Spyware / Malware / Virus Removal

[Resolved] advance cleaner messages and slowness.

9 min read

Looking for the outcome? Ask AI

1misled Topic Starter

Post #1March 4, 2008, 6:03 PM UTC

Help! I am almost finished installing all my old software and Win XP again when obliviously something I installed was infected. My settings in IE change every time I open it on its own. Cookies changes back to accept all rather than the default medium and I continue to disable items in the manage add-ons settings on browser helper objects that have names like xyywttr.dll or ikfygqkk.dll or jkklk.dll only to have them enabled again later. These files looked suspicious but not sure of them. Please advise, I will install Hijack this as you suggested to the last person with similar issues as instructed and post them in a few minutes. Thank-you, Lynn

1misled

Post #2March 4, 2008, 6:05 PM UTC

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:04:45 AM, on 3/4/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nTrayFw.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\McAfee.com\Agent\mcagent.exe
D:\Hardware\razer\program\razerhid.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
D:\Diagnostic\Acronis\TrueImage\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\WINDOWS\Fonts\svchost.exe
D:\Photo Software\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
C:\WINDOWS\SM1BG.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\WINDOWS\system32\cisvc.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
D:\Hardware\razer\program\razerofa.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcIp.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcAppFlt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
D:\Applications\Microsoft Office 2003\Office12\WINWORD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: MYPOINTS - {A057A204-BACC-4D26-CEC4-75A487FD6484} - C:\PROGRA~1\mypoints\mypoints.dll
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [nTrayFw] C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [Copperhead] D:\Hardware\razer\program\razerhid.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TrueImageMonitor.exe] D:\Diagnostic\Acronis\TrueImage\TrueImageMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [Host Process] C:\WINDOWS\Fonts\svchost.exe
O4 - HKLM\..\Run: [RoxioDragToDisc] "D:\Photo Software\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [70152070] rundll32.exe "C:\WINDOWS\system32\ysxxvlpy.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\APPLIC~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\APPLIC~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\APPLIC~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\APPLIC~1\MICROS~1\FRONTP~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02A2D714-433E-46E4-B217-7C3B3FAF8EAE} (ScrabbleCubes Control) - http://www.worldwinner.com/games/v46/scrab…rabblecubes.cab
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://mypoints.worldwinner.com/games/v47/…GamesLoader.cab
O16 - DPF: {25365FF3-2746-4230-9DA7-163CCA318309} (Automatic Driver Installation Control) - http://inst.c-wss.com/vwhpro/EN/install/gtdownlr.cab
O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} (king.com) - http://www.king.com/ctl/kingcomie.cab
O16 - DPF: {5E92F538-B50B-46C5-9C5F-C6EECED3F6C6} - http://www.infospace.com/mypoints.main/tba…pointsSetup.exe
O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - http://www.worldwinner.com/games/v46/bejeweled/bejeweled.cab
O16 - DPF: {62969CF2-0F7A-433B-A221-FD8818C06C2F} (Blockwerx Control) - http://www.worldwinner.com/games/v49/blockwerx/blockwerx.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1203721958250
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo…iaSmartScan.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {97438FE9-D361-4279-BA82-98CC0877A717} (Cubis Control) - http://www.worldwinner.com/games/v57/cubis/cubis.cab
O16 - DPF: {AC2881FD-5760-46DB-83AE-20A5C6432A7E} (SwapIt Control) - http://www.worldwinner.com/games/v67/swapit/swapit.cab
O16 - DPF: {BA94245D-2AA0-4953-9D9F-B0EE4CC02C43} (Tilecity Control) - http://www.worldwinner.com/games/v42/tilecity/tilecity.cab
O16 - DPF: {C5326A4D-E9AA-40AD-A09A-E74304D86B47} (DinerDash Control) - http://www.worldwinner.com/games/v50/dinerdash/dinerdash.cab
O16 - DPF: {E70E3E64-2793-4AEF-8CC8-F1606BE563B0} (WWSpades Control) - http://www.worldwinner.com/games/v47/wwspades/wwspades.cab
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–
End of file - 10062 bytes

1misled

Post #3March 4, 2008, 7:30 PM UTC

Hi, Any suggestions? Thank-you, Lynn

Rorschach112

Post #4March 10, 2008, 3:21 PM UTC

You shouldn't bump your own thread, thats why there has been no reply

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Please, never rename Combofix unless instructed.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

———————————————————–
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  
  ———————————————————–
- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
———————————————————–
Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

1misled

Post #5March 10, 2008, 11:23 PM UTC

Here is the hijackthis file and then the combofix. Thank-you, Lynn

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:22:11 PM, on 3/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcIp.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcAppFlt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: MYPOINTS - {A057A204-BACC-4D26-CEC4-75A487FD6484} - C:\PROGRA~1\mypoints\mypoints.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: MYPOINTS - {A057A204-BACC-4D26-CEC4-75A487FD6484} - C:\PROGRA~1\mypoints\mypoints.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nTrayFw] C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nTrayFw.exe
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\APPLIC~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\APPLIC~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\APPLIC~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\APPLIC~1\MICROS~1\FRONTP~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5E92F538-B50B-46C5-9C5F-C6EECED3F6C6} - http://www.infospace.com/mypoints.main/tba…pointsSetup.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1203721958250
O20 - Winlogon Notify: xxywttr - xxywttr.dll (file missing)
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–
End of file - 7285 bytes

ComboFix 08-03-10.1 - Lynn 2008-03-10 16:15:48.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1538 [GMT -7:00]
Running from: C:\Documents and Settings\[removed]\Local Settings\Temporary Internet Files\Content.IE5\YGVSKL6I\ComboFix[1].exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\BM732613ec.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\aafvisbn.ini
C:\WINDOWS\system32\abaimkte.dll
C:\WINDOWS\system32\axlgepay.dll
C:\WINDOWS\system32\bdsktnxg.ini
C:\WINDOWS\system32\blrihvvf.ini
C:\WINDOWS\system32\blxollrm.dll
C:\WINDOWS\system32\cadfdkuo.dll
C:\WINDOWS\system32\dggxxpuk.dll
C:\WINDOWS\system32\dkpwhsnm.dll
C:\WINDOWS\system32\eeykxdur.dll
C:\WINDOWS\system32\fvjkxcqy.ini
C:\WINDOWS\system32\fvvhirlb.dll
C:\WINDOWS\system32\fwgyqieu.dll
C:\WINDOWS\system32\gjplbhtc.dll
C:\WINDOWS\system32\gxntksdb.dll
C:\WINDOWS\system32\hjmvxkvu.ini
C:\WINDOWS\system32\hrjkghsa.dll
C:\WINDOWS\system32\ikfygqkk.dll
C:\WINDOWS\system32\jhkiggni.dll
C:\WINDOWS\system32\jipcjtwy.dll
C:\WINDOWS\system32\jkklk.dll
C:\WINDOWS\system32\kbipkawa.dll
C:\WINDOWS\system32\kcmsgsfq.dll
C:\WINDOWS\system32\kearfihx.ini
C:\WINDOWS\system32\klkkj.ini
C:\WINDOWS\system32\klkkj.ini2
C:\WINDOWS\system32\ljddvdbn.ini
C:\WINDOWS\system32\lruyarek.dll
C:\WINDOWS\system32\mixalhlo.dll
C:\WINDOWS\system32\mljihff.dll
C:\WINDOWS\system32\mrnskmxg.dll
C:\WINDOWS\system32\mxsoqaun.dll
C:\WINDOWS\system32\myvijvtq.dll
C:\WINDOWS\system32\nbdvddjl.dll
C:\WINDOWS\system32\oefteckh.dll
C:\WINDOWS\system32\oesefraf.dll
C:\WINDOWS\system32\ookssuqn.dll
C:\WINDOWS\system32\opchymnq.dll
C:\WINDOWS\system32\oplcbuxb.ini
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\qygkjapx.dll
C:\WINDOWS\system32\tdkyytrw.ini
C:\WINDOWS\system32\tdkyytrw.ini2
C:\WINDOWS\system32\ucvkpagf.dll
C:\WINDOWS\system32\ueiqygwf.ini
C:\WINDOWS\system32\ufbcfguv.dll
C:\WINDOWS\system32\uvkxvmjh.dll
C:\WINDOWS\system32\vehyksdl.dll
C:\WINDOWS\system32\vfapjuca.dll
C:\WINDOWS\system32\wrtyykdt.dll
C:\WINDOWS\system32\wtdwthkx.dll
C:\WINDOWS\system32\xtyjewpp.ini
C:\WINDOWS\system32\xxywttr.dll
C:\WINDOWS\system32\yplvxxsy.ini
C:\WINDOWS\system32\yqcxkjvf.dll
C:\WINDOWS\system32\ytegfbyp.ini
C:\WINDOWS\system32\yvdroluk.ini
C:\WINDOWS\system32\ywtjcpij.ini

.
((((((((((((((((((((((((( Files Created from 2008-02-10 to 2008-03-10 )))))))))))))))))))))))))))))))
.

