What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] XPAntivirus

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hi Guys, I seem to have an issue with this Aware.XPAntivirus.AJ I think??? I have run the Malwarebytes Anti-Malware program on advice of my PC Tech, but alas I think he is out of his league with this one… I managed to download BitDefender 2009 and did a scan, which identified XPAntivirus. But was unable to do anything with as it is in an archive. I was unable to load anything before running this. Windows installer faulted. Unable to do any restore point before the day the virus arrived.
I,m willing to listen to all help! I have read several of your fixes to other people and you guys seem very ontoit!!! But bear with me as I,m no PC genius, no the basics, Im an Mechanical Engineer by trade.

Any and all help is great!

Here is the Hijack log.

Logfile of HijackThis v1.99.1
Scan saved at 20:07:40, on 8/30/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Xtra Help Assistant\bin\McciTrayApp.exe
C:\WINDOWS\PixArt\PAC7311\Monitor.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://msn.co.nz/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [tcnzTrayApp] "C:\Program Files\Xtra Help Assistant\bin\McciTrayApp.exe"
O4 - HKLM\..\Run: [PAC7311_Monitor] C:\WINDOWS\PixArt\PAC7311\Monitor.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: Xtra Help Assistant.lnk = C:\Program Files\Xtra Help Assistant\bin\matcli.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase5036.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1113435002640
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O18 - Protocol: CDS300 - {AD43AA67-6860-4531-AC8A-0E68F9CF023E} - (no file)
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: ProcAdm - {46F765C4-1C48-4401-5686-062365CD7F25} - C:\Program Files\fvyocbg\ProcAdm.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe" /service (file missing)
Post #2
_________________________________
Welcome to the Forums.

The fixes we will use are specific to your problems and should only be used for this issue on this machine.

Please only use this topic to reply to. Do not start another thread.
If any other issues arise let me know.
The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear. So lets do this to the end!

  • Save and quit any work your doing before beginning the fix.
  • All hijackthis logs I ask for should be done in normal mode ( not safe mode)
  • These logs should be done last after you have followed my instructions in the previous post.


Please if you decide to seek help at another forum let us know. There is a shortage of helpers and tying 2 of us up is a waste of time.
If you have any questions about any advice given here please STOP and ask!


I am going to get some info from you first and this will let me know how to proceed to clean your machine.




_________________________________
We need to disable windows defender.
A good program but may interfere with our fixes.

Open Windows Defender
Click Tools
Click General Settings
Scroll down to Real Time Protection Options
Uncheck Turn on Real Time Protection (recommended)
After you uncheck this, click on the Save button
Close Windows Defender




______________________________
RUN HJT

HJT
Run hijackthis and choose scan only and place a check by the following lines if present.
Close all other windows and browsers except HJT before clicking on Fix Checked

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
O18 - Protocol: CDS300 - {AD43AA67-6860-4531-AC8A-0E68F9CF023E} - (no file)
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O21 - SSODL: ProcAdm - {46F765C4-1C48-4401-5686-062365CD7F25} - C:\Program Files\fvyocbg\ProcAdm.dll

Close that.


_____________________________
Submit a file to Jotti
Please go here : http://virusscan.jotti.org/
On top of the page there is a field to add the filepath, copy and paste this filepath in there.
If theres is more than one file to scan, insert them 1 at a time.


C:\Program Files\fvyocbg\ProcAdm.dl


Then hit Submit
The scan will take a while before the result comes up so please be patient.
Then copy the result and post it here in this thread.

You may recieve a message stating "
"The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file"

Just let me know if that is what you saw.

If Jotti's service load is too high, you can use the following scanner instead:
http://www.virustotal.com/xhtml/index_en.html







__________________________________
Malwarebytes was a good choice!

Let me see the log from it.

Open up malwarebytes and choose Logs from the top tabs.
Double click the first run you did with it ( noted by the date )
Open that and copy and paste that info for me in your next reply.



__________________________________
  • Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
  • Double click on RSIT.exe to run RSIT.
  • Click Continue at the disclaimer screen.
  • Once it has finished, two logs will open. Please post the contents of both log.txt






__________________________________________
A quick question>
I see that you may have had both Symantec and AVG anti virus programs installed at one point.
Is this true and have you uninstalled both of them ?
Also…
Which anti virus program do you intend to continue using ?



_________________________
In your next reply I would like to see:
  • A new HJT log
  • The report from MalwareBytes
  • The report from RSIT
  • Let me know about Symantec and AVG anti virus programs.
Post #3 last edited
B) Hi there BOB4, Many thanks for helping me with this situation…. Please bear with me in the replies as I am a shiftworker and work odd hours, and I,m picking you are from the USA?? so were are in 2 diff timezones.
I will follow your instructions to the letter and will take all info you can throw at me….

Here goes!!

As in your request order:

Logfile of HijackThis v1.99.1
Scan saved at 21:24:11, on 9/1/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Xtra Help Assistant\bin\McciTrayApp.exe
C:\WINDOWS\PixArt\PAC7311\Monitor.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://msn.co.nz/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [tcnzTrayApp] "C:\Program Files\Xtra Help Assistant\bin\McciTrayApp.exe"
O4 - HKLM\..\Run: [PAC7311_Monitor] C:\WINDOWS\PixArt\PAC7311\Monitor.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: Xtra Help Assistant.lnk = C:\Program Files\Xtra Help Assistant\bin\matcli.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase5036.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1113435002640
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe" /service (file missing)





MalwareBytes Logs: 1st scan date was 21/8/08

Malwarebytes' Anti-Malware 1.25
Database version: 1072
Windows 5.1.2600 Service Pack 3

6:49:21 AM 8/21/2008
mbam-log-08-21-2008 (06-49-21).txt

Scan type: Quick Scan
Objects scanned: 46123
Time elapsed: 3 minute(s), 42 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 41
Registry Values Infected: 4
Registry Data Items Infected: 2
Folders Infected: 32
Files Infected: 35

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\videoegg.activexloader (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{168dc258-1455-4e61-8590-9dac2f27b675} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1a8642f1-dc80-4edc-a39d-0fb62a58b455} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3f91eb90-ef62-44ee-a685-fac29af111cd} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5c29c7e4-5321-4cad-be2e-877666bed5df} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{83dfb6ee-ab18-41b5-86d4-b544a141d67e} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{88d6cf0e-cf70-4c24-bf6e-e4e414bc649c} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8f6a82a2-d7b1-443e-bb9f-f7dc887dd618} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9856e2d8-ffb2-4fe5-8cad-d5ad6a35a804} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a3d06987-c35e-49e4-8fe2-ac67b9fbfb4c} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a58c497b-3ee2-45e7-9594-daca6be2a0d0} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ad0a3058-fd49-4f98-a514-fd055201835e} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ad5915ea-b61a-4dba-b5c8-ef4b2df0a3c7} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{af2e62b6-f9e1-4d4f-a10a-9dc8e6dcbcc0} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{af2e62b6-f9e1-4d4f-a10a-9dc8e6dcbcc0} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{bb187c0d-6f53-4f3e-9590-98fd3a7364a2} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c5041fd9-4819-4dc4-b20e-c950b5b03d2a} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{d17726cc-d4dd-4c4a-9671-471d56e413b5} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{db8cce99-59c6-4552-8bfc-058feb38d6ce} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{dc3a04ee-cdd7-4407-915c-a5502f97eecd} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e1a63484-a022-4d42-830a-fbd411514440} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e282c728-189d-419e-8ee2-1601f4b39ba5} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\videoegg.activexloader.1 (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\videoegg (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rhcvpnj0egcp (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\rhcvpnj0egcp (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\VideoEgg (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videoegg.com/publisher,version=1.5 (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\VideoEgg (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MozillaPlugins\@videoegg.com/publisher,version=1.5 (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWay) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\wkey (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiSpyware_is1 (Rogue.Antispyware) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
C:\Program Files\rhcvpnj0egcp (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\Antispyware (Rogue.Antispyware) -> Quarantined and deleted successfully.
C:\Program Files\Microsoft Common (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Data (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Data\Resources (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Data\Resources\gid329 (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Data\Resources\gid329\cid1124 (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Data\Resources\gid329\cid1124\bebo03 (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Data\Resources\gid329\cid1124\bebo03\images (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Loader (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Loader\4665 (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Publisher (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Publisher\4520 (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Publisher\4520\resources (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\messages (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Publisher\4665 (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Updater (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Updater\4665 (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\rhcvpnj0egcp (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\rhcvpnj0egcp\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\rhcvpnj0egcp\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\rhcvpnj0egcp\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\rhcvpnj0egcp\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\rhcvpnj0egcp\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\rhcvpnj0egcp\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\rhcvpnj0egcp\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\rhcvpnj0egcp\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\rhcvpnj0egcp\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\rhcvpnj0egcp\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.

Files Infected:
C:\Documents and Settings\Tom\Application Data\VideoEgg\Loader\4665\npvideoegg-loader.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Program Files\rhcvpnj0egcp\MFC71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\rhcvpnj0egcp\MFC71ENU.DLL (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\rhcvpnj0egcp\msvcp71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\rhcvpnj0egcp\msvcr71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\rhcvpnj0egcp\rhcvpnj0egcp.exe.local (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\Antispyware\Uninstall AntiSpyware.lnk (Rogue.Antispyware) -> Quarantined and deleted successfully.
C:\Program Files\Microsoft Common\emails.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Microsoft Common\log.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Uninstall.exe (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Data\Resources\gid329\cid1124\bebo03\images\skin.ver (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Data\Resources\gid329\cid1124\bebo03\images\videoegg-large.ico (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Data\Resources\gid329\cid1124\bebo03\images\videoegg-small.ico (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Data\Resources\gid329\cid1124\bebo03\images\videoegg.ico (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Loader\loader.ver (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Publisher\publisher.ver (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Publisher\4520\avcodec.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Publisher\4520\crashRpt.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Publisher\4520\FLVEncoder.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Publisher\4520\lame_enc.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Publisher\4520\LevelMeter.ax (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Publisher\4520\libcurlve.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Publisher\4520\libpng.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Publisher\4520\npvideoegg-publisher.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Publisher\4520\VideoEgg_FLVWriter.ax (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Publisher\4520\zlib.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Updater\updater.exe (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Updater\updater.ver (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Updater\VideoEggBroker.exe (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Updater\VideoEggBroker.exe.old (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Updater\4665\libcurlve.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\VideoEgg\Updater\4665\updater.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\blphcrpnj0egcp.scr (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Local Settings\Temp\.tt2.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Local Settings\Temp\.tt6.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.




