12C4-4526-8BB5-D9E72167CF92} - (no file)
O2 - BHO: (no name) - {4a7f4d29-bacb-4668-a610-46c5d87f1e94} - (no file)
O2 - BHO: (no name) - {5027D158-47A4-46B3-A07C-A9FB0D7D0799} - (no file)
O2 - BHO: (no name) - {51deea14-4a45-4ab8-bc22-de0889aeecfd} - (no file)
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
O2 - BHO: (no name) - {599cb252-b932-491c-b1be-207786fb76a4} - (no file)
O2 - BHO: (no name) - {6020c6ca-08d1-4876-9cf3-a0aa8e916910} - (no file)
O2 - BHO: (no name) - {624694C5-D9E3-4534-AA84-E80368A9A308} - (no file)
O2 - BHO: (no name) - {6B53F42F-BA41-419E-A427-B567DC09C967} - (no file)
O2 - BHO: (no name) - {6E0F8E72-16A9-4430-BA7B-B028570D516F} - (no file)
O2 - BHO: (no name) - {8D911365-4A3C-452E-B3F0-CC2D750FDFC7} - (no file)
O2 - BHO: (no name) - {9B22B9D1-7F1F-42F9-81E5-1606DE23708D} - (no file)
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - (no file)
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {b47dbfba-e866-4b1e-a167-af88b635a5b3} - (no file)
O2 - BHO: (no name) - {c5834da1-2720-4ccc-93a7-5c30d25ceb29} - (no file)
O2 - BHO: (no name) - {c58a6214-9035-4965-bf16-d4fbb076a104} - (no file)
O2 - BHO: (no name) - {C932B390-4685-49D7-8458-F8E6166DA9C1} - (no file)
O2 - BHO: (no name) - {D951DD00-0AE7-4593-AD43-D91457AD1C69} - (no file)
O2 - BHO: (no name) - {E08400A7-CF77-40C1-8246-05A721367985} - (no file)
O2 - BHO: (no name) - {e5115a54-83a6-4246-9c06-37336abb1609} - (no file)
O2 - BHO: (no name) - {F5434312-49C4-41B7-A59D-16C1B94958BA} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Save; Flash - {4064EA35-578D-4073-A834-C96D82CBCF40} - C:\Program Files\Save Flash\SaveFlash.dll
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [TotalRecorderScheduler] "C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx2\PXConsole.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [70625938] rundll32.exe "C:\WINDOWS\system32\cilttncb.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MobileConnect.EXE] C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.EXE
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [WinAble] C:\Program Files\WinAble\winable.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Flash Decompiler SWF Capture tool - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\PROGRA~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU)
O9 - Extra 'Tools' menuitem: Flash Decompiler SWF Capture tool menu - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\PROGRA~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: byxxx - C:\WINDOWS\
O20 - Winlogon Notify: mljii - C:\WINDOWS\
O20 - Winlogon Notify: nnnklmk - C:\WINDOWS\
O20 - Winlogon Notify: qfchkbwy - C:\WINDOWS\
O20 - Winlogon Notify: tuvspnl - C:\WINDOWS\
O20 - Winlogon Notify: uxoncaup - C:\WINDOWS\
O20 - Winlogon Notify: winkgg32 - C:\WINDOWS\
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: PREVXAgent - Unknown owner - C:\Program Files\Prevx2\PXAgent.exe (file missing)