2008-03-09 21:05 . 2008-03-10 00:52 1,318,373 –ahs—- C:\WINDOWS\system32\fkpnnteo.ini
2008-03-06 16:46 . 2008-03-06 16:46 245,760 ——— C:\WINDOWS\Setup1.exe
2008-03-06 16:46 . 2008-03-06 16:46 73,216 –a—— C:\WINDOWS\ST6UNST.EXE
2008-03-06 03:48 . 2008-03-06 03:48 d——– C:\Documents and Settings\Lynn\Application Data\Uniblue
2008-03-05 01:11 . 2008-03-05 18:59 1,307,614 –ahs—- C:\WINDOWS\system32\vdyggcdg.ini
2008-03-04 12:13 . 2008-03-04 14:33 1,303,018 –ahs—- C:\WINDOWS\system32\hkmfdeje.ini
2008-03-04 10:46 . 2008-03-04 10:46 d——– C:\Program Files\Trend Micro
2008-03-04 05:02 . 2008-03-04 05:02 d——– C:\Program Files\MSXML 4.0
2008-03-04 00:24 . 2008-03-10 00:39 d——– C:\Documents and Settings\Lynn\Application Data\Roxio
2008-03-04 00:18 . 2008-03-04 00:18 d——– C:\Documents and Settings\Lynn\Application Data\Leadertech
2008-03-03 11:21 . 2008-03-03 11:21 d——– C:\WINDOWS\DRIVERS
2008-03-03 11:21 . 2008-03-03 11:21 d——– C:\Documents and Settings\All Users\Application Data\Napster
2008-03-03 11:21 . 2003-08-27 15:20 266,240 -ra—— C:\WINDOWS\SM1nint.exe
2008-03-03 11:21 . 2003-08-27 15:20 94,208 -ra—— C:\WINDOWS\SM1bg.exe
2008-03-03 11:21 . 2003-08-27 15:20 86,106 -ra—— C:\WINDOWS\system32\SM1un.exe
2008-03-03 11:21 . 2003-08-27 15:19 36,963 -ra—— C:\Program Files\Common Files\SM1updtr.dll
2008-03-03 11:21 . 2003-08-27 15:20 32,896 -ra—— C:\WINDOWS\system32\drivers\SM1fx_at.sys
2008-03-03 11:21 . 2003-08-27 15:20 12,382 -ra—— C:\WINDOWS\system32\SM1ui32.dll
2008-03-03 11:17 . 2008-03-03 11:21 d——– C:\Program Files\Common Files\Roxio Shared
2008-03-03 11:17 . 2008-03-03 11:17 d——– C:\Documents and Settings\All Users\Application Data\Roxio
2008-03-03 10:10 . 2008-03-03 10:10 d——– C:\Program Files\Viewpoint
2008-03-03 10:09 . 2003-09-26 04:53 10,368 ——— C:\WINDOWS\system32\drivers\pfc.sys
2008-03-02 23:08 . 2008-03-02 23:08 1,286,201 –ahs—- C:\WINDOWS\system32\kearfihx.tmp
2008-03-02 20:08 . 2008-03-02 20:08 d——– C:\Program Files\Common Files\Adobe Systems Shared
2008-03-02 20:08 . 2008-03-02 20:08 d——– C:\Documents and Settings\All Users\Application Data\Macrovision
2008-03-02 13:07 . 2008-03-02 13:07 1,286,141 –ahs—- C:\WINDOWS\system32\aafvisbn.tmp
2008-03-02 13:04 . 2008-03-02 13:04 1,286,081 –ahs—- C:\WINDOWS\system32\xtyjewpp.tmp
2008-03-02 12:59 . 2005-10-20 18:47 30,592 ——— C:\WINDOWS\system32\drivers\rndismpx.sys
2008-03-02 12:59 . 2005-10-20 18:47 12,800 ——— C:\WINDOWS\system32\drivers\usb8023x.sys
2008-03-02 09:10 . 2008-03-02 09:10 d——– C:\Program Files\mypoints
2008-03-02 09:10 . 2008-03-02 09:10 d——– C:\Documents and Settings\Lynn\Application Data\mypoints
2008-02-29 19:17 . 2008-02-29 19:17 77 –a—— C:\Documents and Settings\Lynn\2396.bat
2008-02-28 13:48 . 2008-02-28 13:48 4,096 –a—— C:\WINDOWS\d3dx.dat
2008-02-28 13:47 . 2008-02-28 13:47 d–hs—- C:\WINDOWS\ftpcache
2008-02-28 13:46 . 2008-02-28 13:47 d——– C:\Documents and Settings\All Users\Application Data\Spadester
2008-02-28 07:14 . 2008-02-28 07:14 147,456 –a—— C:\WINDOWS\system32\vbzip10.dll
2008-02-28 07:11 . 2008-03-07 10:04 d——– C:\WINDOWS\system32\iDlo18
2008-02-28 07:11 . 2008-03-10 00:57 d——– C:\Temp
2008-02-28 07:08 . 2008-02-28 07:08 d——– C:\Documents and Settings\All Users\Application Data\GlobalSCAPE
2008-02-28 07:02 . 2008-02-28 07:02 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-28 07:02 . 2004-08-30 22:00 1,470,464 –a—— C:\WINDOWS\system32\WinSecure.exe
2008-02-28 07:02 . 2008-02-28 07:02 37,888 –a—— C:\WINDOWS\system32\rar.exe
2008-02-28 06:40 . 2008-02-28 07:07 d——– C:\Documents and Settings\Lynn\Application Data\GlobalSCAPE
2008-02-28 05:44 . 2008-03-06 16:10 2,025 –a—— C:\WINDOWS\mozver.dat
2008-02-28 04:50 . 2008-02-28 04:50 0 –a—— C:\WINDOWS\nsreg.dat
2008-02-28 04:41 . 2008-02-28 04:41 d——– C:\Program Files\Java
2008-02-28 04:41 . 2008-02-28 04:41 d——– C:\Program Files\Common Files\Java
2008-02-28 04:41 . 2007-09-25 00:31 69,632 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-02-28 04:35 . 2008-02-28 04:35 d——– C:\WINDOWS\Sun
2008-02-27 04:53 . 2008-02-27 04:53 d–h—– C:\WINDOWS\system32\CanonIJ Uninstaller Information
2008-02-27 04:53 . 2008-02-27 04:53 d–h—– C:\Program Files\CanonBJ
2008-02-27 04:53 . 2008-02-27 04:53 d–h—– C:\Documents and Settings\All Users\Application Data\CanonBJ
2008-02-27 04:53 . 2007-03-24 01:30 1,400,832 –a—— C:\WINDOWS\system32\CNC470C.DLL
2008-02-27 04:53 . 2007-04-02 14:00 215,040 –a—— C:\WINDOWS\system32\CNMLM8U.DLL
2008-02-27 04:53 . 2007-03-19 19:21 200,704 –a—— C:\WINDOWS\system32\CNC470L.DLL
2008-02-27 04:53 . 2007-03-15 23:12 188,416 –a—— C:\WINDOWS\system32\CNC470O.DLL
2008-02-27 04:53 . 2007-03-24 01:29 98,304 –a—— C:\WINDOWS\system32\CNC470I.DLL
2008-02-27 04:53 . 2004-08-03 23:58 15,104 –a—— C:\WINDOWS\system32\drivers\usbscan.sys
2008-02-27 04:53 . 2004-08-03 23:58 15,104 –a–c— C:\WINDOWS\system32\dllcache\usbscan.sys
2008-02-27 04:52 . 2008-02-27 04:52 d——– C:\Documents and Settings\Lynn\Application Data\Gtek
2008-02-27 04:52 . 2008-02-27 04:52 d——– C:\Documents and Settings\All Users\Application Data\Gtek
2008-02-27 04:09 . 2008-02-27 04:09 d——– C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-02-26 05:29 . 2008-02-26 05:29 d——– C:\Program Files\Common Files\Acronis
2008-02-26 05:29 . 2008-02-26 05:29 249,152 –a—— C:\WINDOWS\system32\drivers\timntr.sys
2008-02-26 05:29 . 2008-02-26 05:29 96,320 –a—— C:\WINDOWS\system32\drivers\snapman.sys
2008-02-26 05:29 . 2008-02-26 05:29 30,688 –a—— C:\WINDOWS\system32\drivers\tifsfilt.sys
2008-02-26 02:50 . 2008-03-02 20:08 d——– C:\Program Files\Common Files\Adobe
2008-02-26 02:49 . 2008-02-26 02:49 d——– C:\WINDOWS\Downloaded Installations
2008-02-26 02:11 . 2008-02-26 02:11 d——– C:\Program Files\Yahoo!
2008-02-26 02:11 . 2008-02-26 02:11 d——– C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-02-26 02:07 . 2008-02-26 02:08 d——– C:\Program Files\Google
2008-02-26 02:07 . 2008-03-09 23:03 d——– C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-25 12:06 . 2008-03-06 20:32 588 –a—— C:\WINDOWS\system32\settingsbkup.sfm
2008-02-25 12:06 . 2008-03-06 20:32 588 –a—— C:\WINDOWS\system32\settings.sfm
2008-02-25 11:27 . 2008-02-25 11:30 d——– C:\Documents and Settings\Lynn\Application Data\Intuit
2008-02-25 11:26 . 2008-02-25 11:26 d——– C:\Program Files\Common Files\Intuit
2008-02-25 11:26 . 2008-02-25 11:26 d——– C:\Documents and Settings\All Users\Application Data\Intuit
2008-02-25 11:26 . 2007-10-22 19:58 1,721,712 –a—— C:\WINDOWS\system32\InetClnt.dll
2008-02-25 11:22 . 2008-02-26 06:37 d——– C:\Documents and Settings\Lynn\Application Data\BitDownload
2008-02-25 03:10 . 2008-02-25 03:10 d——– C:\Documents and Settings\All Users\Application Data\FunGames
2008-02-25 00:58 . 2005-11-10 10:15 69,632 –a—— C:\WINDOWS\system32\copperhd.cpl
2008-02-25 00:58 . 2005-12-21 12:23 14,592 –a—— C:\WINDOWS\system32\drivers\USBICP.sys
2008-02-25 00:58 . 2005-11-02 11:54 11,596 –a—— C:\WINDOWS\system32\drivers\copperhd.sys
2008-02-25 00:57 . 2008-02-25 00:57 d——– C:\Documents and Settings\Lynn\Application Data\InstallShield
2008-02-25 00:11 . 2004-08-04 00:01 25,856 –a—— C:\WINDOWS\system32\drivers\usbprint.sys
2008-02-25 00:11 . 2004-08-04 00:01 25,856 –a–c— C:\WINDOWS\system32\dllcache\usbprint.sys
2008-02-23 14:08 . 2008-02-23 14:08 d——– C:\Program Files\McAfee.com
2008-02-23 14:08 . 2008-02-24 22:47 d——– C:\Program Files\McAfee
2008-02-23 14:08 . 2008-02-23 14:08 d——– C:\Program Files\Common Files\McAfee
2008-02-23 14:08 . 2007-07-21 10:08 201,288 –a—— C:\WINDOWS\system32\drivers\mfehidk.sys
2008-02-23 14:08 . 2007-07-13 10:20 113,952 –a—— C:\WINDOWS\system32\drivers\Mpfp.sys
2008-02-23 14:08 . 2007-07-24 08:40 79,304 –a—— C:\WINDOWS\system32\drivers\mfeavfk.sys
2008-02-23 14:08 . 2007-07-21 10:08 40,488 –a—— C:\WINDOWS\system32\drivers\mfesmfk.sys
2008-02-23 14:08 . 2007-07-21 10:08 35,240 –a—— C:\WINDOWS\system32\drivers\mfebopk.sys
2008-02-23 14:08 . 2007-07-24 13:02 33,800 –a—— C:\WINDOWS\system32\drivers\mferkdk.sys
2008-02-23 13:58 . 2008-02-23 14:09 d——– C:\Documents and Settings\All Users\Application Data\McAfee
2008-02-23 07:32 . 2007-07-30 20:19 271,224 –a—— C:\WINDOWS\system32\mucltui.dll
2008-02-23 07:32 . 2007-07-30 20:19 30,072 –a—— C:\WINDOWS\system32\mucltui.dll.mui
2008-02-22 22:41 . 2008-03-07 10:07 d——– C:\Documents and Settings\Lynn\Application Data\LimeWire
2008-02-22 19:22 . 2008-02-23 08:56 d——– C:\WINDOWS\system32\NtmsData

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-03 21:11 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-02-22 19:49 ——— d—–w C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-02-22 19:43 ——— d—–w C:\Program Files\NVIDIA Corporation
2008-02-22 19:42 ——— d—–w C:\Program Files\Common Files\NVIDIA Shared
2008-02-22 19:42 ——— d—–w C:\Program Files\Common Files\InstallShield
2008-02-22 19:19 ——— d—–w C:\Program Files\microsoft frontpage
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-CEC4-75A487FD6484}]
2007-10-02 13:31 1909248 –a—— C:\PROGRA~1\mypoints\mypoints.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{A057A204-BACC-4D26-CEC4-75A487FD6484}"= "C:\PROGRA~1\mypoints\mypoints.dll" [2007-10-02 13:31 1909248]

[HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-cec4-75a487fd6484}]
[HKEY_CLASSES_ROOT\mypoints.MYPOINTS]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{A057A204-BACC-4D26-CEC4-75A487FD6484}"= C:\PROGRA~1\mypoints\mypoints.dll [2007-10-02 13:31 1909248]

[HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-cec4-75a487fd6484}]
[HKEY_CLASSES_ROOT\mypoints.MYPOINTS]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 18:07 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-02-26 02:07 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2007-12-05 02:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NVMixerTray"="C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-12-20 18:12 131072]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 02:41 81920]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
"nTrayFw"="C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nTrayFw.exe" [2005-12-21 12:52 270336]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 23:33 582992]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\xxywttr]
xxywttr.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 relog_ap

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\70152070]
C:\WINDOWS\system32\oetnnpkf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]
–a—— 2005-11-28 15:46 118784 C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
–a—— 2007-03-09 12:09 63712 C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2008-01-11 23:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BM732613ec]
C:\WINDOWS\system32\vfapjuca.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Copperhead]
–a—— 2005-11-25 11:53 155648 D:\Hardware\razer\program\razerhid.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
–a—— 2007-04-09 13:32 19456 C:\WINDOWS\system32\CtHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTxfiHlp]
–a—— 2007-04-09 13:32 19968 C:\WINDOWS\system32\Ctxfihlp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
–a—— 2006-11-13 14:39 1289000 C:\Program Files\Microsoft ActiveSync\Wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Host Process]
C:\WINDOWS\Fonts\svchost.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
–a—— 2004-02-26 07:56 1179648 D:\Photo Software\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SM1BG]
-ra—— 2003-08-27 15:20 94208 C:\WINDOWS\SM1BG.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
–a—— 2008-02-26 02:07 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
–a—— 2005-11-28 15:46 988701 D:\Diagnostic\Acronis\TrueImage\TrueImageMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"=

S3 UsbFltr;Razer Copperhead Driver;C:\WINDOWS\system32\drivers\copperhd.sys [2005-11-02 11:54]
S4 Fipsumxpqcg;Fipsumxpqcg;C:\WINDOWS\system32\dwwin.exe [2004-08-03 18:07]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-23 21:08:40 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe'
"2008-02-23 21:08:39 C:\WINDOWS\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-10 16:19:32
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcIp.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcAppFlt.exe
.
**************************************************************************
.
Completion time: 2008-03-10 16:21:01 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-10 23:20:51
.
2008-03-04 12:02:12 — E O F —

Rorschach112

Post #6March 11, 2008, 1:24 AM UTC

Hello

1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\fkpnnteo.ini
C:\WINDOWS\system32\vdyggcdg.ini
C:\WINDOWS\system32\hkmfdeje.ini
C:\WINDOWS\system32\kearfihx.tmp
C:\WINDOWS\system32\aafvisbn.tmp
C:\WINDOWS\system32\xtyjewpp.tmp
C:\Documents and Settings\Lynn\2396.bat
C:\WINDOWS\system32\WinSecure.exe
C:\WINDOWS\system32\oetnnpkf.dll
C:\WINDOWS\system32\vfapjuca.dll
C:\WINDOWS\Fonts\svchost.exe

Folder::
C:\WINDOWS\system32\iDlo18

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\70152070]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BM732613ec]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Host Process]

Save this as CFScript.txt, in the same location as ComboFix.exe

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at "C:\ComboFix.txt"

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Reboot and post a new HijackThis log

Rorschach112

Post #7March 11, 2008, 1:35 AM UTC

Also do this please

Go to this site:
http://www.virustotal.com/
On top you'll find 'Browse'
Click the browse button and browse to the file:

C:\WINDOWS\system32\dwwin.exe

Click open.
Then click the 'Send' button next to it.
This will scan the file. Please be patient.
Once scanned, copy and paste the results as well in your next reply.

1misled

Post #8March 11, 2008, 1:54 AM UTC

Combofix.txt, Hijackthis, & dwwin log.

ComboFix 08-03-10.1 - Lynn 2008-03-10 18:42:37.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1548 [GMT -7:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Lynn\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\iDlo18
P:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-02-11 to 2008-03-11 )))))))))))))))))))))))))))))))
.

