[Resolved] Virtumonde.dll

Hi,

I wonder if someone could help? I am trying to help my friend fix her computer. This is her hijackthis log… She has two users on her start up so would both parts need checking seperately? I have run numerous virus checkers, vundo fix but it's still in the computer.

Thanks for any help


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:48:05, on 18/10/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\carpserv.exe
C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\Program Files\VoyagerTest\fts.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\Common Files\AOL\1192036992\ee\AOLSoftware.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\NETGEAR\WG511v2\wlancfg5.exe
C:\WINDOWS\System32\msiexec.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
c:\program files\common files\aol\1192036992\ee\services\antiSpywareApp\ver2_0_32_1\AOLSP Scheduler.exe
c:\program files\common files\aol\1192036992\ee\aolsoftware.exe
C:\Documents and Settings\wendy\Local Settings\Temporary Internet Files\Content.IE5\166GYTHT\HiJackThis[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.presario.net/scripts/redirec…rch&ap=b204
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://desktop.presario.net/scripts/redire…;lc=0809&ac
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://shell.windows.com/fileassoc/0409/xm…dir.asp?Ext=xls
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {2D9CE181-909A-49D6-9CED-0E17C8A03991} - C:\WINDOWS\system32\vtUlJbaw.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [QT4HPOT] C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1192036992\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [SpybotDeletingA2951] command /c del "C:\WINDOWS\system32\vtUlJbaw.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4209] cmd /c del "C:\WINDOWS\system32\vtUlJbaw.dll"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NETGEAR WG511v2 Wireless Assistant.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?0877dac07bb142e89d820b3439f7f8ac
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?0877dac07bb142e89d820b3439f7f8ac
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Facebo…toUploader5.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} -
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O20 - AppInit_DLLs: gapnkt.dll dmqsse.dll slkrjp.dll jlcdtq.dll qzqwjo.dll cihewc.dll xfiqht.dll tiftos.dll zvfrwg.dll lmwqkt.dll taszpk.dll cxphvk.dll qihfsg.dll zzjogu.dll pfcgsv.dll nxjknf.dll tznkoo.dll yashly.dll cphbdy.dll patebb.dll yasqmf.dll pgelss.dll qvzogb.dll nlpenc.dll beprmy.dll ayxvim.dll jsfivu.dll
O20 - Winlogon Notify: ddcBRklK - ddcBRklK.dll (file missing)
O20 - Winlogon Notify: jkkLCvtQ - jkkLCvtQ.dll (file missing)
O20 - Winlogon Notify: ljJDWMGA - ljJDWMGA.dll (file missing)
O20 - Winlogon Notify: urqQjhEw - urqQjhEw.dll (file missing)
O20 - Winlogon Notify: vtUlJbaw - C:\WINDOWS\SYSTEM32\vtUlJbaw.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

–
End of file - 10878 bytes

Thank you, this is the log


——————–\\ Lop S&D 4.2.4-5 XP/Vista

Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 1
X86-based PC ( Uniprocessor Free : Mobile Intel® Celeron® CPU 2.40GHz )
BIOS : PhoenixBIOS 4.0 Release 6.0
USER : wendy ( Administrator )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total : 37 Go Free : 28 Go
D:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 02-10-2008|23:42 )
Option : [1] ( 19/10/2008|17:49 )

——————–\\ Listing folders in APPLIC~1

[05/12/2002|08:43] C:\DOCUME~1\ADMINI~1\APPLIC~1\Adobe
[05/12/2002|17:15] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
[05/12/2002|08:43] C:\DOCUME~1\ADMINI~1\APPLIC~1\InterTrust
[05/12/2002|17:15] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

[07/10/2008|09:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[13/04/2008|18:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
[27/09/2008|16:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL Downloads
[14/09/2008|18:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ball mapi owns ping
[31/01/2008|23:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[28/09/2008|18:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
[13/04/2008|18:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Macromedia
[01/09/2008|09:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
[01/01/2008|16:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[25/10/2007|20:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
[19/10/2008|01:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Office Genuine Advantage
[29/10/2007|13:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
[05/12/2002|08:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
[16/10/2008|21:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
[04/08/2008|23:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
[28/09/2008|15:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[10/10/2007|16:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
[19/10/2008|01:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[30/12/2007|22:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar

[05/12/2002|08:43] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Adobe
[05/12/2002|17:15] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[05/12/2002|08:43] C:\DOCUME~1\DEFAUL~1\APPLIC~1\InterTrust
[05/12/2002|17:15] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[05/12/2002|17:15] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[05/12/2002|17:15] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

[22/06/2008|17:14] C:\DOCUME~1\Owner\APPLIC~1\Adobe
[13/04/2008|18:33] C:\DOCUME~1\Owner\APPLIC~1\AOL
[18/03/2008|17:55] C:\DOCUME~1\Owner\APPLIC~1\Google
[10/10/2007|16:36] C:\DOCUME~1\Owner\APPLIC~1\Help
[05/12/2002|17:15] C:\DOCUME~1\Owner\APPLIC~1\Identities
[05/12/2002|08:43] C:\DOCUME~1\Owner\APPLIC~1\InterTrust
[29/10/2007|13:37] C:\DOCUME~1\Owner\APPLIC~1\InterVideo
[01/02/2008|18:58] C:\DOCUME~1\Owner\APPLIC~1\Macromedia
[12/08/2008|21:15] C:\DOCUME~1\Owner\APPLIC~1\Microsoft
[27/09/2008|16:32] C:\DOCUME~1\Owner\APPLIC~1\Mozilla
[06/11/2007|21:22] C:\DOCUME~1\Owner\APPLIC~1\MSN6
[13/10/2008|22:52] C:\DOCUME~1\Owner\APPLIC~1\PokeDrvLong
[18/09/2008|19:22] C:\DOCUME~1\Owner\APPLIC~1\Symantec
[14/10/2007|22:22] C:\DOCUME~1\Owner\APPLIC~1\Template
[21/08/2008|19:38] C:\DOCUME~1\Owner\APPLIC~1\Viewpoint
[10/10/2007|16:32] C:\DOCUME~1\Owner\APPLIC~1\You've Got Pictures Screensaver

[15/10/2008|22:10] C:\DOCUME~1\wendy\APPLIC~1\Adobe
[27/11/2007|14:35] C:\DOCUME~1\wendy\APPLIC~1\AOL
[15/10/2008|22:22] C:\DOCUME~1\wendy\APPLIC~1\Google
[05/12/2002|17:15] C:\DOCUME~1\wendy\APPLIC~1\Identities
[05/12/2002|08:43] C:\DOCUME~1\wendy\APPLIC~1\InterTrust
[27/11/2007|14:38] C:\DOCUME~1\wendy\APPLIC~1\Macromedia
[19/10/2008|13:41] C:\DOCUME~1\wendy\APPLIC~1\Microsoft
[16/10/2008|12:01] C:\DOCUME~1\wendy\APPLIC~1\Mozilla
[13/10/2008|22:21] C:\DOCUME~1\wendy\APPLIC~1\PokeDrvLong
[16/10/2008|22:33] C:\DOCUME~1\wendy\APPLIC~1\Symantec
[19/10/2008|01:19] C:\DOCUME~1\wendy\APPLIC~1\Template

——————–\\ Scheduled Tasks located in C:\WINDOWS\Tasks

[19/10/2008 17:34][–a——] C:\WINDOWS\tasks\Check Updates for Windows Live Toolbar.job
[19/10/2008 12:21][–ah—–] C:\WINDOWS\tasks\SA.DAT
[29/08/2002 03:00][-rah—–] C:\WINDOWS\tasks\desktop.ini

——————–\\ MsgPlus SPONSOR INSTALLED !