–
End of file - 9251 bytes

– Files created between 2007-10-21 and 2007-11-21 —————————–

2007-11-20 07:45:51 0 d——– C:\WINDOWS\ERUNT
2007-11-20 07:27:57 0 d——– C:\Program Files\Trend Micro
2007-11-19 16:30:06 0 d——– C:\Program Files\JAlbumWin
2007-11-19 12:40:02 0 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-11-19 12:13:15 0 d——– C:\Documents and Settings\Anton\Application Data\uTorrent
2007-11-19 12:13:13 0 d——– C:\Program Files\uTorrent
2007-11-19 12:12:07 0 d——– C:\Anton
2007-11-19 11:49:55 0 d–hs—- C:\Documents and Settings\Anton\UserData
2007-11-19 03:12:48 0 d——– C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2007-11-19 03:09:59 0 d——– C:\Documents and Settings\Anton\Application Data\Macromedia
2007-11-19 03:09:53 0 d——– C:\Program Files\Yahoo!
2007-11-19 02:52:57 0 d——– C:\Documents and Settings\Anton\Application Data\Vodafone Mobile Connect
2007-11-19 02:51:20 237568 –a—-c- C:\WINDOWS\VMC9SavedNwtGatewayDLL.dll

That's weird, I did fix them?

Ok did it again, here's the hijack + deckard log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:53:17, on 21/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\DeviceListener.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Acrobat.exe
C:\DOCUME~1\Anton\LOCALS~1\Temp\Adobelm_Cleanup.0001
C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
C:\DOCUME~1\Anton\LOCALS~1\Temp\Adobelm_Cleanup.0001
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\DeviceListener.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\ConAppM.exe
C:\Program Files\Trend Micro\HijackThis\FindVundo.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.za/
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Save Flash - {4064EA35-578D-4073-A834-C96D82CBCF40} - C:\Program Files\Save Flash\SaveFlash.dll
O4 - HKLM\..\Run: [TotalRecorderScheduler] "C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx2\PXConsole.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MobileConnect.EXE] C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.EXE
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Flash Decompiler SWF Capture tool - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\PROGRA~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU)
O9 - Extra 'Tools' menuitem: Flash Decompiler SWF Capture tool menu - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\PROGRA~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU)
O17 - HKLM\System\CCS\Services\Tcpip\..\{6D78A853-2EA2-45A1-B621-C98FF625398F}: NameServer = 196.207.35.29 196.207.35.30
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: PREVXAgent - Unknown owner - C:\Program Files\Prevx2\PXAgent.exe (file missing)

–
End of file - 7410 bytes




Deckard's System Scanner v20071014.68
Run by [removed] on 2007-11-21 18:06:41
Computer is in Normal Mode.
——————————————————————————–

System Drive C: has 3.46 GiB (less than 15%) free.


– HijackThis (run as Anton.exe) ———————————————–

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:06:49, on 21/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\DeviceListener.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Acrobat.exe
C:\DOCUME~1\Anton\LOCALS~1\Temp\Adobelm_Cleanup.0001
C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
C:\DOCUME~1\Anton\LOCALS~1\Temp\Adobelm_Cleanup.0001
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\DeviceListener.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\ConAppM.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Anton\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Anton.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.za/
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Save Flash - {4064EA35-578D-4073-A834-C96D82CBCF40} - C:\Program Files\Save Flash\SaveFlash.dll
O4 - HKLM\..\Run: [TotalRecorderScheduler] "C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx2\PXConsole.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MobileConnect.EXE] C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.EXE
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Flash Decompiler SWF Capture tool - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\PROGRA~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU)
O9 - Extra 'Tools' menuitem: Flash Decompiler SWF Capture tool menu - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\PROGRA~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU)
O17 - HKLM\System\CCS\Services\Tcpip\..\{6D78A853-2EA2-45A1-B621-C98FF625398F}: NameServer = 196.207.35.29 196.207.35.30
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: PREVXAgent - Unknown owner - C:\Program Files\Prevx2\PXAgent.exe (file missing)

–
End of file - 7490 bytes

– Files created between 2007-10-21 and 2007-11-21 —————————–

2007-11-20 07:45:51 0 d——– C:\WINDOWS\ERUNT
2007-11-20 07:27:57 0 d——– C:\Program Files\Trend Micro
2007-11-19 16:30:06 0 d——– C:\Program Files\JAlbumWin
2007-11-19 12:40:02 0 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-11-19 12:13:15 0 d——– C:\Documents and Settings\Anton\Application Data\uTorrent
2007-11-19 12:13:13 0 d——– C:\Program Files\uTorrent
2007-11-19 12:12:07 0 d——– C:\Anton
2007-11-19 11:49:55 0 d–hs—- C:\Documents and Settings\Anton\UserData
2007-11-19 03:12:48 0 d——– C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2007-11-19 03:09:59 0 d——– C:\Documents and Settings\Anton\Application Data\Macromedia
2007-11-19 03:09:53 0 d——– C:\Program Files\Yahoo!
2007-11-19 02:52:57 0 d——– C:\Documents and Settings\Anton\Application Data\Vodafone Mobile Connect
2007-11-19 02:51:20 237568 –a—-c- C:\WINDOWS\VMC9SavedNwtGatewayDLL.dll

Indi, thanks

See attached the Kaspersky Log and below the HJT:

Well hopefully we're almost there - I'd like to get some advice from you on how to avoid this in future - also I have about a hundred anti spyware / virus tools running which is slowing my laptop to a grind: What tools would you recommend I keep / use in future?

Thanks again for your time!

A


Deckard's System Scanner v20071014.68
Run by [removed] on 2007-11-22 17:20:12
Computer is in Normal Mode.
——————————————————————————–

System Drive C: has 3.36 GiB (less than 15%) free.


– HijackThis (run as Anton.exe) ———————————————–

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:20:30, on 22/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\DeviceListener.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\ConAppM.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Documents and Settings\Anton\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Anton.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.za/
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {04A50AA9-E066-4168-B8F9-670D744492C8} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0f68a09b-ce1a-4581-939c-69384dd8e0fb} - (no file)
O2 - BHO: (no name) - {20c39dc0-cfe4-4e48-b3f6-6dae93b09383} - (no file)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {25A12E63-12C4-4526-8BB5-D9E72167CF92} - (no file)
O2 - BHO: (no name) - {4a7f4d29-bacb-4668-a610-46c5d87f1e94} - (no file)
O2 - BHO: (no name) - {5027D158-47A4-46B3-A07C-A9FB0D7D0799} - (no file)
O2 - BHO: (no name) - {51deea14-4a45-4ab8-bc22-de0889aeecfd} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
O2 - BHO: (no name) - {599cb252-b932-491c-b1be-207786fb76a4} - (no file)
O2 - BHO: (no name) - {6020c6ca-08d1-4876-9cf3-a0aa8e916910} - (no file)
O2 - BHO: (no name) - {624694C5-D9E3-4534-AA84-E80368A9A308} - (no file)
O2 - BHO: (no name) - {6B53F42F-BA41-419E-A427-B567DC09C967} - (no file)
O2 - BHO: (no name) - {6E0F8E72-16A9-4430-BA7B-B028570D516F} - (no file)
O2 - BHO: (no name) - {8D911365-4A3C-452E-B3F0-CC2D750FDFC7} - (no file)
O2 - BHO: (no name) - {9B22B9D1-7F1F-42F9-81E5-1606DE23708D} - (no file)
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - (no file)
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {b47dbfba-e866-4b1e-a167-af88b635a5b3} - (no file)
O2 - BHO: (no name) - {c5834da1-2720-4ccc-93a7-5c30d25ceb29} - (no file)
O2 - BHO: (no name) - {c58a6214-9035-4965-bf16-d4fbb076a104} - (no file)
O2 - BHO: (no name) - {C932B390-4685-49D7-8458-F8E6166DA9C1} - (no file)
O2 - BHO: (no name) - {D951DD00-0AE7-4593-AD43-D91457AD1C69} - (no file)
O2 - BHO: (no name) - {E08400A7-CF77-40C1-8246-05A721367985} - (no file)
O2 - BHO: (no name) - {e5115a54-83a6-4246-9c06-37336abb1609} - (no file)
O2 - BHO: (no name) - {F5434312-49C4-41B7-A59D-16C1B94958BA} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Save Flash - {4064EA35-578D-4073-A834-C96D82CBCF40} - C:\Program Files\Save Flash\SaveFlash.dll
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [TotalRecorderScheduler] "C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx2\PXConsole.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [70625938] rundll32.exe "C:\WINDOWS\system32\cilttncb.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MobileConnect.EXE] C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.EXE
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [WinAble] C:\Program Files\WinAble\winable.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Flash Decompiler SWF Capture tool - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\PROGRA~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU)
O9 - Extra 'Tools' menuitem: Flash Decompiler SWF Capture tool menu - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\PROGRA~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6D78A853-2EA2-45A1-B621-C98FF625398F}: NameServer = 196.207.35.29 196.207.35.30
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: byxxx - C:\WINDOWS\
O20 - Winlogon Notify: mljii - C:\WINDOWS\
O20 - Winlogon Notify: nnnklmk - C:\WINDOWS\
O20 - Winlogon Notify: qfchkbwy - C:\WINDOWS\
O20 - Winlogon Notify: tuvspnl - C:\WINDOWS\
O20 - Winlogon Notify: uxoncaup - C:\WINDOWS\
O20 - Winlogon Notify: winkgg32 - C:\WINDOWS\
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: PREVXAgent - Unknown owner - C:\Program Files\Prevx2\PXAgent.exe (file missing)