2008-03-09 21:05 . 2008-03-10 00:52 1,318,373 –ahs—- C:\WINDOWS\system32\fkpnnteo.ini
2008-03-06 16:46 . 2008-03-06 16:46 245,760 ——— C:\WINDOWS\Setup1.exe
2008-03-06 16:46 . 2008-03-06 16:46 73,216 –a—— C:\WINDOWS\ST6UNST.EXE
2008-03-06 03:48 . 2008-03-06 03:48 d——– C:\Documents and Settings\Lynn\Application Data\Uniblue
2008-03-05 01:11 . 2008-03-05 18:59 1,307,614 –ahs—- C:\WINDOWS\system32\vdyggcdg.ini
2008-03-04 12:13 . 2008-03-04 14:33 1,303,018 –ahs—- C:\WINDOWS\system32\hkmfdeje.ini
2008-03-04 10:46 . 2008-03-04 10:46 d——– C:\Program Files\Trend Micro
2008-03-04 05:02 . 2008-03-04 05:02 d——– C:\Program Files\MSXML 4.0
2008-03-04 00:24 . 2008-03-10 00:39 d——– C:\Documents and Settings\Lynn\Application Data\Roxio
2008-03-04 00:18 . 2008-03-04 00:18 d——– C:\Documents and Settings\Lynn\Application Data\Leadertech
2008-03-03 11:21 . 2008-03-03 11:21 d——– C:\WINDOWS\DRIVERS
2008-03-03 11:21 . 2008-03-03 11:21 d——– C:\Documents and Settings\All Users\Application Data\Napster
2008-03-03 11:21 . 2003-08-27 15:20 266,240 -ra—— C:\WINDOWS\SM1nint.exe
2008-03-03 11:21 . 2003-08-27 15:20 94,208 -ra—— C:\WINDOWS\SM1bg.exe
2008-03-03 11:21 . 2003-08-27 15:20 86,106 -ra—— C:\WINDOWS\system32\SM1un.exe
2008-03-03 11:21 . 2003-08-27 15:19 36,963 -ra—— C:\Program Files\Common Files\SM1updtr.dll
2008-03-03 11:21 . 2003-08-27 15:20 32,896 -ra—— C:\WINDOWS\system32\drivers\SM1fx_at.sys
2008-03-03 11:21 . 2003-08-27 15:20 12,382 -ra—— C:\WINDOWS\system32\SM1ui32.dll
2008-03-03 11:17 . 2008-03-03 11:21 d——– C:\Program Files\Common Files\Roxio Shared
2008-03-03 11:17 . 2008-03-03 11:17 d——– C:\Documents and Settings\All Users\Application Data\Roxio
2008-03-03 10:10 . 2008-03-03 10:10 d——– C:\Program Files\Viewpoint
2008-03-03 10:09 . 2003-09-26 04:53 10,368 ——— C:\WINDOWS\system32\drivers\pfc.sys
2008-03-02 23:08 . 2008-03-02 23:08 1,286,201 –ahs—- C:\WINDOWS\system32\kearfihx.tmp
2008-03-02 20:08 . 2008-03-02 20:08 d——– C:\Program Files\Common Files\Adobe Systems Shared
2008-03-02 20:08 . 2008-03-02 20:08 d——– C:\Documents and Settings\All Users\Application Data\Macrovision
2008-03-02 13:07 . 2008-03-02 13:07 1,286,141 –ahs—- C:\WINDOWS\system32\aafvisbn.tmp
2008-03-02 13:04 . 2008-03-02 13:04 1,286,081 –ahs—- C:\WINDOWS\system32\xtyjewpp.tmp
2008-03-02 12:59 . 2005-10-20 18:47 30,592 ——— C:\WINDOWS\system32\drivers\rndismpx.sys
2008-03-02 12:59 . 2005-10-20 18:47 12,800 ——— C:\WINDOWS\system32\drivers\usb8023x.sys
2008-03-02 09:10 . 2008-03-02 09:10 d——– C:\Program Files\mypoints
2008-03-02 09:10 . 2008-03-02 09:10 d——– C:\Documents and Settings\Lynn\Application Data\mypoints
2008-02-29 19:17 . 2008-02-29 19:17 77 –a—— C:\Documents and Settings\Lynn\2396.bat
2008-02-28 13:48 . 2008-02-28 13:48 4,096 –a—— C:\WINDOWS\d3dx.dat
2008-02-28 13:47 . 2008-02-28 13:47 d–hs—- C:\WINDOWS\ftpcache
2008-02-28 13:46 . 2008-02-28 13:47 d——– C:\Documents and Settings\All Users\Application Data\Spadester
2008-02-28 07:14 . 2008-02-28 07:14 147,456 –a—— C:\WINDOWS\system32\vbzip10.dll
2008-02-28 07:11 . 2008-03-10 00:57 d——– C:\Temp
2008-02-28 07:08 . 2008-02-28 07:08 d——– C:\Documents and Settings\All Users\Application Data\GlobalSCAPE
2008-02-28 07:02 . 2008-02-28 07:02 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-28 07:02 . 2004-08-30 22:00 1,470,464 –a—— C:\WINDOWS\system32\WinSecure.exe
2008-02-28 07:02 . 2008-02-28 07:02 37,888 –a—— C:\WINDOWS\system32\rar.exe
2008-02-28 06:40 . 2008-02-28 07:07 d——– C:\Documents and Settings\Lynn\Application Data\GlobalSCAPE
2008-02-28 05:44 . 2008-03-06 16:10 2,025 –a—— C:\WINDOWS\mozver.dat
2008-02-28 04:50 . 2008-02-28 04:50 0 –a—— C:\WINDOWS\nsreg.dat
2008-02-28 04:41 . 2008-02-28 04:41 d——– C:\Program Files\Java
2008-02-28 04:41 . 2008-02-28 04:41 d——– C:\Program Files\Common Files\Java
2008-02-28 04:41 . 2007-09-25 00:31 69,632 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-02-28 04:35 . 2008-02-28 04:35 d——– C:\WINDOWS\Sun
2008-02-27 04:53 . 2008-02-27 04:53 d–h—– C:\WINDOWS\system32\CanonIJ Uninstaller Information
2008-02-27 04:53 . 2008-02-27 04:53 d–h—– C:\Program Files\CanonBJ
2008-02-27 04:53 . 2008-02-27 04:53 d–h—– C:\Documents and Settings\All Users\Application Data\CanonBJ
2008-02-27 04:53 . 2007-03-24 01:30 1,400,832 –a—— C:\WINDOWS\system32\CNC470C.DLL
2008-02-27 04:53 . 2007-04-02 14:00 215,040 –a—— C:\WINDOWS\system32\CNMLM8U.DLL
2008-02-27 04:53 . 2007-03-19 19:21 200,704 –a—— C:\WINDOWS\system32\CNC470L.DLL
2008-02-27 04:53 . 2007-03-15 23:12 188,416 –a—— C:\WINDOWS\system32\CNC470O.DLL
2008-02-27 04:53 . 2007-03-24 01:29 98,304 –a—— C:\WINDOWS\system32\CNC470I.DLL
2008-02-27 04:53 . 2004-08-03 23:58 15,104 –a—— C:\WINDOWS\system32\drivers\usbscan.sys
2008-02-27 04:53 . 2004-08-03 23:58 15,104 –a–c— C:\WINDOWS\system32\dllcache\usbscan.sys
2008-02-27 04:52 . 2008-02-27 04:52 d——– C:\Documents and Settings\Lynn\Application Data\Gtek
2008-02-27 04:52 . 2008-02-27 04:52 d——– C:\Documents and Settings\All Users\Application Data\Gtek
2008-02-27 04:09 . 2008-02-27 04:09 d——– C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-02-26 05:29 . 2008-02-26 05:29 d——– C:\Program Files\Common Files\Acronis
2008-02-26 05:29 . 2008-02-26 05:29 249,152 –a—— C:\WINDOWS\system32\drivers\timntr.sys
2008-02-26 05:29 . 2008-02-26 05:29 96,320 –a—— C:\WINDOWS\system32\drivers\snapman.sys
2008-02-26 05:29 . 2008-02-26 05:29 30,688 –a—— C:\WINDOWS\system32\drivers\tifsfilt.sys
2008-02-26 02:50 . 2008-03-02 20:08 d——– C:\Program Files\Common Files\Adobe
2008-02-26 02:49 . 2008-02-26 02:49 d——– C:\WINDOWS\Downloaded Installations
2008-02-26 02:11 . 2008-02-26 02:11 d——– C:\Program Files\Yahoo!
2008-02-26 02:11 . 2008-02-26 02:11 d——– C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-02-26 02:07 . 2008-02-26 02:08 d——– C:\Program Files\Google
2008-02-26 02:07 . 2008-03-09 23:03 d——– C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-25 12:06 . 2008-03-06 20:32 588 –a—— C:\WINDOWS\system32\settingsbkup.sfm
2008-02-25 12:06 . 2008-03-06 20:32 588 –a—— C:\WINDOWS\system32\settings.sfm
2008-02-25 11:27 . 2008-02-25 11:30 d——– C:\Documents and Settings\Lynn\Application Data\Intuit
2008-02-25 11:26 . 2008-02-25 11:26 d——– C:\Program Files\Common Files\Intuit
2008-02-25 11:26 . 2008-02-25 11:26 d——– C:\Documents and Settings\All Users\Application Data\Intuit
2008-02-25 11:26 . 2007-10-22 19:58 1,721,712 –a—— C:\WINDOWS\system32\InetClnt.dll
2008-02-25 11:22 . 2008-02-26 06:37 d——– C:\Documents and Settings\Lynn\Application Data\BitDownload
2008-02-25 03:10 . 2008-02-25 03:10 d——– C:\Documents and Settings\All Users\Application Data\FunGames
2008-02-25 00:58 . 2005-11-10 10:15 69,632 –a—— C:\WINDOWS\system32\copperhd.cpl
2008-02-25 00:58 . 2005-12-21 12:23 14,592 –a—— C:\WINDOWS\system32\drivers\USBICP.sys
2008-02-25 00:58 . 2005-11-02 11:54 11,596 –a—— C:\WINDOWS\system32\drivers\copperhd.sys
2008-02-25 00:57 . 2008-02-25 00:57 d——– C:\Documents and Settings\Lynn\Application Data\InstallShield
2008-02-25 00:11 . 2004-08-04 00:01 25,856 –a—— C:\WINDOWS\system32\drivers\usbprint.sys
2008-02-25 00:11 . 2004-08-04 00:01 25,856 –a–c— C:\WINDOWS\system32\dllcache\usbprint.sys
2008-02-23 14:08 . 2008-02-23 14:08 d——– C:\Program Files\McAfee.com
2008-02-23 14:08 . 2008-02-24 22:47 d——– C:\Program Files\McAfee
2008-02-23 14:08 . 2008-02-23 14:08 d——– C:\Program Files\Common Files\McAfee
2008-02-23 14:08 . 2007-07-21 10:08 201,288 –a—— C:\WINDOWS\system32\drivers\mfehidk.sys
2008-02-23 14:08 . 2007-07-13 10:20 113,952 –a—— C:\WINDOWS\system32\drivers\Mpfp.sys
2008-02-23 14:08 . 2007-07-24 08:40 79,304 –a—— C:\WINDOWS\system32\drivers\mfeavfk.sys
2008-02-23 14:08 . 2007-07-21 10:08 40,488 –a—— C:\WINDOWS\system32\drivers\mfesmfk.sys
2008-02-23 14:08 . 2007-07-21 10:08 35,240 –a—— C:\WINDOWS\system32\drivers\mfebopk.sys
2008-02-23 14:08 . 2007-07-24 13:02 33,800 –a—— C:\WINDOWS\system32\drivers\mferkdk.sys
2008-02-23 13:58 . 2008-02-23 14:09 d——– C:\Documents and Settings\All Users\Application Data\McAfee
2008-02-23 07:32 . 2007-07-30 20:19 271,224 –a—— C:\WINDOWS\system32\mucltui.dll
2008-02-23 07:32 . 2007-07-30 20:19 30,072 –a—— C:\WINDOWS\system32\mucltui.dll.mui
2008-02-22 22:41 . 2008-03-07 10:07 d——– C:\Documents and Settings\Lynn\Application Data\LimeWire
2008-02-22 19:22 . 2008-02-23 08:56 d——– C:\WINDOWS\system32\NtmsData
2008-02-22 17:02 . 2008-02-22 17:02 d——– C:\Program Files\Microsoft Silverlight

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-03 21:11 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-02-28 14:02 753,664 —-a-w C:\WINDOWS\system32\NTSpool.exe
2008-02-22 20:43 114,688 —-a-w C:\WINDOWS\system32\OpenAL32.dll
2008-02-22 19:49 ——— d—–w C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-02-22 19:43 ——— d—–w C:\Program Files\NVIDIA Corporation
2008-02-22 19:42 ——— d—–w C:\Program Files\Common Files\NVIDIA Shared
2008-02-22 19:42 ——— d—–w C:\Program Files\Common Files\InstallShield
2008-02-22 19:19 ——— d—–w C:\Program Files\microsoft frontpage
2008-02-05 02:23 693,792 —-a-w C:\WINDOWS\system32\OGACheckControl.DLL
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-CEC4-75A487FD6484}]
2007-10-02 13:31 1909248 –a—— C:\PROGRA~1\mypoints\mypoints.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{A057A204-BACC-4D26-CEC4-75A487FD6484}"= "C:\PROGRA~1\mypoints\mypoints.dll" [2007-10-02 13:31 1909248]

[HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-cec4-75a487fd6484}]
[HKEY_CLASSES_ROOT\mypoints.MYPOINTS]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{A057A204-BACC-4D26-CEC4-75A487FD6484}"= C:\PROGRA~1\mypoints\mypoints.dll [2007-10-02 13:31 1909248]

[HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-cec4-75a487fd6484}]
[HKEY_CLASSES_ROOT\mypoints.MYPOINTS]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 18:07 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-02-26 02:07 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2007-12-05 02:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NVMixerTray"="C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-12-20 18:12 131072]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 02:41 81920]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
"nTrayFw"="C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nTrayFw.exe" [2005-12-21 12:52 270336]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 23:33 582992]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\xxywttr]
xxywttr.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 relog_ap

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]
–a—— 2005-11-28 15:46 118784 C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
–a—— 2007-03-09 12:09 63712 C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2008-01-11 23:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Copperhead]
–a—— 2005-11-25 11:53 155648 D:\Hardware\razer\program\razerhid.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
–a—— 2007-04-09 13:32 19456 C:\WINDOWS\system32\CtHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTxfiHlp]
–a—— 2007-04-09 13:32 19968 C:\WINDOWS\system32\Ctxfihlp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
–a—— 2006-11-13 14:39 1289000 C:\Program Files\Microsoft ActiveSync\Wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
–a—— 2004-02-26 07:56 1179648 D:\Photo Software\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SM1BG]
-ra—— 2003-08-27 15:20 94208 C:\WINDOWS\SM1BG.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
–a—— 2008-02-26 02:07 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
–a—— 2005-11-28 15:46 988701 D:\Diagnostic\Acronis\TrueImage\TrueImageMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"=

S3 UsbFltr;Razer Copperhead Driver;C:\WINDOWS\system32\drivers\copperhd.sys [2005-11-02 11:54]
S4 Fipsumxpqcg;Fipsumxpqcg;C:\WINDOWS\system32\dwwin.exe [2004-08-03 18:07]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-23 21:08:40 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe'
"2008-02-23 21:08:39 C:\WINDOWS\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-10 18:44:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcIp.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcAppFlt.exe
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2008-03-10 18:46:42 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-11 01:46:32
ComboFix2.txt 2008-03-10 23:21:01
.
2008-03-04 12:02:12 — E O F —

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:49:29 PM, on 3/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nTrayFw.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcIp.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcAppFlt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: MYPOINTS - {A057A204-BACC-4D26-CEC4-75A487FD6484} - C:\PROGRA~1\mypoints\mypoints.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: MYPOINTS - {A057A204-BACC-4D26-CEC4-75A487FD6484} - C:\PROGRA~1\mypoints\mypoints.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nTrayFw] C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nTrayFw.exe
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\APPLIC~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\APPLIC~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\APPLIC~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\APPLIC~1\MICROS~1\FRONTP~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5E92F538-B50B-46C5-9C5F-C6EECED3F6C6} - http://www.infospace.com/mypoints.main/tba…pointsSetup.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1203721958250
O20 - Winlogon Notify: xxywttr - xxywttr.dll (file missing)
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–
End of file - 7230 bytes

File dwwin.exe received on 03.10.2008 17:25:11 (CET)
Current status: finished

Result: 0/32 (0.00%)
Compact Print results
Antivirus Version Last Update Result
AhnLab-V3 2008.3.4.0 2008.03.10 -
AntiVir 7.6.0.73 2008.03.10 -
Authentium 4.93.8 2008.03.07 -
Avast 4.7.1098.0 2008.03.09 -
AVG 7.5.0.516 2008.03.10 -
BitDefender 7.2 2008.03.10 -
CAT-QuickHeal 9.50 2008.03.08 -
ClamAV 0.92.1 2008.03.10 -
DrWeb 4.44.0.09170 2008.03.10 -
eSafe 7.0.15.0 2008.03.09 -
eTrust-Vet 31.3.5597 2008.03.07 -
Ewido 4.0 2008.03.10 -
FileAdvisor 1 2008.03.10 -
Fortinet 3.14.0.0 2008.03.10 -
F-Prot 4.4.2.54 2008.03.09 -
F-Secure 6.70.13260.0 2008.03.10 -
Ikarus T3.1.1.20 2008.03.10 -
Kaspersky 7.0.0.125 2008.03.10 -
McAfee 5247 2008.03.07 -
Microsoft 1.3301 2008.03.10 -
NOD32v2 2935 2008.03.10 -
Norman 5.80.02 2008.03.10 -
Panda 9.0.0.4 2008.03.09 -
Prevx1 V2 2008.03.10 -
Rising 20.35.02.00 2008.03.10 -
Sophos 4.27.0 2008.03.10 -
Sunbelt 3.0.930.0 2008.03.05 -
Symantec 10 2008.03.10 -
TheHacker 6.2.92.239 2008.03.09 -
VBA32 3.12.6.2 2008.03.05 -
VirusBuster 4.3.26:9 2008.03.10 -
Webwasher-Gateway 6.6.2 2008.03.10 -
Additional information
File size: 180224 bytes
MD5: 7c25440617eee6f69709aa8c915d2c32
SHA1: 40747172146706013a3334d475b5df0116c56643
PEiD: -

ATTENTION: VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.

Thank-you, Lynn

Rorschach112

Post #9March 11, 2008, 2:39 PM UTC

Hello

Before we begin, you should save these instructions in Notepad to your desktop, or print them, for easy reference. Much of our fix will be done in Safe mode, and you will be unable to access this thread at that time. If you have questions at any point, or are unsure of the instructions, feel free to post here and ask for clarification before proceeding.

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, the Advanced Options Menu should appear;
Select the first option, to run Windows in Safe Mode, then press Enter.
Choose your usual account.

Open the extracted SDFix folder and double click RunThis.bat to start the script.
Type Y to begin the cleanup process.
It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
(Report.txt will also be copied to Clipboard ready for posting back on the forum).
Finally paste the contents of the Report.txt back on the forum.

1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\fkpnnteo.ini
C:\WINDOWS\system32\vdyggcdg.ini
C:\WINDOWS\system32\hkmfdeje.ini
C:\WINDOWS\system32\aafvisbn.tmp
C:\WINDOWS\system32\xtyjewpp.tmp
C:\Documents and Settings\Lynn\2396.bat
C:\WINDOWS\system32\WinSecure.exe
C:\WINDOWS\system32\NTSpool.exe

1misled

Post #10March 11, 2008, 5:12 PM UTC

Here is the report.txt and combofix.txt,

SDFix: Version 1.155

Run by [removed] on Tue 03/11/2008 at 10:00 AM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting

Checking Files :

Trojan Files Found:

C:\WINDOWS\system32\NTSpool.exe - Deleted
C:\WINDOWS\system32\WinSecure.exe - Deleted

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-11 10:02:12
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden services & system hive …

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:*:Enabled:ActiveSync RAPI Manager"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files :

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Sun 2 Mar 2008 1,286,141 A.SH. — "C:\WINDOWS\system32\aafvisbn.tmp"
Sun 2 Mar 2008 1,286,201 A.SH. — "C:\WINDOWS\system32\kearfihx.tmp"
Sun 2 Mar 2008 1,286,081 A.SH. — "C:\WINDOWS\system32\xtyjewpp.tmp"
Sat 23 Feb 2008 20,487 A.SHR — "C:\Program Files\McAfee\MQC\MRU.bak"
Sat 23 Feb 2008 211 A.SHR — "C:\Program Files\McAfee\MQC\qcconf.bak"
Fri 22 Feb 2008 0 A.SH. — "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Thu 14 Feb 2008 1,833,520 A..H. — "C:\Documents and Settings\All Users\Application Data\Google Updater\cache\BIT52.tmp"
Thu 28 Feb 2008 88 A..H. — "C:\Documents and Settings\Lynn\Application Data\GlobalSCAPE\CuteFTP\5.0\cuteftp.sys"

Finished!

ComboFix 08-03-10.1 - Lynn 2008-03-11 10:05:43.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1631 [GMT -7:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Lynn\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-02-11 to 2008-03-11 )))))))))))))))))))))))))))))))
.