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MsgPlus! Plugin]
"DisplayName"="Messenger Plus! 3 & Sponsor"


——————–\\ Listing Folders in C:\Program Files

[05/12/2002|08:43] C:\Program Files\Adobe
[30/12/2007|22:03] C:\Program Files\Adverts
[13/04/2008|18:14] C:\Program Files\AOL
[13/04/2008|18:40] C:\Program Files\AOL 9.0 VR
[18/10/2007|19:26] C:\Program Files\AOL Toolbar
[05/12/2002|08:35] C:\Program Files\ATI Technologies
[10/10/2007|16:28] C:\Program Files\BT Voyager 105 ADSL Modem
[05/12/2002|08:35] C:\Program Files\BTClick XP
[15/10/2008|22:47] C:\Program Files\CCleaner
[14/10/2008|00:04] C:\Program Files\Circle Developement
[28/09/2008|18:49] C:\Program Files\Common Files
[05/12/2002|08:44] C:\Program Files\COMPAQ
[05/12/2002|17:15] C:\Program Files\ComPlus Applications
[05/12/2002|08:27] C:\Program Files\CONEXANT
[05/12/2002|08:35] C:\Program Files\Freeserve
[18/03/2008|17:53] C:\Program Files\Google
[10/10/2007|18:17] C:\Program Files\Hewlett-Packard
[05/12/2002|08:37] C:\Program Files\hp photosmart
[05/12/2002|08:41] C:\Program Files\HPQ
[19/11/2007|11:06] C:\Program Files\InstallShield Installation Information
[05/12/2002|17:15] C:\Program Files\Internet Explorer
[05/10/2007|17:07] C:\Program Files\InterVideo
[13/03/2008|21:10] C:\Program Files\JPEG PC Camera
[28/09/2008|18:51] C:\Program Files\Lavasoft
[10/10/2007|16:32] C:\Program Files\Learn2.com
[05/12/2002|17:15] C:\Program Files\Messenger
[14/09/2008|18:56] C:\Program Files\Messenger Plus! Live
[30/12/2007|22:03] C:\Program Files\MessengerPlus! 3
[05/12/2002|08:34] C:\Program Files\Microsoft ActiveSync
[05/12/2002|17:15] C:\Program Files\microsoft frontpage
[05/12/2002|08:33] C:\Program Files\Microsoft Office
[05/12/2002|08:42] C:\Program Files\Microsoft Works
[05/12/2002|17:15] C:\Program Files\Movie Maker
[16/10/2008|12:08] C:\Program Files\Mozilla Firefox
[03/11/2007|10:22] C:\Program Files\MSN
[05/12/2002|17:15] C:\Program Files\MSN Gaming Zone
[14/09/2008|18:17] C:\Program Files\MSN Messenger
[20/11/2007|10:53] C:\Program Files\NETGEAR
[16/10/2007|11:17] C:\Program Files\NetMeeting
[07/10/2008|11:16] C:\Program Files\Norton 360
[21/11/2007|14:59] C:\Program Files\Norton Internet Security
[05/12/2002|17:15] C:\Program Files\Online Services
[15/10/2007|15:36] C:\Program Files\Outlook Express
[30/09/2008|15:31] C:\Program Files\PokeDrvLong
[10/10/2007|16:32] C:\Program Files\QuickTime
[10/10/2007|16:31] C:\Program Files\Real
[16/10/2008|00:52] C:\Program Files\Spybot - Search & Destroy
[30/05/2008|22:29] C:\Program Files\Symantec
[05/12/2002|08:41] C:\Program Files\Synaptics
[19/10/2008|12:27] C:\Program Files\Trend Micro
[05/12/2002|17:15] C:\Program Files\Uninstall Information
[10/10/2007|16:32] C:\Program Files\Viewpoint
[10/10/2007|16:29] C:\Program Files\VoyagerTest
[01/09/2008|09:17] C:\Program Files\Windows Live
[01/01/2008|16:09] C:\Program Files\Windows Live Favorites
[01/01/2008|16:11] C:\Program Files\Windows Live Toolbar
[20/11/2007|20:31] C:\Program Files\Windows Media Player
[05/12/2002|17:15] C:\Program Files\Windows NT
[10/10/2007|16:26] C:\Program Files\WindowsUpdate
[05/12/2002|17:15] C:\Program Files\xerox
[16/10/2008|02:15] C:\Program Files\XPMedic
[15/10/2008|22:45] C:\Program Files\Yahoo!

——————–\\ Listing Folders in C:\Program Files\Common Files

[10/10/2007|18:12] C:\Program Files\Common Files\Adobe
[13/04/2008|18:26] C:\Program Files\Common Files\AOL
[13/04/2008|18:26] C:\Program Files\Common Files\aolback
[13/04/2008|18:25] C:\Program Files\Common Files\aolshare
[05/12/2002|08:33] C:\Program Files\Common Files\Designer
[10/10/2007|16:29] C:\Program Files\Common Files\FTL Shared
[10/10/2007|18:17] C:\Program Files\Common Files\Hewlett-Packard
[10/10/2007|16:12] C:\Program Files\Common Files\InstallShield
[30/12/2007|22:19] C:\Program Files\Common Files\Microsoft Shared
[05/12/2002|17:15] C:\Program Files\Common Files\MSSoap
[10/10/2007|16:31] C:\Program Files\Common Files\Nullsoft
[05/12/2002|17:15] C:\Program Files\Common Files\ODBC
[10/10/2007|16:31] C:\Program Files\Common Files\Real
[10/10/2007|18:23] C:\Program Files\Common Files\Scanner
[05/12/2002|17:15] C:\Program Files\Common Files\Services
[05/12/2002|17:15] C:\Program Files\Common Files\SpeechEngines
[16/10/2008|16:03] C:\Program Files\Common Files\Symantec Shared
[15/10/2007|15:36] C:\Program Files\Common Files\System
[28/09/2008|18:49] C:\Program Files\Common Files\Wise Installation Wizard

——————–\\ Process

( 43 Processes )

IEXPLORE.EXE ~ [PID:3148]

——————–\\ Searching with S_Lop

No Lop folder found !

——————–\\ Searching for Lop Files - Folders

C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ball mapi owns ping
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ball mapi owns ping\Cash love.exe
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ball mapi owns ping\site the.exe
C:\Program Files\Adverts
C:\Program Files\Circle Developement
C:\DOCUME~1\wendy\Cookies\wendy@advertising[2].txt

——————–\\ Searching within the Registry

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

….. OK !

——————–\\ Checking the Hosts file

Hosts file CLEAN


——————–\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-19 17:55:11
Windows 5.1.2600 Service Pack 1 NTFS
scanning hidden processes …
scanning hidden files …
scan completed successfully
hidden processes: 0
hidden files: 0

——————–\\ Searching for other infections

C:\WINDOWS\system32\acfehkkj.ini
C:\WINDOWS\system32\acfehkkj.ini2
C:\WINDOWS\system32\AKUtDfhk.ini
C:\WINDOWS\system32\AKUtDfhk.ini2
C:\WINDOWS\system32\ayyJknmp.ini
C:\WINDOWS\system32\ayyJknmp.ini2
C:\WINDOWS\system32\cLoVDJjl.ini
C:\WINDOWS\system32\cLoVDJjl.ini2
C:\WINDOWS\system32\CMopYcdd.ini
C:\WINDOWS\system32\CMopYcdd.ini2
C:\WINDOWS\system32\DfeeMoYb.ini
C:\WINDOWS\system32\DfeeMoYb.ini2
C:\WINDOWS\system32\dgilmnmp.ini
C:\WINDOWS\system32\dgilmnmp.ini2
C:\WINDOWS\system32\dMWyFMoq.ini
C:\WINDOWS\system32\dMWyFMoq.ini2
C:\WINDOWS\system32\eghiSvut.ini
C:\WINDOWS\system32\eghiSvut.ini2
C:\WINDOWS\system32\eLknmnmp.ini
C:\WINDOWS\system32\eLknmnmp.ini2
C:\WINDOWS\system32\eLUxwyay.ini
C:\WINDOWS\system32\eLUxwyay.ini2
C:\WINDOWS\system32\eOnprBeg.ini
C:\WINDOWS\system32\eOnprBeg.ini2
C:\WINDOWS\system32\FfikSCfe.ini
C:\WINDOWS\system32\FfikSCfe.ini2
C:\WINDOWS\system32\FMoYIkkj.ini
C:\WINDOWS\system32\FMoYIkkj.ini2
C:\WINDOWS\system32\GNUwGNnn.ini
C:\WINDOWS\system32\GNUwGNnn.ini2
C:\WINDOWS\system32\HhNmnnpo.ini
C:\WINDOWS\system32\HhNmnnpo.ini2
C:\WINDOWS\system32\hhQrAJlm.ini
C:\WINDOWS\system32\hhQrAJlm.ini2
C:\WINDOWS\system32\hiRuvGgh.ini
C:\WINDOWS\system32\hiRuvGgh.ini2
C:\WINDOWS\system32\HjQXyyay.ini
C:\WINDOWS\system32\HjQXyyay.ini2
C:\WINDOWS\system32\HOYxwyay.ini
C:\WINDOWS\system32\HOYxwyay.ini2
C:\WINDOWS\system32\IhQYxGgh.ini
C:\WINDOWS\system32\IhQYxGgh.ini2
C:\WINDOWS\system32\iRutvyxx.ini
C:\WINDOWS\system32\iRutvyxx.ini2
C:\WINDOWS\system32\iSDNmVGh.ini
C:\WINDOWS\system32\iSDNmVGh.ini2
C:\WINDOWS\system32\JRYbaGgh.ini
C:\WINDOWS\system32\JRYbaGgh.ini2
C:\WINDOWS\system32\MnnUEfhk.ini
C:\WINDOWS\system32\MnnUEfhk.ini2
C:\WINDOWS\system32\Mnonmnnn.ini
C:\WINDOWS\system32\Mnonmnnn.ini2
C:\WINDOWS\system32\MUELRqss.ini
C:\WINDOWS\system32\MUELRqss.ini2
C:\WINDOWS\system32\noXxyGgh.ini
C:\WINDOWS\system32\noXxyGgh.ini2
C:\WINDOWS\system32\npAHNXbc.ini
C:\WINDOWS\system32\npAHNXbc.ini2
C:\WINDOWS\system32\orBddfii.ini
C:\WINDOWS\system32\orBddfii.ini2
C:\WINDOWS\system32\OrrCLkkj.ini
C:\WINDOWS\system32\OrrCLkkj.ini2
C:\WINDOWS\system32\pAbHNqss.ini
C:\WINDOWS\system32\pAbHNqss.ini2
C:\WINDOWS\system32\pVGNmnpo.ini
C:\WINDOWS\system32\pVGNmnpo.ini2
C:\WINDOWS\system32\pWaaGfhk.ini
C:\WINDOWS\system32\pWaaGfhk.ini2
C:\WINDOWS\system32\QBLVyJjl.ini
C:\WINDOWS\system32\QBLVyJjl.ini2
C:\WINDOWS\system32\qtELnUvw.ini
C:\WINDOWS\system32\qtELnUvw.ini2
C:\WINDOWS\system32\qtstttwa.ini
C:\WINDOWS\system32\qtstttwa.ini2
C:\WINDOWS\system32\QXELonnn.ini
C:\WINDOWS\system32\QXELonnn.ini2
C:\WINDOWS\system32\SuDJRqru.ini
C:\WINDOWS\system32\SuDJRqru.ini2
C:\WINDOWS\system32\tEgMonmp.ini
C:\WINDOWS\system32\tEgMonmp.ini2
C:\WINDOWS\system32\tuxFeMoq.ini
C:\WINDOWS\system32\tuxFeMoq.ini2
C:\WINDOWS\system32\UCdgNXbc.ini
C:\WINDOWS\system32\UCdgNXbc.ini2
C:\WINDOWS\system32\UxGjjjjl.ini
C:\WINDOWS\system32\UxGjjjjl.ini2
C:\WINDOWS\system32\VvvvGfhk.ini
C:\WINDOWS\system32\VvvvGfhk.ini2
C:\WINDOWS\system32\waaGNqru.ini
C:\WINDOWS\system32\waaGNqru.ini2
C:\WINDOWS\system32\WHjTBbIi.ini
C:\WINDOWS\system32\WHjTBbIi.ini2
C:\WINDOWS\system32\XEhOnnnn.ini
C:\WINDOWS\system32\XEhOnnnn.ini2
C:\WINDOWS\system32\XEMlmnmp.ini
C:\WINDOWS\system32\XEMlmnmp.ini2
C:\WINDOWS\system32\xFffOXyb.ini
C:\WINDOWS\system32\xFffOXyb.ini2
C:\WINDOWS\system32\xGjTBJlm.ini
C:\WINDOWS\system32\xGjTBJlm.ini2
C:\WINDOWS\system32\xIiSYcfe.ini
C:\WINDOWS\system32\xIiSYcfe.ini2
C:\WINDOWS\system32\yyHOnUvw.ini
C:\WINDOWS\system32\yyHOnUvw.ini2
==> VUNDO <==