Scan#2

Malwarebytes' Anti-Malware 1.25
Database version: 1072
Windows 5.1.2600 Service Pack 3

9:25:42 AM 8/21/2008
mbam-log-08-21-2008 (09-25-42).txt

Scan type: Full Scan (C:\|)
Objects scanned: 106135
Time elapsed: 25 minute(s), 43 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 10

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Tom\Application Data\AntiSpyware\Quarantine\02-05-2008-08-29-43\10012.qit (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\AntiSpyware\Quarantine\02-05-2008-08-29-43\10014.qit (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\AntiSpyware\Quarantine\02-05-2008-08-29-43\10016.qit (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\AntiSpyware\Quarantine\02-05-2008-08-29-43\10018.qit (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\AntiSpyware\Quarantine\02-05-2008-08-29-43\10022.qit (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\AntiSpyware\Quarantine\02-05-2008-08-29-43\10026.qit (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\AntiSpyware\Quarantine\02-05-2008-08-29-43\10041.qit (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\AntiSpyware\Quarantine\02-05-2008-08-29-43\10045.qit (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\AntiSpyware\Quarantine\02-05-2008-08-29-43\10033.qit (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tom\Application Data\AntiSpyware\Quarantine\12-05-2008-12-12-23\0.qit (Adware.MyWebSearch) -> Quarantined and deleted successfully.



Scan #3

Malwarebytes' Anti-Malware 1.25
Database version: 1073
Windows 5.1.2600 Service Pack 3

9:32:54 AM 8/21/2008
mbam-log-08-21-2008 (09-32-54).txt

Scan type: Quick Scan
Objects scanned: 46383
Time elapsed: 3 minute(s), 19 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)




Scan Tonight 1/9/08

Malwarebytes' Anti-Malware 1.25
Database version: 1097
Windows 5.1.2600 Service Pack 3

10:01:58 PM 9/1/2008
mbam-log-09-01-2008 (22-01-58).txt

Scan type: Quick Scan
Objects scanned: 47835
Time elapsed: 4 minute(s), 38 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)



Report from RSIT: Note: Log #1

Logfile of random's system information tool (written by random/random)
Run by [removed] at 2008-09-01 20:13:37
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 126 GB (80%) free of 157 GB
Total RAM: 1023 MB (35% free)

HijackThis download failed

Scheduled tasks folder

C:\WINDOWS\tasks\AntiSpyware Scheduled Scan.job
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\MP Scheduled Scan.job
C:\WINDOWS\tasks\RegCure Program Check.job
C:\WINDOWS\tasks\RegCure.job

Registry dump

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-12-18 59032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2008-08-11 1443112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{381FFDE8-2394-4f90-B10D-FC6124A40F8C} - BitDefender Toolbar - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll [2008-08-13 90112]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-05-16 13529088]
"nwiz"=C:\WINDOWS\system32\nwiz.exe [2008-05-16 1630208]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"HP Component Manager"=C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [2005-01-12 241664]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2006-03-01 577536]
"tcnzTrayApp"=C:\Program Files\Xtra Help Assistant\bin\McciTrayApp.exe [2007-02-08 935424]
"PAC7311_Monitor"=C:\WINDOWS\PixArt\PAC7311\Monitor.exe [2006-11-03 319488]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-05-08 54840]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2006-11-03 866584]
"AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2008-07-10 116040]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-05-27 413696]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-07-30 289064]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2008-05-16 86016]
"BDAgent"=C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe [2008-08-14 716800]
"BitDefender Antiphishing Helper"=C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe [2008-08-10 69632]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE
Windows Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE
Xtra Help Assistant.lnk - C:\Program Files\Xtra Help Assistant\bin\matcli.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"=C:\PROGRA~1\WIFD1F~1\MpShHook.dll [2006-11-03 83224]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"=C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=msapsspc.dll schannel.dll digest.dll msnsspc.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"NoDispScrSavPage"=0
"DisableTaskMgr"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\IncrediMail\bin\IncMail.exe"="C:\Program Files\IncrediMail\bin\IncMail.exe:*:Disabled:IncrediMail"
"C:\Program Files\IncrediMail\bin\ImpCnt.exe"="C:\Program Files\IncrediMail\bin\ImpCnt.exe:*:Disabled:IncrediMail"
"C:\Program Files\IncrediMail\bin\IMApp.exe"="C:\Program Files\IncrediMail\bin\IMApp.exe:*:Disabled:IncrediMail"
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\WINDOWS\system32\mmc.exe"="C:\WINDOWS\system32\mmc.exe:*:Disabled:Microsoft Management Console"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

