What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] seach engine

26 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 3 this my rooter.exe file
X86-based PC ( Multiprocessor Free : Intel® Pentium® 4 CPU 3.00GHz )
BIOS : BIOS Date: 04/09/04 13:44:32 Ver: 08.00.08
USER : Melissa Rodriguez ( Administrator )
BOOT : Normal boot

Antivirus : Norton AntiVirus 2004 (Not Activated)
Firewall : Norton Internet Security 2004 (Activated)

A:\ (USB)
C:\ (Local Disk) - NTFS - Total:143 Go (Free:75 Go)
D:\ (CD or DVD)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)

Mon 01/19/2009| 0:10

———————-\\ Search..

———————-\\ ROOTKIT !!

Rootkit msqpdxserv ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\msqpdxserv.sys]


1 - "C:\Rooter$\Rooter_1.txt" - Mon 01/19/2009| 0:11

———————-\\ Scan completed at 0:11 Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:14:00 AM, on 1/19/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\sony\usbsircs\usbsircs.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Sony\Giga Pocket\shwserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\internet explorer\iexplore.exe
C:\PROGRA~1\PANASO~1\LocalCom\lmsrvnt.exe
C:\PROGRA~1\PANASO~1\TRAPMO~1\Trapmnnt.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCdb\VzFw.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Sony\Giga Pocket\RM_SV.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
N3 - Netscape 7: # Mozilla User Preferences
// This is a generated file!

user_pref("browser.activation.checkedNNFlag", true);
user_pref("browser.bookmarks.added_static_root", true);
user_pref("browser.history.last_page_visited", "http://bwp.techrepublic.com.com/search?dw-siteid=11&dw-ontid=6230&dw-ptid=5208&dw-edid=87");
user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src");
user_pref("browser.startup.homepage_override.mstone", "rv:1.0.2");
user_pref("browser.tabs.forceHide", true);
user_pref("intl.charsetmenu.browser.cache", "UTF-8, ISO-8859-1");
user_pref("ldap_2.prefs_migrated", true);
user_pref("mail.smtpservers", "");
user_pref("mail.ui.folderpane.version", 2);
user_pref("mailnews.global_html_domains.version", 2);
user_pref("mailnews.html_domains", "netscape.net,netscape.com,aol.com,cs.com,yahoo.com,hotmail.com,msn.com");
user_pref("mailnews.ui.threadpane.version", 2);
user_pref("prefs.converted-to-utf8", true);
user_pref("signo
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Melissa Rodriguez\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Remocon Driver.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase6662.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1232263077812
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1232263065687
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Giga Pocket Hardware Detector - Sony Corporation - C:\Program Files\Sony\Giga Pocket\shwserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Office keyboard utility\1.2\nhksrv.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\PACSPT~1.EXE
O23 - Service: Panasonic Local Printer Service - Panasonic Communications Co., Ltd. - C:\PROGRA~1\PANASO~1\LocalCom\lmsrvnt.exe
O23 - Service: Panasonic Trap Monitor Service - Panasonic - C:\PROGRA~1\PANASO~1\TRAPMO~1\Trapmnnt.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Sony TV Tuner Controller - Sony Corporation - C:\Program Files\Sony\Giga Pocket\halsv.exe
O23 - Service: Sony TV Tuner Manager - Sony Corporation - C:\Program Files\Sony\Giga Pocket\RM_SV.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
O23 - Service: VAIO Entertainment File Import Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCdb\VzFw.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VCSW\VCSW.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\VmGateway.exe
O23 - Service: VAIO Media Video Server (VAIOMediaPlatform-VideoServer-AppServer) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Video\GPVSvr.exe
O23 - Service: VAIO Media Video Server (HTTP) (VAIOMediaPlatform-VideoServer-HTTP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Video Server (UPnP) (VAIOMediaPlatform-VideoServer-UPnP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\UPnPFramework.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Here is my new hijack file . and about my norton anti virus i am not is using it. Do you have any free anti virus.i can use. Any good ones? The last thing everything is running good and i updated my sevice pack 2 to sevice pack 3. should i get internet explore 7?or keep the same one .. just to repeat everything is running smooth… if you find something post back . thanks
Post #17
Hi Meche,

Hold off on IE7 until we are done, then by all means install it.

We will be using Combofix again.

Please follow all previous instructions regarding security programs.

Open a new Notepad session
  • Click the Start button, click run
  • in the run box type notepad
  • click ok
  • In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  • Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

File::
c:\windows\Tasks\Symantec NetDetect.job
c:\windows\Tasks\Norton AntiVirus - Scan my computer.job

Folder::
c:\program files\Full Tilt Poker
c:\program files\LimeWire
C:\Program Files\PartyGaming\PartyPoker

Registry::
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\msqpdxserv.sys]

Driver::
nhksrv

In the notepad
  • Click File, Save as…, and set the Save in to your Desktop
  • In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
  • Click save
Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]

Please save the log in a convenient place such as your desktop so you can post it when you have completed the rest.

Your current antivirus program is part of a suite. Since the components are interconnected, it would be best to remove the entire suite. We can replace the firewall with a good free one when we are finished.

You can get a free antivirus program from any of these 3 vendors. Download only one and save it to your desktop.

Do not install it yet.

Avast
Help and support can be found here Avast Forum
AVG
Help and support can be found here AVG Forum
Antivir PersonalEditionClassic
Help and support can be found hereAvira Personal Support Forum

Next, Click to download the Norton Removal Tool from HERE and save it to your desktop. You will use it later.

Disconnect from the internet, pull the plug on the modem.

Go to add/remove programs and uninstall

Norton AntiSpam
Norton AntiVirus
Norton Internet Security
Norton Internet Security (Symantec Corporation)
Norton WMI Update
Symantec Network Drivers Update
Symantec Technical Support Web Controls

Reboot

Next double click Norton_Removal_Tool.exe to run the tool.
  • Follow the on-screen instructions.
  • Your computer may be restarted more than once, and you may be asked to repeat some steps after the computer restarts.
When the tool has finished, reboot and installl your new antivirus program.

Next, make sure your Windows firewall is turned on,

Click start, click control panel, click Security Center. At the bottom of Security Center click windows firewall. Ensure it is set to On.

Please obtain a new HJT log and post it along with the combofix log. Tell us how things are now.

Thanks
Post #18 last edited
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:21:26 AM, on 1/21/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Sony\Giga Pocket\shwserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\PROGRA~1\PANASO~1\LocalCom\lmsrvnt.exe
C:\PROGRA~1\PANASO~1\TRAPMO~1\Trapmnnt.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCdb\VzFw.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Sony\Giga Pocket\RM_SV.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\sony\usbsircs\usbsircs.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
N3 - Netscape 7: # Mozilla User Preferences
// This is a generated file!

user_pref("browser.activation.checkedNNFlag", true);
user_pref("browser.bookmarks.added_static_root", true);
user_pref("browser.history.last_page_visited", "http://bwp.techrepublic.com.com/search?dw-siteid=11&dw-ontid=6230&dw-ptid=5208&dw-edid=87");
user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src");
user_pref("browser.startup.homepage_override.mstone", "rv:1.0.2");
user_pref("browser.tabs.forceHide", true);
user_pref("intl.charsetmenu.browser.cache", "UTF-8, ISO-8859-1");
user_pref("ldap_2.prefs_migrated", true);
user_pref("mail.smtpservers", "");
user_pref("mail.ui.folderpane.version", 2);
user_pref("mailnews.global_html_domains.version", 2);
user_pref("mailnews.html_domains", "netscape.net,netscape.com,aol.com,cs.com,yahoo.com,hotmail.com,msn.com");
user_pref("mailnews.ui.threadpane.version", 2);
user_pref("prefs.converted-to-utf8", true);
user_pref("signo
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Melissa Rodriguez\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Remocon Driver.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase6662.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1232263077812
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1232263065687
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Giga Pocket Hardware Detector - Sony Corporation - C:\Program Files\Sony\Giga Pocket\shwserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\PACSPT~1.EXE
O23 - Service: Panasonic Local Printer Service - Panasonic Communications Co., Ltd. - C:\PROGRA~1\PANASO~1\LocalCom\lmsrvnt.exe
O23 - Service: Panasonic Trap Monitor Service - Panasonic - C:\PROGRA~1\PANASO~1\TRAPMO~1\Trapmnnt.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Sony TV Tuner Controller - Sony Corporation - C:\Program Files\Sony\Giga Pocket\halsv.exe
O23 - Service: Sony TV Tuner Manager - Sony Corporation - C:\Program Files\Sony\Giga Pocket\RM_SV.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
O23 - Service: VAIO Entertainment File Import Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCdb\VzFw.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VCSW\VCSW.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\VmGateway.exe
O23 - Service: VAIO Media Video Server (VAIOMediaPlatform-VideoServer-AppServer) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Video\GPVSvr.exe
O23 - Service: VAIO Media Video Server (HTTP) (VAIOMediaPlatform-VideoServer-HTTP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Video Server (UPnP) (VAIOMediaPlatform-VideoServer-UPnP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\UPnPFramework.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