–
End of file - 9714 bytes

– Files created between 2007-10-22 and 2007-11-22 —————————–

2007-11-22 13:49:41 0 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-11-22 13:49:38 0 d——– C:\WINDOWS\LastGood
2007-11-21 21:51:25 0 –a—— C:\WINDOWS\nsreg.dat
2007-11-21 21:51:16 0 d——– C:\Documents and Settings\Anton\Application Data\Mozilla
2007-11-20 07:45:51 0 d——– C:\WINDOWS\ERUNT
2007-11-20 07:27:57 0 d——– C:\Program Files\Trend Micro
2007-11-19 16:30:06 0 d——– C:\Program Files\JAlbumWin
2007-11-19 12:40:02 0 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-11-19 12:13:15 0 d——– C:\Documents and Settings\Anton\Application Data\uTorrent
2007-11-19 12:13:13 0 d——– C:\Program Files\uTorrent
2007-11-19 12:12:07 0 d——– C:\Anton
2007-11-19 11:49:55 0 d–hs—- C:\Documents and Settings\Anton\UserData
2007-11-19 03:12:48 0 d——– C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2007-11-19 03:09:59 0 d——– C:\Documents and Settings\Anton\Application Data\Macromedia
2007-11-19 03:09:53 0 d——– C:\Program Files\Yahoo!
2007-11-19 02:52:57 0 d——– C:\Documents and Settings\Anton\Application Data\Vodafone Mobile Connect
2007-11-19 02:51:20 237568 –a—-c- C:\WINDOWS\VMC9SavedNwtGatewayDLL.dll

Indi, This is weird!

I disabled Teatimer, rebooted - checked and fixed the HJT files - see log below, it looks like the files are gone right?

So I enabled teatimer again and reran HJT and the files are back !!! (see log below this one): So could SSD be the culprit?

Thanks again,

A




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:27:42, on 23/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.EXE
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\DeviceListener.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\ConAppM.exe
C:\Program Files\Trend Micro\HijackThis\FindVundo.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.za/
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Save Flash - {4064EA35-578D-4073-A834-C96D82CBCF40} - C:\Program Files\Save Flash\SaveFlash.dll
O4 - HKLM\..\Run: [TotalRecorderScheduler] "C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx2\PXConsole.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MobileConnect.EXE] C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.EXE
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Flash Decompiler SWF Capture tool - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\PROGRA~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU)
O9 - Extra 'Tools' menuitem: Flash Decompiler SWF Capture tool menu - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\PROGRA~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: PREVXAgent - Unknown owner - C:\Program Files\Prevx2\PXAgent.exe (file missing)

–
End of file - 7080 bytes


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:35:45, on 23/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.EXE
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\DeviceListener.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\ConAppM.exe
C:\Program Files\Trend Micro\HijackThis\FindVundo.exe.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.za/
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {04A50AA9-E066-4168-B8F9-670D744492C8} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0f68a09b-ce1a-4581-939c-69384dd8e0fb} - (no file)
O2 - BHO: (no name) - {20c39dc0-cfe4-4e48-b3f6-6dae93b09383} - (no file)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {25A12E63-12C4-4526-8BB5-D9E72167CF92} - (no file)
O2 - BHO: (no name) - {4a7f4d29-bacb-4668-a610-46c5d87f1e94} - (no file)
O2 - BHO: (no name) - {5027D158-47A4-46B3-A07C-A9FB0D7D0799} - (no file)
O2 - BHO: (no name) - {51deea14-4a45-4ab8-bc22-de0889aeecfd} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
O2 - BHO: (no name) - {599cb252-b932-491c-b1be-207786fb76a4} - (no file)
O2 - BHO: (no name) - {6020c6ca-08d1-4876-9cf3-a0aa8e916910} - (no file)
O2 - BHO: (no name) - {624694C5-D9E3-4534-AA84-E80368A9A308} - (no file)
O2 - BHO: (no name) - {6B53F42F-BA41-419E-A427-B567DC09C967} - (no file)
O2 - BHO: (no name) - {6E0F8E72-16A9-4430-BA7B-B028570D516F} - (no file)
O2 - BHO: (no name) - {8D911365-4A3C-452E-B3F0-CC2D750FDFC7} - (no file)
O2 - BHO: (no name) - {9B22B9D1-7F1F-42F9-81E5-1606DE23708D} - (no file)
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - (no file)
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {b47dbfba-e866-4b1e-a167-af88b635a5b3} - (no file)
O2 - BHO: (no name) - {c5834da1-2720-4ccc-93a7-5c30d25ceb29} - (no file)
O2 - BHO: (no name) - {c58a6214-9035-4965-bf16-d4fbb076a104} - (no file)
O2 - BHO: (no name) - {C932B390-4685-49D7-8458-F8E6166DA9C1} - (no file)
O2 - BHO: (no name) - {D951DD00-0AE7-4593-AD43-D91457AD1C69} - (no file)
O2 - BHO: (no name) - {E08400A7-CF77-40C1-8246-05A721367985} - (no file)
O2 - BHO: (no name) - {e5115a54-83a6-4246-9c06-37336abb1609} - (no file)
O2 - BHO: (no name) - {F5434312-49C4-41B7-A59D-16C1B94958BA} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Save Flash - {4064EA35-578D-4073-A834-C96D82CBCF40} - C:\Program Files\Save Flash\SaveFlash.dll
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [TotalRecorderScheduler] "C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx2\PXConsole.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [70625938] rundll32.exe "C:\WINDOWS\system32\cilttncb.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MobileConnect.EXE] C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.EXE
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [WinAble] C:\Program Files\WinAble\winable.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Flash Decompiler SWF Capture tool - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\PROGRA~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU)
O9 - Extra 'Tools' menuitem: Flash Decompiler SWF Capture tool menu - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\PROGRA~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6D78A853-2EA2-45A1-B621-C98FF625398F}: NameServer = 196.207.35.29 196.207.35.30
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: byxxx - C:\WINDOWS\
O20 - Winlogon Notify: mljii - C:\WINDOWS\
O20 - Winlogon Notify: nnnklmk - C:\WINDOWS\
O20 - Winlogon Notify: qfchkbwy - C:\WINDOWS\
O20 - Winlogon Notify: tuvspnl - C:\WINDOWS\
O20 - Winlogon Notify: uxoncaup - C:\WINDOWS\
O20 - Winlogon Notify: winkgg32 - C:\WINDOWS\
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: PREVXAgent - Unknown owner - C:\Program Files\Prevx2\PXAgent.exe (file missing)

–
End of file - 9743 bytes