[F:5][D:7]-> C:\DOCUME~1\wendy\LOCALS~1\Temp
[F:84][D:0]-> C:\DOCUME~1\wendy\Cookies
[F:981][D:4]-> C:\DOCUME~1\wendy\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 19/10/2008|18:03 - Option : [1]

——————–\\ Scan completed at 18:03:42

log.txt

Logfile of random's system information tool 1.04 (written by random/random)
Run by [removed] at 2008-10-19 20:56:48
Microsoft Windows XP Home Edition Service Pack 1
System drive C: has 29 GB (76%) free of 38 GB
Total RAM: 447 MB (47% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:00:34, on 19/10/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\System32\carpserv.exe
C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\Program Files\VoyagerTest\fts.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\Common Files\AOL\1192036992\ee\AOLSoftware.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\NETGEAR\WG511v2\wlancfg5.exe
c:\program files\common files\aol\1192036992\ee\services\antiSpywareApp\ver2_0_32_1\AOLSP Scheduler.exe
c:\program files\common files\aol\1192036992\ee\aolsoftware.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\wendy\Desktop\tools\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\wendy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.presario.net/scripts/redirec…rch≈=b204
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://desktop.presario.net/scripts/redire…;lc=0809∾
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://shell.windows.com/fileassoc/0409/xm…dir.asp?Ext=xls
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {2D9CE181-909A-49D6-9CED-0E17C8A03991} - C:\WINDOWS\system32\vtUlJbaw.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {EDA3F8C9-8D27-47ED-8E87-7F4BA676124E} - C:\WINDOWS\System32\geBstsrq.dll (file missing)
O3 - Toolbar: &Radio; - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google; - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [QT4HPOT] C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1192036992\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NETGEAR WG511v2 Wireless Assistant.lnk = ?
O8 - Extra context menu item: &Windows; Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live; Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?0877dac07bb142e89d820b3439f7f8ac
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?0877dac07bb142e89d820b3439f7f8ac
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Facebo…toUploader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} -
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O20 - AppInit_DLLs: gapnkt.dll dmqsse.dll slkrjp.dll jlcdtq.dll qzqwjo.dll cihewc.dll xfiqht.dll tiftos.dll zvfrwg.dll lmwqkt.dll taszpk.dll cxphvk.dll qihfsg.dll zzjogu.dll pfcgsv.dll nxjknf.dll tznkoo.dll yashly.dll cphbdy.dll patebb.dll yasqmf.dll pgelss.dll qvzogb.dll nlpenc.dll beprmy.dll ayxvim.dll jsfivu.dll
O20 - Winlogon Notify: ddcBRklK - ddcBRklK.dll (file missing)
O20 - Winlogon Notify: jkkLCvtQ - jkkLCvtQ.dll (file missing)
O20 - Winlogon Notify: ljJDWMGA - ljJDWMGA.dll (file missing)
O20 - Winlogon Notify: urqQjhEw - urqQjhEw.dll (file missing)
O20 - Winlogon Notify: vtUlJbaw - C:\WINDOWS\SYSTEM32\vtUlJbaw.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

–
End of file - 10631 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Check Updates for Windows Live Toolbar.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-04-16 37808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2D9CE181-909A-49D6-9CED-0E17C8A03991}]
C:\WINDOWS\system32\vtUlJbaw.dll [2008-09-23 29184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-08-31 322368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - c:\program files\google\googletoolbar1.dll [2008-01-31 2403392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll [2008-09-14 737776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]
Windows Live Toolbar Helper - C:\Program Files\Windows Live Toolbar\msntb.dll [2007-10-19 546320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EDA3F8C9-8D27-47ED-8E87-7F4BA676124E}]
C:\WINDOWS\System32\geBstsrq.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E718888-423F-11D2-876E-00A0C9082467} - &Radio; - C:\WINDOWS\System32\msdxm.ocx [2002-08-29 842268]
{4982D40A-C53B-4615-B15B-B5B5E98D167C} - AOL Toolbar - C:\Program Files\AOL Toolbar\toolbar.dll [2004-03-22 385024]
{90222687-F593-4738-B738-FBEE9C7B26DF} - Show Norton Toolbar - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll [2007-02-19 609424]
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - Windows Live Toolbar - C:\Program Files\Windows Live Toolbar\msntb.dll [2007-10-19 546320]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google; - c:\program files\google\googletoolbar1.dll [2008-01-31 2403392]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ATIModeChange"=C:\WINDOWS\system32\Ati2mdxx.exe [2002-08-15 28672]
"CARPService"=C:\WINDOWS\system32\carpserv.exe [2002-11-05 4608]
"PreloadApp"=c:\hp\drivers\printers\photosmart\hphprld.exe [2001-12-12 36864]
"srmclean"=C:\Cpqs\Scom\srmclean.exe [2001-07-24 36864]
"Display Settings"=C:\Program Files\HPQ\Notebook Utilities\hptasks.exe [2002-08-15 45056]
"QT4HPOT"=C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE [2002-10-14 98304]
"SynTPLpr"=C:\Program Files\Synaptics\SynTP\SynTPLpr.exe [2002-09-09 126976]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2002-09-09 557056]
"Cpqset"=C:\Program Files\HPQ\Default Settings\cpqset.exe [2002-10-23 176197]
"DSLSTATEXE"=C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe [2003-06-28 1658965]
"DSLAGENTEXE"=C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe [2003-08-19 16384]
"%FP%Friendly fts.exe"=C:\Program Files\VoyagerTest\fts.exe [2003-05-06 72192]
"HPDJ Taskbar Utility"=C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe [2003-03-09 188416]
"AOLDialer"=C:\Program Files\Common Files\AOL\ACS\AOLDial.exe [2006-12-04 71216]
"HostManager"=C:\Program Files\Common Files\AOL\1192036992\ee\AOLSoftware.exe [2006-11-17 50736]
"ccApp"=C:\Program Files\Common Files\Symantec Shared\ccApp.exe [2007-01-10 115816]
"Symantec PIF AlertEng"=C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2008-01-29 583048]
"ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2002-08-14 290816]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3]
C:\Program Files\MessengerPlus! 3\MsgPlus.exe [2007-12-30 190024]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
C:\Program Files\MSN Messenger\msnmsgr.exe [2007-01-19 5674352]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe [2007-10-10 98304]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
C:\Program Files\Real\RealPlayer\RealPlay.exe [2007-10-10 26112]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-04-15 68856]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
hpoddt01.exe.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE
NETGEAR WG511v2 Wireless Assistant.lnk - C:\WINDOWS\Installer\{B93D24B3-928D-4805-B379-4AA47CB3794E}\NewShortcut1_1.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="gapnkt.dll dmqsse.dll slkrjp.dll jlcdtq.dll qzqwjo.dll cihewc.dll xfiqht.dll tiftos.dll zvfrwg.dll lmwqkt.dll taszpk.dll cxphvk.dll qihfsg.dll zzjogu.dll pfcgsv.dll nxjknf.dll tznkoo.dll yashly.dll cphbdy.dll patebb.dll yasqmf.dll pgelss.dll qvzogb.dll nlpenc.dll beprmy.dll ayxvim.dll jsfivu.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ddcBRklK]
ddcBRklK.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\jkkLCvtQ]
jkkLCvtQ.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ljJDWMGA]
ljJDWMGA.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\urqQjhEw]
urqQjhEw.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\vtUlJbaw]
C:\WINDOWS\system32\vtUlJbaw.dll [2008-09-23 29184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5F02D04B-50B3-4A07-BA6E-DAB1562CE975}"= []
"{D2376FB3-3D0D-414D-83AA-3AD6AD6B111F}"= []
"{0BB6EF78-FFC8-4F7A-BD2C-09DA1169A4B5}"= []
"{74D1CB04-C4AE-4147-8337-5C66A473B66E}"= []
"{81D6FDCB-651D-47E2-9538-16BD14659205}"= []
"{2D9CE181-909A-49D6-9CED-0E17C8A03991}"=C:\WINDOWS\system32\vtUlJbaw.dll [2008-09-23 29184]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
C:\WINDOWS\System32\geBstsrq

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======List of files/folders created in the last 1 months======

2008-10-19 20:56:48 —-D—- C:\rsit
2008-10-19 18:59:52 —-A—- C:\WINDOWS\System32\lhopbyff.dll
2008-10-19 18:57:05 —-ASH—- C:\WINDOWS\System32\ucbscygo.ini
2008-10-19 18:57:01 —-A—- C:\WINDOWS\System32\ogycsbcu.dll
2008-10-19 18:56:58 —-A—- C:\WINDOWS\System32\tqaubbpe.dll
2008-10-19 18:56:10 —-ASH—- C:\WINDOWS\System32\qrstsBeg.ini2
2008-10-19 18:56:10 —-ASH—- C:\WINDOWS\System32\qrstsBeg.ini
2008-10-19 18:56:04 —-A—- C:\WINDOWS\System32\_geBstsrq.dll
2008-10-19 18:40:07 —-D—- C:\_OTMoveIt
2008-10-19 17:48:59 —-A—- C:\lopR.txt
2008-10-19 17:47:55 —-D—- C:\Lop SD
2008-10-19 12:33:45 —-ASH—- C:\WINDOWS\System32\whssnfwx.ini
2008-10-19 12:33:36 —-N—- C:\WINDOWS\System32\xwfnsshw.dll
2008-10-19 12:30:25 —-A—- C:\WINDOWS\System32\jetdorvc.dll
2008-10-19 12:28:08 —-A—- C:\WINDOWS\System32\hjffxtye.dll
2008-10-19 12:27:55 —-D—- C:\Program Files\Trend Micro
2008-10-19 12:27:11 —-A—- C:\WINDOWS\System32\_urqRJDuS.dll
2008-10-19 01:19:27 —-D—- C:\Documents and Settings\wendy\Application Data\Template
2008-10-19 01:04:23 —-D—- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-10-19 01:03:59 —-D—- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2008-10-19 01:01:15 —-ASH—- C:\WINDOWS\System32\vjnmkjrr.ini
2008-10-19 01:01:05 —-A—- C:\WINDOWS\System32\rrjkmnjv.dll
2008-10-19 00:55:42 —-A—- C:\WINDOWS\System32\ejlvoawe.dll
2008-10-19 00:55:39 —-A—- C:\WINDOWS\System32\vxninuhd.dll
2008-10-19 00:54:35 —-A—- C:\WINDOWS\System32\_ljJDVoLc.dll
2008-10-18 23:04:17 —-ASH—- C:\WINDOWS\System32\wdwdkfgn.ini
2008-10-18 23:04:12 —-A—- C:\WINDOWS\System32\ngfkdwdw.dll
2008-10-18 23:02:12 —-A—- C:\WINDOWS\System32\nigqmxxv.dll
2008-10-18 23:01:41 —-A—- C:\WINDOWS\System32\rcdmmfgq.dll
2008-10-18 23:00:44 —-A—- C:\WINDOWS\System32\_efcYSiIx.dll
2008-10-17 01:55:28 —-ASH—- C:\WINDOWS\System32\auqbflmy.ini
2008-10-17 01:53:49 —-A—- C:\WINDOWS\System32\tbrqlfvc.dll
2008-10-17 00:11:00 —-ASH—- C:\WINDOWS\System32\ltrwmcvd.ini
2008-10-17 00:09:12 —-A—- C:\WINDOWS\System32\dvhfctes.dll
2008-10-17 00:08:27 —-A—- C:\WINDOWS\System32\niknthdt.dll
2008-10-16 22:05:06 —-A—- C:\WINDOWS\System32\apeddbmv.dll
2008-10-16 22:02:22 —-ASH—- C:\WINDOWS\System32\wyrbalcv.ini
2008-10-16 22:00:22 —-A—- C:\WINDOWS\System32\ejuxafwm.dll
2008-10-16 11:59:52 —-D—- C:\Documents and Settings\wendy\Application Data\Mozilla
2008-10-16 03:32:23 —-A—- C:\WINDOWS\wininit.ini
2008-10-16 02:15:29 —-D—- C:\Program Files\XPMedic
2008-10-16 00:54:32 —-D—- C:\VundoFix Backups
2008-10-16 00:54:32 —-A—- C:\VundoFix.txt
2008-10-15 23:00:29 —-D—- C:\Program Files\Spybot - Search & Destroy
2008-10-15 23:00:29 —-D—- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-15 22:44:59 —-D—- C:\Program Files\Yahoo!
2008-10-15 22:44:03 —-D—- C:\Program Files\CCleaner
2008-10-15 22:16:12 —-ASH—- C:\WINDOWS\System32\abulttmh.ini
2008-10-15 22:11:36 —-A—- C:\WINDOWS\System32\hyxllgkq.dll
2008-10-15 22:06:32 —-D—- C:\Documents and Settings\wendy\Application Data\Google
2008-10-14 18:12:59 —-ASH—- C:\WINDOWS\System32\wflsfcnq.ini
2008-10-14 18:05:40 —-A—- C:\WINDOWS\System32\wcmitrpq.dll
2008-10-14 18:03:37 —-A—- C:\WINDOWS\System32\_nnnmnonM.dll
2008-10-14 16:49:06 —-ASH—- C:\WINDOWS\System32\errbidqp.ini
2008-10-14 16:44:03 —-A—- C:\WINDOWS\System32\jblclbmw.dll
2008-10-14 16:39:47 —-A—- C:\WINDOWS\System32\_qoMeFxut.dll
2008-10-14 08:25:00 —-ASH—- C:\WINDOWS\System32\wuhiwgpw.ini
2008-10-14 08:23:30 —-A—- C:\WINDOWS\System32\jxrjxpkc.dll
2008-10-13 21:40:14 —-ASH—- C:\WINDOWS\System32\mvnlrpcv.ini
2008-10-13 19:34:48 —-ASH—- C:\WINDOWS\System32\fjcplkfj.ini
2008-10-13 19:30:49 —-A—- C:\WINDOWS\System32\djislvnd.dll
2008-10-13 14:39:12 —-ASH—- C:\WINDOWS\System32\pidwcswn.ini
2008-10-13 14:35:41 —-A—- C:\WINDOWS\System32\iqwddpog.dll
2008-10-12 19:02:03 —-ASH—- C:\WINDOWS\System32\nuhjjboh.ini
2008-10-12 18:56:57 —-A—- C:\WINDOWS\System32\kutyyeuk.dll
2008-10-12 18:54:52 —-A—- C:\WINDOWS\System32\_khfGaaWp.dll
2008-10-11 21:34:51 —-ASH—- C:\WINDOWS\System32\lbgtugwr.ini
2008-10-11 21:27:20 —-A—- C:\WINDOWS\System32\mjpotcdd.dll
2008-10-10 17:29:28 —-ASH—- C:\WINDOWS\System32\wcxxcrds.ini
2008-10-10 17:25:28 —-A—- C:\WINDOWS\System32\forneupx.dll
2008-10-10 15:16:56 —-ASH—- C:\WINDOWS\System32\stgcypfu.ini
2008-10-10 15:10:17 —-A—- C:\WINDOWS\System32\laircaqo.dll
2008-10-10 13:27:23 —-ASH—- C:\WINDOWS\System32\avwcqjwr.ini
2008-10-10 13:21:16 —-A—- C:\WINDOWS\System32\iceofnwr.dll
2008-10-08 09:52:40 —-ASH—- C:\WINDOWS\System32\oghxfdul.ini
2008-10-08 09:43:04 —-A—- C:\WINDOWS\System32\ohsrqqmi.dll
2008-10-07 19:49:03 —-ASH—- C:\WINDOWS\System32\gmksflic.ini
2008-10-07 19:47:51 —-A—- C:\WINDOWS\System32\ulwdhhey.dll
2008-10-07 18:38:45 —-ASH—- C:\WINDOWS\System32\sgsnfarm.ini
2008-10-07 09:33:37 —-A—- C:\WINDOWS\System32\GEARAspi.dll
2008-10-07 09:32:00 —-D—- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-07 07:52:58 —-ASH—- C:\WINDOWS\System32\pbgtjthv.ini
2008-10-07 07:48:31 —-A—- C:\WINDOWS\System32\ryuqhxpv.dll
2008-10-06 17:56:26 —-ASH—- C:\WINDOWS\System32\bfkinpqs.ini
2008-10-06 17:51:04 —-A—- C:\WINDOWS\System32\ymolmfrs.dll
2008-10-06 16:27:24 —-ASH—- C:\WINDOWS\System32\ufnvluii.ini
2008-10-06 16:22:35 —-A—- C:\WINDOWS\System32\jpptrfbd.dll
2008-10-05 20:35:11 —-ASH—- C:\WINDOWS\System32\sqbnamgb.ini
2008-10-05 20:32:03 —-A—- C:\WINDOWS\System32\tpbjwsrp.dll
2008-10-04 10:31:27 —-ASH—- C:\WINDOWS\System32\dirlyoxo.ini
2008-10-04 09:00:22 —-ASH—- C:\WINDOWS\System32\gxtnqlqy.ini
2008-10-04 08:52:31 —-A—- C:\WINDOWS\System32\nwetgfgw.dll
2008-10-04 08:05:24 —-ASH—- C:\WINDOWS\System32\yqwtwies.ini
2008-10-04 07:59:34 —-A—- C:\WINDOWS\System32\gwsiwxhm.dll
2008-10-03 18:08:24 —-ASH—- C:\WINDOWS\System32\ndqtulhp.ini
2008-10-03 18:03:13 —-A—- C:\WINDOWS\System32\vsyiqcxe.dll
2008-10-03 12:34:51 —-ASH—- C:\WINDOWS\System32\xllycbie.ini
2008-10-03 12:28:16 —-A—- C:\WINDOWS\System32\ddpxkxeb.dll
2008-10-02 15:28:02 —-ASH—- C:\WINDOWS\System32\pmagpebx.ini
2008-10-02 15:24:05 —-A—- C:\WINDOWS\System32\dvaayvaf.dll
2008-10-02 14:10:09 —-ASH—- C:\WINDOWS\System32\ppqxftyq.ini
2008-10-02 10:07:30 —-ASH—- C:\WINDOWS\System32\imotuxhq.ini
2008-10-02 10:06:01 —-A—- C:\WINDOWS\System32\quixyhmp.dll
2008-10-02 09:38:25 —-D—- C:\Program Files\Mozilla Firefox
2008-10-02 08:49:05 —-ASH—- C:\WINDOWS\System32\yoxhegrh.ini
2008-10-01 17:41:23 —-ASH—- C:\WINDOWS\System32\elwhvdhy.ini
2008-10-01 17:38:40 —-A—- C:\WINDOWS\System32\bgtjbbji.dll
2008-09-30 20:46:50 —-ASH—- C:\WINDOWS\System32\urbikpuc.ini
2008-09-30 20:37:46 —-A—- C:\WINDOWS\System32\rredtrqx.dll
2008-09-30 19:37:31 —-ASH—- C:\WINDOWS\System32\upwtboak.ini
2008-09-30 19:30:42 —-A—- C:\WINDOWS\System32\orksoiot.dll
2008-09-30 15:36:57 —-ASH—- C:\WINDOWS\System32\ejvlubth.ini
2008-09-30 15:31:31 —-D—- C:\Program Files\PokeDrvLong
2008-09-30 15:25:37 —-A—- C:\WINDOWS\System32\ssinyihd.dll
2008-09-29 16:54:05 —-ASH—- C:\WINDOWS\System32\yekrwvuq.ini
2008-09-29 16:46:02 —-A—- C:\WINDOWS\System32\cplrwxmn.dll
2008-09-28 18:49:47 —-D—- C:\Program Files\Common Files\Wise Installation Wizard
2008-09-28 18:14:43 —-ASH—- C:\WINDOWS\System32\glvdnbvf.ini
2008-09-28 18:08:42 —-A—- C:\WINDOWS\System32\yfnmplqu.dll
2008-09-28 18:02:19 —-A—- C:\WINDOWS\System32\_yaywxYOH.dll
2008-09-28 16:09:46 —-D—- C:\Program Files\Lavasoft
2008-09-28 16:09:43 —-D—- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-09-28 15:12:45 —-AD—- C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-28 15:04:46 —-D—- C:\Documents and Settings\wendy\Application Data\PokeDrvLong
2008-09-28 10:42:45 —-ASH—- C:\WINDOWS\System32\udsdkkkq.ini
2008-09-28 10:30:22 —-A—- C:\WINDOWS\System32\eplhfxai.dll
2008-09-28 10:28:34 —-A—- C:\WINDOWS\System32\_nnnoLEXQ.dll
2008-09-27 15:42:44 —-ASH—- C:\WINDOWS\System32\trgdyrfk.ini
2008-09-27 15:37:22 —-A—- C:\WINDOWS\System32\wftxarpu.dll
2008-09-27 15:36:32 —-A—- C:\WINDOWS\System32\_hgGvuRih.dll
2008-09-27 13:57:02 —-ASH—- C:\WINDOWS\System32\cgbxxsek.ini
2008-09-27 13:45:51 —-A—- C:\WINDOWS\System32\rtcvhngv.dll
2008-09-27 13:44:41 —-A—- C:\WINDOWS\System32\_jkkIYoMF.dll
2008-09-26 18:30:02 —-ASH—- C:\WINDOWS\System32\gcrlunan.ini
2008-09-26 18:23:49 —-A—- C:\WINDOWS\System32\thvsoryr.dll
2008-09-26 18:20:27 —-A—- C:\WINDOWS\System32\_ssqNHbAp.dll
2008-09-26 17:33:30 —-ASH—- C:\WINDOWS\System32\fwtemkjb.ini
2008-09-26 17:27:18 —-A—- C:\WINDOWS\System32\fvxeyutl.dll
2008-09-26 17:24:02 —-A—- C:\WINDOWS\System32\_wvUnOHyy.dll
2008-09-25 15:51:02 —-ASH—- C:\WINDOWS\System32\kvxpskut.ini
2008-09-25 15:47:58 —-A—- C:\WINDOWS\System32\lyilqgwl.dll
2008-09-25 15:44:32 —-A—- C:\WINDOWS\System32\_geBrpnOe.dll
2008-09-25 14:06:56 —-A—- C:\WINDOWS\System32\wjbklqon.dll
2008-09-25 14:03:37 —-A—- C:\WINDOWS\System32\_nnnnOhEX.dll
2008-09-24 21:09:30 —-ASH—- C:\WINDOWS\System32\fqwotuas.ini
2008-09-24 21:00:26 —-A—- C:\WINDOWS\System32\vddrpaft.dll
2008-09-24 20:59:18 —-A—- C:\WINDOWS\System32\rttauqib.dll
2008-09-24 20:57:03 —-A—- C:\WINDOWS\System32\_wvUnLEtq.dll
2008-09-24 19:31:59 —-ASH—- C:\WINDOWS\System32\wxdyaqow.ini
2008-09-24 19:22:49 —-A—- C:\WINDOWS\System32\lpvxfcqb.dll
2008-09-24 19:21:41 —-A—- C:\WINDOWS\System32\gwhajmrq.dll
2008-09-24 19:19:11 —-A—- C:\WINDOWS\System32\_pmnkJyya.dll
2008-09-23 20:45:05 —-A—- C:\WINDOWS\System32\vtUlJbaw.dll

======List of files/folders modified in the last 1 months======

2008-10-19 20:57:34 —-D—- C:\WINDOWS\Prefetch
2008-10-19 19:00:21 —-D—- C:\WINDOWS\system32
2008-10-19 18:57:53 —-D—- C:\WINDOWS\Temp
2008-10-19 18:56:30 —-A—- C:\WINDOWS\System32\7618efd5-.txt
2008-10-19 18:49:27 —-A—- C:\WINDOWS\SchedLgU.Txt
2008-10-19 18:40:18 —-D—- C:\Program Files
2008-10-19 13:41:07 —-SD—- C:\Documents and Settings\wendy\Application Data\Microsoft
2008-10-19 13:40:43 —-D—- C:\WINDOWS\System32\CatRoot2
2008-10-19 13:36:31 —-SD—- C:\WINDOWS\Downloaded Program Files
2008-10-19 12:53:22 —-SHD—- C:\WINDOWS\Installer
2008-10-16 23:13:41 —-D—- C:\WINDOWS
2008-10-16 22:33:06 —-D—- C:\Documents and Settings\wendy\Application Data\Symantec
2008-10-16 16:03:04 —-D—- C:\Program Files\Common Files\Symantec Shared
2008-10-16 02:58:29 —-SHD—- C:\System Volume Information
2008-10-16 02:58:29 —-D—- C:\WINDOWS\System32\Restore
2008-10-15 22:49:08 —-D—- C:\WINDOWS\Debug
2008-10-15 22:10:51 —-D—- C:\Documents and Settings\wendy\Application Data\Adobe
2008-10-15 21:45:41 —-D—- C:\Documents and Settings
2008-10-14 18:28:31 —-A—- C:\WINDOWS\win.ini
2008-10-10 13:42:49 —-A—- C:\WINDOWS\ModemLog_Conexant 56K ACLink Modem.txt
2008-10-07 11:16:04 —-D—- C:\Program Files\Norton 360
2008-10-07 09:37:18 —-D—- C:\Config.Msi
2008-10-07 09:34:59 —-D—- C:\WINDOWS\System32\drivers
2008-10-07 09:34:51 —-HD—- C:\WINDOWS\inf
2008-10-07 09:33:33 —-DC—- C:\WINDOWS\System32\DRVSTORE
2008-09-30 15:31:36 —-SD—- C:\WINDOWS\Tasks
2008-09-28 20:00:22 —-D—- C:\WINDOWS\SoftwareDistribution
2008-09-28 18:49:47 —-D—- C:\Program Files\Common Files
2008-09-28 17:02:51 —-SHD—- C:\RECYCLER
2008-09-27 16:32:28 —-D—- C:\Documents and Settings\All Users\Application Data\AOL Downloads
2008-09-25 15:37:10 —-A—- C:\WINDOWS\cookies.ini
2008-09-21 20:19:33 —-D—- C:\WINDOWS\Help
2008-09-21 19:39:14 —-A—- C:\WINDOWS\System32\mcrh.tmp

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys []
R1 SPBBCDrv;SPBBCDrv; \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys []
R1 SRTSPX;SRTSPX; C:\WINDOWS\System32\Drivers\SRTSPX.SYS [2007-12-01 43696]
R1 SYMTDI;SYMTDI; C:\WINDOWS\System32\Drivers\SYMTDI.SYS [2007-01-09 191544]
R2 ASCTRM;ASCTRM; C:\WINDOWS\System32\drivers\ASCTRM.sys [2007-10-10 8552]
R2 irda;IrDA Protocol; C:\WINDOWS\System32\DRIVERS\irda.sys [2001-08-17 55296]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys [2002-11-05 9855]
R2 StreamDispatcher;StreamDispatcher; C:\WINDOWS\System32\DRIVERS\strmdisp.sys [2002-11-05 34224]
R3 ati2mtag;ati2mtag; C:\WINDOWS\System32\DRIVERS\ati2mtag.sys [2002-08-16 471168]
R3 CALIAUD;Conexant AMC 3D ENVIRONMENTAL AUDIO; C:\WINDOWS\system32\drivers\caliaud.sys [2002-11-05 291328]
R3 CALIHALA;CALIHALA; C:\WINDOWS\system32\drivers\calihal.sys [2002-11-05 244608]
R3 CmBatt;Microsoft AC Adapter Driver; C:\WINDOWS\System32\DRIVERS\CmBatt.sys [2002-08-28 13184]
R3 DKbFltr;Dritek HotKey Keyboard Filter Driver; C:\WINDOWS\System32\Drivers\DKbFltr.SYS [2002-10-11 14543]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys []
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]
R3 HPCI;HP Configuration Interface; C:\WINDOWS\System32\DRIVERS\hpci.sys [2002-07-17 14504]
R3 HSF_DP;HSF_DP; C:\WINDOWS\System32\DRIVERS\HSF_DP.sys [2002-11-05 1171616]
R3 HSFHWALI;HSFHWALI; C:\WINDOWS\System32\DRIVERS\HSFHWALI.sys [2002-11-05 153380]
R3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
R3 NAVENG;NAVENG; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20081018.004\NAVENG.SYS []
R3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20081018.004\NAVEX15.SYS []
R3 Passthru;Service; C:\WINDOWS\System32\DRIVERS\ndisio.sys [2008-10-14 99584]
R3 PPPoEWin;PPPoEWin Miniport; C:\WINDOWS\System32\DRIVERS\PPPoEWin.SYS [2003-09-25 104375]
R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\System32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 SRTSPL;SRTSPL; C:\WINDOWS\System32\Drivers\SRTSPL.SYS [2007-12-01 317616]
R3 SYMDNS;SYMDNS; C:\WINDOWS\System32\Drivers\SYMDNS.SYS [2007-01-09 12984]
R3 SymEvent;SymEvent; \??\C:\WINDOWS\System32\Drivers\SYMEVENT.SYS []
R3 SYMFW;SYMFW; C:\WINDOWS\System32\Drivers\SYMFW.SYS [2007-01-09 145976]
R3 SYMIDS;SYMIDS; C:\WINDOWS\System32\Drivers\SYMIDS.SYS [2007-01-09 40120]
R3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\idsdefs\20081014.001\SymIDSCo.sys []
R3 SYMNDIS;SYMNDIS; C:\WINDOWS\System32\Drivers\SYMNDIS.SYS [2007-01-09 35256]
R3 SYMREDRV;SYMREDRV; C:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2007-01-09 27576]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\System32\DRIVERS\SynTP.sys [2002-09-10 262608]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2002-08-29 51968]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbohci.sys [2002-08-29 15744]
R3 W8335XP;NETGEAR WG511v2 54 Mbps Wireless PC Card for Windows XP (8335); C:\WINDOWS\System32\DRIVERS\WG511v2XP.sys [2005-03-10 265984]
R3 wanatw;WAN Miniport (ATW); C:\WINDOWS\System32\DRIVERS\wanatw4.sys [2003-01-10 33588]
R3 winachsf;winachsf; C:\WINDOWS\System32\DRIVERS\HSF_CNXT.sys [2002-11-05 594960]
S1 P3;Intel PentiumIII Processor Driver; C:\WINDOWS\System32\DRIVERS\p3.sys [2002-08-29 37504]
S3 ALiIRDA;ALi Infrared Device Driver; C:\WINDOWS\System32\DRIVERS\aliirda.sys [2001-12-17 26112]
S3 allegro;ESS Allegro Audio Driver (WDM); C:\WINDOWS\system32\drivers\es198x.sys [2001-08-17 174464]
S3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2002-08-29 57344]
S3 atimpab;atimpab; C:\WINDOWS\System32\DRIVERS\atimpab.sys [2001-08-17 289664]
S3 CE3;Xircom Ethernet Adapter 10/100 Service; C:\WINDOWS\System32\DRIVERS\ce3n5.sys [2001-08-17 27164]
S3 DP83815;National Semiconductor Corp. DP83815/816 NDIS 5.0 Miniport Driver; C:\WINDOWS\System32\DRIVERS\DP83815.SYS [2002-08-29 16512]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\System32\DRIVERS\HPZid412.sys [2003-03-09 51024]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\System32\DRIVERS\HPZipr12.sys [2003-03-09 16080]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\System32\DRIVERS\HPZius12.sys [2003-03-09 21456]
S3 lanusb;GlobeSpan USB ADSL LAN Modem; C:\WINDOWS\System32\DRIVERS\glausb.sys [2003-08-15 138402]
S3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2002-08-29 57984]
S3 s616bus;Sony Ericsson Device 616 driver (WDM); C:\WINDOWS\System32\DRIVERS\s616bus.sys [2007-04-03 83208]
S3 s616mdfl;Sony Ericsson Device 616 USB WMC Modem Filter; C:\WINDOWS\System32\DRIVERS\s616mdfl.sys [2007-04-03 15112]
S3 s616mdm;Sony Ericsson Device 616 USB WMC Modem Driver; C:\WINDOWS\System32\DRIVERS\s616mdm.sys [2007-04-03 108680]
S3 s616obex;Sony Ericsson Device 616 USB WMC OBEX Interface; C:\WINDOWS\System32\DRIVERS\s616obex.sys [2007-04-03 98568]
S3 s616unic;Sony Ericsson Device 616 USB Ethernet Emulation SEMC616 (WDM); C:\WINDOWS\System32\DRIVERS\s616unic.sys [2007-04-03 99080]
S3 SRTSP;SRTSP; C:\WINDOWS\System32\Drivers\SRTSP.SYS [2007-12-01 279088]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2002-08-29 28160]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2002-08-29 24960]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\System32\DRIVERS\usbscan.sys [2002-08-29 14208]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2002-08-29 21760]
S3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2002-08-29 19328]
S4 IntelIde;IntelIde; C:\WINDOWS\System32\DRIVERS\intelide.sys [2002-08-29 4736]
S4 sr;System Restore Filter Driver; C:\WINDOWS\System32\DRIVERS\sr.sys [2002-08-29 69248]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-07-07 611664]
R2 AOL ACS;AOL Connectivity Service; C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe [2006-10-23 46640]
R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2007-09-12 554352]
R2 ccEvtMgr;Symantec Event Manager; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2007-01-10 108648]
R2 ccSetMgr;Symantec Settings Manager; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2007-01-10 108648]
R2 CLTNetCnService;Symantec Lic NetConnect service; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2007-01-10 108648]
R2 HPConfig;HP Configuration Interface Service; C:\WINDOWS\system32\HPConfig.exe [2002-08-15 151552]
R2 HPWirelessMgr;HPWirelessMgr; C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe [2002-07-17 53248]
R2 Irmon;Infrared Monitor; C:\WINDOWS\System32\svchost.exe [2002-08-29 12800]
R2 LiveUpdate Notice Ex;LiveUpdate Notice Service Ex; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2007-01-10 108648]
S2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\System32\atievxx.exe [2001-08-17 37376]
S2 LiveUpdate Notice Service;LiveUpdate Notice Service; C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2008-01-29 583048]
S3 comHost;COM Host; C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe [2007-01-13 49248]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-01-31 138168]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2007-09-12 2999664]
S3 Symantec Core LC;Symantec Core LC; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe [2008-01-23 1251720]
S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]

—————–EOF—————–




info.txt

info.txt logfile of random's system information tool 1.04 2008-10-19 21:01:05

======Uninstall list======

–>C:\WINDOWS\IsUninst.exe -f"C:\Program Files\COMPAQ\Software Setup\Uninst.isu" -c"C:\Program Files\COMPAQ\Software Setup\CPQUNST.DLL"
–>C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\orun32.isu
–>C:\WINDOWS\uninst.exe -fc:\compaq\lutil\DeIsL1.isu
–>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Ad-Aware–>MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Adobe Acrobat 5.0–>C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.isu" -c"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.dll"
Adobe Flash Player ActiveX–>C:\WINDOWS\System32\Macromed\Flash\uninstall_activeX.exe
Adobe Shockwave Player–>C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
AOL Registration–>"C:\Program Files\AOL\RC\uninstall.exe"
AOL Toolbar–>"C:\Program Files\AOL Toolbar\UNWISE.EXE" /u "C:\Program Files\AOL Toolbar\INSTALL.LOG"
AOL Uninstaller (Choose which Products to Remove)–>C:\Program Files\Common Files\AOL\uninstaller.exe
AOL You've Got Pictures Screensaver–>C:\Program Files\Common Files\AOL\Screensaver\uninst_ygpss.exe
AppCore–>MsiExec.exe /I{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}
ATI Control Panel–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}\setup.exe"
ATI Display Driver–>rundll32 C:\WINDOWS\System32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
AV–>MsiExec.exe /I{F4DB525F-A986-4249-B98B-42A8066251CA}
BT Voyager 105 ADSL Modem–>C:\Program Files\BT Voyager 105 ADSL Modem\uninstall.exe
BT Voyager Modem AOL Test–>C:\WINDOWS\AppRun.exe C:\PROGRA~1\VOYAGE~1
ccCommon–>MsiExec.exe /I{3CCAD2EF-CFF2-4637-82AA-AABF370282D3}
CCleaner (remove only)–>"C:\Program Files\CCleaner\uninst.exe"
Conexant 56K ACLink Modem–>C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_10B9&DEV;_5457&SUBSYS;_0850103C\HXFSETUP.EXE -U -Ihpm08505.inf
Conexant AC-Link Audio–>CIAunwdm.exe
GearDrvs–>MsiExec.exe /I{228F6876-A313-40A3-91C0-C3CBE6997D09}
GearDrvs–>MsiExec.exe /I{CB84F0F2-927B-458D-9DC5-87832E3DC653}
Google Earth–>MsiExec.exe /I{1E04F83B-2AB9-4301-9EF7-E86307F79C72}
Google Toolbar for Internet Explorer–>MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Toolbar for Internet Explorer–>regsvr32 /u /s "c:\program files\google\googletoolbar1.dll"
HijackThis 2.0.2–>"C:\Documents and Settings\wendy\Local Settings\Temporary Internet Files\Content.IE5\166GYTHT\HijackThis.exe" /uninstall
hp instant support–>C:\PROGRA~1\HEWLET~1\hpis\Uninstall.exe /s CeS
HP Photo and Imaging 2.0 - All-in-One Drivers–>MsiExec.exe /X{6ECB39BD-73C2-44DD-B1A0-898207C58D8B}
HP Photo and Imaging 2.0 - All-in-One–>MsiExec.exe /X{9867A917-5D17-40DE-83BA-BEA5293194B1}
hp psc 1200 series–>rundll32 hpzcon07.dll,VendorJettison hp psc 1200 series
Inactive HP Printer Drivers (Remove only)–>RunDll32 hpuninst.dll,InstallHinfSection UninstDefault 132 prntunin.inf
InterVideo WinDVD–>"C:\Program Files\InstallShield Installation Information\{98E8A2EF-4EAE-43B8-A172-74842B764777}\setup.exe" REMOVEALL
JPEG USB Video Camera Driver v0.93–>MsiExec.exe /I{9B1473BA-7B0E-4373-A8E2-AED09D9019C4}
Learn2 Player (Uninstall Only)–>C:\Program Files\Learn2.com\StRunner\stuninst.exe
LiveUpdate 3.2 (Symantec Corporation)–>"C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
LiveUpdate Notice (Symantec Corporation)–>MsiExec.exe /X{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}
Map Button (Windows Live Toolbar)–>MsiExec.exe /X{7745B7A9-F323-4BB9-9811-01BF57A028DA}
Messenger Plus! 3 & Sponsor–>"C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /Remove
Messenger Plus! Live & Sponsor (CiD)–>"C:\Program Files\Messenger Plus! Live\Uninstall.exe"
Microsoft .NET Framework (English) v1.0.3705–>C:\WINDOWS\Microsoft.NET\Framework\Install.exe /u /p Microsoft .NET Framework Full v1.0.3705 (1033)
Microsoft .NET Framework (English)–>MsiExec.exe /X{B43357AA-3A6D-4D94-B56E-43C44D09E548}
Microsoft Word 2002–>MsiExec.exe /I{911B0409-6000-11D3-8CFE-0050048383C9}
Microsoft Works 7.0–>MsiExec.exe /I{764D06D8-D8DE-411E-A1C8-D9E9380F8A84}
Mozilla Firefox (3.0.3)–>C:\Program Files\Mozilla Firefox\uninstall\helper.exe
NETGEAR WG511v2 54 Mbps Wireless PC Card–>C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{B93D24B3-928D-4805-B379-4AA47CB3794E}
Norton 360 (Symantec Corporation)–>"C:\Program Files\Common Files\Symantec Shared\SymSetup\{2D617065-1C52-4240-B5BC-C0AE12157777}_1_0_0_184\{2D617065-1C52-4240-B5BC-C0AE12157777}.exe" /X
Norton 360 Help–>MsiExec.exe /I{1CA941F1-5006-487E-9FD4-09F812A7D6B8}
Norton 360–>MsiExec.exe /I{21829177-4DED-4209-AD08-490B3AC9C01A}
Norton 360–>MsiExec.exe /I{2D617065-1C52-4240-B5BC-C0AE12157777}
Norton 360–>MsiExec.exe /I{63A6E9A9-A190-46D4-9430-2DB28654AFD8}
Norton 360–>MsiExec.exe /I{F413B69D-4AD6-42ab-AEA5-0548989FAD50}
Norton Confidential Browser Component–>MsiExec.exe /I{4843B611-8FCB-4428-8C23-31D0A5EAE164}
Norton Confidential Web Authentification Component–>MsiExec.exe /I{3074EB89-1BCA-4AEF-AFF4-EFB4634C1923}
Norton Confidential Web Protection Component–>MsiExec.exe /I{D353CC51-430D-4C6F-9B7E-52003DA1E05A}
Notebook Utilities–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A8F2DCDE-AE4E-4AC9-BECD-496FB80FBF6A}\Setup.exe" -l0x9 UNINSTALL
OneCare Advisor (Windows Live Toolbar)–>MsiExec.exe /X{DF821FC5-C198-452B-A0D4-82433EFEAE9B}
One-Touch Buttons–>C:\WINDOWS\UnInst32.exe QT4HPOT.UNI
Popup Blocker (Windows Live Toolbar)–>MsiExec.exe /X{66A7A386-6F35-41A7-A731-101F0C0153C8}
QuickTime–>C:\WINDOWS\unvise32qt.exe C:\WINDOWS\System32\QuickTime\Uninstall.log
RealPlayer Basic–>C:\Program Files\Common Files\Real\Update\\rnuninst.exe RealNetworks|RealPlayer|6.0
Security Update for Step By Step Interactive Training (KB898458)–>"C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB911564)–>"C:\WINDOWS\$NtUninstallKB911564$\spuninst\spuninst.exe"
Security Update for Windows Media Player 8 (KB917734)–>"C:\WINDOWS\$NtUninstallKB917734_WMP8$\spuninst\spuninst.exe"
Security Update for Windows XP (KB890046)–>"C:\WINDOWS\$NtUninstallKB890046$\spuninst\spuninst.exe"
Security Update for Windows XP (KB893756)–>"C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896358)–>"C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896423)–>"C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896424)–>"C:\WINDOWS\$NtUninstallKB896424$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896428)–>"C:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe"
Security Update for Windows XP (KB899587)–>"C:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe"
Security Update for Windows XP (KB899591)–>"C:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe"
Security Update for Windows XP (KB900725)–>"C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe"
Security Update for Windows XP (KB901017)–>"C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe"
Security Update for Windows XP (KB901190)–>"C:\WINDOWS\$NtUninstallKB901190$\spuninst\spuninst.exe"
Security Update for Windows XP (KB901214)–>"C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe"
Security Update for Windows XP (KB902400)–>"C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe"
Security Update for Windows XP (KB904706)–>"C:\WINDOWS\$NtUninstallKB904706$\spuninst\spuninst.exe"
Security Update for Windows XP (KB905414)–>"C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe"
Security Update for Windows XP (KB905495)–>"C:\WINDOWS\$NtUninstallKB905495$\spuninst\spuninst.exe"
Security Update for Windows XP (KB905749)–>"C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe"
Security Update for Windows XP (KB908519)–>"C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe"
Security Update for Windows XP (KB911562)–>"C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe"
Security Update for Windows XP (KB911927)–>"C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe"
Security Update for Windows XP (KB912919)–>"C:\WINDOWS\$NtUninstallKB912919$\spuninst\spuninst.exe"
Security Update for Windows XP (KB913580)–>"C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe"
Security Update for Windows XP (KB914388)–>"C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe"
Security Update for Windows XP (KB914389)–>"C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe"
Security Update for Windows XP (KB917344)–>"C:\WINDOWS\$NtUninstallKB917344$\spuninst\spuninst.exe"
Security Update for Windows XP (KB917422)–>"C:\WINDOWS\$NtUninstallKB917422$\spuninst\spuninst.exe"
Security Update for Windows XP (KB917953)–>"C:\WINDOWS\$NtUninstallKB917953$\spuninst\spuninst.exe"
Security Update for Windows XP (KB919007)–>"C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920670)–>"C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920683)–>"C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920685)–>"C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe"
Security Update for Windows XP (KB921398)–>"C:\WINDOWS\$NtUninstallKB921398$\spuninst\spuninst.exe"
Security Update for Windows XP (KB921883)–>"C:\WINDOWS\$NtUninstallKB921883$\spuninst\spuninst.exe"
Security Update for Windows XP (KB922616)–>"C:\WINDOWS\$NtUninstallKB922616$\spuninst\spuninst.exe"
Security Update for Windows XP (KB922819)–>"C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923191)–>"C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923414)–>"C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924191)–>"C:\WINDOWS\$NtUninstallKB924191$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924496)–>"C:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe"
Smart Menus (Windows Live Toolbar)–>MsiExec.exe /X{F084395C-40FB-4DB3-981C-B51E74E1E83D}
SPBBC 32bit–>MsiExec.exe /I{77772678-817F-4401-9301-ED1D01A8DA56}
Spybot - Search & Destroy–>"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
SuppSoft–>MsiExec.exe /I{022DA2C3-81C7-4003-A6BC-1BB147B20097}
Symantec Technical Support Controls–>MsiExec.exe /I{92B1B3CC-EC78-45B8-96D0-8B3F11495864}
SymNet–>MsiExec.exe /I{2DA85B02-13C0-4E6D-9A76-22E6B3DD0CB2}
Synaptics TouchPad–>rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
Tabbed Browsing (Windows Live Toolbar)–>MsiExec.exe /X{47FBF7F9-FBD3-43EF-823B-7684D56C1962}
Update for Windows XP (KB835409)–>"C:\WINDOWS\$NtUninstallKB835409$\spuninst\spuninst.exe"
Update for Windows XP (KB898461)–>"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Update for Windows XP (KB908531)–>"C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe"
Update for Windows XP (KB910437)–>"C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe"
Update for Windows XP (KB911280)–>"C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe"
Viewpoint Media Player–>C:\Program Files\Viewpoint\Viewpoint Experience Technology\mtsAxInstaller.exe /u
Windows Backup Utility–>MsiExec.exe /I{76EFFC7C-17A6-479D-9E47-8E658C1695AE}
Windows Installer 3.1 (KB893803)–>"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Live Favorites for Windows Live Toolbar–>MsiExec.exe /X{786C4AD1-DCBA-49A6-B0EF-B317A344BD66}
Windows Live Messenger–>MsiExec.exe /I{571700F0-DB9D-4B3A-B03D-35A14BB5939F}
Windows Live Outlook Toolbar (Windows Live Toolbar)–>MsiExec.exe /X{35E1A8C8-6646-4101-B0AA-42D1EB2AB3AE}
Windows Live Sign-in Assistant–>MsiExec.exe /I{49672EC2-171B-47B4-8CE7-50D7806360D7}
Windows Live Toolbar Extension (Windows Live Toolbar)–>MsiExec.exe /X{341201D4-4F61-4ADB-987E-9CCE4D83A58D}
Windows Live Toolbar Feed Detector (Windows Live Toolbar)–>MsiExec.exe /X{68108E66-D13A-4EE8-A6F4-40E4B90C2A26}
Windows Live Toolbar–>"C:\Program Files\Windows Live Toolbar\UnInstall.exe" {D5A145FC-D00C-4F1A-9119-EB4D9D659750}
Windows Live Toolbar–>MsiExec.exe /X{D5A145FC-D00C-4F1A-9119-EB4D9D659750}
Windows XP Hotfix - KB835732–>C:\WINDOWS\$NtUninstallKB835732$\spuninst\spuninst.exe
Windows XP Hotfix - KB842773–>C:\WINDOWS\$NtUninstallKB842773$\spuninst\spuninst.exe
Windows XP Hotfix - KB873339–>C:\WINDOWS\$NtUninstallKB873339$\spuninst\spuninst.exe
Windows XP Hotfix - KB885835–>C:\WINDOWS\$NtUninstallKB885835$\spuninst\spuninst.exe
Windows XP Hotfix - KB885836–>C:\WINDOWS\$NtUninstallKB885836$\spuninst\spuninst.exe
Windows XP Hotfix - KB888302–>C:\WINDOWS\$NtUninstallKB888302$\spuninst\spuninst.exe
Windows XP Hotfix - KB890859–>"C:\WINDOWS\$NtUninstallKB890859$\spuninst\spuninst.exe"
Windows XP Hotfix - KB891781–>C:\WINDOWS\$NtUninstallKB891781$\spuninst\spuninst.exe
Windows XP Hotfix - KB911567–>"C:\WINDOWS\$NtUninstallKB911567-OE6SP1-20060316.165634$\spuninst\spuninst.exe"
Windows XP Hotfix - KB918439–>"C:\WINDOWS\$NtUninstallKB918439-IE6SP1-20060530.145346$\spuninst\spuninst.exe"
Windows XP Hotfix - KB918899–>"C:\WINDOWS\$NtUninstallKB918899-IE6SP1-20060725.123917$\spuninst\spuninst.exe"
Windows XP Hotfix - KB925486–>"C:\WINDOWS\$NtUninstallKB925486-IE6SP1-20060918.120000$\spuninst\spuninst.exe"
XPMedic–>"C:\Program Files\XPMedic\unins000.exe"

======Hosts File======

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI Control Panel
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 2 Stepping 9, GenuineIntel
"PROCESSOR_REVISION"=0209
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

—————–EOF—————–