2008-03-11 09:58 . 2008-03-11 09:58 d——– C:\WINDOWS\ERUNT
2008-03-11 09:57 . 2008-03-11 10:04 d——– C:\SDFix
2008-03-11 08:47 . 2001-08-17 13:47 12,928 –a—— C:\WINDOWS\system32\drivers\Dot4Prt.sys
2008-03-11 08:47 . 2001-08-17 13:47 12,928 –a–c— C:\WINDOWS\system32\dllcache\dot4prt.sys
2008-03-11 08:46 . 2004-08-03 22:58 207,360 –a—— C:\WINDOWS\system32\drivers\Dot4.sys
2008-03-11 08:46 . 2004-08-03 22:58 207,360 –a–c— C:\WINDOWS\system32\dllcache\dot4.sys
2008-03-11 08:46 . 2001-08-17 13:47 23,808 –a—— C:\WINDOWS\system32\drivers\Dot4usb.sys
2008-03-11 08:46 . 2001-08-17 13:47 23,808 –a–c— C:\WINDOWS\system32\dllcache\dot4usb.sys
2008-03-11 02:58 . 2008-03-11 02:58 d——– C:\Program Files\VIP Casinos
2008-03-09 21:05 . 2008-03-10 00:52 1,318,373 –ahs—- C:\WINDOWS\system32\fkpnnteo.ini
2008-03-06 16:46 . 2008-03-06 16:46 245,760 ——— C:\WINDOWS\Setup1.exe
2008-03-06 16:46 . 2008-03-06 16:46 73,216 –a—— C:\WINDOWS\ST6UNST.EXE
2008-03-06 03:48 . 2008-03-06 03:48 d——– C:\Documents and Settings\Lynn\Application Data\Uniblue
2008-03-05 01:11 . 2008-03-05 18:59 1,307,614 –ahs—- C:\WINDOWS\system32\vdyggcdg.ini
2008-03-04 12:13 . 2008-03-04 14:33 1,303,018 –ahs—- C:\WINDOWS\system32\hkmfdeje.ini
2008-03-04 10:46 . 2008-03-04 10:46 d——– C:\Program Files\Trend Micro
2008-03-04 05:02 . 2008-03-04 05:02 d——– C:\Program Files\MSXML 4.0
2008-03-04 00:24 . 2008-03-10 00:39 d——– C:\Documents and Settings\Lynn\Application Data\Roxio
2008-03-04 00:18 . 2008-03-04 00:18 d——– C:\Documents and Settings\Lynn\Application Data\Leadertech
2008-03-03 11:21 . 2008-03-03 11:21 d——– C:\WINDOWS\DRIVERS
2008-03-03 11:21 . 2008-03-03 11:21 d——– C:\Documents and Settings\All Users\Application Data\Napster
2008-03-03 11:21 . 2003-08-27 15:20 266,240 -ra—— C:\WINDOWS\SM1nint.exe
2008-03-03 11:21 . 2003-08-27 15:20 94,208 -ra—— C:\WINDOWS\SM1bg.exe
2008-03-03 11:21 . 2003-08-27 15:20 86,106 -ra—— C:\WINDOWS\system32\SM1un.exe
2008-03-03 11:21 . 2003-08-27 15:19 36,963 -ra—— C:\Program Files\Common Files\SM1updtr.dll
2008-03-03 11:21 . 2003-08-27 15:20 32,896 -ra—— C:\WINDOWS\system32\drivers\SM1fx_at.sys
2008-03-03 11:21 . 2003-08-27 15:20 12,382 -ra—— C:\WINDOWS\system32\SM1ui32.dll
2008-03-03 11:17 . 2008-03-03 11:21 d——– C:\Program Files\Common Files\Roxio Shared
2008-03-03 11:17 . 2008-03-03 11:17 d——– C:\Documents and Settings\All Users\Application Data\Roxio
2008-03-03 10:10 . 2008-03-03 10:10 d——– C:\Program Files\Viewpoint
2008-03-03 10:09 . 2003-09-26 04:53 10,368 ——— C:\WINDOWS\system32\drivers\pfc.sys
2008-03-02 23:08 . 2008-03-02 23:08 1,286,201 –ahs—- C:\WINDOWS\system32\kearfihx.tmp
2008-03-02 20:08 . 2008-03-02 20:08 d——– C:\Program Files\Common Files\Adobe Systems Shared
2008-03-02 20:08 . 2008-03-02 20:08 d——– C:\Documents and Settings\All Users\Application Data\Macrovision
2008-03-02 13:07 . 2008-03-02 13:07 1,286,141 –ahs—- C:\WINDOWS\system32\aafvisbn.tmp
2008-03-02 13:04 . 2008-03-02 13:04 1,286,081 –ahs—- C:\WINDOWS\system32\xtyjewpp.tmp
2008-03-02 12:59 . 2005-10-20 18:47 30,592 ——— C:\WINDOWS\system32\drivers\rndismpx.sys
2008-03-02 12:59 . 2005-10-20 18:47 12,800 ——— C:\WINDOWS\system32\drivers\usb8023x.sys
2008-03-02 09:10 . 2008-03-02 09:10 d——– C:\Program Files\mypoints
2008-03-02 09:10 . 2008-03-02 09:10 d——– C:\Documents and Settings\Lynn\Application Data\mypoints
2008-02-29 19:17 . 2008-02-29 19:17 77 –a—— C:\Documents and Settings\Lynn\2396.bat
2008-02-28 13:48 . 2008-02-28 13:48 4,096 –a—— C:\WINDOWS\d3dx.dat
2008-02-28 13:47 . 2008-02-28 13:47 d–hs—- C:\WINDOWS\ftpcache
2008-02-28 13:46 . 2008-02-28 13:47 d——– C:\Documents and Settings\All Users\Application Data\Spadester
2008-02-28 07:14 . 2008-02-28 07:14 147,456 –a—— C:\WINDOWS\system32\vbzip10.dll
2008-02-28 07:11 . 2008-03-10 00:57 d——– C:\Temp
2008-02-28 07:08 . 2008-02-28 07:08 d——– C:\Documents and Settings\All Users\Application Data\GlobalSCAPE
2008-02-28 07:02 . 2008-02-28 07:02 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-28 07:02 . 2008-02-28 07:02 37,888 –a—— C:\WINDOWS\system32\rar.exe
2008-02-28 06:40 . 2008-02-28 07:07 d——– C:\Documents and Settings\Lynn\Application Data\GlobalSCAPE
2008-02-28 05:44 . 2008-03-06 16:10 2,025 –a—— C:\WINDOWS\mozver.dat
2008-02-28 04:50 . 2008-02-28 04:50 0 –a—— C:\WINDOWS\nsreg.dat
2008-02-28 04:41 . 2008-02-28 04:41 d——– C:\Program Files\Java
2008-02-28 04:41 . 2008-02-28 04:41 d——– C:\Program Files\Common Files\Java
2008-02-28 04:41 . 2007-09-25 00:31 69,632 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-02-28 04:35 . 2008-02-28 04:35 d——– C:\WINDOWS\Sun
2008-02-27 04:53 . 2008-02-27 04:53 d–h—– C:\WINDOWS\system32\CanonIJ Uninstaller Information
2008-02-27 04:53 . 2008-02-27 04:53 d–h—– C:\Program Files\CanonBJ
2008-02-27 04:53 . 2008-02-27 04:53 d–h—– C:\Documents and Settings\All Users\Application Data\CanonBJ
2008-02-27 04:53 . 2007-03-24 01:30 1,400,832 –a—— C:\WINDOWS\system32\CNC470C.DLL
2008-02-27 04:53 . 2007-04-02 14:00 215,040 –a—— C:\WINDOWS\system32\CNMLM8U.DLL
2008-02-27 04:53 . 2007-03-19 19:21 200,704 –a—— C:\WINDOWS\system32\CNC470L.DLL
2008-02-27 04:53 . 2007-03-15 23:12 188,416 –a—— C:\WINDOWS\system32\CNC470O.DLL
2008-02-27 04:53 . 2007-03-24 01:29 98,304 –a—— C:\WINDOWS\system32\CNC470I.DLL
2008-02-27 04:53 . 2004-08-03 23:58 15,104 –a—— C:\WINDOWS\system32\drivers\usbscan.sys
2008-02-27 04:53 . 2004-08-03 23:58 15,104 –a–c— C:\WINDOWS\system32\dllcache\usbscan.sys
2008-02-27 04:52 . 2008-02-27 04:52 d——– C:\Documents and Settings\Lynn\Application Data\Gtek
2008-02-27 04:52 . 2008-02-27 04:52 d——– C:\Documents and Settings\All Users\Application Data\Gtek
2008-02-27 04:09 . 2008-02-27 04:09 d——– C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-02-26 05:29 . 2008-02-26 05:29 d——– C:\Program Files\Common Files\Acronis
2008-02-26 05:29 . 2008-02-26 05:29 249,152 –a—— C:\WINDOWS\system32\drivers\timntr.sys
2008-02-26 05:29 . 2008-02-26 05:29 96,320 –a—— C:\WINDOWS\system32\drivers\snapman.sys
2008-02-26 05:29 . 2008-02-26 05:29 30,688 –a—— C:\WINDOWS\system32\drivers\tifsfilt.sys
2008-02-26 02:50 . 2008-03-02 20:08 d——– C:\Program Files\Common Files\Adobe
2008-02-26 02:49 . 2008-02-26 02:49 d——– C:\WINDOWS\Downloaded Installations
2008-02-26 02:11 . 2008-02-26 02:11 d——– C:\Program Files\Yahoo!
2008-02-26 02:11 . 2008-02-26 02:11 d——– C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-02-26 02:07 . 2008-02-26 02:08 d——– C:\Program Files\Google
2008-02-26 02:07 . 2008-03-11 00:03 d——– C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-25 12:06 . 2008-03-06 20:32 588 –a—— C:\WINDOWS\system32\settingsbkup.sfm
2008-02-25 12:06 . 2008-03-06 20:32 588 –a—— C:\WINDOWS\system32\settings.sfm
2008-02-25 11:27 . 2008-02-25 11:30 d——– C:\Documents and Settings\Lynn\Application Data\Intuit
2008-02-25 11:26 . 2008-02-25 11:26 d——– C:\Program Files\Common Files\Intuit
2008-02-25 11:26 . 2008-02-25 11:26 d——– C:\Documents and Settings\All Users\Application Data\Intuit
2008-02-25 11:26 . 2007-10-22 19:58 1,721,712 –a—— C:\WINDOWS\system32\InetClnt.dll
2008-02-25 11:22 . 2008-02-26 06:37 d——– C:\Documents and Settings\Lynn\Application Data\BitDownload
2008-02-25 03:10 . 2008-02-25 03:10 d——– C:\Documents and Settings\All Users\Application Data\FunGames
2008-02-25 00:58 . 2005-11-10 10:15 69,632 –a—— C:\WINDOWS\system32\copperhd.cpl
2008-02-25 00:58 . 2005-12-21 12:23 14,592 –a—— C:\WINDOWS\system32\drivers\USBICP.sys
2008-02-25 00:58 . 2005-11-02 11:54 11,596 –a—— C:\WINDOWS\system32\drivers\copperhd.sys
2008-02-25 00:57 . 2008-02-25 00:57 d——– C:\Documents and Settings\Lynn\Application Data\InstallShield
2008-02-25 00:11 . 2004-08-04 00:01 25,856 –a—— C:\WINDOWS\system32\drivers\usbprint.sys
2008-02-25 00:11 . 2004-08-04 00:01 25,856 –a–c— C:\WINDOWS\system32\dllcache\usbprint.sys
2008-02-23 14:08 . 2008-02-23 14:08 d——– C:\Program Files\McAfee.com
2008-02-23 14:08 . 2008-02-24 22:47 d——– C:\Program Files\McAfee
2008-02-23 14:08 . 2008-02-23 14:08 d——– C:\Program Files\Common Files\McAfee
2008-02-23 14:08 . 2007-07-21 10:08 201,288 –a—— C:\WINDOWS\system32\drivers\mfehidk.sys
2008-02-23 14:08 . 2007-07-13 10:20 113,952 –a—— C:\WINDOWS\system32\drivers\Mpfp.sys
2008-02-23 14:08 . 2007-07-24 08:40 79,304 –a—— C:\WINDOWS\system32\drivers\mfeavfk.sys
2008-02-23 14:08 . 2007-07-21 10:08 40,488 –a—— C:\WINDOWS\system32\drivers\mfesmfk.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-03 21:11 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-02-22 20:43 114,688 —-a-w C:\WINDOWS\system32\OpenAL32.dll
2008-02-22 19:49 ——— d—–w C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-02-22 19:43 ——— d—–w C:\Program Files\NVIDIA Corporation
2008-02-22 19:42 ——— d—–w C:\Program Files\Common Files\NVIDIA Shared
2008-02-22 19:42 ——— d—–w C:\Program Files\Common Files\InstallShield
2008-02-22 19:19 ——— d—–w C:\Program Files\microsoft frontpage
2008-02-05 02:23 693,792 —-a-w C:\WINDOWS\system32\OGACheckControl.DLL
.

((((((((((((((((((((((((((((( snapshot@2008-03-10_16.20.38.42 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-03-10 10:03:21 163,328 —-a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-03-11 16:58:48 3,878,912 —-a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
+ 2008-03-11 16:58:48 151,552 —-a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-03-10 10:03:21 163,328 —-a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-03-11 16:58:47 3,878,912 —-a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
+ 2008-03-11 16:58:47 151,552 —-a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
- 2008-03-10 21:53:19 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-03-11 14:58:07 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-03-10 21:53:19 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-03-11 14:58:07 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-03-11 14:58:07 32,768 –sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-CEC4-75A487FD6484}]
2007-10-02 13:31 1909248 –a—— C:\PROGRA~1\mypoints\mypoints.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{A057A204-BACC-4D26-CEC4-75A487FD6484}"= "C:\PROGRA~1\mypoints\mypoints.dll" [2007-10-02 13:31 1909248]

[HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-cec4-75a487fd6484}]
[HKEY_CLASSES_ROOT\mypoints.MYPOINTS]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{A057A204-BACC-4D26-CEC4-75A487FD6484}"= C:\PROGRA~1\mypoints\mypoints.dll [2007-10-02 13:31 1909248]

[HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-cec4-75a487fd6484}]
[HKEY_CLASSES_ROOT\mypoints.MYPOINTS]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 18:07 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-02-26 02:07 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2007-12-05 02:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NVMixerTray"="C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-12-20 18:12 131072]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 02:41 81920]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
"nTrayFw"="C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nTrayFw.exe" [2005-12-21 12:52 270336]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 23:33 582992]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\xxywttr]
xxywttr.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 relog_ap

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]
–a—— 2005-11-28 15:46 118784 C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
–a—— 2007-03-09 12:09 63712 C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2008-01-11 23:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Copperhead]
–a—— 2005-11-25 11:53 155648 D:\Hardware\razer\program\razerhid.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
–a—— 2007-04-09 13:32 19456 C:\WINDOWS\system32\CtHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTxfiHlp]
–a—— 2007-04-09 13:32 19968 C:\WINDOWS\system32\Ctxfihlp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
–a—— 2006-11-13 14:39 1289000 C:\Program Files\Microsoft ActiveSync\Wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
–a—— 2004-02-26 07:56 1179648 D:\Photo Software\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SM1BG]
-ra—— 2003-08-27 15:20 94208 C:\WINDOWS\SM1BG.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
–a—— 2008-02-26 02:07 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
–a—— 2005-11-28 15:46 988701 D:\Diagnostic\Acronis\TrueImage\TrueImageMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"=

S3 UsbFltr;Razer Copperhead Driver;C:\WINDOWS\system32\drivers\copperhd.sys [2005-11-02 11:54]
S4 Fipsumxpqcg;Fipsumxpqcg;C:\WINDOWS\system32\dwwin.exe [2004-08-03 18:07]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-23 21:08:40 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe'
"2008-02-23 21:08:39 C:\WINDOWS\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-11 10:08:00
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcIp.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcLog.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcAppFlt.exe
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2008-03-11 10:10:00 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-11 17:09:56
ComboFix2.txt 2008-03-11 01:56:03
ComboFix3.txt 2008-03-10 23:21:01
.
2008-03-04 12:02:12 — E O F —

Thank-you, Lynn

Rorschach112

Post #11March 11, 2008, 11:04 PM UTC

Hello

Please download the OTMoveIt2 by OldTimer.

Save it to your desktop.
Please double-click OTMoveIt2.exe to run it.

Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

C:\WINDOWS\system32\aafvisbn.tmp
C:\WINDOWS\system32\kearfihx.tmp
C:\WINDOWS\system32\xtyjewpp.tmp
C:\WINDOWS\system32\fkpnnteo.ini
C:\WINDOWS\system32\vdyggcdg.ini
C:\WINDOWS\system32\hkmfdeje.ini
C:\WINDOWS\system32\kearfihx.tmp
C:\WINDOWS\system32\aafvisbn.tmp
C:\WINDOWS\system32\xtyjewpp.tmp
C:\Documents and Settings\Lynn\2396.bat

Return to OTMoveIt2, right click in the "Paste List of Files/Folders to be Moved" window (under the light blue bar) and choose Paste.
Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
```
purity
```
Return to OTMoveIt2, right click in the "Paste List Of Files/Patterns To Search For and Move" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Reboot and do this

Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner and click Accept

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:
- Scan using the following Anti-Virus database:
Extended (if available otherwise Standard)
- Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan:Select My Computer
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
- Now click on the Save as Text button:
Save the file to your desktop.
Copy and paste that information in your next post.

Also post a new HijackThis log

1misled

Post #12March 14, 2008, 9:16 AM UTC

Here is the otmoveit2.txt, kaspersky.txt and hijackthis.txt

[Custom Input]
< C:\WINDOWS\system32\aafvisbn.tmp >
C:\WINDOWS\system32\aafvisbn.tmp moved successfully.
< C:\WINDOWS\system32\kearfihx.tmp >
C:\WINDOWS\system32\kearfihx.tmp moved successfully.
< C:\WINDOWS\system32\xtyjewpp.tmp >
C:\WINDOWS\system32\xtyjewpp.tmp moved successfully.
< C:\WINDOWS\system32\fkpnnteo.ini >
C:\WINDOWS\system32\fkpnnteo.ini moved successfully.
< C:\WINDOWS\system32\vdyggcdg.ini >
C:\WINDOWS\system32\vdyggcdg.ini moved successfully.
< C:\WINDOWS\system32\hkmfdeje.ini >
C:\WINDOWS\system32\hkmfdeje.ini moved successfully.
< C:\WINDOWS\system32\kearfihx.tmp >
File/Folder C:\WINDOWS\system32\kearfihx.tmp not found.
< C:\WINDOWS\system32\aafvisbn.tmp >
File/Folder C:\WINDOWS\system32\aafvisbn.tmp not found.
< C:\WINDOWS\system32\xtyjewpp.tmp >
File/Folder C:\WINDOWS\system32\xtyjewpp.tmp not found.
< C:\Documents and Settings\Lynn\2396.bat >
C:\Documents and Settings\Lynn\2396.bat moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.21 log created on 03132008_130207

[Custom Input]
< purity >

OTMoveIt2 by OldTimer - Version 1.0.21 log created on 03132008_135909

——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Friday, March 14, 2008 2:04:37 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 13/03/2008
Kaspersky Anti-Virus database records: 628082
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\

Scan Statistics:
Total number of scanned objects: 29991
Number of viruses found: 8
Number of infected objects: 292
Number of suspicious objects: 0
Duration of the scan process: 00:24:30

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\McAfee\MNA\NAData Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\Events.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\{29774919-62F2-4CE7-84CB-79FDF0D3C320}.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\MSC\McUsers.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\VirusScan\Logs\OAS.Log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Lynn\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Lynn\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Lynn\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Lynn\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Lynn\Local Settings\Application Data\Mozilla\Firefox\Profiles\cnogoc66.default\Cache\2F4C79DEd01 Infected: not-a-virus:Downloader.Win32.WinFixer.an skipped
C:\Documents and Settings\Lynn\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Lynn\Local Settings\History\History.IE5\MSHist012008031320080314\index.dat Object is locked skipped
C:\Documents and Settings\Lynn\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Lynn\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Lynn\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\logs\access_log Object is locked skipped
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\logs\error.log Object is locked skipped
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\logs\error_log Object is locked skipped
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\logs\ssl_request_log Object is locked skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\abaimkte.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\axlgepay.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.jxa skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\blxollrm.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\cadfdkuo.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\dggxxpuk.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\dkpwhsnm.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\eeykxdur.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\fvvhirlb.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\fwgyqieu.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\gjplbhtc.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\gxntksdb.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\hrjkghsa.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ikfygqkk.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\jhkiggni.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\jipcjtwy.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\kbipkawa.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\kcmsgsfq.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\lruyarek.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\mixalhlo.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\mljihff.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\mrnskmxg.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.jxa skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\mxsoqaun.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\myvijvtq.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\nbdvddjl.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\oefteckh.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\oesefraf.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ookssuqn.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\opchymnq.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\qygkjapx.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ucvkpagf.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ufbcfguv.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\uvkxvmjh.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\vehyksdl.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\vfapjuca.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\wrtyykdt.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\wtdwthkx.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\yqcxkjvf.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\catchme2008-03-10_161929.03.zip/jkklk.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\catchme2008-03-10_161929.03.zip/xxywttr.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\catchme2008-03-10_161929.03.zip ZIP: infected - 2 skipped
C:\SDFix\backups\backups.zip/backups/NTSpool.exe Infected: Trojan.Win32.Agent.ftz skipped
C:\SDFix\backups\backups.zip/backups/WinSecure.exe Infected: P2P-Worm.Win32.Archivarius.a skipped
C:\SDFix\backups\backups.zip ZIP: infected - 2 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP41\A0015684.exe Infected: Trojan-Downloader.Win32.VB.bsa skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP41\A0015731.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP41\A0015750.exe Infected: Trojan.Win32.VB.cfl skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP41\A0015762.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP41\A0015763.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP41\A0015766.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017026.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017031.exe Infected: Trojan.Win32.VB.cfl skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017039.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017040.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017041.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017042.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018250.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018251.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jxa skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018252.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018253.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018254.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018255.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018256.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018257.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018258.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018259.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018260.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018261.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018262.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018263.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018264.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018265.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018266.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018267.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018268.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018269.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018270.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jxa skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018271.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018272.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018273.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018274.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018275.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018276.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018277.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018278.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018279.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018280.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018281.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018282.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018283.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018284.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018285.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP44\A0018286.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP45\A0018541.exe Infected: Trojan.Win32.Agent.ftz skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP45\A0018542.exe Infected: P2P-Worm.Win32.Archivarius.a skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP45\A0018549.exe Infected: Trojan.Win32.Agent.ftz skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP45\A0018551.exe Infected: P2P-Worm.Win32.Archivarius.a skipped
C:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP48\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{096BAA44-655A-4CB4-83FF-4D5461A42F8F}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\app_filter_ui.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\system32\_nvidia_xxx_.log Object is locked skipped
C:\WINDOWS\Temp\mcmsc_lTHuY7oeDhmZRIT Object is locked skipped
C:\WINDOWS\Temp\mcmsc_Rl3KNWhIwDaTC7e Object is locked skipped
C:\WINDOWS\Temp\mcmsc_RMPw5tvR6JsJaJv Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\Online\CuteFTP 8 Professional\Setup.exe Infected: Trojan-Downloader.Win32.VB.bsa skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017058.exe/data0001/regwebh.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017058.exe/data0001/wbhshare.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017058.exe/data0001/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017058.exe/data0001/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017058.exe/data0001/whiedc.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017058.exe/data0001/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017058.exe/data0001/whieshm.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017058.exe/data0001/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017058.exe/data0001 Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017058.exe Inno: infected - 9 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017070.exe/data0001/regwebh.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017070.exe/data0001/wbhshare.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017070.exe/data0001/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017070.exe/data0001/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017070.exe/data0001/whiedc.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017070.exe/data0001/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017070.exe/data0001/whieshm.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017070.exe/data0001/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017070.exe/data0001 Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017070.exe Inno: infected - 9 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017073.exe/data0001/regwebh.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017073.exe/data0001/wbhshare.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017073.exe/data0001/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017073.exe/data0001/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017073.exe/data0001/whiedc.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017073.exe/data0001/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017073.exe/data0001/whieshm.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017073.exe/data0001/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017073.exe/data0001 Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017073.exe Inno: infected - 9 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017100.exe/data0001/regwebh.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017100.exe/data0001/wbhshare.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017100.exe/data0001/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017100.exe/data0001/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017100.exe/data0001/whiedc.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017100.exe/data0001/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017100.exe/data0001/whieshm.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017100.exe/data0001/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017100.exe/data0001 Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017100.exe Inno: infected - 9 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017109.exe/data0001/regwebh.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017109.exe/data0001/wbhshare.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017109.exe/data0001/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017109.exe/data0001/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017109.exe/data0001/whiedc.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017109.exe/data0001/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017109.exe/data0001/whieshm.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017109.exe/data0001/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017109.exe/data0001 Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017109.exe Inno: infected - 9 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017116.exe/data0001/regwebh.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017116.exe/data0001/wbhshare.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017116.exe/data0001/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017116.exe/data0001/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017116.exe/data0001/whiedc.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017116.exe/data0001/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017116.exe/data0001/whieshm.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017116.exe/data0001/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017116.exe/data0001 Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017116.exe Inno: infected - 9 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017118.exe/data0001/regwebh.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017118.exe/data0001/wbhshare.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017118.exe/data0001/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017118.exe/data0001/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017118.exe/data0001/whiedc.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017118.exe/data0001/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017118.exe/data0001/whieshm.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017118.exe/data0001/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017118.exe/data0001 Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017118.exe Inno: infected - 9 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017119.exe/data0001/regwebh.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017119.exe/data0001/wbhshare.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017119.exe/data0001/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017119.exe/data0001/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017119.exe/data0001/whiedc.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017119.exe/data0001/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017119.exe/data0001/whieshm.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017119.exe/data0001/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017119.exe/data0001 Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017119.exe Inno: infected - 9 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017126.exe/data0001/regwebh.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017126.exe/data0001/wbhshare.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017126.exe/data0001/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017126.exe/data0001/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017126.exe/data0001/whiedc.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017126.exe/data0001/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017126.exe/data0001/whieshm.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017126.exe/data0001/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017126.exe/data0001 Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017126.exe Inno: infected - 9 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017131.exe/data0001/regwebh.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017131.exe/data0001/wbhshare.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017131.exe/data0001/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017131.exe/data0001/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017131.exe/data0001/whiedc.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017131.exe/data0001/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017131.exe/data0001/whieshm.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017131.exe/data0001/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017131.exe/data0001 Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017131.exe Inno: infected - 9 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017142.exe/data0001/regwebh.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017142.exe/data0001/wbhshare.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017142.exe/data0001/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017142.exe/data0001/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017142.exe/data0001/whiedc.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017142.exe/data0001/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017142.exe/data0001/whieshm.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017142.exe/data0001/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017142.exe/data0001 Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017142.exe Inno: infected - 9 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017151.exe/data0001/regwebh.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017151.exe/data0001/wbhshare.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017151.exe/data0001/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017151.exe/data0001/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017151.exe/data0001/whiedc.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017151.exe/data0001/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017151.exe/data0001/whieshm.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017151.exe/data0001/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017151.exe/data0001 Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017151.exe Inno: infected - 9 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017163.exe/data0001/regwebh.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017163.exe/data0001/wbhshare.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017163.exe/data0001/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017163.exe/data0001/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017163.exe/data0001/whiedc.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017163.exe/data0001/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017163.exe/data0001/whieshm.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017163.exe/data0001/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017163.exe/data0001 Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017163.exe Inno: infected - 9 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017165.exe/data0001/regwebh.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017165.exe/data0001/wbhshare.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017165.exe/data0001/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017165.exe/data0001/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017165.exe/data0001/whiedc.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017165.exe/data0001/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017165.exe/data0001/whieshm.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017165.exe/data0001/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017165.exe/data0001 Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017165.exe Inno: infected - 9 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017170.exe/data0001/regwebh.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017170.exe/data0001/wbhshare.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017170.exe/data0001/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017170.exe/data0001/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017170.exe/data0001/whiedc.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017170.exe/data0001/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017170.exe/data0001/whieshm.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017170.exe/data0001/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017170.exe/data0001 Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017170.exe Inno: infected - 9 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017172.exe/data0001/regwebh.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017172.exe/data0001/wbhshare.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017172.exe/data0001 Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
F:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017172.exe Inno: infected - 3 skipped
G:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017069.exe/data0001/regwebh.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017069.exe/data0001/wbhshare.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017069.exe/data0001/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017069.exe/data0001/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017069.exe/data0001/whiedc.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017069.exe/data0001/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017069.exe/data0001/whieshm.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017069.exe/data0001/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017069.exe/data0001 Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017069.exe Inno: infected - 9 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017117.exe/data0001/regwebh.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017117.exe/data0001/wbhshare.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017117.exe/data0001/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017117.exe/data0001/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017117.exe/data0001/whiedc.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017117.exe/data0001/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017117.exe/data0001/whieshm.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017117.exe/data0001/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017117.exe/data0001 Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017117.exe Inno: infected - 9 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017164.exe/data0001/regwebh.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017164.exe/data0001/wbhshare.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017164.exe/data0001/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017164.exe/data0001/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017164.exe/data0001/whiedc.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017164.exe/data0001/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017164.exe/data0001/whieshm.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017164.exe/data0001/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017164.exe/data0001 Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017164.exe Inno: infected - 9 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017171.exe/data0001/regwebh.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017171.exe/data0001/wbhshare.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017171.exe/data0001/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017171.exe/data0001/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017171.exe/data0001/whiedc.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017171.exe/data0001/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017171.exe/data0001/whieshm.dll Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017171.exe/data0001/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017171.exe/data0001 Infected: not-a-virus:AdWare.Win32.WebHancer.16 skipped
G:\System Volume Information\_restore{4B66EAAA-814A-4267-9914-A2589EBB8BBC}\RP42\A0017171.exe Inno: infected - 9 skipped
H:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
I:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

Scan process completed.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:10:45 AM, on 3/14/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nTrayFw.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcIp.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcAppFlt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: MYPOINTS - {A057A204-BACC-4D26-CEC4-75A487FD6484} - C:\PROGRA~1\mypoints\mypoints.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: MYPOINTS - {A057A204-BACC-4D26-CEC4-75A487FD6484} - C:\PROGRA~1\mypoints\mypoints.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nTrayFw] C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nTrayFw.exe
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\APPLIC~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\APPLIC~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\APPLIC~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\APPLIC~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {5E92F538-B50B-46C5-9C5F-C6EECED3F6C6} - http://www.infospace.com/mypoints.main/tba…pointsSetup.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1203721958250
O20 - Winlogon Notify: xxywttr - xxywttr.dll (file missing)
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–
End of file - 7400 bytes

Rorschach112

Post #13March 14, 2008, 2:42 PM UTC

Hello

1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

O20 - Winlogon Notify: xxywttr - xxywttr.dll (file missing)

2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.

1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\Documents and Settings\Lynn\Local Settings\Application Data\Mozilla\Firefox\Profiles\cnogoc66.default\Cache\2F4C79DEd01
D:\Online\CuteFTP 8 Professional\Setup.exe

Folder::
C:\Documents and Settings\Lynn\Local Settings\Application Data\Mozilla\Firefox\Profiles\cnogoc66.default\Cache\2F4C79DEd01

Driver::
Fipsumxpqcg

1misled

Post #14March 14, 2008, 5:20 PM UTC

It definitely appears to be running better, no more pop-ups or so far lags. I am so impressed with all of your effort and work I donated $$ to support What the Tech. You saved me from having to reinstall my system again. Do you have any ideas as to what software I installed that maybe this virus or viruses originated from so I will avoid doing this again? And any other advice is strongly appreciated. Please advise if there are any additional steps for me to take.
Thank-you very much. Lynn

One more thing, I wish when I donated that there was an area where I could have given you recognition for your expertise.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:13:14 AM, on 3/14/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nTrayFw.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\SM1BG.EXE
D:\Photo Software\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcIp.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcAppFlt.exe
C:\WINDOWS\system32\wscntfy.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
D:\Online\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: MYPOINTS - {A057A204-BACC-4D26-CEC4-75A487FD6484} - C:\PROGRA~1\mypoints\mypoints.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: MYPOINTS - {A057A204-BACC-4D26-CEC4-75A487FD6484} - C:\PROGRA~1\mypoints\mypoints.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nTrayFw] C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nTrayFw.exe
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [RoxioDragToDisc] "D:\Photo Software\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\APPLIC~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\APPLIC~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\APPLIC~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\APPLIC~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} (king.com) - http://www.king.com/ctl/kingcomie.cab
O16 - DPF: {5E92F538-B50B-46C5-9C5F-C6EECED3F6C6} - http://www.infospace.com/mypoints.main/tba…pointsSetup.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1203721958250
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–
End of file - 8096 bytes

Rorschach112

Post #15March 14, 2008, 7:17 PM UTC

Thank you for the kind words

Few things to do

Now lets uninstall Combofix:

Click START then RUN
Now type Combofix /u in the runbox and click OK

The above procedure will do the following:

Delete ComboFix and its associated files and folders.
Delete VundoFix backups, if present
Delete the C:\Deckard folder, if present
Delete the C:_OtMoveIt folder, if present
Reset the clock settings.
Hide file extensions, if required.
Hide System/Hidden files, if required.
Reset System Restore.

You now need to update your Java and remove your older versions.

Please follow these steps to remove older version Java components.

* Click Start > Control Panel.
* Click Add/Remove Programs.
* Check any item with Java Runtime Environment (JRE) in the name.
* Click the Remove or Change/Remove button.

Download the latest version of Java Runtime Environment (JRE), and install it to your computer from
here

Make sure you have an Internet Connection.
Double-click OTMoveIt2.exe to run it.
Click on the CleanUp! button
A list of tool components used in the Cleanup of malware will be downloaded.
If your Firewall or Real Time protection attempts to block OtMoveit2 to rech the Internet, please allow the application to do so.
Click Yes to beging the Cleanup process and remove these components, including this application.
You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

Below I have included a number of recommendations for how to protect your computer against malware infections.

* Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.

* To reduce re-infection for malware in the future, I strongly recommend installing these free programs:
SpywareBlaster protects against bad ActiveX
IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all
Have a look at this tutorial for IE-Spyad here

* SpywareGuard offers realtime protection from spyware installation attempts.

Make Internet Explorer more secure

Click Start > Run
Type Inetcpl.cpl & click OK
Click on the Security tab
Click Reset all zones to default level
Make sure the Internet Zone is selected & Click Custom level
In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
Next Click OK, then Apply button and then OK to exit the Internet Properties page.

* MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

* Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
Here

* Take a good look at the following suggestions for malware prevention by reading Tony Klein’s article 'How Did I Get Infected In The First Place'
Here

Thank you for your patience, and performing all of the procedures requested.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] advance cleaner messages and slowness.

✨ Ask AI

Ask AI