File associations

.reg - open - regedit.exe "%1" %*

List of files/folders created in the last three months

2008-09-01 20:13:38 —-D—- C:\Program Files\trend micro
2008-09-01 20:13:37 —-D—- C:\rsit
2008-08-30 20:05:40 —-D—- C:\Program Files\Hijackthis
2008-08-30 09:18:27 —-D—- C:\Documents and Settings\All Users\Application Data\WinZip
2008-08-29 05:59:42 —-D—- C:\Program Files\Common Files\Skype
2008-08-28 16:24:29 —-D—- C:\Documents and Settings\Tom\Application Data\Windows Search
2008-08-28 16:17:19 —-D—- C:\Program Files\Microsoft Silverlight
2008-08-28 16:16:55 —-HDC—- C:\WINDOWS\$NtUninstallKB951618-v2$
2008-08-28 16:16:41 —-D—- C:\Documents and Settings\Tom\Application Data\Windows Desktop Search
2008-08-28 16:15:36 —-D—- C:\WINDOWS\system32\GroupPolicy
2008-08-28 16:15:36 —-D—- C:\Program Files\Windows Desktop Search
2008-08-28 16:15:11 —-HDC—- C:\WINDOWS\$NtUninstallKB940157$
2008-08-28 16:14:53 —-HDC—- C:\WINDOWS\$NtUninstallKB915800-v4$
2008-08-28 10:38:35 —-D—- C:\WINDOWS\system32\logs
2008-08-28 10:38:30 —-D—- C:\Documents and Settings\Tom\Application Data\BitDefender
2008-08-28 10:38:29 —-D—- C:\Binaries
2008-08-28 10:37:56 —-D—- C:\Program Files\BitDefender
2008-08-28 10:37:56 —-D—- C:\Documents and Settings\All Users\Application Data\BitDefender
2008-08-28 10:29:26 —-D—- C:\Program Files\Common Files\BitDefender
2008-08-28 09:30:03 —-D—- C:\WINDOWS\BDOSCAN8
2008-08-27 12:49:35 —-D—- C:\WINDOWS\temp
2008-08-27 01:08:20 —-D—- C:\Program Files\RegCure
2008-08-26 13:19:19 —-A—- C:\WINDOWS\system32\msisip.dll
2008-08-26 13:19:19 —-A—- C:\WINDOWS\system32\msimsg.dll
2008-08-26 13:19:19 —-A—- C:\WINDOWS\system32\msihnd.dll
2008-08-26 13:19:19 —-A—- C:\WINDOWS\system32\msiexec.exe
2008-08-26 13:19:19 —-A—- C:\WINDOWS\system32\msi.dll
2008-08-26 01:15:33 —-N—- C:\WINDOWS\system32\_000116_.tmp.dll
2008-08-25 01:36:34 —-N—- C:\WINDOWS\system32\spmsg.dll
2008-08-21 06:43:33 —-D—- C:\Documents and Settings\Tom\Application Data\Malwarebytes
2008-08-21 06:43:27 —-D—- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-21 06:43:27 —-D—- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-20 12:25:50 —-D—- C:\189d6794b071e94af2
2008-08-20 09:43:29 —-A—- C:\WINDOWS\system32\tmp.txt
2008-08-20 09:43:15 —-A—- C:\rapport.txt
2008-08-20 09:41:00 —-A—- C:\WINDOWS\ntbtlog.txt
2008-08-20 09:30:56 —-AD—- C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-20 06:10:52 —-D—- C:\Program Files\Microsoft Windows OneCare Live
2008-08-19 21:01:34 —-D—- C:\Documents and Settings\Tom\Application Data\AVGTOOLBAR
2008-08-19 21:01:25 —-D—- C:\Program Files\AVG
2008-08-19 15:25:53 —-D—- C:\Program Files\Common Files\Wise Installation Wizard
2008-08-19 13:02:41 —-A—- C:\WINDOWS\system32\qqeyaaoh.tmp
2008-08-19 13:02:18 —-D—- C:\Program Files\fvyocbg
2008-08-19 13:02:15 —-D—- C:\Documents and Settings\All Users\Application Data\uzulcbap
2008-08-17 14:00:36 —-D—- C:\Program Files\SystemRequirementsLab
2008-08-13 07:54:51 —-HDC—- C:\WINDOWS\$NtUninstallKB952954$
2008-08-13 07:54:46 —-HDC—- C:\WINDOWS\$NtUninstallKB946648$
2008-08-13 07:54:42 —-HDC—- C:\WINDOWS\$NtUninstallKB953839$
2008-08-13 07:54:29 —-HDC—- C:\WINDOWS\$NtUninstallKB950974$
2008-08-13 07:53:39 —-HDC—- C:\WINDOWS\$NtUninstallKB951072-v2$
2008-08-13 07:53:34 —-HDC—- C:\WINDOWS\$NtUninstallKB952287$
2008-08-13 07:53:04 —-HDC—- C:\WINDOWS\$NtUninstallKB951066$
2008-08-11 10:14:20 —-D—- C:\Program Files\iPod
2008-08-11 10:07:51 —-D—- C:\Program Files\Safari
2008-07-25 18:17:03 —-HDC—- C:\WINDOWS\$NtUninstallKB951978$
2008-07-25 17:02:38 —-A—- C:\WINDOWS\OEWABLog.txt
2008-07-25 17:01:51 —-D—- C:\WINDOWS\Prefetch
2008-07-25 16:27:52 —-HDC—- C:\WINDOWS\$NtUninstallKB951748$
2008-07-25 16:27:45 —-HDC—- C:\WINDOWS\$NtUninstallKB951698$
2008-07-25 16:27:38 —-HDC—- C:\WINDOWS\$NtUninstallKB951376-v2$
2008-07-25 16:27:31 —-HDC—- C:\WINDOWS\$NtUninstallKB950762$
2008-07-25 16:25:45 —-A—- C:\WINDOWS\setuplog.txt
2008-07-25 16:24:49 —-D—- C:\WINDOWS\system32\scripting
2008-07-25 16:24:48 —-D—- C:\WINDOWS\system32\en
2008-07-25 16:24:48 —-D—- C:\WINDOWS\l2schemas
2008-07-25 16:22:21 —-D—- C:\WINDOWS\ServicePackFiles
2008-07-25 16:16:55 —-HDC—- C:\WINDOWS\$NtServicePackUninstall$
2008-07-25 16:10:30 —-D—- C:\WINDOWS\EHome
2008-07-25 16:06:40 —-N—- C:\WINDOWS\system32\wmphoto.dll
2008-07-25 16:06:39 —-N—- C:\WINDOWS\system32\wlanapi.dll
2008-07-25 16:06:37 —-N—- C:\WINDOWS\system32\windowscodecsext.dll
2008-07-25 16:06:37 —-N—- C:\WINDOWS\system32\windowscodecs.dll
2008-07-25 16:06:29 —-N—- C:\WINDOWS\system32\tspkg.dll
2008-07-25 16:06:29 —-N—- C:\WINDOWS\system32\tsgqec.dll
2008-07-25 16:06:24 —-N—- C:\WINDOWS\system32\spupdwxp.exe
2008-07-25 16:06:23 —-A—- C:\WINDOWS\system32\spdwnwxp.exe
2008-07-25 16:06:22 —-N—- C:\WINDOWS\system32\slserv.exe
2008-07-25 16:06:22 —-N—- C:\WINDOWS\system32\slrundll.exe
2008-07-25 16:06:22 —-N—- C:\WINDOWS\system32\slgen.dll
2008-07-25 16:06:22 —-N—- C:\WINDOWS\system32\slextspk.dll
2008-07-25 16:06:22 —-N—- C:\WINDOWS\slrundll.exe
2008-07-25 16:06:21 —-N—- C:\WINDOWS\system32\slcoinst.dll
2008-07-25 16:06:19 —-N—- C:\WINDOWS\system32\setupn.exe
2008-07-25 16:06:17 —-N—- C:\WINDOWS\system32\s3gnb.dll
2008-07-25 16:06:16 —-N—- C:\WINDOWS\system32\rhttpaa.dll
2008-07-25 16:06:14 —-N—- C:\WINDOWS\system32\rasqec.dll
2008-07-25 16:06:13 —-N—- C:\WINDOWS\system32\qutil.dll
2008-07-25 16:06:13 —-N—- C:\WINDOWS\system32\qcliprov.dll
2008-07-25 16:06:12 —-N—- C:\WINDOWS\system32\qagentrt.dll
2008-07-25 16:06:12 —-N—- C:\WINDOWS\system32\qagent.dll
2008-07-25 16:06:11 —-N—- C:\WINDOWS\system32\photometadatahandler.dll
2008-07-25 16:06:08 —-N—- C:\WINDOWS\system32\onex.dll
2008-07-25 16:05:58 —-N—- C:\WINDOWS\system32\napstat.exe
2008-07-25 16:05:58 —-N—- C:\WINDOWS\system32\napmontr.dll
2008-07-25 16:05:58 —-N—- C:\WINDOWS\system32\napipsec.dll
2008-07-25 16:05:58 —-N—- C:\WINDOWS\system32\mtxparhd.dll
2008-07-25 16:05:57 —-N—- C:\WINDOWS\system32\msxml6r.dll
2008-07-25 16:05:57 —-N—- C:\WINDOWS\system32\msxml6.dll
2008-07-25 16:05:55 —-N—- C:\WINDOWS\system32\msshavmsg.dll
2008-07-25 16:05:55 —-N—- C:\WINDOWS\system32\mssha.dll
2008-07-25 16:05:45 —-N—- C:\WINDOWS\system32\mmcperf.exe
2008-07-25 16:05:44 —-N—- C:\WINDOWS\system32\mmcfxcommon.dll
2008-07-25 16:05:44 —-N—- C:\WINDOWS\system32\mmcex.dll
2008-07-25 16:05:44 —-N—- C:\WINDOWS\system32\microsoft.managementconsole.dll
2008-07-25 16:05:42 —-N—- C:\WINDOWS\system32\mdmxsdk.dll
2008-07-25 16:05:34 —-N—- C:\WINDOWS\system32\l2gpstore.dll
2008-07-25 16:05:33 —-N—- C:\WINDOWS\system32\kmsvc.dll
2008-07-25 16:05:33 —-N—- C:\WINDOWS\system32\kbdpash.dll
2008-07-25 16:05:33 —-N—- C:\WINDOWS\system32\kbdnepr.dll
2008-07-25 16:05:32 —-N—- C:\WINDOWS\system32\kbdiultn.dll
2008-07-25 16:05:32 —-N—- C:\WINDOWS\system32\kbdbhc.dll
2008-07-25 16:05:25 —-N—- C:\WINDOWS\system32\hsfcisp2.dll
2008-07-25 16:05:20 —-N—- C:\WINDOWS\system32\faxpatch.exe
2008-07-25 16:05:20 —-A—- C:\WINDOWS\002823_.tmp
2008-07-25 16:05:19 —-N—- C:\WINDOWS\system32\eapsvc.dll
2008-07-25 16:05:19 —-N—- C:\WINDOWS\system32\eapqec.dll
2008-07-25 16:05:19 —-N—- C:\WINDOWS\system32\eappprxy.dll
2008-07-25 16:05:19 —-N—- C:\WINDOWS\system32\eapphost.dll
2008-07-25 16:05:19 —-N—- C:\WINDOWS\system32\eappgnui.dll
2008-07-25 16:05:19 —-N—- C:\WINDOWS\system32\eappcfg.dll
2008-07-25 16:05:18 —-N—- C:\WINDOWS\system32\eapp3hst.dll
2008-07-25 16:05:18 —-N—- C:\WINDOWS\system32\eapolqec.dll
2008-07-25 16:05:16 —-N—- C:\WINDOWS\system32\dot3ui.dll
2008-07-25 16:05:16 —-N—- C:\WINDOWS\system32\dot3svc.dll
2008-07-25 16:05:16 —-N—- C:\WINDOWS\system32\dot3msm.dll
2008-07-25 16:05:16 —-N—- C:\WINDOWS\system32\dot3gpclnt.dll
2008-07-25 16:05:16 —-N—- C:\WINDOWS\system32\dot3dlg.dll
2008-07-25 16:05:16 —-N—- C:\WINDOWS\system32\dot3cfg.dll
2008-07-25 16:05:16 —-N—- C:\WINDOWS\system32\dot3api.dll
2008-07-25 16:05:15 —-N—- C:\WINDOWS\system32\dimsroam.dll
2008-07-25 16:05:15 —-N—- C:\WINDOWS\system32\dimsntfy.dll
2008-07-25 16:05:14 —-N—- C:\WINDOWS\system32\dhcpqec.dll
2008-07-25 16:05:12 —-N—- C:\WINDOWS\system32\credssp.dll
2008-07-25 16:05:07 —-N—- C:\WINDOWS\system32\azroles.dll
2008-07-25 16:05:06 —-N—- C:\WINDOWS\system32\ativvaxx.dll
2008-07-25 16:05:06 —-N—- C:\WINDOWS\system32\ativtmxx.dll
2008-07-25 16:05:06 —-N—- C:\WINDOWS\system32\ati3duag.dll
2008-07-25 16:05:06 —-N—- C:\WINDOWS\system32\ati3d1ag.dll
2008-07-25 16:05:06 —-N—- C:\WINDOWS\system32\ati2dvag.dll
2008-07-25 16:05:06 —-N—- C:\WINDOWS\system32\ati2dvaa.dll
2008-07-25 16:05:05 —-N—- C:\WINDOWS\system32\ati2cqag.dll
2008-07-25 16:05:01 —-N—- C:\WINDOWS\system32\aaclient.dll
2008-07-25 10:13:01 —-D—- C:\WINDOWS\system32\bits
2008-07-25 10:12:52 —-HDC—- C:\WINDOWS\$NtUninstallKB923845$
2008-07-25 10:12:34 —-N—- C:\WINDOWS\system32\bitsprx4.dll
2008-07-25 10:12:21 —-HDC—- C:\WINDOWS\$NtUninstallKB914882$
2008-07-25 10:01:52 —-D—- C:\6e3e9a1c901d5b2fa20b1f3305945b
2008-07-21 00:29:06 —-A—- C:\WINDOWS\system32\javaws.exe
2008-07-21 00:29:06 —-A—- C:\WINDOWS\system32\javaw.exe
2008-07-21 00:29:06 —-A—- C:\WINDOWS\system32\java.exe
2008-07-17 17:50:24 —-D—- C:\Program Files\iTunes
2008-07-17 17:49:13 —-DC—- C:\WINDOWS\system32\DRVSTORE
2008-07-17 17:49:07 —-D—- C:\Documents and Settings\All Users\Application Data\Apple
2008-07-15 09:16:46 —-A—- C:\WINDOWS\system32\muweb.dll
2008-07-15 09:16:45 —-A—- C:\WINDOWS\system32\mucltui.dll
2008-07-15 09:13:37 —-D—- C:\Program Files\MsnMusic
2008-07-15 09:13:37 —-D—- C:\Program Files\microsoft money 2005
2008-07-15 09:13:34 —-D—- C:\Program Files\Motive
2008-07-15 09:13:29 —-D—- C:\Documents and Settings\All Users\Application Data\Adobe
2008-07-15 09:09:29 —-D—- C:\WINDOWS\system32\QuickTime
2008-07-15 09:09:29 —-D—- C:\Program Files\QuickTime
2008-07-14 14:58:30 —-D—- C:\Documents and Settings\Tom\Application Data\LimeWire
2008-07-14 14:58:09 —-D—- C:\Program Files\LimeWire
2008-07-13 16:42:26 —-D—- C:\Documents and Settings\Tom\Application Data\Apple Computer
2008-07-13 16:41:54 —-D—- C:\Program Files\Bonjour
2008-07-13 16:41:18 —-D—- C:\Program Files\QuickTime(2)
2008-07-13 16:41:16 —-D—- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-07-13 16:41:02 —-D—- C:\Program Files\Apple Software Update
2008-07-13 16:40:21 —-D—- C:\Program Files\Common Files\Apple
2008-07-09 08:03:09 —-HDC—- C:\WINDOWS\$NtUninstallKB951748_0$
2008-07-07 18:55:09 —-D—- C:\Program Files\Windows Live Safety Center
2008-06-20 16:29:07 —-HDC—- C:\WINDOWS\$NtUninstallKB951376-v2_0$
2008-06-20 13:26:02 —-A—- C:\WINDOWS\system32\mucltui.dll.mui
2008-06-11 08:04:23 —-HDC—- C:\WINDOWS\$NtUninstallKB951698_0$
2008-06-11 08:04:18 —-HDC—- C:\WINDOWS\$NtUninstallKB950762_0$
2008-06-11 08:04:13 —-HDC—- C:\WINDOWS\$NtUninstallKB950760$
2008-06-11 08:04:06 —-DC—- C:\WINDOWS\$NtUninstallKB951376$
2008-06-09 09:35:31 —-D—- C:\Documents and Settings\All Users\Application Data\Adobe(2)
2008-06-09 09:21:30 —-D—- C:\Program Files\viewsonic
2008-06-09 09:21:26 —-A—- C:\WINDOWS\system32\mon.txt

List of drivers

R1 bdftdif;bdftdif; \??\C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdftdif.sys []
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 36352]
R1 sdcplh;sdcplh; C:\WINDOWS\System32\drivers\sdcplh.sys [2005-11-01 55168]
R2 BDVEDISK;BDVEDISK; \??\C:\Program Files\BitDefender\BitDefender 2009\BDVEDISK.sys []
R2 symlcbrd;symlcbrd; \??\C:\WINDOWS\system32\drivers\symlcbrd.sys []
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2006-05-10 3964736]
R3 bdfm;BDFM; C:\WINDOWS\system32\drivers\bdfm.sys [2008-08-12 108864]
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service; C:\WINDOWS\system32\DRIVERS\bdfndisf.sys [2008-08-14 102208]
R3 bdfsfltr;bdfsfltr; C:\WINDOWS\system32\drivers\bdfsfltr.sys [2008-08-12 228672]
R3 BDSelfPr;BDSelfPr; \??\C:\Program Files\BitDefender\BitDefender 2009\bdselfpr.sys []
R3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-01-29 16168]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 Intels51;Intel® 536EP Modem; C:\WINDOWS\system32\DRIVERS\Intels51.sys [2003-05-23 670203]
R3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-05-16 6557408]
R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [2006-02-27 81408]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
S2 RRQTRQPT;RRQTRQPT; \??\C:\WINDOWS\system32\drivers\RRQTRQPT.sys []
S3 3d3c9c72-9b03-4f5b-8605-8e4c5e65f561;3d3c9c72-9b03-4f5b-8605-8e4c5e65f561; \??\D:\Player\cds300.dll []
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 GMSIPCI;GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS []
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2004-02-27 51056]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2004-02-27 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2004-02-27 21488]
S3 HwIOctl;HwIOctl; C:\WINDOWS\system32\drivers\HwIOctl.sys []
S3 Memctl;Memctl; C:\WINDOWS\system32\drivers\Memctl.sys []
S3 MREMPR5;MREMPR5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS []
S3 MRENDIS5;MRENDIS5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS []
S3 MSICPL;MSICPL; \??\D:\install4\MSICPL.sys []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 NTACCESS;NTACCESS; \??\D:\NTACCESS.sys []
S3 ovt519;PS2 EyeToy SLEH-00031 Webcam; C:\WINDOWS\System32\Drivers\ov519vid.sys [2003-10-15 174530]
S3 PAC7311;PAC7312 VGA USB Camera; C:\WINDOWS\system32\DRIVERS\PA707UCM.SYS [2007-01-11 530944]
S3 pacdcacm;pacdcacm; C:\WINDOWS\system32\DRIVERS\pacdcacm.sys [2005-06-15 26496]
S3 Profos;Profos; \??\C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\profos.sys []
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-04 20992]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 SymEvent;SymEvent; \??\C:\Program Files\Symantec\SYMEVENT.SYS []
S3 Trufos;Trufos; \??\C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\trufos.sys []
S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

List of services

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-07-22 116040]
R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2006-07-25 100032]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2007-07-24 229376]
R2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-14 267776]
R2 LIVESRV;BitDefender Desktop Update Service; C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe [2008-08-13 393216]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-05-16 159812]
R2 Symantec Core LC;Symantec Core LC; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe [2005-06-24 826512]
R2 VSSERV;BitDefender Virus Shield; C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe [2008-08-15 1523712]
R2 WinDefend;Windows Defender; C:\Program Files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
R2 WSearch;Windows Search; C:\WINDOWS\system32\SearchIndexer.exe [2008-05-26 439808]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-07-30 532264]
R3 scan;BitDefender Threat Scanner; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2007-08-09 73728]
S3 Arrakis3;BitDefender Arrakis Server; C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [2008-07-17 118784]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-04-13 33632]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-04-13 68952]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2006-07-25 2119360]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]

—————–EOF—————–

Report from RSIT: Note: Log #2

Logfile of random's system information tool (written by random/random)
Run by [removed] at 2008-09-01 22:38:20
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 126 GB (80%) free of 157 GB
Total RAM: 1023 MB (31% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:38:36, on 9/1/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Xtra Help Assistant\bin\McciTrayApp.exe
C:\WINDOWS\PixArt\PAC7311\Monitor.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Tom\Desktop\RSIT.exe
C:\Program Files\trend micro\Tom.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://msn.co.nz/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [tcnzTrayApp] "C:\Program Files\Xtra Help Assistant\bin\McciTrayApp.exe"
O4 - HKLM\..\Run: [PAC7311_Monitor] C:\WINDOWS\PixArt\PAC7311\Monitor.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: Xtra Help Assistant.lnk = C:\Program Files\Xtra Help Assistant\bin\matcli.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase5036.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1113435002640
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe

–
End of file - 10277 bytes

Scheduled tasks folder

C:\WINDOWS\tasks\AntiSpyware Scheduled Scan.job
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\MP Scheduled Scan.job
C:\WINDOWS\tasks\RegCure Program Check.job
C:\WINDOWS\tasks\RegCure.job

Registry dump

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-12-18 59032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2008-08-11 1443112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{381FFDE8-2394-4f90-B10D-FC6124A40F8C} - BitDefender Toolbar - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll [2008-08-13 90112]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-05-16 13529088]
"nwiz"=C:\WINDOWS\system32\nwiz.exe [2008-05-16 1630208]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"HP Component Manager"=C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [2005-01-12 241664]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2006-03-01 577536]
"tcnzTrayApp"=C:\Program Files\Xtra Help Assistant\bin\McciTrayApp.exe [2007-02-08 935424]
"PAC7311_Monitor"=C:\WINDOWS\PixArt\PAC7311\Monitor.exe [2006-11-03 319488]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-05-08 54840]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2006-11-03 866584]
"AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2008-07-10 116040]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-05-27 413696]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-07-30 289064]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2008-05-16 86016]
"BDAgent"=C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe [2008-08-14 716800]
"BitDefender Antiphishing Helper"=C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe [2008-08-10 69632]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE
Windows Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE
Xtra Help Assistant.lnk - C:\Program Files\Xtra Help Assistant\bin\matcli.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"=C:\PROGRA~1\WIFD1F~1\MpShHook.dll [2006-11-03 83224]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"=C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=msapsspc.dll schannel.dll digest.dll msnsspc.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"NoDispScrSavPage"=0
"DisableTaskMgr"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\IncrediMail\bin\IncMail.exe"="C:\Program Files\IncrediMail\bin\IncMail.exe:*:Disabled:IncrediMail"
"C:\Program Files\IncrediMail\bin\ImpCnt.exe"="C:\Program Files\IncrediMail\bin\ImpCnt.exe:*:Disabled:IncrediMail"
"C:\Program Files\IncrediMail\bin\IMApp.exe"="C:\Program Files\IncrediMail\bin\IMApp.exe:*:Disabled:IncrediMail"
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\WINDOWS\system32\mmc.exe"="C:\WINDOWS\system32\mmc.exe:*:Disabled:Microsoft Management Console"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

File associations

.reg - open - regedit.exe "%1" %*

List of files/folders created in the last three months

2008-09-01 20:13:38 —-D—- C:\Program Files\trend micro
2008-09-01 20:13:37 —-D—- C:\rsit
2008-08-30 20:05:40 —-D—- C:\Program Files\Hijackthis
2008-08-30 09:18:27 —-D—- C:\Documents and Settings\All Users\Application Data\WinZip
2008-08-29 05:59:42 —-D—- C:\Program Files\Common Files\Skype
2008-08-28 16:24:29 —-D—- C:\Documents and Settings\Tom\Application Data\Windows Search
2008-08-28 16:17:19 —-D—- C:\Program Files\Microsoft Silverlight
2008-08-28 16:16:55 —-HDC—- C:\WINDOWS\$NtUninstallKB951618-v2$
2008-08-28 16:16:41 —-D—- C:\Documents and Settings\Tom\Application Data\Windows Desktop Search
2008-08-28 16:15:36 —-D—- C:\WINDOWS\system32\GroupPolicy
2008-08-28 16:15:36 —-D—- C:\Program Files\Windows Desktop Search
2008-08-28 16:15:11 —-HDC—- C:\WINDOWS\$NtUninstallKB940157$
2008-08-28 16:14:53 —-HDC—- C:\WINDOWS\$NtUninstallKB915800-v4$
2008-08-28 10:38:35 —-D—- C:\WINDOWS\system32\logs
2008-08-28 10:38:30 —-D—- C:\Documents and Settings\Tom\Application Data\BitDefender
2008-08-28 10:38:29 —-D—- C:\Binaries
2008-08-28 10:37:56 —-D—- C:\Program Files\BitDefender
2008-08-28 10:37:56 —-D—- C:\Documents and Settings\All Users\Application Data\BitDefender
2008-08-28 10:29:26 —-D—- C:\Program Files\Common Files\BitDefender
2008-08-28 09:30:03 —-D—- C:\WINDOWS\BDOSCAN8
2008-08-27 12:49:35 —-D—- C:\WINDOWS\temp
2008-08-27 01:08:20 —-D—- C:\Program Files\RegCure
2008-08-26 13:19:19 —-A—- C:\WINDOWS\system32\msisip.dll
2008-08-26 13:19:19 —-A—- C:\WINDOWS\system32\msimsg.dll
2008-08-26 13:19:19 —-A—- C:\WINDOWS\system32\msihnd.dll
2008-08-26 13:19:19 —-A—- C:\WINDOWS\system32\msiexec.exe
2008-08-26 13:19:19 —-A—- C:\WINDOWS\system32\msi.dll
2008-08-26 01:15:33 —-N—- C:\WINDOWS\system32\_000116_.tmp.dll
2008-08-25 01:36:34 —-N—- C:\WINDOWS\system32\spmsg.dll
2008-08-21 06:43:33 —-D—- C:\Documents and Settings\Tom\Application Data\Malwarebytes
2008-08-21 06:43:27 —-D—- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-21 06:43:27 —-D—- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-20 12:25:50 —-D—- C:\189d6794b071e94af2
2008-08-20 09:43:29 —-A—- C:\WINDOWS\system32\tmp.txt
2008-08-20 09:43:15 —-A—- C:\rapport.txt
2008-08-20 09:41:00 —-A—- C:\WINDOWS\ntbtlog.txt
2008-08-20 09:30:56 —-AD—- C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-20 06:10:52 —-D—- C:\Program Files\Microsoft Windows OneCare Live
2008-08-19 21:01:34 —-D—- C:\Documents and Settings\Tom\Application Data\AVGTOOLBAR
2008-08-19 21:01:25 —-D—- C:\Program Files\AVG
2008-08-19 15:25:53 —-D—- C:\Program Files\Common Files\Wise Installation Wizard
2008-08-19 13:02:41 —-A—- C:\WINDOWS\system32\qqeyaaoh.tmp
2008-08-19 13:02:18 —-D—- C:\Program Files\fvyocbg
2008-08-19 13:02:15 —-D—- C:\Documents and Settings\All Users\Application Data\uzulcbap
2008-08-17 14:00:36 —-D—- C:\Program Files\SystemRequirementsLab
2008-08-13 07:54:51 —-HDC—- C:\WINDOWS\$NtUninstallKB952954$
2008-08-13 07:54:46 —-HDC—- C:\WINDOWS\$NtUninstallKB946648$
2008-08-13 07:54:42 —-HDC—- C:\WINDOWS\$NtUninstallKB953839$
2008-08-13 07:54:29 —-HDC—- C:\WINDOWS\$NtUninstallKB950974$
2008-08-13 07:53:39 —-HDC—- C:\WINDOWS\$NtUninstallKB951072-v2$
2008-08-13 07:53:34 —-HDC—- C:\WINDOWS\$NtUninstallKB952287$
2008-08-13 07:53:04 —-HDC—- C:\WINDOWS\$NtUninstallKB951066$
2008-08-11 10:14:20 —-D—- C:\Program Files\iPod
2008-08-11 10:07:51 —-D—- C:\Program Files\Safari
2008-07-25 18:17:03 —-HDC—- C:\WINDOWS\$NtUninstallKB951978$
2008-07-25 17:02:38 —-A—- C:\WINDOWS\OEWABLog.txt
2008-07-25 17:01:51 —-D—- C:\WINDOWS\Prefetch
2008-07-25 16:27:52 —-HDC—- C:\WINDOWS\$NtUninstallKB951748$
2008-07-25 16:27:45 —-HDC—- C:\WINDOWS\$NtUninstallKB951698$
2008-07-25 16:27:38 —-HDC—- C:\WINDOWS\$NtUninstallKB951376-v2$
2008-07-25 16:27:31 —-HDC—- C:\WINDOWS\$NtUninstallKB950762$
2008-07-25 16:25:45 —-A—- C:\WINDOWS\setuplog.txt
2008-07-25 16:24:49 —-D—- C:\WINDOWS\system32\scripting
2008-07-25 16:24:48 —-D—- C:\WINDOWS\system32\en
2008-07-25 16:24:48 —-D—- C:\WINDOWS\l2schemas
2008-07-25 16:22:21 —-D—- C:\WINDOWS\ServicePackFiles
2008-07-25 16:16:55 —-HDC—- C:\WINDOWS\$NtServicePackUninstall$
2008-07-25 16:10:30 —-D—- C:\WINDOWS\EHome
2008-07-25 16:06:40 —-N—- C:\WINDOWS\system32\wmphoto.dll
2008-07-25 16:06:39 —-N—- C:\WINDOWS\system32\wlanapi.dll
2008-07-25 16:06:37 —-N—- C:\WINDOWS\system32\windowscodecsext.dll
2008-07-25 16:06:37 —-N—- C:\WINDOWS\system32\windowscodecs.dll
2008-07-25 16:06:29 —-N—- C:\WINDOWS\system32\tspkg.dll
2008-07-25 16:06:29 —-N—- C:\WINDOWS\system32\tsgqec.dll
2008-07-25 16:06:24 —-N—- C:\WINDOWS\system32\spupdwxp.exe
2008-07-25 16:06:23 —-A—- C:\WINDOWS\system32\spdwnwxp.exe
2008-07-25 16:06:22 —-N—- C:\WINDOWS\system32\slserv.exe
2008-07-25 16:06:22 —-N—- C:\WINDOWS\system32\slrundll.exe
2008-07-25 16:06:22 —-N—- C:\WINDOWS\system32\slgen.dll
2008-07-25 16:06:22 —-N—- C:\WINDOWS\system32\slextspk.dll
2008-07-25 16:06:22 —-N—- C:\WINDOWS\slrundll.exe
2008-07-25 16:06:21 —-N—- C:\WINDOWS\system32\slcoinst.dll
2008-07-25 16:06:19 —-N—- C:\WINDOWS\system32\setupn.exe
2008-07-25 16:06:17 —-N—- C:\WINDOWS\system32\s3gnb.dll
2008-07-25 16:06:16 —-N—- C:\WINDOWS\system32\rhttpaa.dll
2008-07-25 16:06:14 —-N—- C:\WINDOWS\system32\rasqec.dll
2008-07-25 16:06:13 —-N—- C:\WINDOWS\system32\qutil.dll
2008-07-25 16:06:13 —-N—- C:\WINDOWS\system32\qcliprov.dll
2008-07-25 16:06:12 —-N—- C:\WINDOWS\system32\qagentrt.dll
2008-07-25 16:06:12 —-N—- C:\WINDOWS\system32\qagent.dll
2008-07-25 16:06:11 —-N—- C:\WINDOWS\system32\photometadatahandler.dll
2008-07-25 16:06:08 —-N—- C:\WINDOWS\system32\onex.dll
2008-07-25 16:05:58 —-N—- C:\WINDOWS\system32\napstat.exe
2008-07-25 16:05:58 —-N—- C:\WINDOWS\system32\napmontr.dll
2008-07-25 16:05:58 —-N—- C:\WINDOWS\system32\napipsec.dll
2008-07-25 16:05:58 —-N—- C:\WINDOWS\system32\mtxparhd.dll
2008-07-25 16:05:57 —-N—- C:\WINDOWS\system32\msxml6r.dll
2008-07-25 16:05:57 —-N—- C:\WINDOWS\system32\msxml6.dll
2008-07-25 16:05:55 —-N—- C:\WINDOWS\system32\msshavmsg.dll
2008-07-25 16:05:55 —-N—- C:\WINDOWS\system32\mssha.dll
2008-07-25 16:05:45 —-N—- C:\WINDOWS\system32\mmcperf.exe
2008-07-25 16:05:44 —-N—- C:\WINDOWS\system32\mmcfxcommon.dll
2008-07-25 16:05:44 —-N—- C:\WINDOWS\system32\mmcex.dll
2008-07-25 16:05:44 —-N—- C:\WINDOWS\system32\microsoft.managementconsole.dll
2008-07-25 16:05:42 —-N—- C:\WINDOWS\system32\mdmxsdk.dll
2008-07-25 16:05:34 —-N—- C:\WINDOWS\system32\l2gpstore.dll
2008-07-25 16:05:33 —-N—- C:\WINDOWS\system32\kmsvc.dll
2008-07-25 16:05:33 —-N—- C:\WINDOWS\system32\kbdpash.dll
2008-07-25 16:05:33 —-N—- C:\WINDOWS\system32\kbdnepr.dll
2008-07-25 16:05:32 —-N—- C:\WINDOWS\system32\kbdiultn.dll
2008-07-25 16:05:32 —-N—- C:\WINDOWS\system32\kbdbhc.dll
2008-07-25 16:05:25 —-N—- C:\WINDOWS\system32\hsfcisp2.dll
2008-07-25 16:05:20 —-N—- C:\WINDOWS\system32\faxpatch.exe
2008-07-25 16:05:20 —-A—- C:\WINDOWS\002823_.tmp
2008-07-25 16:05:19 —-N—- C:\WINDOWS\system32\eapsvc.dll
2008-07-25 16:05:19 —-N—- C:\WINDOWS\system32\eapqec.dll
2008-07-25 16:05:19 —-N—- C:\WINDOWS\system32\eappprxy.dll
2008-07-25 16:05:19 —-N—- C:\WINDOWS\system32\eapphost.dll
2008-07-25 16:05:19 —-N—- C:\WINDOWS\system32\eappgnui.dll
2008-07-25 16:05:19 —-N—- C:\WINDOWS\system32\eappcfg.dll
2008-07-25 16:05:18 —-N—- C:\WINDOWS\system32\eapp3hst.dll
2008-07-25 16:05:18 —-N—- C:\WINDOWS\system32\eapolqec.dll
2008-07-25 16:05:16 —-N—- C:\WINDOWS\system32\dot3ui.dll
2008-07-25 16:05:16 —-N—- C:\WINDOWS\system32\dot3svc.dll
2008-07-25 16:05:16 —-N—- C:\WINDOWS\system32\dot3msm.dll
2008-07-25 16:05:16 —-N—- C:\WINDOWS\system32\dot3gpclnt.dll
2008-07-25 16:05:16 —-N—- C:\WINDOWS\system32\dot3dlg.dll
2008-07-25 16:05:16 —-N—- C:\WINDOWS\system32\dot3cfg.dll
2008-07-25 16:05:16 —-N—- C:\WINDOWS\system32\dot3api.dll
2008-07-25 16:05:15 —-N—- C:\WINDOWS\system32\dimsroam.dll
2008-07-25 16:05:15 —-N—- C:\WINDOWS\system32\dimsntfy.dll
2008-07-25 16:05:14 —-N—- C:\WINDOWS\system32\dhcpqec.dll
2008-07-25 16:05:12 —-N—- C:\WINDOWS\system32\credssp.dll
2008-07-25 16:05:07 —-N—- C:\WINDOWS\system32\azroles.dll
2008-07-25 16:05:06 —-N—- C:\WINDOWS\system32\ativvaxx.dll
2008-07-25 16:05:06 —-N—- C:\WINDOWS\system32\ativtmxx.dll
2008-07-25 16:05:06 —-N—- C:\WINDOWS\system32\ati3duag.dll
2008-07-25 16:05:06 —-N—- C:\WINDOWS\system32\ati3d1ag.dll
2008-07-25 16:05:06 —-N—- C:\WINDOWS\system32\ati2dvag.dll
2008-07-25 16:05:06 —-N—- C:\WINDOWS\system32\ati2dvaa.dll
2008-07-25 16:05:05 —-N—- C:\WINDOWS\system32\ati2cqag.dll
2008-07-25 16:05:01 —-N—- C:\WINDOWS\system32\aaclient.dll
2008-07-25 10:13:01 —-D—- C:\WINDOWS\system32\bits
2008-07-25 10:12:52 —-HDC—- C:\WINDOWS\$NtUninstallKB923845$
2008-07-25 10:12:34 —-N—- C:\WINDOWS\system32\bitsprx4.dll
2008-07-25 10:12:21 —-HDC—- C:\WINDOWS\$NtUninstallKB914882$
2008-07-25 10:01:52 —-D—- C:\6e3e9a1c901d5b2fa20b1f3305945b
2008-07-21 00:29:06 —-A—- C:\WINDOWS\system32\javaws.exe
2008-07-21 00:29:06 —-A—- C:\WINDOWS\system32\javaw.exe
2008-07-21 00:29:06 —-A—- C:\WINDOWS\system32\java.exe
2008-07-17 17:50:24 —-D—- C:\Program Files\iTunes
2008-07-17 17:49:13 —-DC—- C:\WINDOWS\system32\DRVSTORE
2008-07-17 17:49:07 —-D—- C:\Documents and Settings\All Users\Application Data\Apple
2008-07-15 09:16:46 —-A—- C:\WINDOWS\system32\muweb.dll
2008-07-15 09:16:45 —-A—- C:\WINDOWS\system32\mucltui.dll
2008-07-15 09:13:37 —-D—- C:\Program Files\MsnMusic
2008-07-15 09:13:37 —-D—- C:\Program Files\microsoft money 2005
2008-07-15 09:13:34 —-D—- C:\Program Files\Motive
2008-07-15 09:13:29 —-D—- C:\Documents and Settings\All Users\Application Data\Adobe
2008-07-15 09:09:29 —-D—- C:\WINDOWS\system32\QuickTime
2008-07-15 09:09:29 —-D—- C:\Program Files\QuickTime
2008-07-14 14:58:30 —-D—- C:\Documents and Settings\Tom\Application Data\LimeWire
2008-07-14 14:58:09 —-D—- C:\Program Files\LimeWire
2008-07-13 16:42:26 —-D—- C:\Documents and Settings\Tom\Application Data\Apple Computer
2008-07-13 16:41:54 —-D—- C:\Program Files\Bonjour
2008-07-13 16:41:18 —-D—- C:\Program Files\QuickTime(2)
2008-07-13 16:41:16 —-D—- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-07-13 16:41:02 —-D—- C:\Program Files\Apple Software Update
2008-07-13 16:40:21 —-D—- C:\Program Files\Common Files\Apple
2008-07-09 08:03:09 —-HDC—- C:\WINDOWS\$NtUninstallKB951748_0$
2008-07-07 18:55:09 —-D—- C:\Program Files\Windows Live Safety Center
2008-06-20 16:29:07 —-HDC—- C:\WINDOWS\$NtUninstallKB951376-v2_0$
2008-06-20 13:26:02 —-A—- C:\WINDOWS\system32\mucltui.dll.mui
2008-06-11 08:04:23 —-HDC—- C:\WINDOWS\$NtUninstallKB951698_0$
2008-06-11 08:04:18 —-HDC—- C:\WINDOWS\$NtUninstallKB950762_0$
2008-06-11 08:04:13 —-HDC—- C:\WINDOWS\$NtUninstallKB950760$
2008-06-11 08:04:06 —-DC—- C:\WINDOWS\$NtUninstallKB951376$
2008-06-09 09:35:31 —-D—- C:\Documents and Settings\All Users\Application Data\Adobe(2)
2008-06-09 09:21:30 —-D—- C:\Program Files\viewsonic
2008-06-09 09:21:26 —-A—- C:\WINDOWS\system32\mon.txt

List of drivers

R1 bdftdif;bdftdif; \??\C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdftdif.sys []
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 36352]
R1 sdcplh;sdcplh; C:\WINDOWS\System32\drivers\sdcplh.sys [2005-11-01 55168]
R2 BDVEDISK;BDVEDISK; \??\C:\Program Files\BitDefender\BitDefender 2009\BDVEDISK.sys []
R2 symlcbrd;symlcbrd; \??\C:\WINDOWS\system32\drivers\symlcbrd.sys []
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2006-05-10 3964736]
R3 bdfm;BDFM; C:\WINDOWS\system32\drivers\bdfm.sys [2008-08-12 108864]
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service; C:\WINDOWS\system32\DRIVERS\bdfndisf.sys [2008-08-14 102208]
R3 bdfsfltr;bdfsfltr; C:\WINDOWS\system32\drivers\bdfsfltr.sys [2008-08-12 228672]
R3 BDSelfPr;BDSelfPr; \??\C:\Program Files\BitDefender\BitDefender 2009\bdselfpr.sys []
R3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-01-29 16168]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 Intels51;Intel® 536EP Modem; C:\WINDOWS\system32\DRIVERS\Intels51.sys [2003-05-23 670203]
R3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-05-16 6557408]
R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [2006-02-27 81408]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
S2 RRQTRQPT;RRQTRQPT; \??\C:\WINDOWS\system32\drivers\RRQTRQPT.sys []
S3 3d3c9c72-9b03-4f5b-8605-8e4c5e65f561;3d3c9c72-9b03-4f5b-8605-8e4c5e65f561; \??\D:\Player\cds300.dll []
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 GMSIPCI;GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS []
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2004-02-27 51056]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2004-02-27 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2004-02-27 21488]
S3 HwIOctl;HwIOctl; C:\WINDOWS\system32\drivers\HwIOctl.sys []
S3 Memctl;Memctl; C:\WINDOWS\system32\drivers\Memctl.sys []
S3 MREMPR5;MREMPR5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS []
S3 MRENDIS5;MRENDIS5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS []
S3 MSICPL;MSICPL; \??\D:\install4\MSICPL.sys []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 NTACCESS;NTACCESS; \??\D:\NTACCESS.sys []
S3 ovt519;PS2 EyeToy SLEH-00031 Webcam; C:\WINDOWS\System32\Drivers\ov519vid.sys [2003-10-15 174530]
S3 PAC7311;PAC7312 VGA USB Camera; C:\WINDOWS\system32\DRIVERS\PA707UCM.SYS [2007-01-11 530944]
S3 pacdcacm;pacdcacm; C:\WINDOWS\system32\DRIVERS\pacdcacm.sys [2005-06-15 26496]
S3 Profos;Profos; \??\C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\profos.sys []
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-04 20992]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 SymEvent;SymEvent; \??\C:\Program Files\Symantec\SYMEVENT.SYS []
S3 Trufos;Trufos; \??\C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\trufos.sys []
S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

List of services

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-07-22 116040]
R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2006-07-25 100032]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2007-07-24 229376]
R2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-14 267776]
R2 LIVESRV;BitDefender Desktop Update Service; C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe [2008-08-13 393216]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-05-16 159812]
R2 Symantec Core LC;Symantec Core LC; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe [2005-06-24 826512]
R2 VSSERV;BitDefender Virus Shield; C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe [2008-08-15 1523712]
R2 WinDefend;Windows Defender; C:\Program Files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
R2 WSearch;Windows Search; C:\WINDOWS\system32\SearchIndexer.exe [2008-05-26 439808]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-07-30 532264]
R3 scan;BitDefender Threat Scanner; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2007-08-09 73728]
S3 Arrakis3;BitDefender Arrakis Server; C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [2008-07-17 118784]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-04-13 33632]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-04-13 68952]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2006-07-25 2119360]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]

—————–EOF—————–




Submit a file to Jotti
Please go here : http://virusscan.jotti.org/
On top of the page there is a field to add the filepath, copy and paste this filepath in there.
If theres is more than one file to scan, insert them 1 at a time.


C:\Program Files\fvyocbg\ProcAdm.dl


Then hit Submit
The scan will take a while before the result comes up so please be patient.
Then copy the result and post it here in this thread.

You may recieve a message stating "
"The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file"

Just let me know if that is what you saw.

Answer is:- YES! Exsact same message.


I hope I have done what you requested correctly??

When I had this PC made the PC guyz loaded all software etc, Nortons and Symantec were part of the install, I tried "Windows One Care" a few months ago and when this loaded it wiped out Nortons. Couldnt workout how to get it back so…I then heard of Defender so went with that, not realiseing that it didnt protect me from virus,s… I know now it doesnt….

I tried to download and run AVG when I received this XPAntiVirus, but Windows installer kept faulting. Was then advised to load and run " Dial-a-Fix to repair WIndows installer, This did not work. Was then advised to load "BIt Defender Free trial", and use this. Since loading this tho my Pc is very slow online…. That was at the begining of last week.

I have also loaded "Regcure" to no avail, and had "ErrorSmart" installed and running for 6-8months.

I know I have tried a lot of things, but I wished I had known about you guys years ago!!! As in my trade ,knowledge goes a long way…

As for Anti Virus program: I will use what you suggest… simple.

Cheers for your time and effort.

TOMT
Post #4
No problem on the time difference.


OK here we go.




1. Download Combo fix from one of these locations.
* IMPORTANT !!! Place combofix.exe on your Desktop

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

]DO NOT USE IT JUST YET.



________________________________________
Open notepad and copy/paste the text in the quotebox below into it: 

KillAll::
File:: 
C:\WINDOWS\system32\_000116_.tmp.dll
C:\WINDOWS\system32\tmp.txt
C:\WINDOWS\system32\qqeyaaoh.tmp
C:\WINDOWS\002823_.tmp
Folder:: 
C:\Program Files\fvyocbg
C:\Documents and Settings\All Users\Application Data\uzulcbap


NOTE: This script was done for this user specifically.
DO NOT ATTEMPT TO USE IT IF YOU ARE NOT THIS USER
YOU WILL HURT THE WORKINGS OF YOUR COMPUTER !!.

Save this as CFScript.txt, in the same location as ComboFix.exe

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe


________________________________
When finished, it shall produce a log for you at C:ComboFix.txt which I will need in your next reply.

Also Post a new HJT log.
Post #5
Hi BOB4, I have done what was asked, but know find that I am unable to get any websites up???? I am on my kids pc now. I can send/receive emails, but no web… the pc I,m useing to reply is on a shared modem so it doesnt appear to be that, has something happined to my web?? I have reset exsplorer to default but still no luck.. I cant post the logs as they are all on other pc… help….
Post #7
Hi again, yep tried that… I will have to go between both pc,z to reply. I will attempt to load logs onto a pen drive and try and post. I will be away for a few hours but will either let u know asap.
Post #9
One thing we might try Tom is this.
Fromm the other computer down load this browser and load it on your pen drive and install it on your machine.
It's called Firefox.

http://www.mozilla.com/en-US/firefox/
Post #10
Hey Bob4, nope firefox loaded, but could not get online.

I have managed to get pen drive sorted so here is the Combo log and a current ( After firefox install ) HIJack log, weird because I can still send/recieve email?
I thought it may have been a firewall conflict ? as windows and Bitdefender firewalls were both on, turned of windows firewall but still no luck…..

I will still have to use both pc,z to answer you….. recieve email on the pc your are working on and post off this pc….

Cheers again for all help. :)



ComboFix 08-09-01.01 - Tom 2008-09-02 19:36:04.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.654 [GMT 12:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Tom\Desktop\CFScript.txt
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\002823_.tmp
C:\WINDOWS\system32\_000116_.tmp.dll
C:\WINDOWS\system32\qqeyaaoh.tmp
C:\WINDOWS\system32\tmp.txt
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\uzulcbap
C:\Documents and Settings\Tom\Application Data\macromedia\Flash Player\#SharedObjects\PCUURYNG\bin.clearspring.com
C:\Documents and Settings\Tom\Application Data\macromedia\Flash Player\#SharedObjects\PCUURYNG\bin.clearspring.com\clearspring.sol
C:\Documents and Settings\Tom\Application Data\macromedia\Flash Player\#SharedObjects\PCUURYNG\interclick.com
C:\Documents and Settings\Tom\Application Data\macromedia\Flash Player\#SharedObjects\PCUURYNG\interclick.com\ud.sol
C:\Documents and Settings\Tom\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com
C:\Documents and Settings\Tom\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\settings.sol
C:\Documents and Settings\Tom\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Tom\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Program Files\AntiSpywareApp
C:\Program Files\AntiSpywareApp\Launcher.exe
C:\Program Files\AntiSpywareApp\unins000.exe
C:\Program Files\fvyocbg
C:\Program Files\fvyocbg\ProcAdm.dll
C:\WINDOWS\002823_.tmp
C:\WINDOWS\setup.exe
C:\WINDOWS\system32\_000115_.tmp.dll
C:\WINDOWS\system32\_000116_.tmp.dll
C:\WINDOWS\system32\drivers\bdfm.sys
C:\WINDOWS\system32\drivers\bdfsfltr.sys
C:\WINDOWS\system32\qqeyaaoh.tmp
C:\WINDOWS\system32\tmp.txt

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_BDFM
——-\Legacy_BDFSFLTR
——-\Service_bdfm
——-\Service_bdfsfltr


((((((((((((((((((((((((( Files Created from 2008-08-02 to 2008-09-02 )))))))))))))))))))))))))))))))
.

2008-09-01 20:13 . 2008-09-01 20:18 d——– C:\rsit
2008-09-01 20:13 . 2008-09-01 22:38 d——– C:\Program Files\trend micro
2008-08-30 19:12 . 2008-08-30 19:12 d——– C:\Documents and Settings\Administrator\Application Data\BitDefender
2008-08-30 19:11 . 2008-08-30 19:11 d——– C:\Documents and Settings\Administrator
2008-08-30 09:18 . 2008-08-30 09:18 d——– C:\Documents and Settings\All Users\Application Data\WinZip
2008-08-29 09:28 . 2008-08-29 09:28 850 –a—— C:\WINDOWS\system32\ProductTweaks.xml
2008-08-29 06:00 . 2008-08-29 06:00 56 –ah—– C:\WINDOWS\system32\ezsidmv.dat
2008-08-29 05:59 . 2008-08-29 05:59 d——– C:\Program Files\Common Files\Skype
2008-08-29 05:44 . 2008-08-29 05:44 385 –a—— C:\WINDOWS\system32\user_gensett.xml
2008-08-28 16:24 . 2008-08-28 16:24 d——– C:\Documents and Settings\Tom\Application Data\Windows Search
2008-08-28 16:17 . 2008-08-28 16:17 d——– C:\Program Files\Microsoft Silverlight
2008-08-28 16:16 . 2008-08-28 16:16 d——– C:\Documents and Settings\Tom\Application Data\Windows Desktop Search
2008-08-28 16:15 . 2008-08-28 16:15 d——– C:\WINDOWS\system32\GroupPolicy
2008-08-28 16:15 . 2008-08-28 16:15 d——– C:\Program Files\Windows Desktop Search
2008-08-28 16:14 . 2008-03-08 05:02 192,000 —–c— C:\WINDOWS\system32\dllcache\offfilt.dll
2008-08-28 16:14 . 2008-03-08 05:02 98,304 —–c— C:\WINDOWS\system32\dllcache\nlhtml.dll
2008-08-28 16:14 . 2008-03-08 05:02 29,696 —–c— C:\WINDOWS\system32\dllcache\mimefilt.dll
2008-08-28 16:11 . 2008-07-23 02:45 1,214,526 —–c— C:\WINDOWS\system32\dllcache\sysmain.sdb
2008-08-28 16:11 . 2008-07-23 02:45 790,846 —–c— C:\WINDOWS\system32\dllcache\apph_sp.sdb
2008-08-28 16:11 . 2008-07-23 02:45 9,696 —–c— C:\WINDOWS\system32\dllcache\drvmain.sdb
2008-08-28 10:38 . 2008-08-28 10:38 d——– C:\WINDOWS\system32\logs
2008-08-28 10:38 . 2008-08-28 10:38 d——– C:\Documents and Settings\Tom\Application Data\BitDefender
2008-08-28 10:38 . 2008-08-28 10:38 d——– C:\Binaries
2008-08-28 10:37 . 2008-08-28 10:38 d——– C:\Program Files\BitDefender
2008-08-28 10:37 . 2008-08-28 10:40 d——– C:\Documents and Settings\All Users\Application Data\BitDefender
2008-08-28 10:29 . 2008-08-28 10:38 d——– C:\Program Files\Common Files\BitDefender
2008-08-28 09:30 . 2008-08-28 10:14 d——– C:\WINDOWS\BDOSCAN8
2008-08-27 01:08 . 2008-08-27 01:08 d——– C:\Program Files\RegCure
2008-08-26 13:19 . 2008-04-14 12:11 2,843,136 –a—— C:\WINDOWS\system32\msi.dll
2008-08-26 13:19 . 2008-04-14 03:39 884,736 –a—— C:\WINDOWS\system32\msimsg.dll
2008-08-26 13:19 . 2008-04-14 12:11 271,360 –a—— C:\WINDOWS\system32\msihnd.dll
2008-08-26 13:19 . 2008-04-14 12:12 78,848 –a—— C:\WINDOWS\system32\msiexec.exe
2008-08-26 13:19 . 2008-04-14 12:11 15,360 –a—— C:\WINDOWS\system32\msisip.dll
2008-08-21 06:43 . 2008-08-21 06:43 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-08-21 06:43 . 2008-08-21 06:43 d——– C:\Documents and Settings\Tom\Application Data\Malwarebytes
2008-08-21 06:43 . 2008-08-21 06:43 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-21 06:43 . 2008-08-17 15:04 38,472 –a—— C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-21 06:43 . 2008-08-17 15:04 17,144 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-08-20 12:25 . 2008-08-20 12:25 d——– C:\189d6794b071e94af2
2008-08-20 09:43 . 2008-08-20 09:51 3,448 –a—— C:\WINDOWS\system32\tmp.reg
2008-08-20 09:30 . 2008-08-21 11:42 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-20 06:10 . 2008-08-20 12:33 d——– C:\Program Files\Microsoft Windows OneCare Live
2008-08-19 21:01 . 2008-08-19 21:01 d——– C:\Program Files\AVG
2008-08-19 21:01 . 2008-08-19 21:01 d——– C:\Documents and Settings\Tom\Application Data\AVGTOOLBAR
2008-08-19 15:25 . 2008-08-21 12:08 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-08-17 14:00 . 2008-08-17 14:00 d——– C:\Program Files\SystemRequirementsLab
2008-08-14 18:54 . 2008-08-14 18:54 102,208 –a—— C:\WINDOWS\system32\drivers\bdfndisf.sys
2008-08-13 07:02 . 2008-05-02 02:33 331,776 —–c— C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-13 07:01 . 2008-04-12 07:04 691,712 —–c— C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-08-11 10:14 . 2008-08-11 10:14 d——– C:\Program Files\iPod
2008-08-11 10:07 . 2008-08-11 10:07 d——– C:\Program Files\Safari

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-02 04:34 45,778 —-a-w C:\Documents and Settings\Tom\Application Data\wklnhst.dat
2008-08-29 23:31 ——— d—–w C:\Program Files\Google
2008-08-28 18:01 ——— d—–w C:\Documents and Settings\Tom\Application Data\Skype
2008-08-28 18:00 ——— d—–w C:\Documents and Settings\Tom\Application Data\skypePM
2008-08-28 00:14 ——— d—–w C:\Program Files\ErrorSmart
2008-08-27 01:05 ——— d—–w C:\Program Files\Picture It! Premium 10
2008-08-20 03:05 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-08-19 18:24 ——— d—–w C:\Documents and Settings\Tom\Application Data\LimeWire
2008-08-19 09:12 ——— d—–w C:\Program Files\Windows Live Safety Center
2008-08-19 08:03 ——— d—–w C:\Documents and Settings\Tom\Application Data\ErrorSmart
2008-08-11 02:15 ——— d—–w C:\Documents and Settings\Tom\Application Data\Apple Computer
2008-08-10 22:43 ——— d—–w C:\Program Files\Apple Software Update
2008-08-10 22:14 ——— d—–w C:\Program Files\iTunes
2008-08-06 08:08 58,280 —-a-w C:\Documents and Settings\Tom\Application Data\GDIPFONTCACHEV1.DAT
2008-07-24 22:31 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-07-20 12:29 ——— d—–w C:\Program Files\Java
2008-07-17 05:50 ——— d—–w C:\Program Files\QuickTime
2008-07-17 05:50 ——— d—–w C:\Program Files\Bonjour
2008-07-17 05:49 ——— d—–w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-07-17 05:49 ——— d—–w C:\Documents and Settings\All Users\Application Data\Apple
2008-07-14 22:02 ——— d—–w C:\Program Files\LimeWire
2008-07-14 21:13 ——— d—–w C:\Program Files\Xtra Help Assistant
2008-07-14 21:13 ——— d—–w C:\Program Files\MsnMusic
2008-07-14 21:13 ——— d—–w C:\Program Files\Motive
2008-07-14 21:13 ——— d—–w C:\Program Files\microsoft money 2005
2008-07-14 21:13 ——— d—–w C:\Documents and Settings\All Users\Application Data\Adobe(2)
2008-07-14 21:09 ——— d—–w C:\Program Files\QuickTime(2)
2008-07-13 04:40 ——— d—–w C:\Program Files\Common Files\Apple
2008-07-02 01:07 82,568 —-a-w C:\WINDOWS\system32\drivers\BDVEDISK.sys
2008-01-28 19:22 32 —-a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 12:12 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 14:01 13529088]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2005-01-12 13:54 241664]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"tcnzTrayApp"="C:\Program Files\Xtra Help Assistant\bin\McciTrayApp.exe" [2007-02-08 09:12 935424]
"PAC7311_Monitor"="C:\WINDOWS\PixArt\PAC7311\Monitor.exe" [2006-11-03 10:01 319488]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 16:24 54840]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 10:47 289064]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 14:01 86016]
"BDAgent"="C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe" [2008-08-14 20:14 716800]
"BitDefender Antiphishing Helper"="C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe" [2008-08-10 23:53 69632]
"nwiz"="nwiz.exe" [2008-05-16 14:01 1630208 C:\WINDOWS\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2006-03-01 16:22 577536 C:\WINDOWS\soundman.exe]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 05:19:24 237568]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]
Windows Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 22:19:14 123904]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2008-04-28 11:20:00 415072]
Xtra Help Assistant.lnk - C:\Program Files\Xtra Help Assistant\bin\matcli.exe [2007-02-18 18:57:05 217088]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 22:19 304128]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\WINDOWS\\system32\\mmc.exe"=

R2 BDVEDISK;BDVEDISK;C:\Program Files\BitDefender\BitDefender 2009\BDVEDISK.sys [2008-07-02 13:07]
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;C:\WINDOWS\system32\DRIVERS\bdfndisf.sys [2008-08-14 18:54]
S2 RRQTRQPT;RRQTRQPT;C:\WINDOWS\system32\drivers\RRQTRQPT.sys []
S3 3d3c9c72-9b03-4f5b-8605-8e4c5e65f561;3d3c9c72-9b03-4f5b-8605-8e4c5e65f561;D:\Player\cds300.dll []
S3 Arrakis3;BitDefender Arrakis Server;C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [2008-07-17 13:06]
S3 PAC7311;PAC7312 VGA USB Camera;C:\WINDOWS\system32\DRIVERS\PA707UCM.SYS [2007-01-11 08:34]
S3 pacdcacm;pacdcacm;C:\WINDOWS\system32\DRIVERS\pacdcacm.sys [2005-06-15 23:28]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
.
Contents of the 'Scheduled Tasks' folder
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-02 19:43:38
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\searchindexer.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
.
**************************************************************************
.
Completion time: 2008-09-02 19:48:27 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-02 07:48:22

Pre-Run: 131,536,850,944 bytes free
Post-Run: 131,443,601,408 bytes free

224 — E O F — 2008-08-29 20:32:27




Current HiJack log:



Logfile of HijackThis v1.99.1
Scan saved at 11:50:51, on 9/3/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Xtra Help Assistant\bin\McciTrayApp.exe
C:\WINDOWS\PixArt\PAC7311\Monitor.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [tcnzTrayApp] "C:\Program Files\Xtra Help Assistant\bin\McciTrayApp.exe"
O4 - HKLM\..\Run: [PAC7311_Monitor] C:\WINDOWS\PixArt\PAC7311\Monitor.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: Xtra Help Assistant.lnk = C:\Program Files\Xtra Help Assistant\bin\matcli.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase5036.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1113435002640
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe" /service (file missing)
Post #11
Hi again Bob4, I tried several times to reboot etc. I tried a system restore to the Combofix restore point, and reloaded firefox.
I tried to load firefox www page and left it running to slowly download, went away for 1/2hr came back and internet was back??? I changed nothing and didnt alter any settings at firefox.
I am able to veiw pages again? they are a bit slow but they are comeing up…

I did a new HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 13:08, on 2008-09-03
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Xtra Help Assistant\bin\McciTrayApp.exe
C:\WINDOWS\PixArt\PAC7311\Monitor.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://msn.co.nz/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [tcnzTrayApp] "C:\Program Files\Xtra Help Assistant\bin\McciTrayApp.exe"
O4 - HKLM\..\Run: [PAC7311_Monitor] C:\WINDOWS\PixArt\PAC7311\Monitor.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: Xtra Help Assistant.lnk = C:\Program Files\Xtra Help Assistant\bin\matcli.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase5036.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1113435002640
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe" /service (file missing)
Post #12
Hi TomT,
Glad you have it running again. I need to see a log .
Navigate to and open this log.

C:\QooBox\ComboFix-quarantined-files.txt

PLease copy post the contents of that log.





______________________________
We need a copy of 2 files you have for some experts to examine.

Go to this LINK

Where is says Link to topic where this file was requested:
Copy this link in.

http://forums.whatthetech.com/XPAntivirus_…734#entry483734


Now Paste this in the section where it says browse one at a time and choose submit for each of them.


C:\WINDOWS\system32\drivers\bdfm.sys

C:\WINDOWS\system32\drivers\bdfsfltr.sys

Click send file.



_________________________
In your next reply I would like to see:
  • The contets of ComboFix-quarantined-files.txt
  • Let me know you were able to submit those 2 files.
Post #13
Hey there BOB4, Just got home and FireFox is still up and running, still able to go online, pages loading nearly as fast as before I got this bug.

I was able to submit the 2 files to Bleeping Computer.

Managed to find the ComBo fix Quarantine log:-

2005-07-14 14:06:18 508,448 C:\Qoobox\Quarantine\C\WINDOWS\setup.exe.vir
2006-12-28 19:01:31 19,569 C:\Qoobox\Quarantine\C\WINDOWS\002823_.tmp.vir
2007-05-24 05:57:42 89 C:\Qoobox\Quarantine\C\Documents and Settings\Tom\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\settings.sol.vir
2007-10-12 00:00:30 795,896 C:\Qoobox\Quarantine\C\Program Files\AntiSpywareApp\Launcher.exe.vir
2008-01-07 20:47:27 765,785 C:\Qoobox\Quarantine\C\Program Files\AntiSpywareApp\unins000.exe.vir
2008-01-29 22:00:07 84 C:\Qoobox\Quarantine\C\Documents and Settings\Tom\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol.vir
2008-03-01 01:40:00 139 C:\Qoobox\Quarantine\C\Documents and Settings\Tom\Application Data\Macromedia\Flash Player\#SharedObjects\PCUURYNG\interclick.com\ud.sol.vir
2008-04-14 00:11:59 2,843,136 C:\Qoobox\Quarantine\C\WINDOWS\system32\_000115_.tmp.dll.vir
2008-04-14 00:11:59 2,843,136 C:\Qoobox\Quarantine\C\WINDOWS\system32\_000116_.tmp.dll.vir
2008-08-12 06:40:32 108,864 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\bdfm.sys.vir
2008-08-12 06:40:52 228,672 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\bdfsfltr.sys.vir
2008-08-19 01:02:18 106,496 C:\Qoobox\Quarantine\C\Program Files\fvyocbg\ProcAdm.dll.vir
2008-08-19 01:02:41 29 C:\Qoobox\Quarantine\C\WINDOWS\system32\qqeyaaoh.tmp.vir
2008-08-19 21:51:02 0 C:\Qoobox\Quarantine\C\WINDOWS\system32\tmp.txt.vir
2008-08-29 23:27:57 1,418 C:\Qoobox\Quarantine\C\Documents and Settings\Tom\Application Data\Macromedia\Flash Player\#SharedObjects\PCUURYNG\bin.clearspring.com\clearspring.sol.vir
2008-09-02 07:39:42 6,026 C:\Qoobox\Quarantine\Registry_backups\tcpip.reg
2008-09-02 07:40:28 1,038 C:\Qoobox\Quarantine\Registry_backups\Legacy_BDFSFLTR.reg.dat
2008-09-02 07:40:28 990 C:\Qoobox\Quarantine\Registry_backups\Legacy_BDFM.reg.dat
2008-09-02 07:40:29 3,060 C:\Qoobox\Quarantine\Registry_backups\Service_bdfm.reg.dat
2008-09-02 07:40:30 2,402 C:\Qoobox\Quarantine\Registry_backups\Service_bdfsfltr.reg.dat
2008-09-02 07:41:00 54 C:\Qoobox\Quarantine\catchme.log
2008-09-02 07:47:55 2 C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-CFSServ.exe.reg.dat
2008-09-02 07:47:55 2 C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-NDSTray.exe.reg.dat
2008-09-02 07:47:55 2 C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-TFncKy.reg.dat

I was browsing the forum at work 2nite, and read that " Limewire" is a good source for virus's?? is this if you are sharing files?? or just downloading?? I have this but not set to share files.
I will get rid of whatever programs you suggest too. and do what is needed to stay clean… I hope…
And Many cheerz for your time…

I have run another HJT and heres the log:-

Logfile of HijackThis v1.99.1
Scan saved at 01:30, on 2008-09-04
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Xtra Help Assistant\bin\McciTrayApp.exe
C:\WINDOWS\PixArt\PAC7311\Monitor.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Xtra Help Assistant\bin\MotiveBrowser.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://msn.co.nz/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [tcnzTrayApp] "C:\Program Files\Xtra Help Assistant\bin\McciTrayApp.exe"
O4 - HKLM\..\Run: [PAC7311_Monitor] C:\WINDOWS\PixArt\PAC7311\Monitor.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: Xtra Help Assistant.lnk = C:\Program Files\Xtra Help Assistant\bin\matcli.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase5036.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1113435002640
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe" /service (file missing)
Post #14
Yes Limewire and any other file sharing program can lead to inflecting computers.
It's not the program itself but what you download with them that causes this kind of trouble.
That's why we now have a strict policy that ANY programs like this must be removed or we may refuse to help someone.

Because of this, we felt we needed to change our policy on the use of P2P file sharing programs.

Please read that.





_________________________________________
Please delete combofix from your desktop now.

Then we are going to download and run a new version.
Using System restore may have placed the infection back in, but was nessacary .


____________________________________
1. Download Combo fix from one of these locations.
* IMPORTANT !!! Place combofix.exe on your Desktop

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

2. Click start/run and copy and Paste this in exactly using the picture below for reference:

"%userprofile%\desktop\combofix.exe" /killall


[external image: Posted Image]

3. Combo will begin to run DO NOTHING while this is happeneing.
  • It will kill a few processes and disconnect you from the internet.
  • If by chance it stops prematurly you can re-establish your internet connection by restarting your computer.
  • This needs to be done so the program can work most efficiently for you.
Do not attempt to use the internet or anything else while it's doing its job for you.

If when it's completed you can not get on the internet just reboot the computer

Post the log from comboFix for me located in
c:\comboFix.txt

________________________________________


Please post the contents of that log for me.
Post #15
Hey BOB4, just read that policy on P2P, Should I remove that program before I do anything else?? I have not used it for a while and deff not dureing this proccess! I have no issue dumping it as it was mainly for the kids. Only after reading that notice did I realise the dangers of it… as said previous I will dump what you say too. Cheers

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI