What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Virus/Trojan - explorer .exe

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Firstly, the computer I am trying to fix is not my own and I am accessing it remotely.
Shortly after startup:

p-07-0100 irql: 1f SYSVER 0xff0024
NT_Kernel error 1256
KMODE_EXCEPTION_NOT_HANDLED

and then this after 10-15 minutes:

A potential problem has been detected and Windows has been shutdown buggy application to prevent damage to your computer.
****WXYZ.SYS - Address F73120AE base at C00000, DateStamp 36b072A3
Kernel Debugger Using: COM2 (Port0x28f, Baud rat 192000)"

The user had two new icons on her desktop, Windows XP's "Help and Support" icon and Windows XP's "Windows Update", both pointing to http://storageprotector.com. Symptoms of this infection included sluggishness, inability to double-click "My computer" icon as well as others, depending of the configuration of the system

Here is HJT Log. Hope it's supposed to go here.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:46:16 PM, on 1/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\wanmpsvc.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\iConcepts Music Express\MEAutoDetect.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Grisoft\AVG7\avgwb.dat
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Documents and Settings\Mary Kay O'Connor\Desktop\HiJackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {10BCAEE8-C9E9-4870-A031-EA9C2874ACEC} - C:\WINDOWS\system32\vtstr.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll
O2 - BHO: (no name) - {D4576C73-52BD-4401-B966-5A128C4433D4} - C:\WINDOWS\system32\qommjji.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask .exe" -atboottime
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Dot1XCfg] C:\Program Files\Dot1XCfg\Dot1XCfg.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-3200903036-260940732-2997775758-1011\..\Run: [Sonic RecordNow!] (User 'LogMeInRemoteUser')
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Auto Detect.lnk = C:\Program Files\iConcepts Music Express\MEAutoDetect.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: officejet 6100.lnk = ?
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O20 - Winlogon Notify: qommjji - qommjji.dll (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\TWFyeSBLYXkgTydDb25ub3I\command.exe (file missing)
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: Microsoft cache control (MSControlService) - Unknown owner - C:\WINDOWS\system32\windows (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

–
End of file - 7910 bytes

Also, here is CCleaner Log.. In case it helps.

Adobe Download Manager 2.0 (Remove Only)
Adobe Flash Player ActiveX
Adobe Reader 7.0.5
Adobe® Photoshop® Album Starter Edition 3.0
America Online (Choose which version to remove)
AOL Coach Version 1.0(Build:20030807.3)
AOL Instant Messenger
Apple Mobile Device Support
Apple Software Update
Banctec Service Agreement
Broadcom Management Programs
BufferChm
Camera Window
CameraDrivers
Canon Camera Window for ZoomBrowser EX
Canon PhotoRecord
Canon RAW Image Task for ZoomBrowser EX
Canon RemoteCapture Task for ZoomBrowser EX
Canon Utilities File Viewer Utility 1.3
Canon Utilities PhotoStitch 3.1
Canon Utilities RemoteCapture 2.7
Canon Utilities ZoomBrowser EX
CCleaner (remove only)
Conexant SmartHSFi V.9x 56K DF PCI Modem
Create and Print Greeting Cards 1.0
CreativeProjects
CreativeProjectsTemplates
Cue Club
CueTour
Dell Digital Jukebox Driver
Dell Media Experience
Dell Networking Guide
Dell Solution Center
DellSupport
Destinations
Digital Line Detect
Diner Dash (remove only)
Diner Dash 2 (remove only)
Director
Dot1XCfg
DVDSentry
EarthLink Setup Files
File Viewer Utility 1.3.2
FUJIFILM USB Driver
Google Toolbar for Internet Explorer
Help and Support Customization
HP Image Zone 4.5
HP Memories Disc
hp officejet 6100 series
HP Photo and Imaging 2.0 - All-in-One
HP Photo and Imaging 2.0 - All-in-One Drivers
HP Photo and Imaging 2.0 - hp officejet 6100 series
HP Photosmart Cameras 4.5
HP Product Assistant
HP Software Update
HPSystemDiagnostics
iConcepts Music Express
InstantShare
Intel® Extreme Graphics Driver
Interactive User’s Guide
Internet Explorer Default Page
iTunes
Jasc Paint Shop Photo Album
Jasc Paint Shop Pro 8 Dell Edition
Java 2 Runtime Environment, SE v1.4.2
JEOPARDY! (remove only)
Kick N Rush
Learn2 Player (Uninstall Only)
LogMeIn
McAfee SecurityCenter
McAfee VirusScan
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft Data Access Components KB870669
Microsoft Encarta Encyclopedia Standard 2004
Microsoft Money 2004
Microsoft Money 2004 System Pack
Microsoft Picture It! Photo Premium 9
Microsoft Streets and Trips 2004
Microsoft Word 2002
Microsoft Works
Microsoft Works 2004 Setup Launcher
Microsoft Works Suite Add-in for Microsoft Word
Modem Helper
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
NetWaiting
Panda Craze Gold (remove only)
PanoStandAlone
PhotoGallery
PhotoStitch
Polar Bowler
PowerDVD
QFolder
QuickTime
RAW Image Task
RealOne Player
RemoteCapture 2.7.5
RemoteCapture Task
Saints & Sinners Bowling
Scholastic's I SPY
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB911565)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928090)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB929969)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931768)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933566)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937143)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB939653)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB942615)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
ShareIns
Shockwave
SkinsHP1
Sonic DLA
Sonic RecordNow!
Sonic Update Manager
Spybot - Search & Destroy
TrayApp
Typing Quick & Easy
Unload
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB942840)
Update for Windows XP (KB946627)
USB Driver Vers. 3.2
Viewpoint Manager (Remove Only)
Viewpoint Media Player
Web Buying
WebFldrs XP
WebReg
Wheel of Fortune (remove only)
Windows Installer 3.1 (KB893803)
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Windows XP Service Pack 2
Yahoo! Ten Pin Championship Bowling
Yahoo! Toolbar
Zoombinis Logical Journey™

Any/All Help is MUCH appreciated. Thanks very much,
- Maggie
[removed]
Post #2
I just want to give a little more information on this.. Originally it was spawning explorer.exe's, explorer .exe (not the space before the .exe), command.exe. My friend was able to stop most of that.. So.. at this point, the PC is in better shape.. It still has the red x on the C drive.. but the windows help icons were able to be removed and I've run a bunch of antivirus programs and spyware removal programs. I's still like to know (as the HJT log is current) if there are more steps I should be taking. Thanks so very much for your help. - Maggie
Post #3
Hello and Welcome to the forum.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.

Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.


(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:

Download ComboFix from Here to your Desktop.

**Note: In the event you already have Combofix, please delete it from your desktop and download this new version . It is important that it is saved directly to your desktop**
——————————————————————–
  • Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
  • WARNING: IF you have not already done so Combofix will disconnect your machine from the Internet when it starts
  • Please do not re-connect your machine back to the Internet until Combofix has completely finished.
——————————————————————–

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.
Post #4
Hi there. I am so so sorry it has taken me so long to get back to you. .This computer is remote and lots of other reasons. .Also, fyi, we have it running pretty well right now.. the only obvious thing left from this virus is the red X on the C drive. It's working fine though. Anyway, here are the logs you requested. I would still take any suggestions you have to further clean up this computer.
First, ComboFix:
ComboFix 08-01-20.1 - Mary Kay O'Connor 2008-01-28 16:52:38.2 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Christian\Application Data\Starware337
C:\Documents and Settings\Christian\Application Data\Starware337\BrowserSearch\BrowserSearch.xml
C:\Documents and Settings\Christian\Application Data\Starware337\BrowserSearch\BrowserSearch.xml.backup
C:\Documents and Settings\Christian\Application Data\Starware337\Configurator\Configurator.xml
C:\Documents and Settings\Christian\Application Data\Starware337\Configurator\Configurator.xml.backup
C:\Documents and Settings\Christian\Application Data\Starware337\ErrorSearch\ErrorSearchOptions.xml
C:\Documents and Settings\Christian\Application Data\Starware337\ErrorSearch\ErrorSearchOptions.xml.backup
C:\Documents and Settings\Christian\Application Data\Starware337\Games\GamesOptions.xml
C:\Documents and Settings\Christian\Application Data\Starware337\Games\GamesOptions.xml.backup
C:\Documents and Settings\Christian\Application Data\Starware337\Layouts\ToolbarLayout.xml
C:\Documents and Settings\Christian\Application Data\Starware337\Layouts\ToolbarLayout.xml.backup
C:\Documents and Settings\Christian\Application Data\Starware337\Manager\ManagerOptions.xml
C:\Documents and Settings\Christian\Application Data\Starware337\Manager\ManagerOptions.xml.backup
C:\Documents and Settings\Christian\Application Data\Starware337\Movies\MoviesOptions.xml
C:\Documents and Settings\Christian\Application Data\Starware337\Movies\MoviesOptions.xml.backup
C:\Documents and Settings\Christian\Application Data\Starware337\Recipes\RecipesOptions.xml
C:\Documents and Settings\Christian\Application Data\Starware337\Recipes\RecipesOptions.xml.backup
C:\Documents and Settings\Christian\Application Data\Starware337\Reference\ReferenceOptions.xml
C:\Documents and Settings\Christian\Application Data\Starware337\Reference\ReferenceOptions.xml.backup
C:\Documents and Settings\Christian\Application Data\Starware337\RelatedSearch\RelatedSearchOptions.xml
C:\Documents and Settings\Christian\Application Data\Starware337\RelatedSearch\RelatedSearchOptions.xml.backup
C:\Documents and Settings\Christian\Application Data\Starware337\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml
C:\Documents and Settings\Christian\Application Data\Starware337\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup
C:\Documents and Settings\Christian\Application Data\Starware337\SearchAssistPlus\SearchAssistPlusOptions.xml
C:\Documents and Settings\Christian\Application Data\Starware337\SearchAssistPlus\SearchAssistPlusOptions.xml.backup
C:\Documents and Settings\Christian\Application Data\Starware337\SearchMatch\SearchMatchOptions.xml
C:\Documents and Settings\Christian\Application Data\Starware337\SearchMatch\SearchMatchOptions.xml.backup
C:\Documents and Settings\Christian\Application Data\Starware337\Toolbar\TBProductsOptions.xml
C:\Documents and Settings\Christian\Application Data\Starware337\Toolbar\TBProductsOptions.xml.backup
C:\Documents and Settings\Christian\Application Data\Starware337\ToolbarLogo\ToolbarLogoOptions.xml
C:\Documents and Settings\Christian\Application Data\Starware337\ToolbarLogo\ToolbarLogoOptions.xml.backup
C:\Documents and Settings\Christian\Application Data\Starware337\ToolbarSearch\ToolbarSearchOptions.xml
C:\Documents and Settings\Christian\Application Data\Starware337\ToolbarSearch\ToolbarSearchOptions.xml.backup
C:\Documents and Settings\Christian\Application Data\Starware337\TravelSearch\TravelSearchOptions.xml
C:\Documents and Settings\Christian\Application Data\Starware337\TravelSearch\TravelSearchOptions.xml.backup
C:\Documents and Settings\Christian\Application Data\Starware337\Weather\AlertArchive.xml
C:\Documents and Settings\Christian\Application Data\Starware337\Weather\WeatherOptions.xml
C:\Documents and Settings\Christian\Application Data\Starware337\Weather\WeatherOptions.xml.backup
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\BrowserSearch\BrowserSearch.xml
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\BrowserSearch\BrowserSearch.xml.backup
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\Configurator\Configurator.xml
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\Configurator\Configurator.xml.backup
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\ErrorSearch\ErrorSearchOptions.xml
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\ErrorSearch\ErrorSearchOptions.xml.backup
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\Games\GamesOptions.xml
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\Games\GamesOptions.xml.backup
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\Layouts\ToolbarLayout.xml
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\Layouts\ToolbarLayout.xml.backup
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\Layouts\WeatherLayout.xml
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\Layouts\WeatherLayout.xml.backup
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\Manager\ManagerOptions.xml
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\Manager\ManagerOptions.xml.backup
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\Movies\MoviesOptions.xml
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\Movies\MoviesOptions.xml.backup
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\Recipes\RecipesOptions.xml
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\Recipes\RecipesOptions.xml.backup
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\Reference\ReferenceOptions.xml
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\Reference\ReferenceOptions.xml.backup
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\RelatedSearch\RelatedSearchOptions.xml
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\RelatedSearch\RelatedSearchOptions.xml.backup
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\SearchAssistPlus\SearchAssistPlusOptions.xml
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\SearchAssistPlus\SearchAssistPlusOptions.xml.backup
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\SearchMatch\SearchMatchOptions.xml
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\SearchMatch\SearchMatchOptions.xml.backup
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\Toolbar\TBProductsOptions.xml
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\Toolbar\TBProductsOptions.xml.backup
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\ToolbarLogo\ToolbarLogoOptions.xml
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\ToolbarLogo\ToolbarLogoOptions.xml.backup
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\ToolbarSearch\ToolbarSearchOptions.xml
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\ToolbarSearch\ToolbarSearchOptions.xml.backup
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\TravelSearch\TravelSearchOptions.xml
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\TravelSearch\TravelSearchOptions.xml.backup
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\Weather\AlertArchive.xml
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\Weather\WeatherOptions.xml
C:\Documents and Settings\Edila O'Connor\Application Data\Starware337\Weather\WeatherOptions.xml.backup
C:\Documents and Settings\Gracie\Application Data\Starware337
C:\Documents and Settings\Gracie\Application Data\Starware337\BrowserSearch\BrowserSearch.xml
C:\Documents and Settings\Gracie\Application Data\Starware337\BrowserSearch\BrowserSearch.xml.backup
C:\Documents and Settings\Gracie\Application Data\Starware337\Configurator\Configurator.xml
C:\Documents and Settings\Gracie\Application Data\Starware337\Configurator\Configurator.xml.backup
C:\Documents and Settings\Gracie\Application Data\Starware337\ErrorSearch\ErrorSearchOptions.xml
C:\Documents and Settings\Gracie\Application Data\Starware337\ErrorSearch\ErrorSearchOptions.xml.backup
C:\Documents and Settings\Gracie\Application Data\Starware337\Games\GamesOptions.xml
C:\Documents and Settings\Gracie\Application Data\Starware337\Games\GamesOptions.xml.backup
C:\Documents and Settings\Gracie\Application Data\Starware337\Layouts\ToolbarLayout.xml
C:\Documents and Settings\Gracie\Application Data\Starware337\Layouts\ToolbarLayout.xml.backup
C:\Documents and Settings\Gracie\Application Data\Starware337\Layouts\WeatherLayout.xml
C:\Documents and Settings\Gracie\Application Data\Starware337\Layouts\WeatherLayout.xml.backup
C:\Documents and Settings\Gracie\Application Data\Starware337\Manager\ManagerOptions.xml
C:\Documents and Settings\Gracie\Application Data\Starware337\Manager\ManagerOptions.xml.backup
C:\Documents and Settings\Gracie\Application Data\Starware337\Movies\MoviesOptions.xml
C:\Documents and Settings\Gracie\Application Data\Starware337\Movies\MoviesOptions.xml.backup
C:\Documents and Settings\Gracie\Application Data\Starware337\Recipes\RecipesOptions.xml
C:\Documents and Settings\Gracie\Application Data\Starware337\Recipes\RecipesOptions.xml.backup
C:\Documents and Settings\Gracie\Application Data\Starware337\Reference\ReferenceOptions.xml
C:\Documents and Settings\Gracie\Application Data\Starware337\Reference\ReferenceOptions.xml.backup
C:\Documents and Settings\Gracie\Application Data\Starware337\RelatedSearch\RelatedSearchOptions.xml
C:\Documents and Settings\Gracie\Application Data\Starware337\RelatedSearch\RelatedSearchOptions.xml.backup
C:\Documents and Settings\Gracie\Application Data\Starware337\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml
C:\Documents and Settings\Gracie\Application Data\Starware337\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup
C:\Documents and Settings\Gracie\Application Data\Starware337\SearchAssistPlus\SearchAssistPlusOptions.xml
C:\Documents and Settings\Gracie\Application Data\Starware337\SearchAssistPlus\SearchAssistPlusOptions.xml.backup
C:\Documents and Settings\Gracie\Application Data\Starware337\SearchMatch\SearchMatchOptions.xml
C:\Documents and Settings\Gracie\Application Data\Starware337\SearchMatch\SearchMatchOptions.xml.backup
C:\Documents and Settings\Gracie\Application Data\Starware337\Toolbar\TBProductsOptions.xml
C:\Documents and Settings\Gracie\Application Data\Starware337\Toolbar\TBProductsOptions.xml.backup
C:\Documents and Settings\Gracie\Application Data\Starware337\ToolbarLogo\ToolbarLogoOptions.xml
C:\Documents and Settings\Gracie\Application Data\Starware337\ToolbarLogo\ToolbarLogoOptions.xml.backup
C:\Documents and Settings\Gracie\Application Data\Starware337\ToolbarSearch\ToolbarSearchOptions.xml
C:\Documents and Settings\Gracie\Application Data\Starware337\ToolbarSearch\ToolbarSearchOptions.xml.backup
C:\Documents and Settings\Gracie\Application Data\Starware337\TravelSearch\TravelSearchOptions.xml
C:\Documents and Settings\Gracie\Application Data\Starware337\TravelSearch\TravelSearchOptions.xml.backup
C:\Documents and Settings\Gracie\Application Data\Starware337\Weather\AlertArchive.xml
C:\Documents and Settings\Gracie\Application Data\Starware337\Weather\WeatherOptions.xml
C:\Documents and Settings\Gracie\Application Data\Starware337\Weather\WeatherOptions.xml.backup
C:\Documents and Settings\Julianna\Application Data\Starware337
C:\Documents and Settings\Julianna\Application Data\Starware337\BrowserSearch\BrowserSearch.xml
C:\Documents and Settings\Julianna\Application Data\Starware337\BrowserSearch\BrowserSearch.xml.backup
C:\Documents and Settings\Julianna\Application Data\Starware337\Configurator\Configurator.xml
C:\Documents and Settings\Julianna\Application Data\Starware337\Configurator\Configurator.xml.backup
C:\Documents and Settings\Julianna\Application Data\Starware337\ErrorSearch\ErrorSearchOptions.xml
C:\Documents and Settings\Julianna\Application Data\Starware337\ErrorSearch\ErrorSearchOptions.xml.backup
C:\Documents and Settings\Julianna\Application Data\Starware337\Games\GamesOptions.xml
C:\Documents and Settings\Julianna\Application Data\Starware337\Games\GamesOptions.xml.backup
C:\Documents and Settings\Julianna\Application Data\Starware337\Layouts\ToolbarLayout.xml
C:\Documents and Settings\Julianna\Application Data\Starware337\Layouts\ToolbarLayout.xml.backup
C:\Documents and Settings\Julianna\Application Data\Starware337\Manager\ManagerOptions.xml
C:\Documents and Settings\Julianna\Application Data\Starware337\Manager\ManagerOptions.xml.backup
C:\Documents and Settings\Julianna\Application Data\Starware337\Movies\MoviesOptions.xml
C:\Documents and Settings\Julianna\Application Data\Starware337\Movies\MoviesOptions.xml.backup
C:\Documents and Settings\Julianna\Application Data\Starware337\Recipes\RecipesOptions.xml
C:\Documents and Settings\Julianna\Application Data\Starware337\Recipes\RecipesOptions.xml.backup
C:\Documents and Settings\Julianna\Application Data\Starware337\Reference\ReferenceOptions.xml
C:\Documents and Settings\Julianna\Application Data\Starware337\Reference\ReferenceOptions.xml.backup
C:\Documents and Settings\Julianna\Application Data\Starware337\RelatedSearch\RelatedSearchOptions.xml