–
End of file - 12739 bytes
Here is the hijack file. i did the combo fix . and the the log i got is 689kb . it seems that every is double for example here is part of it ComboFix 09-01-17.03 - Melissa Rodriguez 2009-01-20 10:53:54.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.193 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Melissa Rodriguez\Desktop\CFScript.txt
AV: Norton AntiVirus *On-access scanning disabled* (Outdated)
FW: Norton Internet Security *disabled*
* Created a new restore point

FILE ::
c:\windows\Tasks\Norton AntiVirus - Scan my computer.job
c:\windows\Tasks\Symantec NetDetect.job
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Full Tilt Poker
c:\program files\Full Tilt Poker\application.prefs
c:\program files\Full Tilt Poker\Cache\42D4EB830001.dc
c:\program files\Full Tilt Poker\mechepimp.dat
c:\program files\LimeWire
c:\program files\LimeWire\donotremove.htm
c:\program files\LimeWire\GenericWindowsUtils.dll
c:\program files\LimeWire\hashes
c:\program files\LimeWire\i18n.jar
c:\program files\LimeWire\jl011.jar
c:\program files\LimeWire\lib\unpackedJars.tmp
c:\program files\LimeWire\LimeWire20.dll
c:\program files\LimeWire\log.txt
c:\program files\LimeWire\log4j.properties
c:\program files\LimeWire\logicrypto.jar
c:\program files\LimeWire\MessagesBundle.properties
c:\program files\LimeWire\MessagesBundles.jar
c:\program files\LimeWire\mp3sp14.jar
c:\program files\LimeWire\mp3sp14.jar.tmp
c:\program files\LimeWire\PackedJars.7z
c:\program files\LimeWire\unpackedJars.tmp
c:\program files\LimeWire\update.ver
c:\program files\LimeWire\vorbis.jar
c:\program files\LimeWire\WindowsFirewall.dll
c:\program files\LimeWire\WindowsV5PlusUtils.dll
c:\program files\LimeWire\xerces.jar
c:\program files\LimeWire\xml-apis.jar
c:\program files\LimeWire\xml.war
c:\program files\PartyGaming\PartyPoker
c:\program files\PartyGaming\PartyPoker\Articles\1.html
c:\program files\PartyGaming\PartyPoker\Articles\103.atc
c:\program files\PartyGaming\PartyPoker\Articles\105.atc
c:\program files\PartyGaming\PartyPoker\Articles\107.atc
c:\program files\PartyGaming\PartyPoker\Articles\109.atc
c:\program files\PartyGaming\PartyPoker\Articles\117.atc
c:\program files\PartyGaming\PartyPoker\Articles\125.atc
c:\program files\PartyGaming\PartyPoker\Articles\127.atc
c:\program files\PartyGaming\PartyPoker\Articles\139.atc
c:\program files\PartyGaming\PartyPoker\Articles\157.atc
c:\program files\PartyGaming\PartyPoker\Articles\165.atc
c:\program files\PartyGaming\PartyPoker\Articles\225.atc
c:\program files\PartyGaming\PartyPoker\Articles\29.atc
c:\program files\PartyGaming\PartyPoker\Articles\3.html
c:\program files\PartyGaming\PartyPoker\Articles\67.atc
c:\program files\PartyGaming\PartyPoker\Articles\77.atc
c:\program files\PartyGaming\PartyPoker\Articles\79.atc
c:\program files\PartyGaming\PartyPoker\Articles\89.atc
c:\program files\PartyGaming\PartyPoker\Articles\91.atc
c:\program files\PartyGaming\PartyPoker\Articles\97.atc
c:\program files\PartyGaming\PartyPoker\Articles\99.atc
c:\program files\PartyGaming\PartyPoker\Images\system_but_bingo.jpg
c:\program files\PartyGaming\PartyPoker\Images\system_but_gammon.jpg
c:\program files\PartyGaming\PartyPoker\Language\en_US\articles\10285.atc
c:\program files\PartyGaming\PartyPoker\Language\en_US\articles\10287.atc
c:\program files\PartyGaming\PartyPoker\Language\en_US\articles\10299.atc
c:\program files\PartyGaming\PartyPoker\Language\en_US\articles\10301.atc
c:\program files\PartyGaming\PartyPoker\Language\en_US\articles\10303.atc
c:\program files\PartyGaming\PartyPoker\Language\en_US\articles\10305.atc
c:\program files\PartyGaming\PartyPoker\Language\en_US\articles\10437.atc
c:\program files\PartyGaming\PartyPoker\Language\en_US\articles\10445.atc
c:\program files\PartyGaming\PartyPoker\Language\en_US\articles\10447.atc
c:\program files\PartyGaming\PartyPoker\Language\en_US\articles\10571.atc
c:\program files\PartyGaming\PartyPoker\Language\en_US\articles\10573.atc
c:\program files\PartyGaming\PartyPoker\Language\en_US\articles\10577.atc
c:\program files\PartyGaming\PartyPoker\Language\en_US\articles\10579.atc
c:\program files\PartyGaming\PartyPoker\Language\en_US\articles\10581.atc
c:\program files\PartyGaming\PartyPoker\Language\en_US\articles\10625.atc
c:\program files\PartyGaming\PartyPoker\Language\en_US\articles\10627.atc
c:\program files\PartyGaming\PartyPoker\Language\en_US\articles\6331.html
c:\program files\PartyGaming\PartyPoker\Language\en_US\articles\6333.html
c:\program files\PartyGaming\PartyPoker\Language\en_US\articles\8321.atc
c:\program files\PartyGaming\PartyPoker\Language\en_US\articles\8323.atc
c:\program files\PartyGaming\PartyPoker\Language\en_US\articles\8325.atc
c:\program files\PartyGaming\PartyPoker\Notes.txt
c:\program files\PartyGaming\PartyPoker\ppunistall.bat
c:\program files\PartyGaming\PartyPoker\tmpUpgrade\upgradepp107-108man.exe
c:\program files\PartyGaming\PartyPoker\tmpUpgrade\upgradepp91-92man.exe
c:\program files\PartyGaming\PartyPoker\TourneyDescription.html
c:\program files\PartyGaming\PartyPoker\Uninstall.exe
c:\program files\PartyGaming\PartyPoker\usertab.txt
c:\windows\Tasks\Norton AntiVirus - Scan my computer.job
c:\windows\Tasks\Symantec NetDetect.job

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_NHKSRV
——-\Service_nhksrv


((((((((((((((((((((((((( Files Created from 2008-12-20 to 2009-01-20 )))))))))))))))))))))))))))))))
.

2009-01-19 10:15 . 2009-01-19 10:15 d–hs—- C:\USMT.TMP
2009-01-19 00:10 . 2009-01-19 00:11 d——– C:\Rooter$
2009-01-18 11:30 . 2009-01-18 11:30 410,984 –a—— c:\windows\system32\deploytk.dll
2009-01-18 10:51 . 2009-01-18 10:51 d——– c:\windows\system32\scripting
2009-01-18 10:51 . 2009-01-18 10:51 d——– c:\windows\system32\en
2009-01-18 10:51 . 2009-01-18 10:51 d——– c:\windows\l2schemas
2009-01-18 04:08 . 2008-04-13 16:11 650,752 ——— c:\windows\system32\dot3ui.dll
2009-01-18 04:07 . 2008-04-13 16:11 136,192 ——— c:\windows\system32\aaclient.dll
2009-01-18 03:10 . 2008-06-13 03:05 272,128 —–c— c:\windows\system32\dllcache\bthport.sys
2009-01-18 03:06 . 2008-12-12 09:01 3,067,904 —–c— c:\windows\system32\dllcache\mshtml.dll
2009-01-18 03:06 . 2008-10-15 17:00 1,499,136 —–c— c:\windows\system32\dllcache\shdocvw.dll
2009-01-18 03:06 . 2008-10-15 17:00 666,112 —–c— c:\windows\system32\dllcache\wininet.dll
2009-01-18 03:06 . 2008-10-15 17:00 619,520 —–c— c:\windows\system32\dllcache\urlmon.dll
2009-01-18 03:01 . 2009-01-18 10:58 2,675 –a—— c:\windows\imsins.BAK
2009-01-18 02:59 . 2008-09-15 04:12 1,846,400 —–c— c:\windows\system32\dllcache\win32k.sys
2009-01-18 02:58 . 2008-08-14 02:11 2,189,184 —–c— c:\windows\system32\dllcache\ntoskrnl.exe
2009-01-18 02:58 . 2008-08-14 02:09 2,145,280 —–c— c:\windows\system32\dllcache\ntkrnlmp.exe
2009-01-18 02:58 . 2008-08-14 01:33 2,066,048 —–c— c:\windows\system32\dllcache\ntkrnlpa.exe
2009-01-18 02:58 . 2008-08-14 01:33 2,023,936 —–c— c:\windows\system32\dllcache\ntkrpamp.exe
2009-01-18 02:51 . 2008-04-11 11:04 691,712 —–c— c:\windows\system32\dllcache\inetcomm.dll
2009-01-18 02:51 . 2008-10-24 03:21 455,296 —–c— c:\windows\system32\dllcache\mrxsmb.sys
2009-01-18 02:51 . 2008-12-11 02:57 333,952 —–c— c:\windows\system32\dllcache\srv.sys
2009-01-18 02:51 . 2008-05-01 06:33 331,776 —–c— c:\windows\system32\dllcache\msadce.dll
2009-01-18 02:51 . 2008-05-08 06:02 203,136 —–c— c:\windows\system32\dllcache\rmcast.sys
2009-01-18 02:49 . 2008-10-15 08:34 337,408 —–c— c:\windows\system32\dllcache\netapi32.dll
2009-01-17 23:18 . 2008-10-16 14:07 23,576 –a—— c:\windows\system32\wuapi.dll.mui
2009-01-08 21:28 . 2009-01-08 21:34 d——– c:\program files\Windows Live Safety Center
2009-01-04 22:31 . 2009-01-04 22:31 d——– c:\program files\Trend Micro
2009-01-03 00:36 . 2009-01-03 00:36 d——– c:\program files\Malwarebytes' Anti-Malware
2009-01-03 00:36 . 2009-01-03 00:36 d——– c:\documents and settings\Melissa Rodriguez\Application Data\Malwarebytes
2009-01-03 00:36 . 2009-01-03 00:36 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-03 00:36 . 2008-12-03 19:52 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-03 00:36 . 2008-12-03 19:52 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2008-12-31 21:44 . 2008-12-31 21:44 d——– c:\program files\Lavasoft
2008-12-31 21:44 . 2008-12-31 21:44 d——– c:\program files\Common Files\Wise Installation Wizard
2008-12-31 21:44 . 2008-12-31 21:44 d——– c:\documents and settings\All Users\Application Data\Lavasoft
2008-12-31 19:25 . 2008-12-31 19:25 d——– c:\documents and settings\Isabella Rodriguez\Application Data\Panasonic
2008-12-31 18:40 . 2004-03-31 16:02 d——– c:\documents and settings\Administrator\Application Data\Symantec
2008-12-31 18:40 . 2008-12-31 18:40 d——– c:\documents and settings\Administrator
2008-12-27 19:27 . 2008-12-29 22:39 224 –a—— c:\windows\system32\9B13A86D.plf
2008-12-27 19:24 . 2008-12-27 19:24 d——– c:\documents and settings\All Users\Application Data\Cached Installations

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-20 18:54 ——— d—–w c:\program files\PartyGaming
2009-01-19 09:41 ——— d—–w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-01-19 09:02 ——— d—–w c:\program files\Common Files\Symantec Shared
2009-01-19 08:58 ——— d–h–w c:\program files\InstallShield Installation Information
2009-01-19 08:39 ——— d—–w c:\program files\PacificPoker
2009-01-18 19:30 ——— d—–w c:\program files\Java
2009-01-09 04:08 ——— d—–w c:\program files\Burn4Free
2009-01-07 19:55 ——— d—–w c:\program files\Hewlett-Packard
2009-01-07 19:54 ——— d—–w c:\program files\HP
2009-01-07 19:52 ——— d—–w c:\program files\Common Files\InstallShield
2009-01-07 19:52 ——— d—–w c:\program files\Brother
2009-01-02 02:13 ——— d—–w c:\documents and settings\All Users\Application Data\DVD Shrink
2009-01-01 07:18 ——— d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-01 07:15 ——— d—–w c:\program files\Spybot - Search & Destroy
2008-12-30 18:06 ——— d—–w c:\documents and settings\Melissa Rodriguez\Application Data\ZoomBrowser EX
2008-12-30 18:06 ——— d—–w c:\documents and settings\Melissa Rodriguez\Application Data\CameraWindowDC
2008-12-11 10:57 333,952 —-a-w c:\windows\system32\drivers\srv.sys
2008-11-25 06:20 ——— d—–w c:\program files\Three Rings Design
2008-11-25 06:03 ——— d—–w c:\program files\Apple Software Update
2007-06-21 01:26 24,192 —-a-w c:\documents and settings\Melissa Rodriguez\usbsermptxp.sys
2007-06-21 01:26 22,768 —-a-w c:\documents and settings\Melissa Rodriguez\usbsermpt.sys
2007-05-30 07:52 92,064 —-a-w c:\documents and settings\Melissa Rodriguez\mqdmmdm.sys
2007-05-30 07:52 9,232 —-a-w c:\documents and settings\Melissa Rodriguez\mqdmmdfl.sys
2007-05-30 07:52 79,328 —-a-w c:\documents and settings\Melissa Rodriguez\mqdmserd.sys
2007-05-30 07:52 66,656 —-a-w c:\documents and settings\Melissa Rodriguez\mqdmbus.sys
2007-05-30 07:52 6,208 —-a-w c:\documents and settings\Melissa Rodriguez\mqdmcmnt.sys
2007-05-30 07:52 5,936 —-a-w c:\documents and settings\Melissa Rodriguez\mqdmwhnt.sys
2007-05-30 07:52 4,048 —-a-w c:\documents and settings\Melissa Rodriguez\mqdmcr.sys
2005-10-11 17:14 112,640 —-a-w c:\documents and settings\Melissa Rodriguez\a.exe
2005-09-20 01:29 52,736 —-a-w c:\documents and settings\Melissa Rodriguez\wm.exe
.

((((((((((((((((((((((((((((( snapshot@2009-01-17_22.58.50.64 )))))))))))))))))))))))))))))))))))))))))
.
- 2003-01-14 00:53:24 50,816 -c—-w c:\windows\$NtServicePackUninstall$\1394bus.sys
+ 2004-08-04 06:10:06 53,248 -c—-w c:\windows\$NtServicePackUninstall$\1394bus.sys
+ 2005-11-19 04:03:14 2,678 -c—-w c:\windows\$NtServicePackUninstall$\13db7xrr.dat
+ 2005-11-19 04:03:08 2,678 -c—-w c:\windows\$NtServicePackUninstall$\3j7p35bf.dat
+ 2004-08-04 06:00:03 12,288 -c—-w c:\windows\$NtServicePackUninstall$\4mmdat.sys
+ 2004-08-04 06:10:10 48,128 -c—-w c:\windows\$NtServicePackUninstall$\61883.sys
- 2003-03-31 12:00:00 59,392 -c—-w c:\windows\$NtServicePackUninstall$\6to4svc.dll
+ 2006-08-16 11:58:05 100,352 -c—-w c:\windows\$NtServicePackUninstall$\6to4svc.dll
+ 2006-10-04 14:05:26 39,424 -c—-w c:\windows\$NtServicePackUninstall$\acadproc.dll
+ 2006-10-04 14:05:26 39,424 -c—-w c:\windows\$NtServicePackUninstall$\acadproc.dll.000
- 2002-11-20 18:50:50 179,200 -c—-w c:\windows\$NtServicePackUninstall$\accwiz.exe
+ 2004-08-04 07:56:47 183,808 -c—-w c:\windows\$NtServicePackUninstall$\accwiz.exe
- 2003-02-19 22:15:36 1,821,696 -c—-w c:\windows\$NtServicePackUninstall$\acgenral.dll
+ 2004-08-04 07:56:41 1,852,416 -c—-w c:\windows\$NtServicePackUninstall$\acgenral.dll
+ 2004-08-04 07:56:41 1,852,416 -c—-w c:\windows\$NtServicePackUninstall$\acgenral.dll.000
- 2003-03-31 12:00:00 406,528 -c—-w c:\windows\$NtServicePackUninstall$\aclayers.dll
+ 2004-08-04 07:56:41 450,048 -c—-w c:\windows\$NtServicePackUninstall$\aclayers.dll
+ 2004-08-04 07:56:41 450,048 -c—-w c:\windows\$NtServicePackUninstall$\aclayers.dll.000
- 2003-03-31 12:00:00 125,440 -c—-w c:\windows\$NtServicePackUninstall$\aclua.dll
+ 2004-08-04 07:56:41 137,728 -c—-w c:\windows\$NtServicePackUninstall$\aclua.dll
+ 2004-08-04 07:56:41 137,728 -c—-w c:\windows\$NtServicePackUninstall$\aclua.dll.000
- 2003-03-31 12:00:00 107,008 -c—-w c:\windows\$NtServicePackUninstall$\aclui.dll
+ 2004-08-04 07:56:41 114,688 -c—-w c:\windows\$NtServicePackUninstall$\aclui.dll
- 2003-03-31 12:00:00 179,328 -c—-w c:\windows\$NtServicePackUninstall$\acpi.sys
+ 2004-08-04 06:07:38 187,776 -c—-w c:\windows\$NtServicePackUninstall$\acpi.sys
- 2003-03-31 12:00:00 219,136 -c—-w c:\windows\$NtServicePackUninstall$\acspecfc.dll
+ 2004-08-04 07:56:41 244,736 -c—-w c:\windows\$NtServicePackUninstall$\acspecfc.dll
+ 2004-08-04 07:56:41 244,736 -c—-w c:\windows\$NtServicePackUninstall$\acspecfc.dll.000
- 2003-03-31 12:00:00 181,760 -c—-w c:\windows\$NtServicePackUninstall$\activeds.dll
+ 2004-08-04 07:56:41 194,048 -c—-w c:\windows\$NtServicePackUninstall$\activeds.dll
- 2003-03-31 12:00:00 4,096 -c—-w c:\windows\$NtServicePackUninstall$\actmovie.exe
+ 2004-08-04 07:56:47 4,096 -c—-w c:\windows\$NtServicePackUninstall$\actmovie.exe
- 2003-03-31 12:00:00 98,304 -c—-w c:\windows\$NtServicePackUninstall$\actxprxy.dll
+ 2004-08-04 07:56:41 101,888 -c—-w c:\windows\$NtServicePackUninstall$\actxprxy.dll
- 2003-03-31 12:00:00 107,520 -c—-w c:\windows\$NtServicePackUninstall$\acxtrnal.dll
+ 2004-08-04 07:56:41 116,224 -c—-w c:\windows\$NtServicePackUninstall$\acxtrnal.dll
+ 2004-08-04 07:56:41 116,224 -c—-w c:\windows\$NtServicePackUninstall$\acxtrnal.dll.000
+ 2004-08-04 07:56:41 20,540 -c—-w c:\windows\$NtServicePackUninstall$\admin.dll
+ 2004-08-04 07:56:47 16,439 -c—-w c:\windows\$NtServicePackUninstall$\admin.exe
- 2003-03-31 12:00:00 57,344 -c—-w c:\windows\$NtServicePackUninstall$\admparse.dll
+ 2004-08-04 07:56:41 61,440 -c—-w c:\windows\$NtServicePackUninstall$\admparse.dll
- 2003-03-31 12:00:00 162,816 -c—-w c:\windows\$NtServicePackUninstall$\adsldp.dll
+ 2004-08-04 07:56:41 175,616 -c—-w c:\windows\$NtServicePackUninstall$\adsldp.dll
- 2003-03-31 12:00:00 139,776 -c—-w c:\windows\$NtServicePackUninstall$\adsldpc.dll
+ 2004-08-04 07:56:41 143,360 -c—-w c:\windows\$NtServicePackUninstall$\adsldpc.dll
- 2003-03-31 12:00:00 62,464 -c—-w c:\windows\$NtServicePackUninstall$\adsmsext.dll
+ 2004-08-04 07:56:41 68,096 -c—-w c:\windows\$NtServicePackUninstall$\adsmsext.dll
- 2003-03-31 12:00:00 239,616 -c—-w c:\windows\$NtServicePackUninstall$\adsnt.dll
+ 2004-08-04 07:56:41 263,680 -c—-w c:\windows\$NtServicePackUninstall$\adsnt.dll
+ 2004-08-04 07:56:41 4,255 -c—-w c:\windows\$NtServicePackUninstall$\adv01nt5.dll
+ 2004-08-04 07:56:41 3,967 -c—-w c:\windows\$NtServicePackUninstall$\adv02nt5.dll
+ 2004-08-04 07:56:41 3,615 -c—-w c:\windows\$NtServicePackUninstall$\adv05nt5.dll
+ 2004-08-04 07:56:41 3,647 -c—-w c:\windows\$NtServicePackUninstall$\adv07nt5.dll
+ 2004-08-04 07:56:41 3,135 -c—-w c:\windows\$NtServicePackUninstall$\adv08nt5.dll
+ 2004-08-04 07:56:41 3,711 -c—-w c:\windows\$NtServicePackUninstall$\adv09nt5.dll
+ 2004-08-04 07:56:41 3,775 -c—-w c:\windows\$NtServicePackUninstall$\adv11nt5.dll
- 2003-03-31 12:00:00 558,080 -c—-w c:\windows\$NtServicePackUninstall$\advapi32.dll
+ 2004-08-04 07:56:41 616,960 -c—-w c:\windows\$NtServicePackUninstall$\advapi32.dll
- 2003-03-31 12:00:00 91,136 -c—-w c:\windows\$NtServicePackUninstall$\advpack.dll
+ 2004-08-04 07:56:41 99,840 -c—-w c:\windows\$NtServicePackUninstall$\advpack.dll
- 2002-08-28 23:16:38 142,208 -c—-w c:\windows\$NtServicePackUninstall$\aec.sys
+ 2006-02-15 00:22:26 142,464 -c—-w c:\windows\$NtServicePackUninstall$\aec.sys
+ 2006-02-15 00:22:26 142,464 -c—-w c:\windows\$NtServicePackUninstall$\aec.sys.001
- 2003-03-31 12:00:00 131,968 -c—-w c:\windows\$NtServicePackUninstall$\afd.sys
+ 2008-08-14 09:51:43 138,368 -c—-w c:\windows\$NtServicePackUninstall$\afd.sys
- 2003-03-31 12:00:00 22,016 -c—-w c:\windows\$NtServicePackUninstall$\agentanm.dll
+ 2004-08-04 07:56:41 24,064 -c—-w c:\windows\$NtServicePackUninstall$\agentanm.dll
- 2003-03-31 12:00:00 204,288 -c—-w c:\windows\$NtServicePackUninstall$\agentctl.dll
+ 2004-08-04 07:56:41 214,016 -c—-w c:\windows\$NtServicePackUninstall$\agentctl.dll
- 2003-03-31 12:00:00 35,840 -c—-w c:\windows\$NtServicePackUninstall$\agentdp2.dll
+ 2006-10-12 13:54:18 42,496 -c—-w c:\windows\$NtServicePackUninstall$\agentdp2.dll
- 2003-03-31 12:00:00 50,688 -c—-w c:\windows\$NtServicePackUninstall$\agentdpv.dll
+ 2007-03-09 13:58:57 57,344 -c—-w c:\windows\$NtServicePackUninstall$\agentdpv.dll
- 2003-03-31 12:00:00 44,032 -c—-w c:\windows\$NtServicePackUninstall$\agentmpx.dll
+ 2004-08-04 07:56:41 49,152 -c—-w c:\windows\$NtServicePackUninstall$\agentmpx.dll
- 2003-03-31 12:00:00 21,504 -c—-w c:\windows\$NtServicePackUninstall$\agentpsh.dll
+ 2004-08-04 07:56:41 24,064 -c—-w c:\windows\$NtServicePackUninstall$\agentpsh.dll
- 2003-03-31 12:00:00 39,936 -c—-w c:\windows\$NtServicePackUninstall$\agentsr.dll
+ 2004-08-04 07:56:41 44,032 -c—-w c:\windows\$NtServicePackUninstall$\agentsr.dll
- 2003-03-31 12:00:00 235,008 -c—-w c:\windows\$NtServicePackUninstall$\agentsvr.exe
+ 2006-10-12 11:54:07 256,512 -c—-w c:\windows\$NtServicePackUninstall$\agentsvr.exe
- 2001-08-17 21:58:00 25,472 -c—-w c:\windows\$NtServicePackUninstall$\agp440.sys
+ 2004-08-04 06:07:41 42,368 -c—-w c:\windows\$NtServicePackUninstall$\agp440.sys
+ 2004-08-04 06:07:42 44,928 -c—-w c:\windows\$NtServicePackUninstall$\agpcpq.sys
+ 2003-03-31 12:00:00 19,456 -c—-w c:\windows\$NtServicePackUninstall$\agt0405.dll
+ 2003-03-31 12:00:00 19,456 -c—-w c:\windows\$NtServicePackUninstall$\agt0406.dll
+ 2003-03-31 12:00:00 21,504 -c—-w c:\windows\$NtServicePackUninstall$\agt0407.dll
+ 2003-03-31 12:00:00 22,016 -c—-w c:\windows\$NtServicePackUninstall$\agt0408.dll
+ 2003-03-31 12:00:00 19,456 -c—-w c:\windows\$NtServicePackUninstall$\agt0409.dll
+ 2003-03-31 12:00:00 19,456 -c—-w c:\windows\$NtServicePackUninstall$\agt040b.dll
+ 2003-03-31 12:00:00 21,504 -c—-w c:\windows\$NtServicePackUninstall$\agt040c.dll
+ 2003-03-31 12:00:00 19,968 -c—-w c:\windows\$NtServicePackUninstall$\agt040e.dll
+ 2003-03-31 12:00:00 20,992 -c—-w c:\windows\$NtServicePackUninstall$\agt0410.dll
+ 2003-03-31 12:00:00 20,992 -c—-w c:\windows\$NtServicePackUninstall$\agt0413.dll
+ 2003-03-31 12:00:00 19,456 -c—-w c:\windows\$NtServicePackUninstall$\agt0414.dll
+ 2003-03-31 12:00:00 19,456 -c—-w c:\windows\$NtServicePackUninstall$\agt0415.dll
+ 2003-03-31 12:00:00 20,480 -c—-w c:\windows\$NtServicePackUninstall$\agt0416.dll
+ 2003-03-31 12:00:00 19,456 -c—-w c:\windows\$NtServicePackUninstall$\agt0419.dll
+ 2003-03-31 12:00:00 19,456 -c—-w c:\windows\$NtServicePackUninstall$\agt041d.dll
+ 2003-03-31 12:00:00 19,456 -c—-w c:\windows\$NtServicePackUninstall$\agt041f.dll
+ 2003-03-31 12:00:00 20,992 -c—-w c:\windows\$NtServicePackUninstall$\agt0816.dll
+ 2003-03-31 12:00:00 20,480 -c—-w c:\windows\$NtServicePackUninstall$\agt0c0a.dll
- 2003-03-31 12:00:00 21,504 -c—-w c:\windows\$NtServicePackUninstall$\agtintl.dll
+ 2004-08-04 07:56:41 24,064 -c—-w c:\windows\$NtServicePackUninstall$\agtintl.dll
- 2003-03-31 12:00:00 91,648 -c—-w c:\windows\$NtServicePackUninstall$\ahui.exe
+ 2004-08-04 07:56:47 98,304 -c—-w c:\windows\$NtServicePackUninstall$\ahui.exe
- 2003-03-31 12:00:00 41,984 -c—-w c:\windows\$NtServicePackUninstall$\alg.exe
+ 2004-08-04 07:56:47 44,544 -c—-w c:\windows\$NtServicePackUninstall$\alg.exe
+ 2004-08-04 06:07:41 42,752 -c—-w c:\windows\$NtServicePackUninstall$\alim1541.sys
- 2003-03-31 12:00:00 15,872 -c—-w c:\windows\$NtServicePackUninstall$\alrsvc.dll
+ 2004-08-04 07:56:41 17,408 -c—-w c:\windows\$NtServicePackUninstall$\alrsvc.dll
+ 2004-08-04 06:07:42 43,008 -c—-w c:\windows\$NtServicePackUninstall$\amdagp.sys
- 2003-03-31 12:00:00 32,000 -c—-w c:\windows\$NtServicePackUninstall$\amdk6.sys
+ 2004-08-04 05:59:19 36,992 -c—-w c:\windows\$NtServicePackUninstall$\amdk6.sys
- 2003-03-31 12:00:00 32,512 -c—-w c:\windows\$NtServicePackUninstall$\amdk7.sys
+ 2004-08-04 05:59:20 37,376 -c—-w c:\windows\$NtServicePackUninstall$\amdk7.sys
- 2002-12-12 08:14:32 64,512 -c—-w c:\windows\$NtServicePackUninstall$\amstream.dll
+ 2004-08-04 07:56:41 70,656 -c—-w c:\windows\$NtServicePackUninstall$\amstream.dll
- 2003-03-31 12:00:00 115,712 -c—-w c:\windows\$NtServicePackUninstall$\apphelp.dll
+ 2004-08-04 07:56:41 126,976 -c—-w c:\windows\$NtServicePackUninstall$\apphelp.dll
+ 2004-08-04 07:56:41 331,264 -c—-w c:\windows\$NtServicePackUninstall$\aqueue.dll
- 2003-03-31 12:00:00 57,344 -c—-w c:\windows\$NtServicePackUninstall$\arp1394.sys
+ 2004-08-04 05:58:29 60,800 -c—-w c:\windows\$NtServicePackUninstall$\arp1394.sys
- 2003-03-31 12:00:00 77,824 -c—-w c:\windows\$NtServicePackUninstall$\asycfilt.dll
+ 2004-08-04 07:56:41 65,024 -c—-w c:\windows\$NtServicePackUninstall$\asycfilt.dll
- 2003-03-31 12:00:00 13,568 -c—-w c:\windows\$NtServicePackUninstall$\asyncmac.sys
+ 2004-08-04 06:05:03 14,336 -c—-w c:\windows\$NtServicePackUninstall$\asyncmac.sys
- 2003-03-31 12:00:00 22,528 -c—-w c:\windows\$NtServicePackUninstall$\at.exe
+ 2004-08-04 07:56:47 25,088 -c—-w c:\windows\$NtServicePackUninstall$\at.exe
- 2002-10-24 23:59:48 87,040 -c—-w c:\windows\$NtServicePackUninstall$\atapi.sys
+ 2004-08-04 05:59:42 95,360 -c—-w c:\windows\$NtServicePackUninstall$\atapi.sys
+ 2004-08-04 07:56:41 229,376 -c—-w c:\windows\$NtServicePackUninstall$\ati2cqag.dll
+ 2004-08-04 07:56:41 377,984 -c—-w c:\windows\$NtServicePackUninstall$\ati2dvaa.dll
+ 2004-08-04 07:56:41 201,728 -c—-w c:\windows\$NtServicePackUninstall$\ati2dvag.dll
+ 2004-08-04 07:56:41 870,784 -c—-w c:\windows\$NtServicePackUninstall$\ati3d1ag.dll
+ 2004-08-04 07:56:41 1,057,760 -c—-w c:\windows\$NtServicePackUninstall$\ati3d2ag.dll
+ 2004-08-04 07:56:41 1,888,992 -c—-w c:\windows\$NtServicePackUninstall$\ati3duag.dll
+ 2004-08-04 07:56:41 32,768 -c—-w c:\windows\$NtServicePackUninstall$\ativtmxx.dll
+ 2004-08-04 07:56:41 516,768 -c—-w c:\windows\$NtServicePackUninstall$\ativvaxx.dll
- 2003-03-31 12:00:00 74,810 -c—-w c:\windows\$NtServicePackUninstall$\atl.dll
+ 2004-08-04 07:56:41 58,880 -c—-w c:\windows\$NtServicePackUninstall$\atl.dll
- 2003-03-31 12:00:00 10,240 -c—-w c:\windows\$NtServicePackUninstall$\atmadm.exe
+ 2004-08-04 07:56:47 11,264 -c—-w c:\windows\$NtServicePackUninstall$\atmadm.exe
- 2003-03-31 12:00:00 57,216 -c—-w c:\windows\$NtServicePackUninstall$\atmarpc.sys
+ 2004-08-04 05:58:30 59,904 -c—-w c:\windows\$NtServicePackUninstall$\atmarpc.sys
- 2003-03-31 12:00:00 272,768 -c—-w c:\windows\$NtServicePackUninstall$\atmfd.dll
+ 2004-08-04 07:55:59 285,696 -c—-w c:\windows\$NtServicePackUninstall$\atmfd.dll
- 2003-03-31 12:00:00 53,888 -c—-w c:\windows\$NtServicePackUninstall$\atmlane.sys
+ 2004-08-04 05:58:34 55,936 -c—-w c:\windows\$NtServicePackUninstall$\atmlane.sys
- 2003-03-31 12:00:00 27,136 -c—-w c:\windows\$NtServicePackUninstall$\atmlib.dll
+ 2004-08-04 07:56:41 30,208 -c—-w c:\windows\$NtServicePackUninstall$\atmlib.dll
+ 2003-03-31 12:00:00 11,264 -c—-w c:\windows\$NtServicePackUninstall$\attrib.exe
+ 2004-08-04 07:56:41 21,183 -c—-w c:\windows\$NtServicePackUninstall$\atv01nt5.dll
+ 2004-08-04 07:56:41 11,359 -c—-w c:\windows\$NtServicePackUninstall$\atv02nt5.dll
+ 2004-08-04 07:56:41 25,471 -c—-w c:\windows\$NtServicePackUninstall$\atv04nt5.dll
+ 2004-08-04 07:56:41 14,143 -c—-w c:\windows\$NtServicePackUninstall$\atv06nt5.dll
+ 2004-08-04 07:56:41 17,279 -c—-w c:\windows\$NtServicePackUninstall$\atv10nt5.dll
- 2003-03-31 12:00:00 38,912 -c—-w c:\windows\$NtServicePackUninstall$\audiosrv.dll
+ 2004-08-04 07:56:41 42,496 -c—-w c:\windows\$NtServicePackUninstall$\audiosrv.dll
+ 2004-08-04 07:56:47 14,336 -c—-w c:\windows\$NtServicePackUninstall$\auditusr.exe
+ 2004-08-04 07:56:41 20,540 -c—-w c:\windows\$NtServicePackUninstall$\author.dll
+ 2004-08-04 07:56:47 16,439 -c—-w c:\windows\$NtServicePackUninstall$\author.exe
- 2003-03-31 12:00:00 51,200 -c—-w c:\windows\$NtServicePackUninstall$\authz.dll
+ 2005-03-02 18:09:29 56,832 -c—-w c:\windows\$NtServicePackUninstall$\authz.dll
- 2003-03-31 12:00:00 565,760 -c—-w c:\windows\$NtServicePackUninstall$\autochk.exe
+ 2004-08-04 07:56:47 588,800 -c—-w c:\windows\$NtServicePackUninstall$\autochk.exe
- 2003-03-31 12:00:00 578,560 -c—-w c:\windows\$NtServicePackUninstall$\autoconv.exe
+ 2004-08-04 07:56:47 602,624 -c—-w c:\windows\$NtServicePackUninstall$\autoconv.exe DO you want to me to run it again without the file inserted ( the one that had party porker and limewire ) . Do you want me to fit the whole file on my next reply i try to do by parts because my computer says not responding in widows task manager….when i try to copy and paste all of it . and about the antivirus i will do that after we staight this out .. thanks for everthing . i am a beginner at this but i am understanding alot . my computer is running much better I do not have any problems with point restore ,windows update and my seach engine . i just want a strong antivirus and unwanted files in my system…
Post #19
Hi Meche,

about the antivirus i will do that after we staight this out…………….my computer is running much better I do not have any problems with point restore ,windows update and my seach engine


We want to keep it that way. Without an antivirus program there is a very good chance you will become infected again before we get finished. Just being connected to the internet can be very,very risky.

Please follow the previous instructions regarding removing Norton and installing a new antivirus.

Meche, you gotta quit doing this
PartyGaming
PacificPoker
http://www.bleepingcomputer.com/uninstall/…ific-Poker.html

Please go to add/remove programs and uninstall, if present
PartyGaming
PacificPoker

Please download ZipIt from here:
Download 1
Download 2
  • Double-click ZipIt! to run it.
  • Then copy the content of the following codebox into the textfield:
    Do Not copy the word CODE

    C:\combofix\combofix.txt
  • Then, just click the Zip button.
  • When finished, and if successful, a new file will have been created on your Desktop. You will be notified of what the file name is when the process has been completed.
Please attach that file to your next reply.

To attach a file, do the following:
  • Under the reply panel is the Attachments Panel
  • Browse for the attachment file you want to upload, then click the green Upload button
  • Once it has uploaded, click the Manage Current Attachments drop down box
  • Click on [external image: Posted Image] to insert the attachment into your post

Thanks
Post #20
here is the file that you ask combo fix . do you want a hijack file ?it is as an attachment

Attachments:

  • [attachment removed: Melissa_Rodriguez.zip]
Post #21
Hi Meche,

Finish the rest of the instructions. I'll give them to you again.

You can get a free antivirus program from any of these 3 vendors. Download only one and save it to your desktop. Do not install it yet.

Avast
Help and support can be found here Avast Forum
AVG
Help and support can be found here AVG Forum
Antivir PersonalEditionClassic
Help and support can be found here Avira Personal Support Forum

Next, Download the Norton Removal Tool from HERE and save it to your desktop. You will use it later.

Disconnect from the internet, go to add/remove programs and uninstall

Norton AntiSpam
Norton AntiVirus
Norton Internet Security
Norton Internet Security (Symantec Corporation)
Norton WMI Update
Symantec Network Drivers Update
Symantec Technical Support Web Controls

Reboot

Next double click Norton_Removal_Tool.exe to run the tool.

  • Follow the on-screen instructions.
  • Your computer may be restarted more than once, and you may be asked to repeat some steps after the computer restarts.
When the tool has finished, reboot and installl your new antivirus program.

Next, make sure your Windows firewall is turned on,

Click start, click control panel, click Security Center. At the bottom of Security Center click windows firewall. Ensure it is set to On.

Please obtain a new HJT log after you have finished all the steps and post it in your next reply.

Thanks
Post #22
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:17:19 PM, on 1/22/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Sony\Giga Pocket\shwserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\PROGRA~1\PANASO~1\LocalCom\lmsrvnt.exe
C:\PROGRA~1\PANASO~1\TRAPMO~1\Trapmnnt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCdb\VzFw.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Sony\Giga Pocket\RM_SV.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\sony\usbsircs\usbsircs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
N3 - Netscape 7: # Mozilla User Preferences
// This is a generated file!

user_pref("browser.activation.checkedNNFlag", true);
user_pref("browser.bookmarks.added_static_root", true);
user_pref("browser.history.last_page_visited", "http://bwp.techrepublic.com.com/search?dw-siteid=11&dw-ontid=6230&dw-ptid=5208&dw-edid=87");
user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src");
user_pref("browser.startup.homepage_override.mstone", "rv:1.0.2");
user_pref("browser.tabs.forceHide", true);
user_pref("intl.charsetmenu.browser.cache", "UTF-8, ISO-8859-1");
user_pref("ldap_2.prefs_migrated", true);
user_pref("mail.smtpservers", "");
user_pref("mail.ui.folderpane.version", 2);
user_pref("mailnews.global_html_domains.version", 2);
user_pref("mailnews.html_domains", "netscape.net,netscape.com,aol.com,cs.com,yahoo.com,hotmail.com,msn.com");
user_pref("mailnews.ui.threadpane.version", 2);
user_pref("prefs.converted-to-utf8", true);
user_pref("signo
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Melissa Rodriguez\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O4 - Global Startup: Remocon Driver.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase6662.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1232263077812
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1232263065687
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Giga Pocket Hardware Detector - Sony Corporation - C:\Program Files\Sony\Giga Pocket\shwserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\PACSPT~1.EXE
O23 - Service: Panasonic Local Printer Service - Panasonic Communications Co., Ltd. - C:\PROGRA~1\PANASO~1\LocalCom\lmsrvnt.exe
O23 - Service: Panasonic Trap Monitor Service - Panasonic - C:\PROGRA~1\PANASO~1\TRAPMO~1\Trapmnnt.exe
O23 - Service: Sony TV Tuner Controller - Sony Corporation - C:\Program Files\Sony\Giga Pocket\halsv.exe
O23 - Service: Sony TV Tuner Manager - Sony Corporation - C:\Program Files\Sony\Giga Pocket\RM_SV.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
O23 - Service: VAIO Entertainment File Import Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCdb\VzFw.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VCSW\VCSW.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\VmGateway.exe
O23 - Service: VAIO Media Video Server (VAIOMediaPlatform-VideoServer-AppServer) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Video\GPVSvr.exe
O23 - Service: VAIO Media Video Server (HTTP) (VAIOMediaPlatform-VideoServer-HTTP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Video Server (UPnP) (VAIOMediaPlatform-VideoServer-UPnP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\UPnPFramework.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

–
End of file - 11213 bytes
Post #23
Hi Meche,

You have your antivirus in place, good.

We'll do a check for any left over symantec folder, then I have one more scan for you to do.

Please download the OTMoveIt3 by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    Do not copy the word Quote

    :Files
    C:\Program Files\Common Files\Symantec Shared
    C:\Program Files\Norton Internet Security
    c:\program files\Symantec
    c:\documents and settings\Administrator\Application Data\Symantec
    c:\windows\Tasks\Symantec NetDetect.job
    c:\program files\PartyGaming
    c:\program files\PacificPoker

    :Commands
    [EmptyTemp]
    [Reboot]

  • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Next, Go here to run an online scannner from ESET:
http://www.eset.eu/online-scanner

(Note: You must use Internet Explorer for this scan.)

  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Disable your Antivirus software. You can usually do this with its Notfication Tray icon near the clock
  • Click Start
  • Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is Checked.
  • Click Scan.
  • Wait for the scan to finish.
  • Re-enable your Antivirus software.
  • A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. We will need this later.

    Extra note:
    To pause the Avast scanner
  • Right click the "a" icon near the clock
  • highlight Pause Provider
  • Click Resident shield
Don't forget to Resume it afterwards.
Please post back with the ESET log and a new HJT log and the OTMOVEIT3 log.

How's it running?

Thanks
Post #24
# version=4 # OnlineScanner.ocx=1.0.0.56 # OnlineScannerDLLA.dll=1, 0, 0, 51 # OnlineScannerDLLW.dll=1, 0, 0, 51 # OnlineScannerUninstaller.exe=1, 0, 0, 49 # vers_standard_module=3794 (20090123) # vers_arch_module=1.064 (20080214) # vers_adv_heur_module=1.066 (20070917) # EOSSerial=4b3286bb20360d40a9b11b7ca0a9e739 # end=finished # remove_checked=false # unwanted_checked=true # utc_time=2009-01-23 08:18:04 # local_time=2009-01-23 12:18:04 (-0800, Pacific Standard Time) # country="United States" # osver=5.1.2600 NT Service Pack 3 # scanned=384250 # found=5 # scan_time=3260 C:\Documents and Settings\All Users\Application Data\SecTaskMan\MWSBAR.DLL.q_1397D059_q probably a variant of Win32/Adware.SearchAid application E75F15F3DB5D4D933FC8A0C72C6441CE C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\MyToolbar12.zip Win32/Bagle.gen.zip worm 9F8504DFAB3E65FDEA239C2497C8977A C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudCgp.zip Win32/Bagle.gen.zip worm FD1B00A3FE19AD0BD34468CFE21ED2EA C:\Qoobox\Quarantine\C\WINDOWS\system32\msqpdxjxjlnkpa.dll.vir Win32/TrojanClicker.Agent.NFF trojan A94741E44EA9C2576253D1D1ADF3C5E5 C:\WINDOWS\system32\drivers\etc\hosts.bak Win32/Qhost.EJ trojan 7578EE56632CBF4DC53E637D32C7218E ESET
Post #25
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:45:33 PM, on 1/23/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Sony\Giga Pocket\shwserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\PANASO~1\LocalCom\lmsrvnt.exe
C:\PROGRA~1\PANASO~1\TRAPMO~1\Trapmnnt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCdb\VzFw.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Sony\Giga Pocket\RM_SV.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\sony\usbsircs\usbsircs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
N3 - Netscape 7: # Mozilla User Preferences
// This is a generated file!

user_pref("browser.activation.checkedNNFlag", true);
user_pref("browser.bookmarks.added_static_root", true);
user_pref("browser.history.last_page_visited", "http://bwp.techrepublic.com.com/search?dw-siteid=11&dw-ontid=6230&dw-ptid=5208&dw-edid=87");
user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src");
user_pref("browser.startup.homepage_override.mstone", "rv:1.0.2");
user_pref("browser.tabs.forceHide", true);
user_pref("intl.charsetmenu.browser.cache", "UTF-8, ISO-8859-1");
user_pref("ldap_2.prefs_migrated", true);
user_pref("mail.smtpservers", "");
user_pref("mail.ui.folderpane.version", 2);
user_pref("mailnews.global_html_domains.version", 2);
user_pref("mailnews.html_domains", "netscape.net,netscape.com,aol.com,cs.com,yahoo.com,hotmail.com,msn.com");
user_pref("mailnews.ui.threadpane.version", 2);
user_pref("prefs.converted-to-utf8", true);
user_pref("signo
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Melissa Rodriguez\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Remocon Driver.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/OnlineScanner.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase6662.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1232263077812
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1232263065687
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Giga Pocket Hardware Detector - Sony Corporation - C:\Program Files\Sony\Giga Pocket\shwserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\PACSPT~1.EXE
O23 - Service: Panasonic Local Printer Service - Panasonic Communications Co., Ltd. - C:\PROGRA~1\PANASO~1\LocalCom\lmsrvnt.exe
O23 - Service: Panasonic Trap Monitor Service - Panasonic - C:\PROGRA~1\PANASO~1\TRAPMO~1\Trapmnnt.exe
O23 - Service: Sony TV Tuner Controller - Sony Corporation - C:\Program Files\Sony\Giga Pocket\halsv.exe
O23 - Service: Sony TV Tuner Manager - Sony Corporation - C:\Program Files\Sony\Giga Pocket\RM_SV.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
O23 - Service: VAIO Entertainment File Import Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCdb\VzFw.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VCSW\VCSW.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\VmGateway.exe
O23 - Service: VAIO Media Video Server (VAIOMediaPlatform-VideoServer-AppServer) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Video\GPVSvr.exe
O23 - Service: VAIO Media Video Server (HTTP) (VAIOMediaPlatform-VideoServer-HTTP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Video Server (UPnP) (VAIOMediaPlatform-VideoServer-UPnP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\UPnPFramework.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

–
End of file - 11440 bytes
Post #26
========== FILES ========== File/Folder C:\Program Files\Common Files\Symantec Shared not found. File/Folder C:\Program Files\Norton Internet Security not found. File/Folder c:\program files\Symantec not found. c:\documents and settings\Administrator\Application Data\Symantec\Shared moved successfully. c:\documents and settings\Administrator\Application Data\Symantec moved successfully. File/Folder c:\windows\Tasks\Symantec NetDetect.job not found. c:\program files\PartyGaming\tmpUpgrade moved successfully. c:\program files\PartyGaming\Language\en_US\temp moved successfully. c:\program files\PartyGaming\Language\en_US moved successfully. c:\program files\PartyGaming\Language moved successfully. c:\program files\PartyGaming moved successfully. c:\program files\PacificPoker\PokerLobby\Media moved successfully. c:\program files\PacificPoker\PokerLobby moved successfully. c:\program files\PacificPoker\Poker\media moved successfully. c:\program files\PacificPoker\Poker moved successfully. c:\program files\PacificPoker\media moved successfully. c:\program files\PacificPoker\Login\media moved successfully. c:\program files\PacificPoker\Login moved successfully. c:\program files\PacificPoker\Chat moved successfully. c:\program files\PacificPoker\Cash\media moved successfully. c:\program files\PacificPoker\Cash moved successfully. c:\program files\PacificPoker moved successfully. ========== COMMANDS ========== User's Temp folder emptied. User's Temporary Internet Files folder emptied. User's Internet Explorer cache folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\JETE5.tmp scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\JETFACB.tmp scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_330.dat scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_5ac.dat scheduled to be deleted on reboot. Windows Temp folder emptied. Java cache emptied. FireFox cache emptied. Temp folders emptied. OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01232009_111110 Files moved on Reboot… File move failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot. File move failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be moved on reboot. File move failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be moved on reboot. File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot. File move failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be moved on reboot. C:\WINDOWS\temp\JETE5.tmp moved successfully. C:\WINDOWS\temp\JETFACB.tmp moved successfully. File C:\WINDOWS\temp\Perflib_Perfdata_330.dat not found! File C:\WINDOWS\temp\Perflib_Perfdata_5ac.dat not found! sorry i DID IT IN THREE REPLIES ESET,HJT ,OTMOVEIT3…. IT SEEMS IT WAS MESS UP THE REPORTS …. THANKS AND ABOUT MY computer it is running great. i have one question i go to my hard drive C:/Program files and i see three files that are in there that i thought they would be erase …they are party poker ,full tilt .org and poker stars .net . i can i erase those or should i just leave them there … i do not see those when i go to add remove programs to unstall programs…. thanks for everything
Post #27
Hi Meche,

i have one question i go to my hard drive C:/Program files and i see three files that are in there that i thought they would be erase …they are party poker ,full tilt .org and poker stars .net .

Yes you can delete those 3.

We have a couple of more to remove with OTMOVEIT3.
  • Please double-click OTMoveIt3.exe to run it.
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    Do not copy the word Quote

    :Files
    C:\Documents and Settings\All Users\Application Data\SecTaskMan\MWSBAR.*
    C:\WINDOWS\system32\drivers\etc\hosts.bak

  • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3
Spybot Quarantined files
  • Open Spybot, click Recovery,
  • check the box next to each item listed then click Purge
  • Empty your recycle bin
Please post back with the OTMOVEIT3 log and a new HJT log. If everthing is ok, we'll clean up our tools after you reply.

Thanks
Post #28 last edited
Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01232009_224941 this is the first file and then i will put the hijack file everything is good …
Post #29 last edited
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:01:07 PM, on 1/23/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Sony\Giga Pocket\shwserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\PROGRA~1\PANASO~1\LocalCom\lmsrvnt.exe
C:\PROGRA~1\PANASO~1\TRAPMO~1\Trapmnnt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCdb\VzFw.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Sony\Giga Pocket\RM_SV.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\sony\usbsircs\usbsircs.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
N3 - Netscape 7: # Mozilla User Preferences
// This is a generated file!

user_pref("browser.activation.checkedNNFlag", true);
user_pref("browser.bookmarks.added_static_root", true);
user_pref("browser.history.last_page_visited", "http://bwp.techrepublic.com.com/search?dw-siteid=11&dw-ontid=6230&dw-ptid=5208&dw-edid=87");
user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src");
user_pref("browser.startup.homepage_override.mstone", "rv:1.0.2");
user_pref("browser.tabs.forceHide", true);
user_pref("intl.charsetmenu.browser.cache", "UTF-8, ISO-8859-1");
user_pref("ldap_2.prefs_migrated", true);
user_pref("mail.smtpservers", "");
user_pref("mail.ui.folderpane.version", 2);
user_pref("mailnews.global_html_domains.version", 2);
user_pref("mailnews.html_domains", "netscape.net,netscape.com,aol.com,cs.com,yahoo.com,hotmail.com,msn.com");
user_pref("mailnews.ui.threadpane.version", 2);
user_pref("prefs.converted-to-utf8", true);
user_pref("signo
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Melissa Rodriguez\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Remocon Driver.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/OnlineScanner.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase6662.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1232263077812
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1232263065687
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Giga Pocket Hardware Detector - Sony Corporation - C:\Program Files\Sony\Giga Pocket\shwserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\PACSPT~1.EXE
O23 - Service: Panasonic Local Printer Service - Panasonic Communications Co., Ltd. - C:\PROGRA~1\PANASO~1\LocalCom\lmsrvnt.exe
O23 - Service: Panasonic Trap Monitor Service - Panasonic - C:\PROGRA~1\PANASO~1\TRAPMO~1\Trapmnnt.exe
O23 - Service: Sony TV Tuner Controller - Sony Corporation - C:\Program Files\Sony\Giga Pocket\halsv.exe
O23 - Service: Sony TV Tuner Manager - Sony Corporation - C:\Program Files\Sony\Giga Pocket\RM_SV.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
O23 - Service: VAIO Entertainment File Import Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCdb\VzFw.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VCSW\VCSW.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\VmGateway.exe
O23 - Service: VAIO Media Video Server (VAIOMediaPlatform-VideoServer-AppServer) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Video\GPVSvr.exe
O23 - Service: VAIO Media Video Server (HTTP) (VAIOMediaPlatform-VideoServer-HTTP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Video Server (UPnP) (VAIOMediaPlatform-VideoServer-UPnP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\UPnPFramework.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

–
End of file - 11506 bytes
may be i copy the file for the otmove wrong tell me if you want me do that again if not i wont and i will do what you say
Post #30 last edited
disregard the last two post i got the otmove to work here are the files you requested ========== FILES ========== C:\Documents and Settings\All Users\Application Data\SecTaskMan\MWSBAR.DLL.q_1397D059_q moved successfully. C:\Documents and Settings\All Users\Application Data\SecTaskMan\MWSBAR.DLL.q_1397D059_q.ini moved successfully. C:\WINDOWS\system32\drivers\etc\hosts.bak moved successfully. OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01232009_230650

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI