ShadowProwler420
Topic Starter
Hello,
I am currently trying to fix a friend's computer (which is running XP Media Center Edition) and have found out it is infiected with the winself.exe trojan and am having difficulties removing it. I found a similar thread ( http://forums.whatthetech.com/Please_help_…ood_t91220.html ) in which the person was directed to post scan results from Deckard's System Scanner. PLEASE NOTE: I had to run DSS in Safe Mode due to Notepad systematically crashing in Normal mode (don't know if it is a result of this winself.exe infection or something else), and only got one of the result files (main.txt). So here it is:
Deckard's System Scanner v20071014.68
Run by [removed] on 2008-06-29 18:10:51
Computer is in Safe Mode with Networking.
——————————————————————————–
– HijackThis Clone ————————————————————
Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-06-29 18:11:28
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16674)
Boot mode: Safe mode with network support
Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Citrix\ICA Client\ssonsvr.exe
C:\WINDOWS\explorer.exe
L:\dss.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/keyword/%s
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Helper Class - {3670A914-63C2-4E67-8C9B-370AE1922143} - C:\Program Files\BChanger\bchanger.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: StFlex IE Helper - {8334A30C-49E5-489a-B63D-5B927C1EF46E} - C:\Program Files\QdrDrive\QdrDrive15.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: (no name) - {FB60EC4A-27AE-7B74-FA38-0CA2969A1ECD} - C:\WINDOWS\system32\ojomoye.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar4.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableTaskMgr=1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableTaskMgr=1
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\ERIN\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://fpdownload.macromedia.com/get/shock…director/sw.cab
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} (Shockwave ActiveX Control) - http://fpdownload.macromedia.com/get/shock…director/sw.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/4h/pla…0/Installer.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://elutions.webex.com/client/T23L/webex/ieatgpc.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30155.www3.hp.com/ediags/hpfix/aio…/qdiagh.cab?326
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O20 - Winlogon Notify: efcCrSjK - C:\WINDOWS\system32\efcCrSjK.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSVCCDA.EXE
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildTangent\Apps\HP Game Console\GameConsoleService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MsSecurity Updated (MsSecurity1.209.4) - Unknown owner - C:\WINDOWS\winself.exe service
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\Program Files\Trend Micro\Internet Security 2005\PcCtlCom.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\Program Files\Trend Micro\Internet Security 2005\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security 2005\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security 2005\tmproxy.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
–
End of file - 10198 bytes
– Files created between 2008-05-29 and 2008-06-29 —————————–
2008-06-29 17:16:46 0 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-06-29 16:32:50 0 d——– C:\Program Files\IObit
2008-06-29 12:39:00 0 dr-h—– C:\Documents and Settings\HP_Administrator\Recent
2008-06-29 12:35:13 0 d——– C:\Program Files\CCleaner
2008-06-23 13:04:01 0 d——– C:\Program Files\BChanger
2008-06-22 17:17:34 36 –a—— C:\WINDOWS\rasqervy.dll
2008-06-22 17:17:32 8 –a—— C:\WINDOWS\sdfinacs.dll
2008-06-22 17:17:11 5 –a—— C:\WINDOWS\sdfixwcs.dll
2008-06-14 22:23:21 0 d——– C:\Documents and Settings\All Users\Application Data\eGames
2008-06-14 22:14:06 140 –a—— C:\WINDOWS\wuasirvy.dll
2008-06-14 22:12:14 60928 –a—— C:\WINDOWS\system32\ojomoye.dll
2008-06-14 22:11:55 0 d——– C:\Program Files\GetModule
2008-06-14 22:11:53 0 d——– C:\Program Files\iCheck
2008-06-14 22:11:53 0 d——– C:\Program Files\GetPack
2008-06-14 22:08:18 0 d——– C:\Documents and Settings\Guest\Application Data\WildTangent
2008-06-11 00:44:23 0 d——– C:\Program Files\Antivirus2008
2008-06-10 22:00:00 55808 –a—— C:\WINDOWS\portsv.exe
– Find3M Report —————————————————————
2008-06-27 21:31:27 49 –a—— C:\WINDOWS\popcinfo.dat
2008-06-14 22:16:23 0 d——– C:\Program Files\HP Games
2008-06-14 22:12:23 0 d——– C:\Program Files\QdrPack
2008-06-14 22:11:49 0 d——– C:\Program Files\QdrModule
2008-06-10 22:00:34 0 d——– C:\Program Files\AntiSpywareMaster
2008-05-18 20:36:10 1351809 –ahs—- C:\WINDOWS\system32\OUFOqBeg.ini2
2008-05-18 20:36:08 2112 –a—— C:\WINDOWS\system32\beatiufx.exe
2008-05-18 20:16:59 3648 –a—— C:\WINDOWS\system32\djsdamcr.dll
2008-05-15 16:41:59 90176 –a—— C:\WINDOWS\system32\qqcfwkfs.dll
2008-05-15 16:39:02 2112 –a—— C:\WINDOWS\system32\wypqllht.exe
2008-05-15 16:36:00 101952 –a—— C:\WINDOWS\system32\uyuaxdfv.dll
2008-05-15 16:34:28 3648 –a—— C:\WINDOWS\system32\dwjudiir.dll
2008-05-15 16:34:19 99904 –a—— C:\WINDOWS\system32\uvuryoii.dll
2008-05-11 22:33:30 0 d——– C:\Program Files\MalwareAlarm
2008-05-11 22:18:38 2112 –a—— C:\WINDOWS\system32\ivtmfddk.exe
2008-05-10 21:51:16 16640 –a—— C:\WINDOWS\2020search2.dll
2008-05-10 21:51:15 13824 –a—— C:\WINDOWS\2020search.dll
2008-05-06 22:40:17 1100 –a—— C:\WINDOWS\system32\d3d8caps.dat
2008-05-06 21:34:53 0 d——– C:\Program Files\Common Files
2008-05-06 21:21:44 664 –a—— C:\WINDOWS\system32\d3d9caps.dat
2008-05-06 21:14:08 0 d——– C:\Program Files\RcvSystem
2008-05-04 12:01:19 17408 –a—— C:\WINDOWS\stcloader.exe
2008-05-04 12:01:18 19456 –a—— C:\WINDOWS\voiceip.dll
2008-05-04 12:01:18 32256 –a—— C:\WINDOWS\swin32.dll
2008-05-04 12:01:17 22784 –a—— C:\WINDOWS\cdsm32.dll
2008-05-04 12:01:17 14592 –a—— C:\WINDOWS\bokja.exe
2008-05-04 12:01:16 17664 –a—— C:\WINDOWS\mssvr.exe
2008-05-04 12:01:16 9216 –a—— C:\WINDOWS\mspphe.dll
2008-05-04 12:01:16 8448 –a—— C:\WINDOWS\bjam.dll
2008-05-04 12:01:12 9728 –a—— C:\WINDOWS\saiemod.dll
2008-05-04 12:01:11 11520 –a—— C:\WINDOWS\msapasrc.dll
2008-05-04 12:01:11 16128 –a—— C:\WINDOWS\msa64chk.dll
2008-05-04 12:01:10 20224 –a—— C:\WINDOWS\shdocpl.dll
2008-05-04 12:01:09 28160 –a—— C:\WINDOWS\shdocpe.dll
2008-05-04 12:01:09 11776 –a—— C:\WINDOWS\ntnut.exe
2008-05-04 12:01:08 17920 –a—— C:\WINDOWS\winsb.dll
2008-05-04 12:01:07 31488 –a—— C:\WINDOWS\browserad.dll
2008-05-04 12:01:07 19712 –a—— C:\WINDOWS\aviwrap32.dll
2008-05-04 12:01:07 17152 –a—— C:\WINDOWS\avisynthex32.dll
2008-05-04 12:01:07 14592 –a—— C:\WINDOWS\avifile32.dll
2008-05-04 12:01:07 17920 –a—— C:\WINDOWS\autodisc32.dll
2008-05-04 12:01:06 14592 –a—— C:\WINDOWS\audiosrv32.dll
2008-05-04 12:01:06 21248 –a—— C:\WINDOWS\ati2dvag32.dll
2008-05-04 12:01:06 24064 –a—— C:\WINDOWS\ati2dvaa32.dll
2008-05-04 12:01:06 24320 –a—— C:\WINDOWS\athprxy32.dll
2008-05-04 12:01:05 23296 –a—— C:\WINDOWS\changeurl_30.dll
2008-05-04 12:01:05 30208 –a—— C:\WINDOWS\asycfilt32.dll
2008-05-04 12:01:05 13056 –a—— C:\WINDOWS\asferror32.dll
2008-05-04 12:01:05 27648 –a—— C:\WINDOWS\apphelp32.dll
2008-05-04 10:46:40 0 d——– C:\Program Files\Outerinfo
2008-05-04 10:46:33 0 d——– C:\Program Files\M?crosoft
2008-05-04 10:45:48 0 d——– C:\Program Files\QdrDrive
2008-05-04 10:45:48 0 d——– C:\Program Files\ISM
2008-05-04 10:45:09 4 –a—— C:\WINDOWS\system32\winfrun32.bin
2008-05-04 10:45:09 87979 –a—— C:\WINDOWS\lfn.exe
I am currently trying to fix a friend's computer (which is running XP Media Center Edition) and have found out it is infiected with the winself.exe trojan and am having difficulties removing it. I found a similar thread ( http://forums.whatthetech.com/Please_help_…ood_t91220.html ) in which the person was directed to post scan results from Deckard's System Scanner. PLEASE NOTE: I had to run DSS in Safe Mode due to Notepad systematically crashing in Normal mode (don't know if it is a result of this winself.exe infection or something else), and only got one of the result files (main.txt). So here it is:
Deckard's System Scanner v20071014.68
Run by [removed] on 2008-06-29 18:10:51
Computer is in Safe Mode with Networking.
——————————————————————————–
– HijackThis Clone ————————————————————
Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-06-29 18:11:28
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16674)
Boot mode: Safe mode with network support
Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Citrix\ICA Client\ssonsvr.exe
C:\WINDOWS\explorer.exe
L:\dss.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/keyword/%s
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Helper Class - {3670A914-63C2-4E67-8C9B-370AE1922143} - C:\Program Files\BChanger\bchanger.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: StFlex IE Helper - {8334A30C-49E5-489a-B63D-5B927C1EF46E} - C:\Program Files\QdrDrive\QdrDrive15.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: (no name) - {FB60EC4A-27AE-7B74-FA38-0CA2969A1ECD} - C:\WINDOWS\system32\ojomoye.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar4.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableTaskMgr=1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableTaskMgr=1
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\ERIN\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://fpdownload.macromedia.com/get/shock…director/sw.cab
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} (Shockwave ActiveX Control) - http://fpdownload.macromedia.com/get/shock…director/sw.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/4h/pla…0/Installer.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://elutions.webex.com/client/T23L/webex/ieatgpc.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30155.www3.hp.com/ediags/hpfix/aio…/qdiagh.cab?326
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O20 - Winlogon Notify: efcCrSjK - C:\WINDOWS\system32\efcCrSjK.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSVCCDA.EXE
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildTangent\Apps\HP Game Console\GameConsoleService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MsSecurity Updated (MsSecurity1.209.4) - Unknown owner - C:\WINDOWS\winself.exe service
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\Program Files\Trend Micro\Internet Security 2005\PcCtlCom.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\Program Files\Trend Micro\Internet Security 2005\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security 2005\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security 2005\tmproxy.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
–
End of file - 10198 bytes
– Files created between 2008-05-29 and 2008-06-29 —————————–
2008-06-29 17:16:46 0 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-06-29 16:32:50 0 d——– C:\Program Files\IObit
2008-06-29 12:39:00 0 dr-h—– C:\Documents and Settings\HP_Administrator\Recent
2008-06-29 12:35:13 0 d——– C:\Program Files\CCleaner
2008-06-23 13:04:01 0 d——– C:\Program Files\BChanger
2008-06-22 17:17:34 36 –a—— C:\WINDOWS\rasqervy.dll
2008-06-22 17:17:32 8 –a—— C:\WINDOWS\sdfinacs.dll
2008-06-22 17:17:11 5 –a—— C:\WINDOWS\sdfixwcs.dll
2008-06-14 22:23:21 0 d——– C:\Documents and Settings\All Users\Application Data\eGames
2008-06-14 22:14:06 140 –a—— C:\WINDOWS\wuasirvy.dll
2008-06-14 22:12:14 60928 –a—— C:\WINDOWS\system32\ojomoye.dll
2008-06-14 22:11:55 0 d——– C:\Program Files\GetModule
2008-06-14 22:11:53 0 d——– C:\Program Files\iCheck
2008-06-14 22:11:53 0 d——– C:\Program Files\GetPack
2008-06-14 22:08:18 0 d——– C:\Documents and Settings\Guest\Application Data\WildTangent
2008-06-11 00:44:23 0 d——– C:\Program Files\Antivirus2008
2008-06-10 22:00:00 55808 –a—— C:\WINDOWS\portsv.exe
– Find3M Report —————————————————————
2008-06-27 21:31:27 49 –a—— C:\WINDOWS\popcinfo.dat
2008-06-14 22:16:23 0 d——– C:\Program Files\HP Games
2008-06-14 22:12:23 0 d——– C:\Program Files\QdrPack
2008-06-14 22:11:49 0 d——– C:\Program Files\QdrModule
2008-06-10 22:00:34 0 d——– C:\Program Files\AntiSpywareMaster
2008-05-18 20:36:10 1351809 –ahs—- C:\WINDOWS\system32\OUFOqBeg.ini2
2008-05-18 20:36:08 2112 –a—— C:\WINDOWS\system32\beatiufx.exe
2008-05-18 20:16:59 3648 –a—— C:\WINDOWS\system32\djsdamcr.dll
2008-05-15 16:41:59 90176 –a—— C:\WINDOWS\system32\qqcfwkfs.dll
2008-05-15 16:39:02 2112 –a—— C:\WINDOWS\system32\wypqllht.exe
2008-05-15 16:36:00 101952 –a—— C:\WINDOWS\system32\uyuaxdfv.dll
2008-05-15 16:34:28 3648 –a—— C:\WINDOWS\system32\dwjudiir.dll
2008-05-15 16:34:19 99904 –a—— C:\WINDOWS\system32\uvuryoii.dll
2008-05-11 22:33:30 0 d——– C:\Program Files\MalwareAlarm
2008-05-11 22:18:38 2112 –a—— C:\WINDOWS\system32\ivtmfddk.exe
2008-05-10 21:51:16 16640 –a—— C:\WINDOWS\2020search2.dll
2008-05-10 21:51:15 13824 –a—— C:\WINDOWS\2020search.dll
2008-05-06 22:40:17 1100 –a—— C:\WINDOWS\system32\d3d8caps.dat
2008-05-06 21:34:53 0 d——– C:\Program Files\Common Files
2008-05-06 21:21:44 664 –a—— C:\WINDOWS\system32\d3d9caps.dat
2008-05-06 21:14:08 0 d——– C:\Program Files\RcvSystem
2008-05-04 12:01:19 17408 –a—— C:\WINDOWS\stcloader.exe
2008-05-04 12:01:18 19456 –a—— C:\WINDOWS\voiceip.dll
2008-05-04 12:01:18 32256 –a—— C:\WINDOWS\swin32.dll
2008-05-04 12:01:17 22784 –a—— C:\WINDOWS\cdsm32.dll
2008-05-04 12:01:17 14592 –a—— C:\WINDOWS\bokja.exe
2008-05-04 12:01:16 17664 –a—— C:\WINDOWS\mssvr.exe
2008-05-04 12:01:16 9216 –a—— C:\WINDOWS\mspphe.dll
2008-05-04 12:01:16 8448 –a—— C:\WINDOWS\bjam.dll
2008-05-04 12:01:12 9728 –a—— C:\WINDOWS\saiemod.dll
2008-05-04 12:01:11 11520 –a—— C:\WINDOWS\msapasrc.dll
2008-05-04 12:01:11 16128 –a—— C:\WINDOWS\msa64chk.dll
2008-05-04 12:01:10 20224 –a—— C:\WINDOWS\shdocpl.dll
2008-05-04 12:01:09 28160 –a—— C:\WINDOWS\shdocpe.dll
2008-05-04 12:01:09 11776 –a—— C:\WINDOWS\ntnut.exe
2008-05-04 12:01:08 17920 –a—— C:\WINDOWS\winsb.dll
2008-05-04 12:01:07 31488 –a—— C:\WINDOWS\browserad.dll
2008-05-04 12:01:07 19712 –a—— C:\WINDOWS\aviwrap32.dll
2008-05-04 12:01:07 17152 –a—— C:\WINDOWS\avisynthex32.dll
2008-05-04 12:01:07 14592 –a—— C:\WINDOWS\avifile32.dll
2008-05-04 12:01:07 17920 –a—— C:\WINDOWS\autodisc32.dll
2008-05-04 12:01:06 14592 –a—— C:\WINDOWS\audiosrv32.dll
2008-05-04 12:01:06 21248 –a—— C:\WINDOWS\ati2dvag32.dll
2008-05-04 12:01:06 24064 –a—— C:\WINDOWS\ati2dvaa32.dll
2008-05-04 12:01:06 24320 –a—— C:\WINDOWS\athprxy32.dll
2008-05-04 12:01:05 23296 –a—— C:\WINDOWS\changeurl_30.dll
2008-05-04 12:01:05 30208 –a—— C:\WINDOWS\asycfilt32.dll
2008-05-04 12:01:05 13056 –a—— C:\WINDOWS\asferror32.dll
2008-05-04 12:01:05 27648 –a—— C:\WINDOWS\apphelp32.dll
2008-05-04 10:46:40 0 d——– C:\Program Files\Outerinfo
2008-05-04 10:46:33 0 d——– C:\Program Files\M?crosoft
2008-05-04 10:45:48 0 d——– C:\Program Files\QdrDrive
2008-05-04 10:45:48 0 d——– C:\Program Files\ISM
2008-05-04 10:45:09 4 –a—— C:\WINDOWS\system32\winfrun32.bin
2008-05-04 10:45:09 87979 –a—— C:\WINDOWS\lfn.exe