C:\Documents and Settings\Julianna\Application Data\Starware337\RelatedSearch\RelatedSearchOptions.xml.backup
C:\Documents and Settings\Julianna\Application Data\Starware337\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml
C:\Documents and Settings\Julianna\Application Data\Starware337\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup
C:\Documents and Settings\Julianna\Application Data\Starware337\SearchAssistPlus\SearchAssistPlusOptions.xml
C:\Documents and Settings\Julianna\Application Data\Starware337\SearchAssistPlus\SearchAssistPlusOptions.xml.backup
C:\Documents and Settings\Julianna\Application Data\Starware337\SearchMatch\SearchMatchOptions.xml
C:\Documents and Settings\Julianna\Application Data\Starware337\SearchMatch\SearchMatchOptions.xml.backup
C:\Documents and Settings\Julianna\Application Data\Starware337\Toolbar\TBProductsOptions.xml
C:\Documents and Settings\Julianna\Application Data\Starware337\Toolbar\TBProductsOptions.xml.backup
C:\Documents and Settings\Julianna\Application Data\Starware337\ToolbarLogo\ToolbarLogoOptions.xml
C:\Documents and Settings\Julianna\Application Data\Starware337\ToolbarLogo\ToolbarLogoOptions.xml.backup
C:\Documents and Settings\Julianna\Application Data\Starware337\ToolbarSearch\ToolbarSearchOptions.xml
C:\Documents and Settings\Julianna\Application Data\Starware337\ToolbarSearch\ToolbarSearchOptions.xml.backup
C:\Documents and Settings\Julianna\Application Data\Starware337\TravelSearch\TravelSearchOptions.xml
C:\Documents and Settings\Julianna\Application Data\Starware337\TravelSearch\TravelSearchOptions.xml.backup
C:\Documents and Settings\Julianna\Application Data\Starware337\Weather\AlertArchive.xml
C:\Documents and Settings\Julianna\Application Data\Starware337\Weather\WeatherOptions.xml
C:\Documents and Settings\Julianna\Application Data\Starware337\Weather\WeatherOptions.xml.backup
C:\Documents and Settings\Liam\Application Data\Starware337
C:\Documents and Settings\Liam\Application Data\Starware337\BrowserSearch\BrowserSearch.xml
C:\Documents and Settings\Liam\Application Data\Starware337\BrowserSearch\BrowserSearch.xml.backup
C:\Documents and Settings\Liam\Application Data\Starware337\Configurator\Configurator.xml
C:\Documents and Settings\Liam\Application Data\Starware337\Configurator\Configurator.xml.backup
C:\Documents and Settings\Liam\Application Data\Starware337\ErrorSearch\ErrorSearchOptions.xml
C:\Documents and Settings\Liam\Application Data\Starware337\ErrorSearch\ErrorSearchOptions.xml.backup
C:\Documents and Settings\Liam\Application Data\Starware337\Games\GamesOptions.xml
C:\Documents and Settings\Liam\Application Data\Starware337\Games\GamesOptions.xml.backup
C:\Documents and Settings\Liam\Application Data\Starware337\Layouts\ToolbarLayout.xml
C:\Documents and Settings\Liam\Application Data\Starware337\Layouts\ToolbarLayout.xml.backup
C:\Documents and Settings\Liam\Application Data\Starware337\Manager\ManagerOptions.xml
C:\Documents and Settings\Liam\Application Data\Starware337\Manager\ManagerOptions.xml.backup
C:\Documents and Settings\Liam\Application Data\Starware337\Movies\MoviesOptions.xml
C:\Documents and Settings\Liam\Application Data\Starware337\Movies\MoviesOptions.xml.backup
C:\Documents and Settings\Liam\Application Data\Starware337\Recipes\RecipesOptions.xml
C:\Documents and Settings\Liam\Application Data\Starware337\Recipes\RecipesOptions.xml.backup
C:\Documents and Settings\Liam\Application Data\Starware337\Reference\ReferenceOptions.xml
C:\Documents and Settings\Liam\Application Data\Starware337\Reference\ReferenceOptions.xml.backup
C:\Documents and Settings\Liam\Application Data\Starware337\RelatedSearch\RelatedSearchOptions.xml
C:\Documents and Settings\Liam\Application Data\Starware337\RelatedSearch\RelatedSearchOptions.xml.backup
C:\Documents and Settings\Liam\Application Data\Starware337\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml
C:\Documents and Settings\Liam\Application Data\Starware337\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup
C:\Documents and Settings\Liam\Application Data\Starware337\SearchAssistPlus\SearchAssistPlusOptions.xml
C:\Documents and Settings\Liam\Application Data\Starware337\SearchAssistPlus\SearchAssistPlusOptions.xml.backup
C:\Documents and Settings\Liam\Application Data\Starware337\SearchMatch\SearchMatchOptions.xml
C:\Documents and Settings\Liam\Application Data\Starware337\SearchMatch\SearchMatchOptions.xml.backup
C:\Documents and Settings\Liam\Application Data\Starware337\Toolbar\TBProductsOptions.xml
C:\Documents and Settings\Liam\Application Data\Starware337\Toolbar\TBProductsOptions.xml.backup
C:\Documents and Settings\Liam\Application Data\Starware337\ToolbarLogo\ToolbarLogoOptions.xml
C:\Documents and Settings\Liam\Application Data\Starware337\ToolbarLogo\ToolbarLogoOptions.xml.backup
C:\Documents and Settings\Liam\Application Data\Starware337\ToolbarSearch\ToolbarSearchOptions.xml
C:\Documents and Settings\Liam\Application Data\Starware337\ToolbarSearch\ToolbarSearchOptions.xml.backup
C:\Documents and Settings\Liam\Application Data\Starware337\TravelSearch\TravelSearchOptions.xml
C:\Documents and Settings\Liam\Application Data\Starware337\TravelSearch\TravelSearchOptions.xml.backup
C:\Documents and Settings\Liam\Application Data\Starware337\Weather\AlertArchive.xml
C:\Documents and Settings\Liam\Application Data\Starware337\Weather\WeatherOptions.xml
C:\Documents and Settings\Liam\Application Data\Starware337\Weather\WeatherOptions.xml.backup
C:\Documents and Settings\LocalService\Application Data\Starware337
C:\Documents and Settings\LocalService\Application Data\Starware337\Games\GamesOptions.xml
C:\Documents and Settings\LocalService\Application Data\Starware337\Games\GamesOptions.xml.backup
C:\Documents and Settings\LocalService\Application Data\Starware337\Movies\MoviesOptions.xml
C:\Documents and Settings\LocalService\Application Data\Starware337\Movies\MoviesOptions.xml.backup
C:\Documents and Settings\LocalService\Application Data\Starware337\Recipes\RecipesOptions.xml
C:\Documents and Settings\LocalService\Application Data\Starware337\Recipes\RecipesOptions.xml.backup
C:\Documents and Settings\LocalService\Application Data\Starware337\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml
C:\Documents and Settings\LocalService\Application Data\Starware337\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup
C:\Documents and Settings\NetworkService\Application Data\Starware337
C:\Documents and Settings\NetworkService\Application Data\Starware337\Games\GamesOptions.xml
C:\Documents and Settings\NetworkService\Application Data\Starware337\Games\GamesOptions.xml.backup
C:\Documents and Settings\NetworkService\Application Data\Starware337\Movies\MoviesOptions.xml
C:\Documents and Settings\NetworkService\Application Data\Starware337\Movies\MoviesOptions.xml.backup
C:\Documents and Settings\NetworkService\Application Data\Starware337\Recipes\RecipesOptions.xml
C:\Documents and Settings\NetworkService\Application Data\Starware337\Recipes\RecipesOptions.xml.backup
C:\Documents and Settings\NetworkService\Application Data\Starware337\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml
C:\Documents and Settings\NetworkService\Application Data\Starware337\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\BrowserSearch\BrowserSearch.xml
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\BrowserSearch\BrowserSearch.xml.backup
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\Configurator\Configurator.xml
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\Configurator\Configurator.xml.backup
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\ErrorSearch\ErrorSearchOptions.xml
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\ErrorSearch\ErrorSearchOptions.xml.backup
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\Games\GamesOptions.xml
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\Games\GamesOptions.xml.backup
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\Layouts\ToolbarLayout.xml
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\Layouts\ToolbarLayout.xml.backup
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\Manager\ManagerOptions.xml
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\Manager\ManagerOptions.xml.backup
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\Movies\MoviesOptions.xml
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\Movies\MoviesOptions.xml.backup
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\Recipes\RecipesOptions.xml
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\Recipes\RecipesOptions.xml.backup
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\Reference\ReferenceOptions.xml
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\Reference\ReferenceOptions.xml.backup
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\RelatedSearch\RelatedSearchOptions.xml
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\RelatedSearch\RelatedSearchOptions.xml.backup
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\SearchAssistPlus\SearchAssistPlusOptions.xml
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\SearchAssistPlus\SearchAssistPlusOptions.xml.backup
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\SearchMatch\SearchMatchOptions.xml
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\SearchMatch\SearchMatchOptions.xml.backup
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\Toolbar\TBProductsOptions.xml
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\Toolbar\TBProductsOptions.xml.backup
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\ToolbarLogo\ToolbarLogoOptions.xml
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\ToolbarLogo\ToolbarLogoOptions.xml.backup
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\ToolbarSearch\ToolbarSearchOptions.xml
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\ToolbarSearch\ToolbarSearchOptions.xml.backup
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\TravelSearch\TravelSearchOptions.xml
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\TravelSearch\TravelSearchOptions.xml.backup
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\Weather\AlertArchive.xml
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\Weather\WeatherOptions.xml
C:\Documents and Settings\Sikorrya O'Connor\Application Data\Starware337\Weather\WeatherOptions.xml.backup
C:\Program Files\Common Files\icroso~1
C:\Program Files\Common Files\icroso~1\?ti2evxx.exe
C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe
C:\Program Files\Temporary
C:\WINDOWS\system32\atmtd.dll._
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\Configurator\Configurator.xml
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\Configurator\Configurator.xml.backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\ErrorSearch\ErrorSearchOptions.xml
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\ErrorSearch\ErrorSearchOptions.xml.backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\Games\GamesOptions.xml
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\Games\GamesOptions.xml.backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\Layouts\ToolbarLayout.xml
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\Layouts\ToolbarLayout.xml.backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\Manager\ManagerOptions.xml
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\Manager\ManagerOptions.xml.backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\Movies\MoviesOptions.xml
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\Movies\MoviesOptions.xml.backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\Recipes\RecipesOptions.xml
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\Recipes\RecipesOptions.xml.backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\Reference\ReferenceOptions.xml
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\Reference\ReferenceOptions.xml.backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\RelatedSearch\RelatedSearchOptions.xml
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\RelatedSearch\RelatedSearchOptions.xml.backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\SearchAssistPlus\SearchAssistPlusOptions.xml
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\SearchAssistPlus\SearchAssistPlusOptions.xml.backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\SearchMatch\SearchMatchOptions.xml
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\SearchMatch\SearchMatchOptions.xml.backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\Toolbar\TBProductsOptions.xml
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\Toolbar\TBProductsOptions.xml.backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\ToolbarLogo\ToolbarLogoOptions.xml
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\ToolbarLogo\ToolbarLogoOptions.xml.backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\ToolbarSearch\ToolbarSearchOptions.xml
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\ToolbarSearch\ToolbarSearchOptions.xml.backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\TravelSearch\TravelSearchOptions.xml
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\TravelSearch\TravelSearchOptions.xml.backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\Weather\AlertArchive.xml
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\Weather\WeatherOptions.xml
C:\WINDOWS\system32\config\systemprofile\Application Data\Starware337\Weather\WeatherOptions.xml.backup
C:\WINDOWS\system32\e9
C:\WINDOWS\system32\e9\farstadcom2.exe
C:\WINDOWS\SYSTEM32\efhkj.ini
C:\WINDOWS\SYSTEM32\efhkj.ini2
C:\WINDOWS\system32\icroso~1
C:\WINDOWS\system32\icroso~1\?icrosoft\
C:\WINDOWS\system32\icroso~1\dvdplay.exe
C:\WINDOWS\SYSTEM32\ihhkj.ini
C:\WINDOWS\SYSTEM32\ihhkj.ini2
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\p2
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\SYSTEM32\rtstv.ini
C:\WINDOWS\SYSTEM32\rtstv.ini2
C:\WINDOWS\SYSTEM32\stutv.ini
C:\WINDOWS\SYSTEM32\stutv.ini2
C:\WINDOWS\system32\t8
C:\WINDOWS\system32\vtuts.exe
C:\WINDOWS\SYSTEM32\yccdd.ini
C:\WINDOWS\SYSTEM32\yccdd.ini2
C:\WINDOWS\system32\z4
C:\WINDOWS\system32\zourficu.dllbox
C:\WINDOWS\ystem~1

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_DOMAINSERVICE
——-\LEGACY_NETWORK_MONITOR
——-\DomainService


((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-29 )))))))))))))))))))))))))))))))
.

2008-01-28 16:49 . 2008-01-28 16:49 d——– C:\Program Files\Stentor
2008-01-28 16:49 . 2008-01-28 16:50 d——– C:\iSiteLogs
2008-01-28 16:44 . 2008-01-28 16:48 d——– C:\Tommy
2008-01-22 16:27 . 2007-10-10 18:55 6,065,664 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll
2008-01-22 16:27 . 2007-06-30 22:31 2,455,488 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dat
2008-01-22 16:27 . 2007-06-30 22:36 991,232 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll.mui
2008-01-22 16:27 . 2007-10-10 18:55 459,264 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\msfeeds.dll
2008-01-22 16:27 . 2007-10-10 18:55 383,488 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dll
2008-01-22 16:27 . 2007-10-10 18:55 267,776 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\iertutil.dll
2008-01-22 16:27 . 2007-10-10 18:55 63,488 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\icardie.dll
2008-01-22 16:27 . 2007-10-10 18:55 52,224 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\msfeedsbs.dll
2008-01-22 16:27 . 2007-10-10 05:59 13,824 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe
2008-01-22 16:15 . 2007-08-13 18:54 33,792 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\custsat.dll
2008-01-22 16:14 . 2008-01-22 16:30 1,374 –a—— C:\WINDOWS\imsins.BAK
2008-01-22 14:50 . 2008-01-22 14:50 d——– C:\Program Files\McAfee UnInstaller 6.5 Demo English
2008-01-22 14:10 . 2008-01-22 14:10 0 -ra—— C:\WINDOWS\TWFyeSBLYXkgTydDb25ub3I
2008-01-22 11:16 . 2007-09-24 23:31 69,632 –a—— C:\WINDOWS\SYSTEM32\javacpl.cpl
2008-01-22 11:08 . 2008-01-22 11:08 d——– C:\Program Files\Common Files\Java
2008-01-22 10:06 . 2008-01-22 10:06 2,560 –a—— C:\WINDOWS\_MSRSTRT.EXE
2008-01-21 14:04 . 2008-01-28 08:00 d——– C:\Documents and Settings\Mary Kay O'Connor\Application Data\AVG7
2008-01-21 14:02 . 2008-01-21 14:02 d——– C:\Documents and Settings\LocalService\Application Data\AVG7
2008-01-21 14:00 . 2008-01-21 14:00 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-21 14:00 . 2008-01-21 14:08 d——– C:\Documents and Settings\All Users\Application Data\avg7
2008-01-21 13:31 . 2008-01-21 13:31 0 -ra—— C:\WINDOWS\SYSTEM32\security
2008-01-21 12:08 . 2008-01-21 12:08 138,752 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\sp_rsdrv2.sys
2008-01-21 12:04 . 2008-01-24 18:38 d——– C:\Program Files\Spyware Terminator
2008-01-21 12:04 . 2008-01-25 09:02 d——– C:\Documents and Settings\Mary Kay O'Connor\Application Data\Spyware Terminator
2008-01-21 12:04 . 2008-01-22 14:02 d——– C:\Documents and Settings\All Users\Application Data\Spyware Terminator
2008-01-21 11:53 . 2008-01-21 11:53 0 –a—— C:\WINDOWS\SYSTEM32\RCX26E0.tmp
2008-01-21 08:31 . 2004-08-03 23:00 260,272 –a—— C:\cmldr
2008-01-21 08:31 . 2008-01-20 20:27 211 –a—— C:\Boot.bak
2008-01-20 21:47 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-20 21:37 . 2008-01-20 21:37 0 –a—— C:\WINDOWS\SYSTEM32\RCX1F6C.tmp
2008-01-20 20:26 . 2008-01-20 20:26 d——– C:\Program Files\CCleaner
2008-01-20 18:13 . 2008-01-20 18:13 d——– C:\Documents and Settings\LogMeInRemoteUser\Application Data\Jasc Software Inc
2008-01-19 11:41 . 2008-01-19 11:41 0 –a—— C:\WINDOWS\SYSTEM32\RCX186E.tmp
2008-01-19 07:20 . 2008-01-19 07:20 0 –a—— C:\WINDOWS\SYSTEM32\RCX17E3.tmp
2008-01-18 23:06 . 2008-01-24 13:56 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-18 20:06 . 2004-02-14 09:07 d——– C:\Documents and Settings\LogMeInRemoteUser\Application Data\Sonic
2008-01-17 20:02 . 2008-01-18 21:32 1,073,472 –ahs—- C:\WINDOWS\SYSTEM32\nxgcvkoo.ini
2008-01-15 21:40 . 2008-01-15 21:40 0 –a—— C:\WINDOWS\SYSTEM32\RCX4D9.tmp
2008-01-14 19:59 . 2008-01-14 19:59 0 –a—— C:\WINDOWS\SYSTEM32\RCX68D.tmp
2008-01-14 19:48 . 2008-01-14 19:48 155,648 –a—— C:\WINDOWS\SYSTEM32\igfxtray .exe
2008-01-14 19:48 . 2008-01-14 19:48 126,976 –a—— C:\WINDOWS\SYSTEM32\hkcmd .exe
2008-01-14 19:48 . 2008-01-14 19:48 28,672 –a—— C:\WINDOWS\SYSTEM32\DSentry .exe
2008-01-14 18:46 . 2008-01-21 18:17 d——– C:\Program Files\Dot1XCfg
2008-01-14 18:41 . 2008-01-21 20:41 d——– C:\WINDOWS\SYSTEM32\edcA01
2008-01-13 21:21 . 2008-01-13 21:21 d——– C:\Documents and Settings\Liam\Application Data\Aim

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-28 21:43 ——— d—–w C:\Program Files\LogMeIn
2008-01-24 18:49 ——— d—–w C:\Program Files\Google
2008-01-22 23:54 34,686 —-a-w C:\Documents and Settings\Mary Kay O'Connor\Application Data\wklnhst.dat
2008-01-22 16:11 ——— d—–w C:\Program Files\Java
2008-01-22 15:05 ——— d—–w C:\Program Files\Yahoo!
2008-01-21 23:15 ——— d—–w C:\Program Files\QuickTime
2008-01-20 23:13 ——— d—–w C:\Program Files\REGSHAVE
2008-01-20 23:13 ——— d—–w C:\Program Files\iTunes
2008-01-20 23:13 ——— d—–w C:\Program Files\DellSupport
2008-01-01 20:00 4,146 —-a-w C:\Documents and Settings\Christian\Application Data\wklnhst.dat
2007-12-25 18:39 ——— d—–w C:\Program Files\iConcepts Music Express
2007-12-19 19:54 ——— d—–w C:\Program Files\America Online 9.0
2007-12-12 02:12 ——— d—–w C:\Documents and Settings\Gracie\Application Data\Aim
2007-12-09 01:52 72,512 —-a-w C:\Documents and Settings\Christian\Application Data\GDIPFONTCACHEV1.DAT
2007-10-20 12:21 826 —-a-w C:\Documents and Settings\Sikorrya O'Connor\Application Data\wklnhst.dat
2007-08-05 11:24 3,612 —-a-w C:\Documents and Settings\Edila O'Connor\Application Data\wklnhst.dat
2006-11-03 01:50 72,512 —-a-w C:\Documents and Settings\Edila O'Connor\Application Data\GDIPFONTCACHEV1.DAT
2006-10-04 11:20 72,512 —-a-w C:\Documents and Settings\Mary Kay O'Connor\Application Data\GDIPFONTCACHEV1.DAT
.
—-a-w			57,344 2008-01-15 00:50:00  C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy .exe
—-a-w			50,688 2008-01-15 00:50:23  C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind .exe
—-a-w		   151,597 2008-01-15 00:49:09  C:\Program Files\Common Files\Real\Update_OB\realsched .exe
—-a-w		   110,592 2008-01-15 00:49:26  C:\Program Files\Common Files\Sonic\Update Manager\sgtray .exe
—-a-w		   204,800 2008-01-15 00:48:54  C:\Program Files\Dell\Media Experience\PCMService .exe
—-a-w		   460,784 2008-01-15 00:50:39  C:\Program Files\DellSupport\DSAgnt .exe
—-a-w			68,856 2008-01-15 00:51:03  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
—-a-w			49,152 2008-01-15 00:50:08  C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2 .exe
—-a-w		   278,528 2008-01-18 11:44:34  C:\Program Files\iTunes\iTunesHelper .exe
—-a-w			63,048 2008-01-15 00:50:18  C:\Program Files\LogMeIn\x86\LogMeInSystray .exe
—-a-w		 1,694,208 2008-01-15 00:50:42  C:\Program Files\Messenger\msmsgs .exe
—-a-w		   200,704 2008-01-15 00:50:49  C:\Program Files\Microsoft Money\System\mnyexpr .exe
—-a-w			53,248 2008-01-15 00:49:40  C:\Program Files\REGSHAVE\REGSHAVE .EXE
—-a-w		 2,834,432 2008-01-21 18:16:00  C:\Program Files\Spyware Terminator\SpywareTerminatorShield .exe
—-a-w			28,672 2008-01-15 00:48:49  C:\WINDOWS\SYSTEM32\DSentry .exe
—-a-w		   126,976 2008-01-15 00:48:45  C:\WINDOWS\SYSTEM32\hkcmd .exe
—-a-w		   155,648 2008-01-15 00:48:44  C:\WINDOWS\SYSTEM32\igfxtray .exe
—-a-w		   114,741 2008-01-15 00:48:47  C:\WINDOWS\SYSTEM32\dla\tfswctrl .exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-22 09:58 579072]
"SpywareTerminator"="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-01-21 16:48 2834432]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-21 14:01 219136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
LMIinit.dll 2007-11-21 19:28 87352 C:\WINDOWS\SYSTEM32\LMIinit.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=C:\WINDOWS\pss\HP Image Zone Fast Start.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hpoddt01.exe.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk
backup=C:\WINDOWS\pss\hpoddt01.exe.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\986b3d02]
C:\WINDOWS\system32\ookvcgxn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aida]
C:\DOCUME~1\MARYKA~1\APPLIC~1\SSTEM3~1\explorer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CleanUp]
C:\PROGRA~1\McAfee.com\Shared\mcappins.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
C:\WINDOWS\system32\ddayv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
c:\PROGRA~1\mcafee.com\agent\MCUPDA~1.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent]
C:\Program Files\Microsoft Money\System\mnyexpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sonic RecordNow!]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online]
c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask]
c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WebBuying]
C:\Program Files\Web Buying\v1.8.6\webbuying.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zzzHPSETUP]
D:\Setup.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-01-25 12:16:14 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-01-29 01:07:00 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp officejet 6100 series#1095469527.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe:-I
"2004-03-04 03:14:25 C:\WINDOWS\Tasks\ISP signup reminder 1.job"
- C:\WINDOWS\System32\OOBE\OOBEBALN.EXE
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-28 20:50:56
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-28 20:58:24 - machine was rebooted [Mary Kay O'Connor]
ComboFix-quarantined-files.txt 2008-01-29 01:58:08
.
2008-01-24 08:01:36 — E O F —
Now the HJT log. Both of these are current.:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:44:53 AM, on 1/29/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Documents and Settings\Mary Kay O'Connor\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-3200903036-260940732-2997775758-1011\..\Run: [Sonic RecordNow!] (User 'LogMeInRemoteUser')
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Auto Detect.lnk = C:\Program Files\iConcepts Music Express\MEAutoDetect.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: officejet 6100.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe (file missing)
O23 - Service: Microsoft cache control (MSControlService) - Unknown owner - C:\WINDOWS\system32\windows (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

–
End of file - 6547 bytes

Thanks again.. Any suggesstion are welcomed, but tthe good news is a friend of mine got rid of the recurring explorer .exe and some other stuff.
- Maggie
Post #5 last edited
Open notepad and copy/paste the text in the Codebox below into it:

File::
C:\WINDOWS\imsins.BAK
C:\WINDOWS\TWFyeSBLYXkgTydDb25ub3I
C:\WINDOWS\SYSTEM32\RCX26E0.tmp
C:\WINDOWS\SYSTEM32\RCX1F6C.tmp
C:\WINDOWS\SYSTEM32\RCX186E.tmp
C:\WINDOWS\SYSTEM32\RCX17E3.tmp
C:\WINDOWS\SYSTEM32\nxgcvkoo.ini
C:\WINDOWS\SYSTEM32\RCX4D9.tmp
C:\WINDOWS\SYSTEM32\RCX68D.tmp
C:\WINDOWS\system32\ookvcgxn.dll
C:\DOCUME~1\MARYKA~1\APPLIC~1\SSTEM3~1\explorer.exe
C:\WINDOWS\system32\ddayv.exe
C:\Program Files\Web Buying\v1.8.6\webbuying.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe

RenV::
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy .exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind .exe
C:\Program Files\Common Files\Real\Update_OB\realsched .exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray .exe
C:\Program Files\Dell\Media Experience\PCMService .exe
C:\Program Files\DellSupport\DSAgnt .exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2 .exe
C:\Program Files\iTunes\iTunesHelper .exe
C:\Program Files\LogMeIn\x86\LogMeInSystray .exe
C:\Program Files\Messenger\msmsgs .exe
C:\Program Files\Microsoft Money\System\mnyexpr .exe
C:\Program Files\REGSHAVE\REGSHAVE .EXE
C:\Program Files\Spyware Terminator\SpywareTerminatorShield .exe
C:\WINDOWS\SYSTEM32\DSentry .exe
C:\WINDOWS\SYSTEM32\hkcmd .exe
C:\WINDOWS\SYSTEM32\igfxtray .exe
C:\WINDOWS\SYSTEM32\dla\tfswctrl .exe


Folder::
C:\WINDOWS\SYSTEM32\edcA01
C:\DOCUME~1\MARYKA~1\APPLIC~1\SSTEM3~1
C:\Program Files\Web Buying
C:\Program Files\Viewpoint

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\986b3d02]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aida]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WebBuying]

Save this as Save this as "CFScript"


Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.


Also please describe how your computer behaves at the moment.
Post #7
Hi there, sorry for not getting back to you sooner. Can you tell me what that RenV command does? I see the files in the top section of the last post, that I presume will be removed, and that's fine. I'm just trying to understand what this next section (RenV) does.. Aside from the red X on the C drive, the computer seems to be working quite well, so I'm a little bit nervous to do anything else to it! I trust you though.. just hoping you can explain what that will do. Thanks again - Maggie
Post #8

Hi there, sorry for not getting back to you sooner. Can you tell me what that RenV command does? I see the files in the top section of the last post, that I presume will be removed, and that's fine. I'm just trying to understand what this next section (RenV) does.. Aside from the red X on the C drive, the computer seems to be working quite well, so I'm a little bit nervous to do anything else to it! I trust you though.. just hoping you can explain what that will do.
Thanks again - Maggie

The programs / files listed under RenV were / are infected. The program tries to recover them.
If you haven't completed my last fix, you need to.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI