Spyware / Malware / Virus Removal

[Resolved] Malware or Virus or Spyware?

32 min read

Looking for the outcome? Ask AI

LDTate

Post #16September 29, 2008, 12:12 AM UTC

You're still confusing a Restore Point and a Backup.

Any Backup that you made will Not have a Restore Point.
Restore Points are Only created on your OS boot drive.

If you restore from a the data Backup, then anything you added since the Backup will be gone.

The first thing you want to try is System Restore. NOT a restore from a data backup

1.
Click Start.

2.
Point to All Programs.

3.
Point to Accessories.

4.
Point to System Tools.

5.
Click System Restore.

6.
Follow the instructions on the wizard.

See if you can find a date the the PC worked.

letsee

Post #17September 29, 2008, 1:33 AM UTC last edited September 29, 2008, 1:33 AM UTC

I thought I understood the difference, but I guess it's confusing. I do know for certain that the last XP System Restore Point was a long long time ago. I also know (because I have tried to use it before), that the XP System Restore program/option is faulty on my laptop. Does it matter that the last restore point was 2 years ago? And, for the moment please assume I can not do a system restore ok? If I restore from a backup program will I lose all my data since the backup date too (pics, docs, movies, etc.)? So…if I can't do a system restore in the XP program, what is the next option? (And thanks for all this help!)

LDTate

Post #18September 29, 2008, 1:36 AM UTC

If I restore from a backup program will I lose all my data since the backup date too (pics, docs, movies, etc.)?

Yes

So…if I can't do a system restore in the XP program, what is the next option?

Download and run that program and see if it works to give you internet.
Post a HijackThis log

letsee

Post #19September 29, 2008, 3:41 AM UTC last edited September 29, 2008, 4:17 AM UTC

Will do! Thanks LDTate! When I run HiJackThis, do I leave my Norton activated or am I supposed to somehow deactivate all of my Norton stuff? I have Norton Systemworks 2008. One further thing. About a day before this all happened, I did a backup of my registry (just my registry) using Norton utilities. It saved in my c: drive as SYM_REGISTRY_BACKUP.reg. Is that useful in any of this at all now?

letsee

Post #20September 30, 2008, 3:47 PM UTC last edited September 30, 2008, 3:48 PM UTC

LDTate:

I am so concerned about my system that I've changed my flight and am going to fly back home tonight so I have a day to try to fix this before I have to leave town again tomorrow night (because then I will be gone Wednesday night through Monday). I'm hoping we can work this out tonight and tomorrow. Could you please see my questions below and let me know? Are you around tomorrow? If not, is there another tech expert who can try to work this out with me tomorrow? However, I'd really rather stick with you since you are clearly the most knowledgeable! Thanks again!

When I run HiJackThis, do I leave my Norton activated or am I supposed to somehow deactivate all of my Norton stuff? I have Norton Systemworks 2008.

One further thing. About a day before this all happened, I did a backup of my registry (just my registry) using Norton utilities. It saved in my c: drive as SYM_REGISTRY_BACKUP.reg. Is that useful in any of this at all now?

letsee

Post #21October 1, 2008, 1:14 PM UTC last edited October 1, 2008, 1:54 PM UTC

I am finally home. It's 6am. I haven't slept all night and since I can't connect to the net I'm typing this on my Treo 650 so please bear w me. I started the laptop and spybot immediately scanned before anything loaded (I think) and found virtumonde.dll and zlob.dnschanger and zlob.dnschanger.rtk. I had it fix all. Then it rebooted and rescannned but I stopped it to see what would start. In case I couldn't connect to the net, when I was out of town I had copied programs to a cd incldg the one LDTate said to try to connect and also Hijackthis, avg, ccleaner, malwarebytes, smitfraudfix, superantispyware, combofix and some others. I tried LDTate's pgm to connect but his pgm said I had to reboot and before it rebooted Norton popped up a box saying that lphcru0j0epcr.exe was trying to do something (access the net maybe?) but I chose not to allow it to do that since I don't know what that program is. Is it part of LDTate's pgm? Then when the laptop did try to reboot it wouldnt boot and I got a black screen saying my system was changed or something and that I had to choose to start as normal or to revert to the most recent working configuration. I tried to start normal but it kept going into a loop and wouldn't start so I had to choose the last working config. When it started up I still can't connect! I installed hijackthis and malwarebytes. I did a hijackthis scan and it made a log but can't upload since I can't connect to the net! If I copy to a flash drive will it infect that drive? Malwarebytes found 20 infected files at the start of the scan and is still scanning after an hour and a half (it found 1 more infected file in the windows dirwctory just now but is still scanning). When it finishes scanning do I let it fix or clean the files it finds or could that make things worse? I don't know what to do. Please LDTate or someone here…what can I do to fix this? Please understand I've had no sleep and am typing this on my cellphone. I really appreciate your time and expertise w this.

LDTate

Post #22October 1, 2008, 4:00 PM UTC

Malwarebytes found 20 infected files at the start of the scan and is still scanning after an hour and a half (it found 1 more infected file in the windows dirwctory just now but is still scanning). When it finishes scanning do I let it fix or clean the files it finds or could that make things worse?

Let it clean what it finds.

letsee

Post #23October 1, 2008, 7:41 PM UTC last edited October 1, 2008, 9:36 PM UTC

I managed to get back connected to the net! So…here's a description of what I did based on your suggestions and what I've found and what has happened.

I've run Malwarebytes (quick scan..not full scan again since it took 2 1/2 hours) many times now and each time it finds stuff and I have it fix it. I also installed WinPatrol.

Malwarebytes kept finding "trojan.vundo" and "trojan.dnschanger". Then it found infected files in a c: directory called "resycler" (yes, spelled wrong like that). On the most recent quickscan of Malwarebytes it found two instances of something called "rootkit.dnschanger.H" and supposedly deleted it.

Then Norton popped up and said it detected an attempt to install "w32.sillydc" and supposedly deleted it.

Now winpatrol keeps telling me a new auto start up program keeps trying to install called "c:\windows\system32\kdysw.exe".

A Spybot scan brought up the message "Microsoft.WindowsSecurityCenter_disabled (but it also says that other security programs might have caused this so is this something that Norton causes or is it another problem?).

Also, now there are a bunch of files with the extension .tmp showing up on my desktop that are see-thru icons (like a ghost).

By the way, do I need to worry that this malware or whatever is stealing my passwords (or recording my keystrokes) or private info - I hope not. And do I need to create all new passwords on all my accounts and email?

This is my latest HiJackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:34:39 PM, on 10/1/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Maxtor\Sync\SyncServices.exe
C:\Program Files\Norton Save and Restore\Agent\VProSvc.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\ssoftsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe
C:\WINDOWS\system32\hphmon05.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\MXOALDR.EXE
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\PROGRA~1\RETROS~1\RETROS~1.1\RetroExpress.exe
C:\Program Files\Norton Save and Restore\Agent\VProTray.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\MR Tech Systray\mrsystray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\HP\Digital Imaging\bin\hposol08.exe
C:\Program Files\Say the Time\SayTimeMain.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\PROGRA~1\RETROS~1\RETROS~1.1\retrorun.exe
C:\Program Files\Say the Time\stttsm.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?

LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!

\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!

\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat

7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} -

C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!

\Common\yiesrvc.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec

Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1

\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program

files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program

Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0

\yt.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec

Shared\coShared\Browser\2.0\CoIEPlg.dll
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [HPHUPD05] C:\hp\tmp\src\psptr\Patch\Uninst\HPHupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [MXOBG] C:\WINDOWS\MXOALDR.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [RetroExpress] C:\PROGRA~1\RETROS~1\RETROS~1.1\RetroExpress.exe /h
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Norton Save and Restore 2.0] "C:\Program Files\Norton Save and Restore\Agent\VProTray.exe"
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdihv.exe] C:\WINDOWS\system32\kdihv.exe
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKCU\..\Run: [MR Tech Systray] C:\Program Files\MR Tech Systray\mrsystray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
O4 - Startup: MR Tech Systray.lnk = C:\Program Files\MR Tech Systray\mrsystray.exe
O4 - Startup: Say the Time 5.0.lnk = C:\Program Files\Say the Time\SayTime.exe
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: officejet 6100.lnk = ?
O4 - Global Startup: Say the Time.lnk = C:\Program Files\Say the Time\SayTime.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07

\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!

\Common\yiesrvc.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks

Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton

SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program

Files\ICQLite\ICQLite.exe
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth

Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program

Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network

Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe

(file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?

TYPE=3&tp=iehome&locale=EN_US&c=Q304&bd=pavilion&pf=laptop
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) -

https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!

\Common\Yinsthelper.dll
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-

secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) -

https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -

http://www.update.microsoft.com/microsoftu…b?1201153945783
O16 - DPF: {FC11A119-C2F7-46F4-9E32-937ABA26816E} (AMI DicomDir TreeView Control 2.1) -

file://D:\CDVIEWER\CdViewer.cab
O16 - DPF: {FC6703A7-5B7E-4f58-BE6D-2693AA3906AE} (HP Content Update) -

http://h30043.www3.hp.com/netassist/en/che…hp.cab?1,0,0,94
O18 - Protocol: bw+0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480

\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Maxtor\Schedule2

\schedul2.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device

Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program

Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth

Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec

Shared\ccSvcHst.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec

Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec

Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common

Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec

Shared\VAScanner\comHost.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google

Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common

Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton

AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program

Files\Maxtor\Sync\SyncServices.exe
O23 - Service: Norton Save and Restore - Symantec Corporation - C:\Program Files\Norton Save and

Restore\Agent\VProSvc.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1

\NPROTECT.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Retrospect Express HD Helper (RetroExp Helper) - EMC Dantz - C:\PROGRA~1\RETROS~1\RETROS~1.1

\rthlpsvc.exe
O23 - Service: Retrospect Express HD Launcher (RetroExpLauncher) - EMC Dantz - C:\PROGRA~1\RETROS~1\RETROS~1.1

\retrorun.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program

Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program

Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Cryptainer service (ssoftservice) - Cypherix - C:\WINDOWS\SYSTEM32\ssoftsrv.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program

Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

–
End of file - 28974 bytes

Thank you SO much LDTate for sticking with this and hopefully now this will give you the info you needed to help me clean this once and for all please!

LDTate

Post #24October 1, 2008, 9:53 PM UTC

Don't get ahead of me. We just started cleaning.

Open Notepad, click on Format and uncheck Word Wrap.

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.

Please do not delete anything unless instructed to.

Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:

Download ComboFix from Here or Here to your Desktop.

In the event you already have Combofix, this is a new version that I need you to download.
It must be saved directly to your desktop.

Make sure you are disconnected from the net

1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan.
Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
Remember to re enable the protection again afterwards before connecting to the net

2. Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.

IF you have not already done so Combofix will disconnect your machine from the Internet when it starts.
If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

3. Now double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze.
Give it atleast 20-30 minutes to finish if needed.

letsee

Post #25October 1, 2008, 10:42 PM UTC last edited October 1, 2008, 10:43 PM UTC

(WinPatrol just detected something trying to change my hosts or something and I rejected the change FYI)
Here's the ComboFix log (and then the HiJackThis log):

ComboFix 08-09-30.03 - Brian 2008-10-01 15:12:03.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.293 [GMT -7:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\Downloaded Program Files\ODCTOOLS
C:\WINDOWS\system32\nfrjrhnn.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_VIEWPOINT_MANAGER_SERVICE
——-\Service_Viewpoint Manager Service

((((((((((((((((((((((((( Files Created from 2008-09-01 to 2008-10-01 )))))))))))))))))))))))))))))))
.

2008-10-01 11:43 . 2008-10-01 11:43 d——– C:\Documents and Settings\Brian\Application Data\WinPatrol
2008-10-01 11:42 . 2008-10-01 11:42 d——– C:\Program Files\BillP Studios
2008-10-01 11:16 . 2008-10-01 11:16 d——– C:\Documents and Settings\All Users\Application Data\Avg7
2008-10-01 03:35 . 2008-10-01 03:35 d——– C:\Documents and Settings\Brian\Application Data\Malwarebytes
2008-10-01 03:35 . 2008-09-10 00:03 17,200 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-10-01 03:34 . 2008-10-01 03:35 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-10-01 03:34 . 2008-10-01 03:34 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-01 03:34 . 2008-09-10 00:04 38,528 –a—— C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-01 03:30 . 2008-10-01 03:31 d——– C:\Program Files\CCleaner
2008-10-01 03:20 . 2008-10-01 03:20 d——– C:\Program Files\Trend Micro
2008-09-26 19:05 . 2008-09-26 19:06 133,909,668 –a—— C:\SYM_REGISTRY_BACKUP.reg
2008-09-23 01:53 . 2008-09-23 01:53 d——– C:\Documents and Settings\All Users\Application Data\SlySoft
2008-09-23 01:45 . 2008-09-23 01:45 d——– C:\Program Files\SlySoft
2008-09-20 03:44 . 2008-09-20 03:44 99,648 –a—— C:\WINDOWS\system32\drivers\AnyDVD.sys
2008-09-06 09:14 . 2008-09-06 09:14 d——– C:\Program Files\Opera

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-01 22:23 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-10-01 21:15 ——— d—–w C:\Program Files\Trillian
2008-10-01 21:14 ——— d—–w C:\Documents and Settings\All Users\Application Data\RetroExp
2008-10-01 19:46 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-10-01 17:38 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-10-01 05:08 ——— d—–w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-09-27 04:59 ——— d—–w C:\Program Files\Norton Save and Restore
2008-09-24 07:58 ——— d—–w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-09-23 09:04 ——— d—–w C:\Documents and Settings\Brian\Application Data\RipIt4Me
2008-09-23 02:17 ——— d—–w C:\Program Files\Norton SystemWorks Premier
2008-08-31 19:32 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-15 04:21 ——— d—–w C:\Program Files\Common Files\Adobe
2008-08-15 04:17 ——— d—–w C:\Documents and Settings\Brian\Application Data\AdobeUM
2008-08-12 03:18 ——— d—–w C:\Program Files\Apple Software Update
2007-11-04 23:09 724,984 —-a-w C:\Documents and Settings\Brian\gotomypc_437.exe
2007-09-12 14:19 5,632 –sha-w C:\Program Files\Thumbs.db
2005-09-19 07:10 483,401 —-a-w C:\Documents and Settings\Brian\314_gotomypc.exe
2005-05-14 00:12 217,073 –sha-r C:\WINDOWS\meta4.exe
2005-10-24 18:13 66,560 –sha-r C:\WINDOWS\MOTA113.exe
2005-07-14 19:31 27,648 –sha-r C:\WINDOWS\system32\AVSredirect.dll
2005-06-26 22:32 616,448 –sha-r C:\WINDOWS\system32\cygwin1.dll
2005-06-22 05:37 45,568 –sha-r C:\WINDOWS\system32\cygz.dll
2006-05-03 10:06 163,328 –sha-r C:\WINDOWS\system32\flvDX.dll
2004-01-25 07:00 70,656 –sha-r C:\WINDOWS\system32\i420vfw.dll
2005-01-22 02:30 13,560 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2005-02-28 20:16 240,128 –sha-r C:\WINDOWS\system32\x.264.exe
2004-01-25 07:00 70,656 –sha-r C:\WINDOWS\system32\yv12vfw.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MR Tech Systray"="C:\Program Files\MR Tech Systray\mrsystray.exe" [2006-04-09 479232]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
"AnyDVD"="C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe" [2008-09-20 2177984]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ViewMgr"="C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe" [2004-11-10 111816]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-04 98394]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-04 688218]
"Motive SmartBridge"="C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe" [2006-09-01 380928]
"IPInSightMonitor 02"="C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe" [2003-06-11 122880]
"IPInSightLAN 02"="C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" [2003-06-11 380928]
"HPHUPD05"="C:\hp\tmp\src\psptr\Patch\Uninst\HPHupd05.exe" [2003-05-22 49152]
"HPHmon05"="C:\WINDOWS\system32\hphmon05.exe" [2003-05-22 483328]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2005-01-12 241664]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2004-03-01 200766]
"BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 368706]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-05-15 335872]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"MXOBG"="C:\WINDOWS\MXOALDR.EXE" [2005-09-04 94208]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-31 51048]
"RetroExpress"="C:\PROGRA~1\RETROS~1\RETROS~1.1\RetroExpress.exe" [2006-02-06 18583552]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2007-08-24 714608]
"Norton Save and Restore 2.0"="C:\Program Files\Norton Save and Restore\Agent\VProTray.exe" [2008-05-07 2037088]
"WinPatrol"="C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe" [2008-09-18 333120]
"AGRSMMSG"="AGRSMMSG.exe" [2003-05-06 C:\WINDOWS\AGRSMMSG.exe]

C:\Documents and Settings\Brian\Start Menu\Programs\Startup\
MR Tech Systray.lnk - C:\Program Files\MR Tech Systray\mrsystray.exe [2006-04-09 479232]
Say the Time 5.0.lnk - C:\Program Files\Say the Time\SayTime.exe [2007-05-17 90112]
Trillian.lnk - C:\Program Files\Trillian\trillian.exe [2007-12-11 1873280]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2004-06-02 565309]
hpoddt01.exe.lnk - C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe [2003-04-06 28672]
officejet 6100.lnk - C:\Program Files\HP\Digital Imaging\bin\hposol08.exe [2003-04-06 147456]
Say the Time.lnk - C:\Program Files\Say the Time\SayTime.exe [2007-05-17 90112]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoViewOnDrive"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "C:\Program Files\Qualcomm\Eudora\EuShlExt.dll" [2004-08-27 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll
"VIDC.YV12"= yv12vfw.dll
"mixer"= DrvTrNTm.dll
"wave"= DrvTrNTm.dll
"msacm.g723"= g723.acm
"vidc.I263"= I263_32.drv
"vidc.3IV2"= 3ivxVfWCodec_dec.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=C:\WINDOWS\pss\HotSync Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Brian^Start Menu^Programs^Startup^Event Reminder.lnk]
path=C:\Documents and Settings\Brian\Start Menu\Programs\Startup\Event Reminder.lnk
backup=C:\WINDOWS\pss\Event Reminder.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Brian^Start Menu^Programs^Startup^Shortcut to EzDesk.lnk]
path=C:\Documents and Settings\Brian\Start Menu\Programs\Startup\Shortcut to EzDesk.lnk
backup=C:\WINDOWS\pss\Shortcut to EzDesk.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Brian^Start Menu^Programs^Startup^Shortcut to TopDesk.lnk]
path=C:\Documents and Settings\Brian\Start Menu\Programs\Startup\Shortcut to TopDesk.lnk
backup=C:\WINDOWS\pss\Shortcut to TopDesk.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
–a—— 2005-02-17 00:11 49152 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2008-03-30 10:36 267048 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-03-28 23:37 413696 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TotalRecorderScheduler]
–a—— 2006-05-12 01:32 86016 C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
–a—— 2007-08-30 17:43 4670704 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" /background
"AIM"=C:\Program Files\AIM\aim.exe -cnetwait.odl
"MoneyAgent"="c:\Program Files\Microsoft Money\System\mnyexpr.exe"
"PhotoShow Deluxe Media Manager"=C:\PROGRA~1\Ahead\Ahead\data\Xtras\mssysmgr.exe
"MR Tech Systray"=C:\Program Files\MR Tech Systray\mrsystray.exe
"BackupNotify"=C:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
"LDM"=C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"RoxioEngineUtility"="C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
"RoxioDragToDisc"="C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
"RealTray"=C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
"TotalRecorderScheduler"="C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe"
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
"Norton Save and Restore 2.0"="C:\Program Files\Norton Save and Restore\Agent\VProTray.exe"
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
"SBC Yahoo! Connection Manager"=C:\WINDOWS\..\Program Files\SBC Yahoo!\Connection Manager\ConnectionManager.exe -Show
"MaxBlastMonitor.exe"=C:\Program Files\Maxtor\MaxBlast\MaxBlastMonitor.exe
"AcronisTimounterMonitor"=C:\Program Files\Maxtor\MaxBlast\TimounterMonitor.exe
"Acronis Scheduler2 Service"="C:\Program Files\Common Files\Maxtor\Schedule2\schedhlp.exe"
"NSWosCheck"="C:\Program Files\Norton SystemWorks Premier\osCheck.exe"
"mxomssmenu"="C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\America Online 9.0\\waol.exe"=
"C:\\WINDOWS\\system32\\mshta.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\Program Files\\Trillian\\trillian.exe"=
"C:\\Program Files\\ICQLite\\ICQLite.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\AIM6\\aim6.exe"=

R1 prcmondrv;prcmondrv;C:\WINDOWS\system32\drivers\prcmondrv1041.sys [2007-12-02 18432]
R2 LiveUpdate Notice;LiveUpdate Notice;C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-01-31 149864]
R2 Maxtor Sync Service;Maxtor Service;C:\Program Files\Maxtor\Sync\SyncServices.exe [2007-09-28 156976]
R2 Norton Save and Restore;Norton Save and Restore;C:\Program Files\Norton Save and Restore\Agent\VProSvc.exe [2008-05-07 3425632]
R2 ssoftnt4;ssoftnt4;C:\WINDOWS\system32\Drivers\ssoftnt4.sys [2004-05-21 114944]
R3 WBSD;Winbond Secure Digital Storage (SD/MMC) Device Driver;C:\WINDOWS\system32\Drivers\WBSD.SYS [2003-03-20 26240]
S3 Wdm1;USB Bridge Cable Driver;C:\WINDOWS\system32\Drivers\usbbc.sys [2001-01-07 15576]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{825b143a-a50a-11dc-b0a7-000e3573cf04}]
\Shell\AutoRun\command - F:\system\viewer\FlipVideoforPC.exe
\Shell\Flip Video for PC\command - F:\system\viewer\FlipVideoforPC.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a94ff810-1d83-11da-8576-000fb34eb6c1}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\boot.com e:
\Shell\Open\command - E:\resycled\boot.com e:

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Aim6 - (no file)
HKLM-Run-C:\WINDOWS\system32\kdihv.exe - C:\WINDOWS\system32\kdihv.exe
HKLM-Run-1A:Stardock TrayMonitor - (no file)
HKLM-Run-Say the Time - (no file)
HKLM-RunServices-1A:Stardock TrayMonitor - (no file)

.
——- Supplementary Scan ——-
.
R0 -: HKCU-Main,Start Page = hxxp://www.yahoo.com/
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid;=ie7&rls;=com.microsoft:en-US&ie;=utf8&oe;=utf8
R1 -: HKCU-Internet Settings,ProxyOverride = 127.0.0.1;*.local
R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s
O8 -: &AIM; Search - C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 -: &ICQ; Toolbar Search - C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 -: &Yahoo;! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 -: E&xport; to Microsoft Excel - C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 -: Send To &Bluetooth; - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 -: Yahoo! &Dictionary; - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 -: Yahoo! &Maps; - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O18 -: Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

O16 -: Microsoft XML Parser for Java - file://C:\WINDOWS\Java\classes\xmldso.cab
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd

O16 -: {FC11A119-C2F7-46F4-9E32-937ABA26816E} - file://D:\CDVIEWER\CdViewer.cab
C:\WINDOWS\Downloaded Program Files\cdviewer.inf
C:\WINDOWS\Downloaded Program Files\IR87.txt
C:\WINDOWS\Downloaded Program Files\IR6.txt
C:\WINDOWS\Downloaded Program Files\IR159.txt
C:\WINDOWS\Downloaded Program Files\IR149.txt
C:\WINDOWS\Downloaded Program Files\IR148.txt
C:\WINDOWS\Downloaded Program Files\IR144.txt
C:\WINDOWS\Downloaded Program Files\IR14.txt
C:\WINDOWS\Downloaded Program Files\IR138.txt
C:\WINDOWS\Downloaded Program Files\IR13.txt
C:\WINDOWS\Downloaded Program Files\IR127.txt
C:\WINDOWS\Downloaded Program Files\IR126.txt
C:\WINDOWS\Downloaded Program Files\IR110.txt
C:\WINDOWS\Downloaded Program Files\IR109.txt
C:\WINDOWS\Downloaded Program Files\IR101.txt
C:\WINDOWS\Downloaded Program Files\IR100.txt
C:\WINDOWS\Downloaded Program Files\dict.dat
C:\WINDOWS\Downloaded Program Files\unicows.dll
C:\WINDOWS\Downloaded Program Files\iiscomplib2.dll
C:\WINDOWS\Downloaded Program Files\picn6320.dll
C:\WINDOWS\Downloaded Program Files\picn9120.dll
C:\WINDOWS\Downloaded Program Files\picn9020.dll
C:\WINDOWS\Downloaded Program Files\picn20.dll
C:\WINDOWS\Downloaded Program Files\AmiDicomDirTreeView21.ocx
C:\WINDOWS\Downloaded Program Files\AmiViewerLite21.ocx
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-01 15:22:17
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe????????????P??|?????? ???B???????????????B? ??????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\CCPROXY.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.exe
C:\WINDOWS\system32\ssoftsrv.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Say the Time\SayTimeMain.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\PROGRA~1\RETROS~1\RETROS~1.1\Retrospect.exe
C:\PROGRA~1\RETROS~1\RETROS~1.1\retrorun.exe
C:\Program Files\Say the Time\stttsm.exe
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2008-10-01 15:34:50 - machine was rebooted
ComboFix-quarantined-files.txt 2008-10-01 22:34:35

Pre-Run: 12,711,792,640 bytes free
Post-Run: 12,561,408,000 bytes free

307 — E O F — 2008-09-10 10:33:31

THIS IS THE NEW HIJACKTHIS LOG:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:36:41 PM, on 10/1/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Maxtor\Sync\SyncServices.exe
C:\Program Files\Norton Save and Restore\Agent\VProSvc.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\ssoftsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe
C:\WINDOWS\system32\hphmon05.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\MXOALDR.EXE
C:\PROGRA~1\RETROS~1\RETROS~1.1\RetroExpress.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Norton Save and Restore\Agent\VProTray.exe
C:\Program Files\MR Tech Systray\mrsystray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\HP\Digital Imaging\bin\hposol08.exe
C:\Program Files\Say the Time\SayTimeMain.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\PROGRA~1\RETROS~1\RETROS~1.1\retrospect.exe
C:\PROGRA~1\RETROS~1\RETROS~1.1\retrorun.exe
C:\Program Files\Say the Time\stttsm.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo;! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: &Google; - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [HPHUPD05] C:\hp\tmp\src\psptr\Patch\Uninst\HPHupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [MXOBG] C:\WINDOWS\MXOALDR.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [RetroExpress] C:\PROGRA~1\RETROS~1\RETROS~1.1\RetroExpress.exe /h
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Norton Save and Restore 2.0] "C:\Program Files\Norton Save and Restore\Agent\VProTray.exe"
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKCU\..\Run: [MR Tech Systray] C:\Program Files\MR Tech Systray\mrsystray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
O4 - Startup: MR Tech Systray.lnk = C:\Program Files\MR Tech Systray\mrsystray.exe
O4 - Startup: Say the Time 5.0.lnk = C:\Program Files\Say the Time\SayTime.exe
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: officejet 6100.lnk = ?
O4 - Global Startup: Say the Time.lnk = C:\Program Files\Say the Time\SayTime.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &AIM; Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &ICQ; Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: &Yahoo;! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth; - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Yahoo! &Dictionary; - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps; - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=EN_US&c;=Q304&bd;=pavilion&pf;=laptop
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/as…abs/tgctlsr.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1201153945783
O16 - DPF: {FC11A119-C2F7-46F4-9E32-937ABA26816E} (AMI DicomDir TreeView Control 2.1) - file://D:\CDVIEWER\CdViewer.cab
O16 - DPF: {FC6703A7-5B7E-4f58-BE6D-2693AA3906AE} (HP Content Update) - http://h30043.www3.hp.com/netassist/en/che…hp.cab?1,0,0,94
O18 - Protocol: bw+0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files\Maxtor\Sync\SyncServices.exe
O23 - Service: Norton Save and Restore - Symantec Corporation - C:\Program Files\Norton Save and Restore\Agent\VProSvc.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Retrospect Express HD Helper (RetroExp Helper) - EMC Dantz - C:\PROGRA~1\RETROS~1\RETROS~1.1\rthlpsvc.exe
O23 - Service: Retrospect Express HD Launcher (RetroExpLauncher) - EMC Dantz - C:\PROGRA~1\RETROS~1\RETROS~1.1\retrorun.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Cryptainer service (ssoftservice) - Cypherix - C:\WINDOWS\SYSTEM32\ssoftsrv.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

–
End of file - 28136 bytes

THANKS ONCE AGAIN LDTATE! I leave around 8 pm tonight to go out of town so if there is more to do after that, I won't be back until Monday October 6 (so please don't close this string).

LDTate

Post #26October 1, 2008, 11:06 PM UTC

Please allow any changes

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

File::
E:\resycled\boot.com e
E:\resycled\boot.com 


Folder::
C:\Program Files\Viewpoint
C:\Program Files\Logitech\Desktop Messenger
C:\Program Files\Bonjour

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{825b143a-a50a-11dc-b0a7-000e3573cf04}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a94ff810-1d83-11da-8576-000fb34eb6c1}]

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.

Also please describe how your computer behaves at the moment.

letsee

Post #27October 2, 2008, 12:41 AM UTC

Uh oh. I hope I wasn't supposed to disable all the anti spyware (Norton) and anti malware (WinPatrol) and disconnect from the net again since you didn't say to do that. I just dragged that text file onto combofix and now it's doing it's scan. Also, when I dragged it there, Norton popped up with a warning asking if it was ok for ping.exe to access the net (and for combofix to access the net) and I said "yes" (correct?). Combofix came back with a message that there is a newer version (I dloaded from the place you linked) but I said "no" to that since I wasn't sure. I'll post after it's all done. Thanks!

LDTate

Post #28October 2, 2008, 12:43 AM UTC

You're doing it right.

letsee

Post #29October 2, 2008, 1:13 AM UTC

WinPatrol popped up and asked if a change for HOSTS in windows/system32 was ok and I said "yes." Here is the ComboFix log and then HiJackThis:

ComboFix 08-09-30.03 - Brian 2008-10-01 17:35:40.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.221 [GMT -7:00]Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Brian\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
E:\resycled\boot.com
E:\resycled\boot.com e
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Bonjour
C:\Program Files\Bonjour\About Bonjour.rtf
C:\Program Files\Bonjour\mdnsNSP.dll
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Logitech\Desktop Messenger
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Install\bwUnin.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Install\LiteInst.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Install\readme.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Install\win2000.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Plugins\Npavi32.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\backweb.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\backweb.tlb
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\BWCHelpr.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\BWCmndr.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\BWDocMapExt.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\bwfiles.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\bwlang.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\bwmib.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\BWOfflineUrlAccessor.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\BWPlugProtocol.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\BWPortalPlugin.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\BWScriptExt.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\bwsec.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\BWXMLOffline.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\bwxtext.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\clntutil.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\Cpuinf32.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\ding.wav
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\ClientRc.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\CommStatus\remedy_strings.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\CommStatus\remedy_strings_override.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\CommStatus\strings.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\CommStatus\strings_override.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\Navigation\navigation_strings.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\Navigation\navigation_strings_override.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\arrow_left.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\arrow_right.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\BULLET1.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\closing_the_notification_in.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\deleting_notifications.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\DIAMOND1.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\elements_of_the_statusbar.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\help.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\homebutton_gray.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image003.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image005.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image007.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image009.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image010.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image012.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image014.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image016.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image017.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image018.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image020.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image024.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image025.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\inbox.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\managing_notifications.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\marking_notifications.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\opening_the_notification_in.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\overview.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\preferences.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\ProactivePortal_Notification_Inbox_Help.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\refreshing_the_notification.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\setting_proactiveportal_not.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\sorting_information_in_the_.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\the_proactiveportal_notific.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\viewing_data_in_the_notific.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\viewing_full_stories.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\viewing_the_availability_of.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\viewing_the_notification_s_.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\viewing_the_notification_su.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\xbutton.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\notification_strings.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\notification_strings_override.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\resources\global_strings.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\resources\global_strings_override.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\arrow_left.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\arrow_right.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\BULLET1.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\button_edit.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\button_sendagain.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\closing_the_forms_outbox.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\deleting_form_submissions.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\details.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\DIAMOND1.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\form_submission_scheduling.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\help.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\home.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\homebutton_gray.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\how_does_proactiveportal_se.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\image003_forms.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\image005_forms.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\image007_forms.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\image011_forms.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\image013_forms.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\image014_forms.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\image016_forms.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\image019_forms.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\image020_forms.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\managing_form_submissions.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\marking_form_submissions.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\modifying_a_submitted_form.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\modifying_a_submitted_form.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\opening_the_forms_outbox.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\outbox.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\overview_1.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\preferences.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\ProactivePortal_Forms_Outbox_Help.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\refreshing_the_forms_outbox.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\ResponseAvailable.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\resubmitting_a_form.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\send_again.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\setting_form_submission_pre.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\sorting_form_submissions.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\SubmissionCompleted.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\SubmissionFailed.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\the_forms_outbox.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\the_progress_bar.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\the_status_bar.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\the_status_column.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\viewing_data_in_the_forms_o.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\viewing_form_submission_details.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\viewing_form_submission_res.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\viewing_form_submission_sta.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\viewing_submission_details.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\what_are_forms_.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\xbutton.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\submission_strings.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\submission_strings_override.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\registerRC.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\SpriteRC.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\UninstallRC.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\GAPlugProtocol.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\IAdHide.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\loading.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\pacsupport.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\CommStatus\functions.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\CommStatus\remedy_functions.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\background.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\BWPortalPlugin.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\CommProblem.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\CommProblem.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\CommStatus.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\decorations.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\disableforms.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\fillFormsForResubmit.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\navigation.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\navigation_override.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalBrokenLink.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalBrokenLink.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalClientInactive.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalFormError.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalFormStatus.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalFormSuccess.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalGoOnline.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalGoOnline.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalGoOnlineTesterMode.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalMsgConfig.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalNoClient.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalNoDoc.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalNoDoc.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalNotRegistered.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalNotRegistered.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalNotSupportedURL.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalNotSupportedURL.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalNoUI.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalNoUI.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalOldDoc.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalOldDoc.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\not.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\link_header.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\link_header_MO.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\notification.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\notification_override.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\notification_params.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\notification_params_override.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\NotificationDetailedStatus.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\NotificationMgrUI.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\offline_link.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\offline_link_MO.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\online_link.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\online_link_MO.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\preferences.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\priority.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\priority_header.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\priority_header_MO.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\utilities.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\OfflineMgr.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\OfflineSearch.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\preferences.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\arr_end.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\arr_end_mo.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\arr_end_na.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\arr_next.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\arr_next_mo.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\arr_next_na.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\arr_prev.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\arr_prev_mo.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\arr_prev_na.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\arr_start.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\arr_start_mo.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\arr_start_na.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\background.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\Exit.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\footer.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\global.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\global_override.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\global_params.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\global_params_override.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\header.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\Help.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\help_MO.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\helper.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\preferences.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\preferences.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\preferences_icon.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\preferences_MO.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\Propert.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\sort_ascending.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\sort_descending.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\table.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\tabs.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\utilities.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\sub.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\AddSubmissionMgrLink.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\FormDeleted.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\FormError.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\FormOK.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\FormPending.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\FormProcess.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\FormSuspended.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\FormUpload.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\preferences.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\ResponseAvialable.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\ResponseAvialable_MO.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\submission.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\submission_override.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\submission_params.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\submission_params_override.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\SubmissionCompleted.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\SubmissionCompleted_MO.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\SubmissionDetailedStatus.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\SubmissionFailed.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\SubmissionFailed_MO.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\SubmissionMgrUI.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\SubmissionStatus.inc
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\utilities.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\Pre6Import.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PUI_Launcher.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\register.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\Restart.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\runner.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\runner.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\Sprite6.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\wtsisctd.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\clasid.bak
C:\Program Files\Logitech\Desktop Messenger\8876480\enabled.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\background.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\browser.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\cert.db
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\chandir.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\chandir.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\chn.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\chn.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\DefPrefs.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\GenFlash\1\gen.bif
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\GenFlash\1\gen.bis
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\GenFlash\1\info.iad
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\InfoCenter.GIF
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\InfoCenter.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\main.wkg
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\UpgradePubKey.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\UsrPrefs.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\8876480\Brian\InstallerResult.log
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWCHelpr-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWCmndr-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWDocMapExt-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWfiles-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWOfflineUrlAccessor-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPortalPlugin-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\bwscriptext-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWXmlOffline-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrchs.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrcht.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrdan.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrdeu.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmresp.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrfin.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrfra.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrita.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrjpn.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrkor.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrnld.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrnor.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrptb.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrsve.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LiteInstActivator.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LiteInstActivator.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogiLdmC.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogiLdmW.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogiLdmW.tlb
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe.appid.8876480
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\Enable_OAS\enableOAS.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\AuthLib1.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\AuthLib2.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\CRules1.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\EventLib1.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\EventLib2.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\EventMgr1.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\EventMgr2.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\payload1.pub
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\RuleLib1.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\RuleLib2.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\SyncExt.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\readme.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\279\BWEvents.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\279\chninfo.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\279\ChnReg.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\279\segrules.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\279\Stats.tmp
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\279\UserProf.bak
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\279\UserProf.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\4a21\a9a3e36\_bwfindx.zip
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\4a21\a9a3e36\info.iad
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\4a21\a9a3e53\_bwfindx.zip
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\4a21\a9a3e53\info.iad
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\4a21\a9a3e54\_bwfindx.zip
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\4a21\a9a3e54\info.iad
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\4a21\a9a3ef0\_bwfindx.zip
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\4a21\a9a3ef0\info.iad
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\4a21\a9a3f17\_bwfindx.zip
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\4a21\a9a3f17\info.iad
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\4a21\BWEvents.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\4a21\chninfo.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\4a21\ChnReg.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\4a21\segrules.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\4a21\Stats.tmp
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\4a21\UserProf.bak
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\4a21\UserProf.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\background.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\browser.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\BWDocMap.pht
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\BWInfopakMap.pht
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\bwppipmd.xml
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\cache.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\cert.db
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\chandir.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\chandir.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\chn.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\chn.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\D0000000.FCS
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\DefPrefs.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\e92\BWEvents.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\e92\chninfo.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\e92\ChnReg.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\e92\segrules.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\e92\Stats.tmp
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\e92\submissions.old
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\e92\submissions.xml
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\e92\UserProf.bak
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\e92\UserProf.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\ed8\BWEvents.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\ed8\chninfo.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\ed8\ChnReg.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\ed8\segrules.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\ed8\Stats.tmp
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\ed8\UserProf.bak
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\ed8\UserProf.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\GenFlash\1\gen.bif
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\GenFlash\1\gen.bis
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\GenFlash\1\info.iad
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\HostCache.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\InfoCenter.GIF
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\InfoCenter.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\inuse.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\L0000001.FCS
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\L0000002.FCS
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\main.log
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\player.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\prs.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\prs.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\prs_die.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\prs_die.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\prs_dnd.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\prs_dnd.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\prs_ext.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\prs_ext.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\prs_rcv.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\prs_rcv.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\S0000000.FCS
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\S0000001.FCS
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\shopping.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\storydb.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\storydb.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\T3E21F43
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\T5AC8E8F
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\T62FAAE2
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\TAAEE775
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\UpgradePubKey.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\UsrPrefs.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Data\wg1.wkg
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Misc\Backup\chandir.da~
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Brian\Misc\Backup\chandir.id~
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\DataSets.ini
C:\Program Files\Viewpoint
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Viewpoint\Common\VistaBoot.sdll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\AxMetaStream.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\AxMetaStream_0305000D.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\ClassIDs.ini
C:\Program Files\Viewpoint\Viewpoint Experience Technology\ComponentMgr.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\ComponentMgr_0305000D.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\ComponentRegistry.ini
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\AOLArt.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\AOLShell.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\AOLUserShell.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\BlueStreak.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\DataTracking.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\GifReader.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\JpegReader.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\LensFlares.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\Mts2Reader.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\Mts3Reader.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\ObjectMovie.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\SceneComponent.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\ServiceComponent.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\SreeDMMX.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\SWFView.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VectorView.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMgr.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPExtras.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPSpeech.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPVideo.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPVideo2.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\WaveletReader.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\ZoomView.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\DownLoadHist.ini
C:\Program Files\Viewpoint\Viewpoint Experience Technology\HostRegistry.ini
C:\Program Files\Viewpoint\Viewpoint Experience Technology\MetaStreamID.ini
C:\Program Files\Viewpoint\Viewpoint Experience Technology\MtsAxInstaller.exe
C:\Program Files\Viewpoint\Viewpoint Experience Technology\MTSDownloadSites.txt
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents\AOLUserShell.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents\Cursors.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents\JpegReader.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents\Mts3Reader.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents\SceneComponent.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents\SreeDMMX.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents\SWFView.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents\VETScriptInterpreter.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents\VMPSpeech.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents\VMPVideo2.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.xpt
C:\Program Files\Viewpoint\Viewpoint Manager\VETScriptInterpreter.dll
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCP.cpl
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\s.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_header_av.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_header_cp.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_header_up.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_inner_bg.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_inner_bottom.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab_bg.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab1_off.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab1_on.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab2_off.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab2_on.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vwpt_logo.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\options.ini
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\viewpoint.ico
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\vmctrl.html
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgrCore.dll
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgrInstaller.exe

.
((((((((((((((((((((((((( Files Created from 2008-09-02 to 2008-10-02 )))))))))))))))))))))))))))))))
.

2008-10-01 11:43 . 2008-10-01 11:43 d——– C:\Documents and Settings\Brian\Application Data\WinPatrol
2008-10-01 11:42 . 2008-10-01 11:42 d——– C:\Program Files\BillP Studios
2008-10-01 11:16 . 2008-10-01 11:16 d——– C:\Documents and Settings\All Users\Application Data\Avg7
2008-10-01 03:35 . 2008-10-01 03:35 d——– C:\Documents and Settings\Brian\Application Data\Malwarebytes
2008-10-01 03:35 . 2008-09-10 00:03 17,200 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-10-01 03:34 . 2008-10-01 03:35 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-10-01 03:34 . 2008-10-01 03:34 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-01 03:34 . 2008-09-10 00:04 38,528 –a—— C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-01 03:30 . 2008-10-01 03:31 d——– C:\Program Files\CCleaner
2008-10-01 03:20 . 2008-10-01 03:20 d——– C:\Program Files\Trend Micro
2008-09-26 19:05 . 2008-09-26 19:06 133,909,668 –a—— C:\SYM_REGISTRY_BACKUP.reg
2008-09-23 01:53 . 2008-09-23 01:53 d——– C:\Documents and Settings\All Users\Application Data\SlySoft
2008-09-23 01:45 . 2008-09-23 01:45 d——– C:\Program Files\SlySoft
2008-09-20 03:44 . 2008-09-20 03:44 99,648 –a—— C:\WINDOWS\system32\drivers\AnyDVD.sys
2008-09-06 09:14 . 2008-09-06 09:14 d——– C:\Program Files\Opera

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-02 00:44 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-10-02 00:38 ——— d—–w C:\Program Files\Logitech
2008-10-01 22:43 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-10-01 22:31 ——— d—–w C:\Program Files\Trillian
2008-10-01 22:31 ——— d—–w C:\Documents and Settings\All Users\Application Data\RetroExp
2008-10-01 17:38 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-10-01 05:08 ——— d—–w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-09-27 04:59 ——— d—–w C:\Program Files\Norton Save and Restore
2008-09-24 07:58 ——— d—–w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-09-23 09:04 ——— d—–w C:\Documents and Settings\Brian\Application Data\RipIt4Me
2008-09-23 02:17 ——— d—–w C:\Program Files\Norton SystemWorks Premier
2008-08-31 19:32 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-15 04:21 ——— d—–w C:\Program Files\Common Files\Adobe
2008-08-15 04:17 ——— d—–w C:\Documents and Settings\Brian\Application Data\AdobeUM
2008-08-12 03:18 ——— d—–w C:\Program Files\Apple Software Update
2007-11-04 23:09 724,984 —-a-w C:\Documents and Settings\Brian\gotomypc_437.exe
2007-09-12 14:19 5,632 –sha-w C:\Program Files\Thumbs.db
2005-09-19 07:10 483,401 —-a-w C:\Documents and Settings\Brian\314_gotomypc.exe
2005-05-14 00:12 217,073 –sha-r C:\WINDOWS\meta4.exe
2005-10-24 18:13 66,560 –sha-r C:\WINDOWS\MOTA113.exe
2005-07-14 19:31 27,648 –sha-r C:\WINDOWS\system32\AVSredirect.dll
2005-06-26 22:32 616,448 –sha-r C:\WINDOWS\system32\cygwin1.dll
2005-06-22 05:37 45,568 –sha-r C:\WINDOWS\system32\cygz.dll
2006-05-03 10:06 163,328 –sha-r C:\WINDOWS\system32\flvDX.dll
2004-01-25 07:00 70,656 –sha-r C:\WINDOWS\system32\i420vfw.dll
2005-01-22 02:30 13,560 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2005-02-28 20:16 240,128 –sha-r C:\WINDOWS\system32\x.264.exe
2004-01-25 07:00 70,656 –sha-r C:\WINDOWS\system32\yv12vfw.dll
.

((((((((((((((((((((((((((((( snapshot@2008-10-01_15.34.04.43 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-10-02 00:53:51 16,384 —-atw C:\WINDOWS\temp\Perflib_Perfdata_fa8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MR Tech Systray"="C:\Program Files\MR Tech Systray\mrsystray.exe" [2006-04-09 479232]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
"AnyDVD"="C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe" [2008-09-20 2177984]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-04 98394]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-04 688218]
"Motive SmartBridge"="C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe" [2006-09-01 380928]
"IPInSightMonitor 02"="C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe" [2003-06-11 122880]
"IPInSightLAN 02"="C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" [2003-06-11 380928]
"HPHUPD05"="C:\hp\tmp\src\psptr\Patch\Uninst\HPHupd05.exe" [2003-05-22 49152]
"HPHmon05"="C:\WINDOWS\system32\hphmon05.exe" [2003-05-22 483328]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2005-01-12 241664]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2004-03-01 200766]
"BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 368706]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-05-15 335872]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"MXOBG"="C:\WINDOWS\MXOALDR.EXE" [2005-09-04 94208]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-31 51048]
"RetroExpress"="C:\PROGRA~1\RETROS~1\RETROS~1.1\RetroExpress.exe" [2006-02-06 18583552]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2007-08-24 714608]
"Norton Save and Restore 2.0"="C:\Program Files\Norton Save and Restore\Agent\VProTray.exe" [2008-05-07 2037088]
"WinPatrol"="C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe" [2008-09-18 333120]
"AGRSMMSG"="AGRSMMSG.exe" [2003-05-06 C:\WINDOWS\AGRSMMSG.exe]

C:\Documents and Settings\Brian\Start Menu\Programs\Startup\
MR Tech Systray.lnk - C:\Program Files\MR Tech Systray\mrsystray.exe [2006-04-09 479232]
Say the Time 5.0.lnk - C:\Program Files\Say the Time\SayTime.exe [2007-05-17 90112]
Trillian.lnk - C:\Program Files\Trillian\trillian.exe [2007-12-11 1873280]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2004-06-02 565309]
hpoddt01.exe.lnk - C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe [2003-04-06 28672]
officejet 6100.lnk - C:\Program Files\HP\Digital Imaging\bin\hposol08.exe [2003-04-06 147456]
Say the Time.lnk - C:\Program Files\Say the Time\SayTime.exe [2007-05-17 90112]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoViewOnDrive"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "C:\Program Files\Qualcomm\Eudora\EuShlExt.dll" [2004-08-27 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll
"VIDC.YV12"= yv12vfw.dll
"mixer"= DrvTrNTm.dll
"wave"= DrvTrNTm.dll
"msacm.g723"= g723.acm
"vidc.I263"= I263_32.drv
"vidc.3IV2"= 3ivxVfWCodec_dec.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=C:\WINDOWS\pss\HotSync Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Brian^Start Menu^Programs^Startup^Event Reminder.lnk]
path=C:\Documents and Settings\Brian\Start Menu\Programs\Startup\Event Reminder.lnk
backup=C:\WINDOWS\pss\Event Reminder.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Brian^Start Menu^Programs^Startup^Shortcut to EzDesk.lnk]
path=C:\Documents and Settings\Brian\Start Menu\Programs\Startup\Shortcut to EzDesk.lnk
backup=C:\WINDOWS\pss\Shortcut to EzDesk.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Brian^Start Menu^Programs^Startup^Shortcut to TopDesk.lnk]
path=C:\Documents and Settings\Brian\Start Menu\Programs\Startup\Shortcut to TopDesk.lnk
backup=C:\WINDOWS\pss\Shortcut to TopDesk.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
–a—— 2005-02-17 00:11 49152 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2008-03-30 10:36 267048 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-03-28 23:37 413696 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TotalRecorderScheduler]
–a—— 2006-05-12 01:32 86016 C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
–a—— 2007-08-30 17:43 4670704 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" /background
"AIM"=C:\Program Files\AIM\aim.exe -cnetwait.odl
"MoneyAgent"="c:\Program Files\Microsoft Money\System\mnyexpr.exe"
"PhotoShow Deluxe Media Manager"=C:\PROGRA~1\Ahead\Ahead\data\Xtras\mssysmgr.exe
"MR Tech Systray"=C:\Program Files\MR Tech Systray\mrsystray.exe
"BackupNotify"=C:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
"LDM"=C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"RoxioEngineUtility"="C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
"RoxioDragToDisc"="C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
"RealTray"=C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
"TotalRecorderScheduler"="C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe"
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
"Norton Save and Restore 2.0"="C:\Program Files\Norton Save and Restore\Agent\VProTray.exe"
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
"SBC Yahoo! Connection Manager"=C:\WINDOWS\..\Program Files\SBC Yahoo!\Connection Manager\ConnectionManager.exe -Show
"MaxBlastMonitor.exe"=C:\Program Files\Maxtor\MaxBlast\MaxBlastMonitor.exe
"AcronisTimounterMonitor"=C:\Program Files\Maxtor\MaxBlast\TimounterMonitor.exe
"Acronis Scheduler2 Service"="C:\Program Files\Common Files\Maxtor\Schedule2\schedhlp.exe"
"NSWosCheck"="C:\Program Files\Norton SystemWorks Premier\osCheck.exe"
"mxomssmenu"="C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\America Online 9.0\\waol.exe"=
"C:\\WINDOWS\\system32\\mshta.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\Program Files\\Trillian\\trillian.exe"=
"C:\\Program Files\\ICQLite\\ICQLite.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\AIM6\\aim6.exe"=

R1 prcmondrv;prcmondrv;C:\WINDOWS\system32\drivers\prcmondrv1041.sys [2007-12-02 18432]
R2 LiveUpdate Notice;LiveUpdate Notice;C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-01-31 149864]
R2 Maxtor Sync Service;Maxtor Service;C:\Program Files\Maxtor\Sync\SyncServices.exe [2007-09-28 156976]
R2 Norton Save and Restore;Norton Save and Restore;C:\Program Files\Norton Save and Restore\Agent\VProSvc.exe [2008-05-07 3425632]
R2 ssoftnt4;ssoftnt4;C:\WINDOWS\system32\Drivers\ssoftnt4.sys [2004-05-21 114944]
R3 WBSD;Winbond Secure Digital Storage (SD/MMC) Device Driver;C:\WINDOWS\system32\Drivers\WBSD.SYS [2003-03-20 26240]
S3 Wdm1;USB Bridge Cable Driver;C:\WINDOWS\system32\Drivers\usbbc.sys [2001-01-07 15576]

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-ViewMgr - C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-01 17:52:05
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe????????9?0?4?9??????? ???B???????????????B? ??????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\CCPROXY.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.exe
C:\WINDOWS\system32\ssoftsrv.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Say the Time\SayTimeMain.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\PROGRA~1\RETROS~1\RETROS~1.1\Retrospect.exe
C:\Program Files\Say the Time\stttsm.exe
C:\PROGRA~1\RETROS~1\RETROS~1.1\retrorun.exe
C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
.
**************************************************************************
.
Completion time: 2008-10-01 18:08:21 - machine was rebooted
ComboFix-quarantined-files.txt 2008-10-02 01:08:03
ComboFix2.txt 2008-10-01 22:34:52

Pre-Run: 12,442,513,408 bytes free
Post-Run: 12,337,795,072 bytes free

732 — E O F — 2008-09-10 10:33:31

HERE IS THE HIJACKTHIS LOG:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:11:08 PM, on 10/1/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Maxtor\Sync\SyncServices.exe
C:\Program Files\Norton Save and Restore\Agent\VProSvc.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\ssoftsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe
C:\WINDOWS\system32\hphmon05.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\MXOALDR.EXE
C:\PROGRA~1\RETROS~1\RETROS~1.1\RetroExpress.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Norton Save and Restore\Agent\VProTray.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\MR Tech Systray\mrsystray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\HP\Digital Imaging\bin\hposol08.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Say the Time\SayTimeMain.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Say the Time\stttsm.exe
C:\PROGRA~1\RETROS~1\RETROS~1.1\retrorun.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\CF32666.exe
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [HPHUPD05] C:\hp\tmp\src\psptr\Patch\Uninst\HPHupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [MXOBG] C:\WINDOWS\MXOALDR.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [RetroExpress] C:\PROGRA~1\RETROS~1\RETROS~1.1\RetroExpress.exe /h
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Norton Save and Restore 2.0] "C:\Program Files\Norton Save and Restore\Agent\VProTray.exe"
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKCU\..\Run: [MR Tech Systray] C:\Program Files\MR Tech Systray\mrsystray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
O4 - Startup: MR Tech Systray.lnk = C:\Program Files\MR Tech Systray\mrsystray.exe
O4 - Startup: Say the Time 5.0.lnk = C:\Program Files\Say the Time\SayTime.exe
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: officejet 6100.lnk = ?
O4 - Global Startup: Say the Time.lnk = C:\Program Files\Say the Time\SayTime.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q304&bd=pavilion&pf=laptop
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/as…abs/tgctlsr.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1201153945783
O16 - DPF: {FC11A119-C2F7-46F4-9E32-937ABA26816E} (AMI DicomDir TreeView Control 2.1) - file://D:\CDVIEWER\CdViewer.cab
O16 - DPF: {FC6703A7-5B7E-4f58-BE6D-2693AA3906AE} (HP Content Update) - http://h30043.www3.hp.com/netassist/en/che…hp.cab?1,0,0,94
O18 - Protocol: bw+0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw+0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw-0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw-0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw00 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw00s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw10 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw10s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw20 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw20s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw30 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw30s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw40 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw40s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw50 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw50s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw60 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw60s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw70 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw70s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw80 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw80s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw90 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw90s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwa0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwa0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwb0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwb0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwc0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwc0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwd0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwd0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwe0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwe0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwf0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwf0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwg0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwg0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwh0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwh0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwi0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwi0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwj0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwj0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwk0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwk0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwl0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwl0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwm0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwm0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwn0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwn0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwo0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwo0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwp0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwp0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwq0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwq0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwr0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwr0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bws0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bws0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwt0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwt0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwu0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwu0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwv0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwv0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bww0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bww0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwx0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwx0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwy0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwy0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwz0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwz0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: offline-8876480 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Bonjour Service - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files\Maxtor\Sync\SyncServices.exe
O23 - Service: Norton Save and Restore - Symantec Corporation - C:\Program Files\Norton Save and Restore\Agent\VProSvc.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Retrospect Express HD Helper (RetroExp Helper) - EMC Dantz - C:\PROGRA~1\RETROS~1\RETROS~1.1\rthlpsvc.exe
O23 - Service: Retrospect Express HD Launcher (RetroExpLauncher) - EMC Dantz - C:\PROGRA~1\RETROS~1\RETROS~1.1\retrorun.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Cryptainer service (ssoftservice) - Cypherix - C:\WINDOWS\SYSTEM32\ssoftsrv.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

–
End of file - 29453 bytes

Again…thanks so much LDTate!

LDTate

Post #30October 2, 2008, 1:20 AM UTC

Just some cleanup

Good job

Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
- [external image: Posted Image]
Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a checkmark/tick in the box on the left side on these:

O18 - Protocol: bw+0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw+0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw-0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw-0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw00 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw00s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw10 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw10s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw20 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw20s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw30 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw30s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw40 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw40s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw50 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw50s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw60 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw60s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw70 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw70s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw80 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw80s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw90 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw90s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwa0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwa0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwb0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwb0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwc0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwc0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwd0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwd0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwe0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwe0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwf0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwf0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwg0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwg0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwh0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwh0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwi0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwi0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwj0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwj0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwk0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwk0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwl0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwl0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwm0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwm0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwn0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwn0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwo0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwo0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwp0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwp0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwq0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwq0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwr0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwr0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bws0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bws0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwt0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwt0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwu0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwu0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwv0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwv0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bww0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bww0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwx0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwx0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwy0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwy0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwz0 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwz0s - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: offline-8876480 - {9EBB5D14-1F64-44A8-9A19-E3D0D9CCA466} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O23 - Service: Bonjour Service - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)

Close ALL windows and browsers except HijackThis and click "Fix checked"

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Malware or Virus or Spyware?

✨ Ask AI

Ask AI