Spyware / Malware / Virus Removal

[Resolved] My PC can turn itself on! What the Tech?

15 min read

Looking for the outcome? Ask AI

lisafunkypants Topic Starter

Post #1January 8, 2009, 3:36 PM UTC

Hi Guys, my PC has a mind of its own and can turn itself on, so i quickly disconnect modem.
I have also noticed that my spyblaster has been deleted,
Did a malware scan which came up with nothing at that time.
Taking upto 6mins to load a page and files seems to overlap when scrolling in Documents for example

Any help is much appreciated.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:26:23, on 08/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
C:\apps\ABoard\ABoard.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\QTTask.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\STK02N\STK02NM.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Program Files\Windows Live Toolbar\msn_sl.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live OneCare Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: STK02N 2.3 PNP Monitor.lnk = ?
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\uk.htm
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} (Bebo Uploader Control) - http://www.bebo.com/files/BeboUploader.5.1.4.cab
O16 - DPF: {17D667BA-5675-4AAB-9221-08B9379384D4} (Image Uploader Control) - http://cdnimg.piczo.com/images/uploader/pi…st_uploader.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/OnlineScanner.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1202757372421
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://leahminiratssexy.spaces.live.com/Ph…ad/MsnPUpld.cab
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://bmm.imgag.com/imgag/cp/install/crusher-uk.cab
O16 - DPF: {BF6BBE9A-0656-4598-A0CD-32DAC03959B5} (Image Uploader 3.0 Control) - https://www.tescophoto.com/wpp/tesco/app/opcuploader.cab
O16 - DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} (Java Plug-in 1.5.0_02) -
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} (Java Plug-in 1.6.0_03) -
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} (Java Plug-in 1.6.0_05) -
O16 - DPF: {D1548A26-B8F6-4E86-AE74-E7062CCC2E2A} (igLoader Content on Demand) - http://www.miniclip.com/igloader/igloader.CAB
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.auctiva.com/hostedimages/active…oad/XUpload.ocx
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

–
End of file - 11638 bytes

Tomk

Post #2January 14, 2009, 7:58 PM UTC

Hi lisafunkypants,

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.

Open Spybot Search & Destroy.
In the Mode menu click Advanced mode if not already selected.
Choose Yes at the Warning prompt.
Expand the Tools menu.
Click Resident.
Uncheck the Resident "TeaTimer" (Protection of overall system settings) active. box.
In the File menu click Exit to exit Spybot Search & Destroy.

Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:

Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
Scroll down to where it says "Java Runtime Environment (JRE) 6 Update 11…allows end-users to run Java applications".
Click the "Download" button to the right.
Select your Platform: "Windows".
Select your Language: "Multi-language".
Read the License Agreement, and then check the box that says: "Accept License Agreement".
Click Continue and the page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u11-windows-i586-p.exe to install the newest version.

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Then

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).

Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

lisafunkypants

Post #3January 16, 2009, 11:07 AM UTC

Hi Tomk

pc is really slow
It was constantly says "Not Responding"
and will pause, then there are 10 or so new tabs opened, which say "connecting" then it shuts down windows,

Malwarebytes' Anti-Malware 1.33
Database version: 1657
Windows 5.1.2600 Service Pack 3

16/01/2009 10:15:16
mbam-log-2009-01-16 (10-15-16).txt

Scan type: Quick Scan
Objects scanned: 238527
Time elapsed: 50 minute(s), 45 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
D:\Documents and Settings\Leyah\Desktop\ZwinkySetup2.2.60.11-2.exe (Adware.Myway) -> Quarantined and deleted successfully.

——————————————————-

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:16:37, on 16/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
C:\apps\ABoard\ABoard.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\apps\ABoard\AOSD.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\STK02N\STK02NM.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\trend micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - (no file)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: STK02N 2.3 PNP Monitor.lnk = ?
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\uk.htm
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} (Bebo Uploader Control) - http://www.bebo.com/files/BeboUploader.5.1.4.cab
O16 - DPF: {17D667BA-5675-4AAB-9221-08B9379384D4} (Image Uploader Control) - http://cdnimg.piczo.com/images/uploader/pi…st_uploader.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/OnlineScanner.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1202757372421
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://leahminiratssexy.spaces.live.com/Ph…ad/MsnPUpld.cab
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://bmm.imgag.com/imgag/cp/install/crusher-uk.cab
O16 - DPF: {BF6BBE9A-0656-4598-A0CD-32DAC03959B5} (Image Uploader 3.0 Control) - https://www.tescophoto.com/wpp/tesco/app/opcuploader.cab
O16 - DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} (Java Plug-in 1.5.0_02) -
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} (Java Plug-in 1.6.0_03) -
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} (Java Plug-in 1.6.0_05) -
O16 - DPF: {D1548A26-B8F6-4E86-AE74-E7062CCC2E2A} (igLoader Content on Demand) - http://www.miniclip.com/igloader/igloader.CAB
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.auctiva.com/hostedimages/active…oad/XUpload.ocx
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

–
End of file - 11320 bytes

Tomk

Post #4January 16, 2009, 4:09 PM UTC

lisafunkypants,

JavaRa …by: Paul McLain and Fred de Vries

Please download JavaRa (Copyright © 2008 RaProducts.org) and unzip it to your desktop.
***Please close any instances of Internet Explorer before continuing!***
Print these instructions…you won't have Internet access during this particular phase!

Double-click on JavaRa.exe to start the program.
From the drop-down menu, choose English or the appropriate language…and click on Select.
JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
A logfile will pop up. Please save it to a convenient location.
Copy and paste the contents of the JavaRa log, in your next reply.

Please download DDS and save it to your desktop.

Disable any script blocking protection
Double click dds.scr to run the tool.
When done, DDS.txt will open.
Click Yes at the next prompt for Optional Scan.
Save both reports to your desktop.

—————————————————

Post the contents of the DDS.txt report in your next reply
Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.

lisafunkypants

Post #5January 16, 2009, 9:34 PM UTC

JavaRa 1.11 Removal Log.Report follows after line.————————————The JavaRa removal process was started on Sun Sep 21 16:30:21 2008

Found and removed: C:\Program Files\Java\jre1.5.0_02Found and removed: C:\Program Files\Java\jre1.6.0_03Found and removed: C:\Program Files\Java\jre1.6.0_05Found and removed: C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64Found and removed: Software\JavaSoft\Java2D\1.5.0_02Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D510002Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D510002Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D510002Found and removed: SOFTWARE\Classes\JavaPlugin.150_02Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled.1.5.0.0Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.5.0_02Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.5Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.5.0_02Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D510002Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D510002Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0150020}Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D610003Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D610005Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610003Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610005Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610003Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610005Found and removed: SOFTWARE\Classes\JavaPlugin.160_03Found and removed: SOFTWARE\Classes\JavaPlugin.160_05Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_03Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_05Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_03Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_05Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610003Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610005Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D610003Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D610005Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610003Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610005Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160030}Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160050}Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.5.0_02Found and removed: Software\Classes\JavaPlugin.160_03Found and removed: Software\Classes\JavaPlugin.160_05Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.5.0_02\Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_03\Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_05\Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_03\bin\Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_05\bin\Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Common Files\Java\Update\Base Images\jre1.6.0.b105\patch-jre1.6.0_03.b05\Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Common Files\Java\Update\Base Images\jre1.6.0.b105\patch-jre1.6.0_05.b13\Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\core1.zipFound and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\core2.zipFound and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\core3.zipFound and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.6.0_03Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.6.0_05Found and removed: Software\JavaSoft\Java2D\1.6.0_03Found and removed: Software\JavaSoft\Java2D\1.6.0_05Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_03Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_05Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}————————————Finished reporting.JavaRa 1.13 Removal Log.Report follows after line.————————————The JavaRa removal process was started on Fri Jan 16 20:35:12 2009

Found and removed: C:\Program Files\Java\jre1.6.0_07Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}————————————Finished reporting.

——————————————

DDS (Ver_09-01-07.01) - NTFSx86
Run by [removed] at 20:37:50.06 on 16/01/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.511.79 [GMT 0:00]

AV: AVG 7.5.552 *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
C:\apps\ABoard\ABoard.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\apps\ABoard\AOSD.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\STK02N\STK02NM.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe
C:\WINDOWS\system32\msiexec.exe
D:\Documents and Settings\Renshai Warrior.048919120306.001\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/ig
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
uInternet Settings,ProxyOverride = *.local
mSearchAssistant = hxxp://www.google.com/ie
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Advanced SystemCare 3] "c:\program files\iobit\advanced systemcare 3\AWC.exe" /startup
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [AlcWzrd] ALCWZRD.EXE
mRun: [Ulead AutoDetector v2] c:\program files\common files\ulead systems\autodetector\monitor.exe
mRun: [ACTIVBOARD] c:\apps\aboard\ABoard.exe
mRun: [AVG7_CC] c:\progra~1\grisoft\avg7\avgcc.exe /STARTUP
mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRun: [AVG7_Run] c:\progra~1\grisoft\avg7\avgw.exe /RUNONCE
StartupFolder: d:\docume~1\alluse~1\startm~1\programs\startup\stk02n 2.3 pnp monitor.lnk - c:\windows\stk02n\STK02NM.exe
IE: &ieSpell Options - c:\program files\iespell\iespell.dll/SPELLOPTION.HTM
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: Check &Spelling - c:\program files\iespell\iespell.dll/SPELLCHECK.HTM
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - res://c:\program files\iespell\iespell.dll/SPELLCHECK.HTM
IE: {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - res://c:\program files\iespell\iespell.dll/SPELLOPTION.HTM
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
AppInit_DLLs: MsgPlusLoader.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll

============= SERVICES / DRIVERS ===============

R0 IKFileSec;File Security Driver;c:\windows\system32\drivers\ikfilesec.sys [2008-2-9 41864]
R1 Avg7Core;AVG7 Kernel;c:\windows\system32\drivers\avg7core.sys [2008-2-9 821856]
R1 Avg7RsW;AVG7 Wrap Driver;c:\windows\system32\drivers\avg7rsw.sys [2008-2-9 4224]
R1 Avg7RsXP;AVG7 Resident Driver XP;c:\windows\system32\drivers\avg7rsxp.sys [2008-2-9 27776]
R1 AvgClean;AVG7 Clean Driver;c:\windows\system32\drivers\avgclean.sys [2008-2-9 10760]
R1 IKSysFlt;System Filter Driver;c:\windows\system32\drivers\iksysflt.sys [2008-2-9 66952]
R4 Avg7Alrt;AVG7 Alert Manager Server;c:\progra~1\grisoft\avg7\avgamsvr.exe [2008-2-9 418816]
R4 Avg7UpdSvc;AVG7 Update Service;c:\progra~1\grisoft\avg7\avgupsvc.exe [2008-2-9 49664]
R4 AVGEMS;AVG E-mail Scanner;c:\progra~1\grisoft\avg7\avgemc.exe [2008-2-9 406528]
R4 AvgTdi;AVG Network Redirector;c:\windows\system32\drivers\avgtdi.sys [2008-2-9 4960]
R4 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-1-13 55136]
R4 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
S1 pctfw2;pctfw2;c:\windows\system32\drivers\pctfw2.sys [2008-2-9 218504]
S3 fsssvc;Windows Live Family Safety;c:\program files\windows live\family safety\fsssvc.exe [2008-12-8 533344]
S3 PAC207;SoC PC-Camer@;c:\windows\system32\drivers\PFC027.sys [2005-2-24 162176]

============== File Associations ===============

regfile=regedit.exe "%1" %*

=============== Created Last 30 ================

2009-01-16 08:45 410,984 a——- c:\windows\system32\deploytk.dll
2009-01-16 08:45 73,728 a——- c:\windows\system32\javacpl.cpl
2009-01-14 00:17 58,952 a——- c:\windows\system32\MsgPlusLoader.dll
2009-01-13 21:11 55,136 a——- c:\windows\system32\drivers\fssfltr_tdi.sys
2009-01-13 20:59 –d—– c:\program files\MessengerPlus! 3
2009-01-13 15:04 –d—– d:\docume~1\rensha~1.001\applic~1\IObit
2009-01-12 22:56 –d—– c:\windows\SxsCaPendDel
2009-01-12 22:45 –d—– d:\documents and settings\renshai warrior.048919120306.001\Tracing
2009-01-12 22:43 –d—– c:\program files\Microsoft Office Outlook Connector
2009-01-12 22:36 –d—– c:\program files\Microsoft
2009-01-12 22:35 –d—– c:\program files\Windows Live SkyDrive
2009-01-11 18:42 –d—– d:\docume~1\rensha~1.001\applic~1\Ashtons. Family Resort
2009-01-11 18:42 –d—– d:\docume~1\alluse~1\applic~1\Ashtons. Family Resort
2009-01-10 16:14 -cd-h— C:\LG3G
2009-01-10 16:14 –d—– d:\docume~1\rensha~1.001\applic~1\LG Electronics
2009-01-08 17:30 21,632 a——- c:\windows\system32\drivers\lgusbmodem.sys
2009-01-08 17:30 19,840 a——- c:\windows\system32\drivers\lgusbdiag.sys
2009-01-08 17:30 12,416 a——- c:\windows\system32\drivers\lgusbbus.sys
2009-01-08 17:30 –d—– c:\program files\LG Electronics
2009-01-08 17:27 –d—– c:\program files\LG PC Suite 2
2009-01-08 16:57 244 ac–h— C:\sqmnoopt19.sqm
2009-01-08 16:57 232 ac–h— C:\sqmdata19.sqm
2009-01-06 16:27 –d—– d:\docume~1\rensha~1.001\applic~1\Pogo Games
2008-12-26 19:52 101,520 a——- c:\windows\system32\drivers\STK02NW2.sys
2008-12-26 19:52 33,728 a——- c:\windows\system32\drivers\STK02NW1.sys
2008-12-26 19:52 40,960 a——- c:\windows\system32\STK02NP.ax
2008-12-26 19:52 –d—– c:\windows\STK02N

==================== Find3M ====================

2009-01-14 16:11 38,496 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-14 16:11 15,504 a——- c:\windows\system32\drivers\mbam.sys
2009-01-03 22:43 378 ac—— d:\docume~1\rensha~1.001\applic~1\wklnhst.dat
2008-12-13 06:40 3,593,216 a——- c:\windows\system32\dllcache\mshtml.dll
2008-12-11 10:57 333,952 a——- c:\windows\system32\drivers\srv.sys
2008-12-11 10:57 333,952 a——- c:\windows\system32\dllcache\srv.sys
2008-12-04 22:55 307,560 a——- c:\windows\WLXPGSS.SCR
2008-12-02 22:37 49,480 a——- c:\windows\system32\sirenacm.dll
2008-10-24 11:21 455,296 a——- c:\windows\system32\dllcache\mrxsmb.sys
2008-10-23 12:36 286,720 a——- c:\windows\system32\gdi32.dll
2008-10-23 12:36 286,720 ——– c:\windows\system32\dllcache\gdi32.dll
2008-05-28 23:07 32,768 ac-sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008052920080530\index.dat

============= FINISH: 20:38:21.56 ===============

Attachments:

📎Attach.txt

Tomk

Post #6January 16, 2009, 9:46 PM UTC

lisafunkypants,

Do you use Messenger Plus! 3?

Disable resident protections (Antivirus…); you'll re-enable them after the scan

Download Lop S&D < here

Double-click Lop S&D.exe
Choose the language, then choose Option 1 (Search)
Wait till the end of the scan
Post the log which is created: (%SystemDrive%\lopR.txt)

lisafunkypants

Post #7January 17, 2009, 12:34 AM UTC

Hi TomK
My daughter uses Messenger3 so it appears
I am sure you will find some undesirable programs on this list as i try to monitor what is being downloaded
but it sometimes gets overlooked ie: Limewire which i do not like and remove when i see she has downloaded.

——————–\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Intel® Pentium® 4 CPU 3.06GHz )
BIOS : Award Medallion BIOS v6.00PG
USER : Renshai Warrior ( Administrator )
BOOT : Normal boot
Antivirus : AVG 7.5.552 7.5.552 (Not Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:29 Go (Free:15 Go)
D:\ (Local Disk) - NTFS - Total:113 Go (Free:25 Go)
E:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( 17/01/2009| 0:18 )

——————–\\ Listing folders in APPLIC~1

[10/03/2006|13:30] D:\DOCUME~1\ACCOUN~1.)\APPLIC~1\AOL
[07/02/2006|16:30] D:\DOCUME~1\ACCOUN~1.)\APPLIC~1\CyberLink
[26/01/2006|19:32] D:\DOCUME~1\ACCOUN~1.)\APPLIC~1\Help
[18/10/2005|03:15] D:\DOCUME~1\ACCOUN~1.)\APPLIC~1\Identities
[26/01/2006|21:20] D:\DOCUME~1\ACCOUN~1.)\APPLIC~1\Leadertech
[17/10/2005|19:38] D:\DOCUME~1\ACCOUN~1.)\APPLIC~1\Macromedia
[06/03/2006|18:02] D:\DOCUME~1\ACCOUN~1.)\APPLIC~1\Microsoft
[26/01/2006|22:26] D:\DOCUME~1\ACCOUN~1.)\APPLIC~1\OD2
[17/10/2005|19:37] D:\DOCUME~1\ACCOUN~1.)\APPLIC~1\Real
[07/03/2006|08:22] D:\DOCUME~1\ACCOUN~1.)\APPLIC~1\Skype
[26/01/2006|23:10] D:\DOCUME~1\ACCOUN~1.)\APPLIC~1\Sonic
[26/01/2006|19:19] D:\DOCUME~1\ACCOUN~1.)\APPLIC~1\Sun
[29/01/2006|20:12] D:\DOCUME~1\ACCOUN~1.)\APPLIC~1\Symantec
[22/02/2006|11:20] D:\DOCUME~1\ACCOUN~1.)\APPLIC~1\Template
[07/02/2006|16:29] D:\DOCUME~1\ACCOUN~1.)\APPLIC~1\Ulead Systems
[17/10/2005|19:32] D:\DOCUME~1\ACCOUN~1.)\APPLIC~1\You've Got Pictures Screensaver

[25/09/2008|12:30] D:\DOCUME~1\ACCOUN~2.)\APPLIC~1\Adobe
[25/09/2008|12:30] D:\DOCUME~1\ACCOUN~2.)\APPLIC~1\AOL
[25/09/2008|12:30] D:\DOCUME~1\ACCOUN~2.)\APPLIC~1\Identities
[25/09/2008|12:30] D:\DOCUME~1\ACCOUN~2.)\APPLIC~1\Leadertech
[25/09/2008|12:30] D:\DOCUME~1\ACCOUN~2.)\APPLIC~1\Macromedia
[25/09/2008|12:30] D:\DOCUME~1\ACCOUN~2.)\APPLIC~1\Microsoft
[25/09/2008|12:30] D:\DOCUME~1\ACCOUN~2.)\APPLIC~1\Real
[25/09/2008|12:30] D:\DOCUME~1\ACCOUN~2.)\APPLIC~1\Sonic
[25/09/2008|12:30] D:\DOCUME~1\ACCOUN~2.)\APPLIC~1\Symantec
[25/09/2008|12:30] D:\DOCUME~1\ACCOUN~2.)\APPLIC~1\You've Got Pictures Screensaver

[10/03/2006|13:30] D:\DOCUME~1\ADMINI~1\APPLIC~1\AOL
[09/03/2006|18:03] D:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
[09/03/2006|18:03] D:\DOCUME~1\ADMINI~1\APPLIC~1\Macromedia
[09/03/2006|18:03] D:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
[09/03/2006|18:03] D:\DOCUME~1\ADMINI~1\APPLIC~1\Real
[17/10/2005|12:34] D:\DOCUME~1\ADMINI~1\APPLIC~1\Symantec
[09/03/2006|18:03] D:\DOCUME~1\ADMINI~1\APPLIC~1\You've Got Pictures Screensaver

[18/04/2006|16:57] D:\DOCUME~1\ADMINI~1.SAM\APPLIC~1\AOL
[18/04/2006|16:57] D:\DOCUME~1\ADMINI~1.SAM\APPLIC~1\Identities
[18/04/2006|16:57] D:\DOCUME~1\ADMINI~1.SAM\APPLIC~1\Macromedia
[18/04/2006|16:57] D:\DOCUME~1\ADMINI~1.SAM\APPLIC~1\Microsoft
[18/04/2006|16:57] D:\DOCUME~1\ADMINI~1.SAM\APPLIC~1\Real
[17/10/2005|12:34] D:\DOCUME~1\ADMINI~1.SAM\APPLIC~1\Symantec
[18/04/2006|16:57] D:\DOCUME~1\ADMINI~1.SAM\APPLIC~1\You've Got Pictures Screensaver

[11/12/2008|17:04] D:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[26/05/2006|00:12] D:\DOCUME~1\ALLUSE~1\APPLIC~1\ACIDPEAKPLAYVGA
[23/09/2008|10:20] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[12/02/2008|11:27] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe Systems
[09/02/2008|21:21] D:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
[19/02/2008|14:59] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
[25/12/2007|08:15] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[11/01/2009|18:42] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Ashtons. Family Resort
[16/01/2009|17:00] D:\DOCUME~1\ALLUSE~1\APPLIC~1\avg7
[22/04/2008|14:10] D:\DOCUME~1\ALLUSE~1\APPLIC~1\avg8(2)
[06/03/2006|11:46] D:\DOCUME~1\ALLUSE~1\APPLIC~1\blueyonder
[11/05/2007|20:06] D:\DOCUME~1\ALLUSE~1\APPLIC~1\BVRP Software
[09/11/2007|10:03] D:\DOCUME~1\ALLUSE~1\APPLIC~1\CanonBJ
[17/10/2005|13:31] D:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
[15/06/2008|11:17] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Exetender
[04/03/2007|16:48] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Fileroadreferror
[22/09/2008|11:24] D:\DOCUME~1\ALLUSE~1\APPLIC~1\FLEXnet
[09/08/2008|13:48] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Gogii
[10/08/2008|13:27] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[07/09/2006|10:28] D:\DOCUME~1\ALLUSE~1\APPLIC~1\GrimActiveFilm16
[22/04/2008|10:03] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft
[20/02/2008|19:06] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations
[24/02/2008|00:02] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
[07/03/2007|10:26] D:\DOCUME~1\ALLUSE~1\APPLIC~1\logs
[27/08/2008|09:20] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
[25/05/2006|16:17] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
[16/06/2008|20:30] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Metaboli Player
[12/01/2009|22:56] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[14/01/2009|12:36] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
[06/03/2006|11:52] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Motive
[06/03/2006|11:29] D:\DOCUME~1\ALLUSE~1\APPLIC~1\MotiveSysIDs
[11/08/2008|22:01] D:\DOCUME~1\ALLUSE~1\APPLIC~1\MumboJumbo
[21/09/2008|15:14] D:\DOCUME~1\ALLUSE~1\APPLIC~1\NortonInstaller
[23/09/2008|10:42] D:\DOCUME~1\ALLUSE~1\APPLIC~1\NOS
[17/05/2006|18:35] D:\DOCUME~1\ALLUSE~1\APPLIC~1\nView_Profiles
[17/10/2005|12:37] D:\DOCUME~1\ALLUSE~1\APPLIC~1\OD2
[05/08/2007|12:35] D:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Suite
[20/03/2007|20:08] D:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Tools
[18/12/2008|15:06] D:\DOCUME~1\ALLUSE~1\APPLIC~1\PlayFirst
[18/03/2006|12:40] D:\DOCUME~1\ALLUSE~1\APPLIC~1\POPWWPROFILES
[22/11/2007|13:01] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Pure Networks
[17/10/2005|12:32] D:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
[26/08/2006|13:54] D:\DOCUME~1\ALLUSE~1\APPLIC~1\RTE
[09/08/2006|13:01] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Rule Readme Real 16
[30/11/2008|19:08] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Sandlot Games
[17/10/2005|20:15] D:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
[31/07/2008|19:44] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
[12/02/2008|20:19] D:\DOCUME~1\ALLUSE~1\APPLIC~1\SmartSound Software Inc
[21/09/2008|19:02] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
[17/01/2009|00:11] D:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[28/09/2008|18:09] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Trymedia
[13/02/2007|11:19] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Ubisoft
[30/09/2007|16:51] D:\DOCUME~1\ALLUSE~1\APPLIC~1\UDL
[31/07/2008|15:24] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Ulead Systems
[17/10/2005|12:32] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
[03/05/2006|13:25] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[15/02/2007|10:16] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
[04/11/2008|16:50] D:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
[06/08/2008|12:24] D:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom

[09/02/2008|21:24] D:\DOCUME~1\DEFAUL~1\APPLIC~1\AOL
[09/02/2008|21:24] D:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[09/02/2008|21:24] D:\DOCUME~1\DEFAUL~1\APPLIC~1\Macromedia
[09/02/2008|21:24] D:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
[09/02/2008|21:24] D:\DOCUME~1\DEFAUL~1\APPLIC~1\Real
[17/10/2005|12:34] D:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec
[17/10/2005|12:32] D:\DOCUME~1\DEFAUL~1\APPLIC~1\You've Got Pictures Screensaver

[25/09/2008|12:30] D:\DOCUME~1\LE-LES~1\APPLIC~1\AOL
[25/09/2008|12:30] D:\DOCUME~1\LE-LES~1\APPLIC~1\CyberLink
[25/09/2008|12:30] D:\DOCUME~1\LE-LES~1\APPLIC~1\Identities
[25/09/2008|12:30] D:\DOCUME~1\LE-LES~1\APPLIC~1\Macromedia
[25/09/2008|12:30] D:\DOCUME~1\LE-LES~1\APPLIC~1\Microsoft
[25/09/2008|12:30] D:\DOCUME~1\LE-LES~1\APPLIC~1\OD2
[25/09/2008|12:30] D:\DOCUME~1\LE-LES~1\APPLIC~1\Real
[25/09/2008|12:30] D:\DOCUME~1\LE-LES~1\APPLIC~1\Sun
[25/09/2008|12:30] D:\DOCUME~1\LE-LES~1\APPLIC~1\Symantec
[25/09/2008|12:30] D:\DOCUME~1\LE-LES~1\APPLIC~1\You've Got Pictures Screensaver

[27/01/2006|14:25] D:\DOCUME~1\lisa\APPLIC~1\Adobe
[10/03/2006|13:30] D:\DOCUME~1\lisa\APPLIC~1\AOL
[17/10/2005|19:38] D:\DOCUME~1\lisa\APPLIC~1\Macromedia
[29/01/2006|20:12] D:\DOCUME~1\lisa\APPLIC~1\Microsoft
[27/01/2006|13:21] D:\DOCUME~1\lisa\APPLIC~1\OD2
[29/01/2006|20:12] D:\DOCUME~1\lisa\APPLIC~1\Real

[26/08/2006|14:11] D:\DOCUME~1\LISA~1.048\APPLIC~1\Adobe
[31/08/2006|23:32] D:\DOCUME~1\LISA~1.048\APPLIC~1\AdobeUM
[13/08/2006|00:02] D:\DOCUME~1\LISA~1.048\APPLIC~1\AOL
[06/09/2006|12:49] D:\DOCUME~1\LISA~1.048\APPLIC~1\Apple Computer
[31/08/2006|20:04] D:\DOCUME~1\LISA~1.048\APPLIC~1\ClockPlusSend
[23/08/2006|11:56] D:\DOCUME~1\LISA~1.048\APPLIC~1\CyberLink
[16/10/2006|07:47] D:\DOCUME~1\LISA~1.048\APPLIC~1\Google
[26/08/2006|14:42] D:\DOCUME~1\LISA~1.048\APPLIC~1\Help
[13/08/2006|00:02] D:\DOCUME~1\LISA~1.048\APPLIC~1\Identities
[31/08/2006|22:47] D:\DOCUME~1\LISA~1.048\APPLIC~1\Lavasoft
[12/08/2006|17:25] D:\DOCUME~1\LISA~1.048\APPLIC~1\Leadertech
[31/07/2008|19:44] D:\DOCUME~1\LISA~1.048\APPLIC~1\LimeWire
[13/08/2006|00:02] D:\DOCUME~1\LISA~1.048\APPLIC~1\Macromedia
[29/09/2006|09:29] D:\DOCUME~1\LISA~1.048\APPLIC~1\Microsoft
[21/09/2006|18:51] D:\DOCUME~1\LISA~1.048\APPLIC~1\Nokia
[21/09/2006|18:52] D:\DOCUME~1\LISA~1.048\APPLIC~1\Nokia Multimedia Player
[13/08/2006|09:54] D:\DOCUME~1\LISA~1.048\APPLIC~1\OD2
[21/09/2006|17:29] D:\DOCUME~1\LISA~1.048\APPLIC~1\PC Suite
[23/08/2006|21:32] D:\DOCUME~1\LISA~1.048\APPLIC~1\Real
[26/08/2006|13:54] D:\DOCUME~1\LISA~1.048\APPLIC~1\RTE
[22/08/2006|15:18] D:\DOCUME~1\LISA~1.048\APPLIC~1\Skype
[12/08/2006|17:29] D:\DOCUME~1\LISA~1.048\APPLIC~1\Sonic
[01/09/2006|08:24] D:\DOCUME~1\LISA~1.048\APPLIC~1\stupid draw
[12/08/2006|17:01] D:\DOCUME~1\LISA~1.048\APPLIC~1\Sun
[22/08/2006|14:06] D:\DOCUME~1\LISA~1.048\APPLIC~1\Symantec
[29/09/2006|09:29] D:\DOCUME~1\LISA~1.048\APPLIC~1\Template
[26/10/2006|16:47] D:\DOCUME~1\LISA~1.048\APPLIC~1\Ulead Systems
[13/08/2006|00:02] D:\DOCUME~1\LISA~1.048\APPLIC~1\You've Got Pictures Screensaver

[25/09/2008|12:29] D:\DOCUME~1\LISA04~1.000\APPLIC~1\Adobe
[25/09/2008|12:29] D:\DOCUME~1\LISA04~1.000\APPLIC~1\AdobeUM
[25/09/2008|12:29] D:\DOCUME~1\LISA04~1.000\APPLIC~1\AOL
[25/09/2008|12:29] D:\DOCUME~1\LISA04~1.000\APPLIC~1\CyberLink
[25/09/2008|12:29] D:\DOCUME~1\LISA04~1.000\APPLIC~1\Google
[25/09/2008|12:29] D:\DOCUME~1\LISA04~1.000\APPLIC~1\Help
[25/09/2008|12:29] D:\DOCUME~1\LISA04~1.000\APPLIC~1\Identities
[25/09/2008|12:29] D:\DOCUME~1\LISA04~1.000\APPLIC~1\IDLELICENSE
[25/09/2008|12:29] D:\DOCUME~1\LISA04~1.000\APPLIC~1\Lavasoft
[25/09/2008|12:29] D:\DOCUME~1\LISA04~1.000\APPLIC~1\Leadertech
[25/09/2008|12:29] D:\DOCUME~1\LISA04~1.000\APPLIC~1\LimeWire
[25/09/2008|12:29] D:\DOCUME~1\LISA04~1.000\APPLIC~1\Macromedia
[25/09/2008|12:29] D:\DOCUME~1\LISA04~1.000\APPLIC~1\Microsoft
[25/09/2008|12:29] D:\DOCUME~1\LISA04~1.000\APPLIC~1\OD2
[25/09/2008|12:29] D:\DOCUME~1\LISA04~1.000\APPLIC~1\PC Tools
[25/09/2008|12:29] D:\DOCUME~1\LISA04~1.000\APPLIC~1\Real
[25/09/2008|12:29] D:\DOCUME~1\LISA04~1.000\APPLIC~1\Screenshot Sender
[25/09/2008|12:29] D:\DOCUME~1\LISA04~1.000\APPLIC~1\Skype
[25/09/2008|12:29] D:\DOCUME~1\LISA04~1.000\APPLIC~1\Sonic
[25/09/2008|12:29] D:\DOCUME~1\LISA04~1.000\APPLIC~1\Sun
[25/09/2008|12:29] D:\DOCUME~1\LISA04~1.000\APPLIC~1\Symantec
[25/09/2008|12:29] D:\DOCUME~1\LISA04~1.000\APPLIC~1\Template
[25/09/2008|12:29] D:\DOCUME~1\LISA04~1.000\APPLIC~1\THQ
[25/09/2008|12:29] D:\DOCUME~1\LISA04~1.000\APPLIC~1\Ulead Systems
[25/09/2008|12:29] D:\DOCUME~1\LISA04~1.000\APPLIC~1\Webroot
[25/09/2008|12:29] D:\DOCUME~1\LISA04~1.000\APPLIC~1\You've Got Pictures Screensaver

[31/01/2006|22:04] D:\DOCUME~1\LISA~1.SN0\APPLIC~1\Adobe
[31/01/2006|22:05] D:\DOCUME~1\LISA~1.SN0\APPLIC~1\AdobeUM
[10/03/2006|13:30] D:\DOCUME~1\LISA~1.SN0\APPLIC~1\AOL
[02/02/2006|21:04] D:\DOCUME~1\LISA~1.SN0\APPLIC~1\CyberLink
[29/01/2006|22:55] D:\DOCUME~1\LISA~1.SN0\APPLIC~1\Help
[18/10/2005|03:15] D:\DOCUME~1\LISA~1.SN0\APPLIC~1\Identities
[29/01/2006|23:16] D:\DOCUME~1\LISA~1.SN0\APPLIC~1\Leadertech
[31/07/2008|19:44] D:\DOCUME~1\LISA~1.SN0\APPLIC~1\LimeWire
[06/03/2006|11:45] D:\DOCUME~1\LISA~1.SN0\APPLIC~1\Macromedia
[06/03/2006|16:18] D:\DOCUME~1\LISA~1.SN0\APPLIC~1\Microsoft
[06/03/2006|13:15] D:\DOCUME~1\LISA~1.SN0\APPLIC~1\Motive
[06/03/2006|15:57] D:\DOCUME~1\LISA~1.SN0\APPLIC~1\MSNInstaller
[01/02/2006|16:07] D:\DOCUME~1\LISA~1.SN0\APPLIC~1\OD2
[17/10/2005|19:37] D:\DOCUME~1\LISA~1.SN0\APPLIC~1\Real
[17/02/2006|19:02] D:\DOCUME~1\LISA~1.SN0\APPLIC~1\Sonic
[08/02/2006|09:31] D:\DOCUME~1\LISA~1.SN0\APPLIC~1\Sun
[21/02/2006|09:08] D:\DOCUME~1\LISA~1.SN0\APPLIC~1\Symantec
[03/03/2006|17:08] D:\DOCUME~1\LISA~1.SN0\APPLIC~1\Template
[14/02/2006|12:54] D:\DOCUME~1\LISA~1.SN0\APPLIC~1\Ulead Systems
[17/10/2005|19:32] D:\DOCUME~1\LISA~1.SN0\APPLIC~1\You've Got Pictures Screensaver

[30/07/2006|11:06] D:\DOCUME~1\LITTLE~1\APPLIC~1\Adobe
[30/07/2006|11:06] D:\DOCUME~1\LITTLE~1\APPLIC~1\AdobeUM
[29/07/2006|19:19] D:\DOCUME~1\LITTLE~1\APPLIC~1\AOL
[31/07/2006|12:41] D:\DOCUME~1\LITTLE~1\APPLIC~1\CyberLink
[31/07/2006|14:10] D:\DOCUME~1\LITTLE~1\APPLIC~1\Google
[08/08/2006|15:41] D:\DOCUME~1\LITTLE~1\APPLIC~1\Help
[29/07/2006|19:19] D:\DOCUME~1\LITTLE~1\APPLIC~1\Identities
[30/07/2006|09:43] D:\DOCUME~1\LITTLE~1\APPLIC~1\Macromedia
[05/08/2006|13:45] D:\DOCUME~1\LITTLE~1\APPLIC~1\Microsoft
[30/07/2006|09:27] D:\DOCUME~1\LITTLE~1\APPLIC~1\OD2
[29/07/2006|19:19] D:\DOCUME~1\LITTLE~1\APPLIC~1\Real
[31/07/2006|12:55] D:\DOCUME~1\LITTLE~1\APPLIC~1\Sun
[02/08/2006|21:14] D:\DOCUME~1\LITTLE~1\APPLIC~1\Symantec
[09/08/2006|18:56] D:\DOCUME~1\LITTLE~1\APPLIC~1\Ulead Systems
[29/07/2006|19:19] D:\DOCUME~1\LITTLE~1\APPLIC~1\You've Got Pictures Screensaver

[22/04/2008|14:10] D:\DOCUME~1\LOCALS~1\APPLIC~1\AVG7
[22/04/2008|10:38] D:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[13/11/2007|09:31] D:\DOCUME~1\LOCALS~1\APPLIC~1\Symantec

[29/01/2006|20:11] D:\DOCUME~1\LOCALS~1.NTA\APPLIC~1\Microsoft

[15/02/2006|21:27] D:\DOCUME~1\LOCALS~1.000\APPLIC~1\Microsoft

[17/10/2005|19:22] D:\DOCUME~1\LOCALS~1.001\APPLIC~1\Microsoft

[17/10/2005|19:22] D:\DOCUME~1\LOCALS~1.002\APPLIC~1\Microsoft

[15/03/2006|16:58] D:\DOCUME~1\LOCALS~1.003\APPLIC~1\Microsoft

[09/03/2006|18:03] D:\DOCUME~1\LOCALS~1.004\APPLIC~1\Microsoft

[18/04/2006|16:57] D:\DOCUME~1\LOCALS~1.005\APPLIC~1\Microsoft
[10/07/2006|12:23] D:\DOCUME~1\LOCALS~1.005\APPLIC~1\Symantec

[24/04/2007|23:10] D:\DOCUME~1\LOCALS~1.006\APPLIC~1\Microsoft

[22/04/2008|14:24] D:\DOCUME~1\LOCALS~1.007\APPLIC~1\AVG7
[12/06/2008|09:50] D:\DOCUME~1\LOCALS~1.007\APPLIC~1\Microsoft

[09/03/2006|16:06] D:\DOCUME~1\MINIRA~1\APPLIC~1\Aim
[17/03/2006|10:54] D:\DOCUME~1\MINIRA~1\APPLIC~1\AOL
[09/03/2006|19:19] D:\DOCUME~1\MINIRA~1\APPLIC~1\Help
[09/03/2006|18:03] D:\DOCUME~1\MINIRA~1\APPLIC~1\Identities
[31/07/2008|19:44] D:\DOCUME~1\MINIRA~1\APPLIC~1\LimeWire
[09/03/2006|15:01] D:\DOCUME~1\MINIRA~1\APPLIC~1\Macromedia
[09/03/2006|15:43] D:\DOCUME~1\MINIRA~1\APPLIC~1\Microsoft
[09/03/2006|15:33] D:\DOCUME~1\MINIRA~1\APPLIC~1\MSNInstaller
[09/03/2006|16:37] D:\DOCUME~1\MINIRA~1\APPLIC~1\OD2
[13/03/2006|15:38] D:\DOCUME~1\MINIRA~1\APPLIC~1\Real
[17/10/2005|12:34] D:\DOCUME~1\MINIRA~1\APPLIC~1\Symantec
[09/03/2006|18:03] D:\DOCUME~1\MINIRA~1\APPLIC~1\You've Got Pictures Screensaver

[22/04/2008|14:10] D:\DOCUME~1\NETWOR~1\APPLIC~1\AVG7
[04/08/2006|17:36] D:\DOCUME~1\NETWOR~1\APPLIC~1\Google
[22/04/2008|10:38] D:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
[04/08/2006|17:36] D:\DOCUME~1\NETWOR~1\APPLIC~1\Symantec

[29/01/2006|20:11] D:\DOCUME~1\NETWOR~1.NTA\APPLIC~1\Microsoft

[15/02/2006|21:27] D:\DOCUME~1\NETWOR~1.000\APPLIC~1\Microsoft

[17/10/2005|19:22] D:\DOCUME~1\NETWOR~1.001\APPLIC~1\Microsoft
[06/03/2006|11:32] D:\DOCUME~1\NETWOR~1.001\APPLIC~1\Symantec

[17/10/2005|19:22] D:\DOCUME~1\NETWOR~1.002\APPLIC~1\Microsoft

[15/03/2006|16:58] D:\DOCUME~1\NETWOR~1.003\APPLIC~1\Microsoft

[09/03/2006|18:03] D:\DOCUME~1\NETWOR~1.004\APPLIC~1\Microsoft

[18/04/2006|16:57] D:\DOCUME~1\NETWOR~1.005\APPLIC~1\Microsoft

[24/04/2007|23:10] D:\DOCUME~1\NETWOR~1.006\APPLIC~1\Microsoft

[23/04/2008|10:29] D:\DOCUME~1\NETWOR~1.007\APPLIC~1\Microsoft

[06/04/2007|21:24] D:\DOCUME~1\RENSHA~1\APPLIC~1\AOL
[23/04/2007|18:14] D:\DOCUME~1\RENSHA~1\APPLIC~1\CyberLink
[06/04/2007|21:24] D:\DOCUME~1\RENSHA~1\APPLIC~1\Identities
[23/04/2007|11:29] D:\DOCUME~1\RENSHA~1\APPLIC~1\Lavasoft
[06/04/2007|21:24] D:\DOCUME~1\RENSHA~1\APPLIC~1\Macromedia
[06/04/2007|21:24] D:\DOCUME~1\RENSHA~1\APPLIC~1\Microsoft
[23/04/2007|18:07] D:\DOCUME~1\RENSHA~1\APPLIC~1\OD2
[06/04/2007|16:27] D:\DOCUME~1\RENSHA~1\APPLIC~1\Real
[06/04/2007|17:06] D:\DOCUME~1\RENSHA~1\APPLIC~1\Sun
[06/04/2007|15:19] D:\DOCUME~1\RENSHA~1\APPLIC~1\Symantec
[17/10/2005|12:32] D:\DOCUME~1\RENSHA~1\APPLIC~1\You've Got Pictures Screensaver

[27/04/2007|22:02] D:\DOCUME~1\RENSHA~1.048\APPLIC~1\Adobe
[25/04/2007|16:38] D:\DOCUME~1\RENSHA~1.048\APPLIC~1\AOL
[26/07/2007|08:40] D:\DOCUME~1\RENSHA~1.048\APPLIC~1\AVG7
[05/06/2007|13:09] D:\DOCUME~1\RENSHA~1.048\APPLIC~1\Google
[25/04/2007|16:38] D:\DOCUME~1\RENSHA~1.048\APPLIC~1\Identities
[26/04/2007|10:39] D:\DOCUME~1\RENSHA~1.048\APPLIC~1\Lavasoft
[07/05/2007|19:26] D:\DOCUME~1\RENSHA~1.048\APPLIC~1\Leadertech
[31/07/2008|19:44] D:\DOCUME~1\RENSHA~1.048\APPLIC~1\LimeWire
[25/04/2007|10:22] D:\DOCUME~1\RENSHA~1.048\APPLIC~1\Macromedia
[23/07/2007|10:07] D:\DOCUME~1\RENSHA~1.048\APPLIC~1\Microsoft
[26/04/2007|14:38] D:\DOCUME~1\RENSHA~1.048\APPLIC~1\OD2
[08/05/2007|21:51] D:\DOCUME~1\RENSHA~1.048\APPLIC~1\Real
[07/05/2007|19:26] D:\DOCUME~1\RENSHA~1.048\APPLIC~1\Sonic
[26/04/2007|11:40] D:\DOCUME~1\RENSHA~1.048\APPLIC~1\Sun
[25/04/2007|09:00] D:\DOCUME~1\RENSHA~1.048\APPLIC~1\Symantec
[18/07/2007|20:18] D:\DOCUME~1\RENSHA~1.048\APPLIC~1\Ulead Systems
[25/04/2007|16:38] D:\DOCUME~1\RENSHA~1.048\APPLIC~1\You've Got Pictures Screensaver

[23/09/2008|11:02] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\Adobe
[23/06/2008|19:32] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\AdobeUM
[09/02/2008|21:24] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\AOL
[08/04/2008|09:14] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\Apple Computer
[11/01/2009|19:33] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\Ashtons. Family Resort
[15/01/2009|18:30] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\AVG7
[03/05/2008|19:09] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\Canon
[14/02/2008|10:59] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\CyberLink
[13/09/2008|19:03] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\DivX
[12/02/2008|18:36] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\ErrorSmart
[07/12/2008|16:01] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\GameInvest
[30/11/2008|17:40] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\Gamelab
[28/07/2008|19:34] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\Google
[14/12/2008|14:20] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\Home Sweet Home 2
[06/08/2008|18:08] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\Identities
[29/03/2008|16:22] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\ieSpell
[26/12/2008|19:52] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\InstallShield
[13/01/2009|15:04] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\IObit
[06/08/2008|18:08] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\Jane s Hotel
[21/02/2008|09:35] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\Leadertech
[10/01/2009|16:14] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\LG Electronics
[30/12/2008|18:25] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\LimeWire
[09/02/2008|21:24] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\Macromedia
[27/08/2008|09:20] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\Malwarebytes
[16/01/2009|08:43] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\Microsoft
[16/01/2009|22:13] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\My Games
[20/02/2008|19:08] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\Nokia
[22/02/2008|20:39] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\OD2
[12/02/2008|11:32] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\Opera
[20/02/2008|19:07] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\PC Suite
[09/02/2008|18:18] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\PC Tools
[30/11/2008|18:54] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\PetShowCraze
[18/12/2008|15:06] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\PlayFirst
[06/01/2009|16:27] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\Pogo Games
[09/02/2008|21:24] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\Real
[22/04/2008|15:45] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\Samsung
[10/05/2008|13:52] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\Softplicity
[21/02/2008|09:36] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\Sonic
[11/02/2008|20:42] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\Sun
[27/07/2008|18:26] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\Template
[15/02/2008|15:29] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\Ulead Systems
[14/06/2008|23:04] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\Uniblue
[31/07/2008|19:44] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\VersionTracker Pro
[11/04/2008|15:17] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\Viewpoint
[07/12/2008|17:35] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\ViquaSoft
[22/09/2008|10:17] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\Windows Live Writer
[23/10/2008|18:23] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\WinPatrol
[30/08/2008|11:57] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\Yahoo!
[17/10/2005|12:32] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\You've Got Pictures Screensaver
[15/11/2008|23:02] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\Zen Puzzle Garden
[07/08/2008|20:22] D:\DOCUME~1\RENSHA~1.001\APPLIC~1\Zylom

[25/09/2008|12:29] D:\DOCUME~1\shane\APPLIC~1\AOL
[25/09/2008|12:29] D:\DOCUME~1\shane\APPLIC~1\Macromedia
[25/09/2008|12:29] D:\DOCUME~1\shane\APPLIC~1\Microsoft
[25/09/2008|12:29] D:\DOCUME~1\shane\APPLIC~1\Real

[06/04/2006|22:22] D:\DOCUME~1\SHANE~1.048\APPLIC~1\Adobe
[11/04/2006|15:07] D:\DOCUME~1\SHANE~1.048\APPLIC~1\AdobeUM
[13/04/2006|12:24] D:\DOCUME~1\SHANE~1.048\APPLIC~1\Aim
[17/03/2006|10:54] D:\DOCUME~1\SHANE~1.048\APPLIC~1\AOL
[16/04/2006|16:43] D:\DOCUME~1\SHANE~1.048\APPLIC~1\CyberLink
[26/03/2006|14:39] D:\DOCUME~1\SHANE~1.048\APPLIC~1\Help
[09/03/2006|18:03] D:\DOCUME~1\SHANE~1.048\APPLIC~1\Identities
[01/04/2006|17:37] D:\DOCUME~1\SHANE~1.048\APPLIC~1\LimeWire
[11/03/2006|17:45] D:\DOCUME~1\SHANE~1.048\APPLIC~1\Macromedia
[11/04/2006|15:48] D:\DOCUME~1\SHANE~1.048\APPLIC~1\Microsoft
[24/03/2006|19:33] D:\DOCUME~1\SHANE~1.048\APPLIC~1\OD2
[14/03/2006|17:12] D:\DOCUME~1\SHANE~1.048\APPLIC~1\Real
[01/04/2006|19:29] D:\DOCUME~1\SHANE~1.048\APPLIC~1\Sun
[17/10/2005|12:34] D:\DOCUME~1\SHANE~1.048\APPLIC~1\Symantec
[11/04/2006|13:52] D:\DOCUME~1\SHANE~1.048\APPLIC~1\Ulead Systems
[09/03/2006|18:03] D:\DOCUME~1\SHANE~1.048\APPLIC~1\You've Got Pictures Screensaver

[25/09/2008|12:29] D:\DOCUME~1\SHANE0~1.000\APPLIC~1\Adobe
[25/09/2008|12:29] D:\DOCUME~1\SHANE0~1.000\APPLIC~1\AOL
[25/09/2008|12:29] D:\DOCUME~1\SHANE0~1.000\APPLIC~1\Google
[25/09/2008|12:29] D:\DOCUME~1\SHANE0~1.000\APPLIC~1\Identities
[25/09/2008|12:29] D:\DOCUME~1\SHANE0~1.000\APPLIC~1\Macromedia
[25/09/2008|12:29] D:\DOCUME~1\SHANE0~1.000\APPLIC~1\Microsoft
[25/09/2008|12:29] D:\DOCUME~1\SHANE0~1.000\APPLIC~1\PC Suite
[25/09/2008|12:29] D:\DOCUME~1\SHANE0~1.000\APPLIC~1\Real
[25/09/2008|12:29] D:\DOCUME~1\SHANE0~1.000\APPLIC~1\Symantec
[25/09/2008|12:29] D:\DOCUME~1\SHANE0~1.000\APPLIC~1\You've Got Pictures Screensaver

——————–\\ Scheduled Tasks located in C:\WINDOWS\Tasks

[16/01/2009 08:25][–ah—–] C:\WINDOWS\tasks\MP Scheduled Scan.job
[10/01/2009 18:59][–a——] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[16/01/2009 19:47][–ah-c—] C:\WINDOWS\tasks\User_Feed_Synchronization-{1DE2267F-30A9-468A-A978-AF44CEFC6682}.job
[09/02/2008 14:49][–a–c—] C:\WINDOWS\tasks\Registration reminder 2.job
[09/02/2008 14:49][–a–c—] C:\WINDOWS\tasks\Registration reminder 1.job
[16/01/2009 08:22][–ah-c—] C:\WINDOWS\tasks\SA.DAT
[04/08/2004 13:00][-rah-c—] C:\WINDOWS\tasks\desktop.ini

——————–\\ Listing Folders in C:\Program Files

[10/07/2008|19:22] C:\Program Files\3DGroove
[23/09/2008|10:21] C:\Program Files\Adobe
[14/06/2008|22:53] C:\Program Files\AGEIA Technologies
[23/09/2008|10:53] C:\Program Files\AOL 9.0
[09/02/2008|21:17] C:\Program Files\AOL Companion
[25/09/2008|20:04] C:\Program Files\Apple Software Update
[22/04/2008|14:10] C:\Program Files\AVG(2)
[23/10/2008|18:23] C:\Program Files\BillP Studios
[25/09/2008|20:08] C:\Program Files\Bonjour
[27/02/2008|14:54] C:\Program Files\CanonBJ
[20/09/2008|22:39] C:\Program Files\CCleaner
[11/11/2008|18:59] C:\Program Files\Common Files
[09/02/2008|21:17] C:\Program Files\ComPlus Applications
[09/02/2008|21:17] C:\Program Files\CyberLink
[20/02/2008|19:08] C:\Program Files\DIFX
[18/11/2008|12:11] C:\Program Files\directx
[06/03/2008|17:20] C:\Program Files\Disc2Phone
[07/08/2008|09:39] C:\Program Files\DivX
[12/02/2008|20:02] C:\Program Files\DSC_Program
[26/09/2008|22:06] C:\Program Files\Electronic Arts
[12/02/2008|18:38] C:\Program Files\ErrorSmart
[22/09/2008|10:00] C:\Program Files\ERUNT
[16/09/2008|08:30] C:\Program Files\EsetOnlineScanner
[15/08/2008|10:23] C:\Program Files\Gamenext
[09/08/2008|14:42] C:\Program Files\GamesBar
[09/02/2008|21:17] C:\Program Files\GMixon
[29/07/2008|10:06] C:\Program Files\Google
[09/02/2008|18:05] C:\Program Files\Grisoft
[08/01/2009|15:17] C:\Program Files\Hijackthis
[01/06/2008|17:28] C:\Program Files\HM Screensaver
[28/03/2008|21:03] C:\Program Files\ieSpell
[08/01/2009|17:30] C:\Program Files\InstallShield Installation Information
[02/03/2008|00:52] C:\Program Files\Intel
[10/12/2008|21:28] C:\Program Files\Internet Explorer
[13/01/2009|15:04] C:\Program Files\IObit
[11/12/2008|17:02] C:\Program Files\iPod
[11/12/2008|17:04] C:\Program Files\iTunes
[16/01/2009|20:35] C:\Program Files\Java
[23/09/2008|18:35] C:\Program Files\Lavasoft
[09/02/2008|21:17] C:\Program Files\Learn2.com
[08/01/2009|17:30] C:\Program Files\LG Electronics
[08/01/2009|17:28] C:\Program Files\LG PC Suite 2
[08/01/2009|15:05] C:\Program Files\LimeWire
[16/01/2009|08:50] C:\Program Files\Malwarebytes' Anti-Malware
[26/09/2008|22:02] C:\Program Files\Maxis
[14/08/2008|09:49] C:\Program Files\Messenger
[13/01/2009|21:28] C:\Program Files\Messenger Plus! Live
[13/01/2009|20:59] C:\Program Files\MessengerPlus! 3
[12/01/2009|22:43] C:\Program Files\Microsoft
[11/02/2008|19:18] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[09/02/2008|21:17] C:\Program Files\microsoft frontpage
[13/03/2008|16:27] C:\Program Files\Microsoft Office
[12/01/2009|22:43] C:\Program Files\Microsoft Office Outlook Connector
[12/01/2009|22:43] C:\Program Files\Microsoft Silverlight
[11/02/2008|10:35] C:\Program Files\Microsoft SQL Server Compact Edition
[13/03/2008|16:27] C:\Program Files\Microsoft Visual Studio
[31/07/2008|17:19] C:\Program Files\Microsoft Works
[13/03/2008|16:26] C:\Program Files\Microsoft.NET
[28/05/2008|21:59] C:\Program Files\Movie Maker
[19/08/2008|12:48] C:\Program Files\MSBuild
[09/02/2008|21:17] C:\Program Files\MSN
[09/02/2008|21:17] C:\Program Files\MSN Gaming Zone
[09/02/2008|17:02] C:\Program Files\MSXML 4.0
[28/05/2008|21:55] C:\Program Files\NetMeeting
[23/09/2008|10:42] C:\Program Files\NOS
[09/02/2008|21:20] C:\Program Files\Online Services
[28/05/2008|21:55] C:\Program Files\Outlook Express
[03/01/2009|22:41] C:\Program Files\Paint.NET
[21/02/2008|13:30] C:\Program Files\PC Camer@
[20/02/2008|19:07] C:\Program Files\PC Connectivity Solution
[04/10/2008|15:36] C:\Program Files\Prima Games
[11/12/2008|16:57] C:\Program Files\QuickTime
[09/02/2008|21:17] C:\Program Files\Real
[09/02/2008|21:17] C:\Program Files\Realtek
[19/08/2008|12:48] C:\Program Files\Reference Assemblies
[15/08/2008|19:50] C:\Program Files\ReflexiveArcade
[22/04/2008|15:39] C:\Program Files\Samsung
[16/01/2009|23:39] C:\Program Files\Shockwave.com
[12/02/2008|20:19] C:\Program Files\SmartSound Software
[09/02/2008|21:17] C:\Program Files\Sonic
[12/11/2008|22:00] C:\Program Files\Spybot - Search & Destroy
[09/02/2008|18:18] C:\Program Files\Spyware Doctor
[25/09/2008|12:29] C:\Program Files\SpywareBlaster
[06/08/2008|12:23] C:\Program Files\Sun
[02/03/2008|00:52] C:\Program Files\Take 2 Interactive Software Europe
[30/11/2008|18:54] C:\Program Files\TotalImageConverter
[08/01/2009|15:26] C:\Program Files\trend micro
[12/02/2008|20:07] C:\Program Files\Ulead Systems
[09/02/2008|21:17] C:\Program Files\Uninstall Information
[09/02/2008|21:17] C:\Program Files\Viewpoint
[06/03/2008|19:13] C:\Program Files\Windows Defender
[13/01/2009|21:11] C:\Program Files\Windows Live
[05/05/2008|15:58] C:\Program Files\Windows Live Favorites
[12/01/2009|22:35] C:\Program Files\Windows Live SkyDrive
[12/01/2009|22:41] C:\Program Files\Windows Live Toolbar
[09/02/2008|21:17] C:\Program Files\Windows Media Components
[07/06/2008|20:25] C:\Program Files\Windows Media Connect 2
[07/06/2008|20:25] C:\Program Files\Windows Media Player
[28/05/2008|21:55] C:\Program Files\Windows NT
[09/02/2008|21:17] C:\Program Files\WindowsUpdate
[09/02/2008|21:17] C:\Program Files\xerox
[12/02/2008|20:03] C:\Program Files\XviD
[04/09/2008|15:43] C:\Program Files\Yahoo!
[09/08/2008|13:43] C:\Program Files\Zylom Games

——————–\\ Listing Folders in C:\Program Files\Common Files

[23/09/2008|10:20] C:\Program Files\Common Files\Adobe
[23/09/2008|10:21] C:\Program Files\Common Files\Adobe AIR
[12/02/2008|11:14] C:\Program Files\Common Files\Adobe Systems Shared
[09/02/2008|21:17] C:\Program Files\Common Files\AOL
[09/02/2008|21:17] C:\Program Files\Common Files\aolshare
[11/12/2008|17:02] C:\Program Files\Common Files\Apple
[13/03/2008|16:27] C:\Program Files\Common Files\DESIGNER
[12/02/2008|20:16] C:\Program Files\Common Files\InstallShield
[09/02/2008|21:17] C:\Program Files\Common Files\Java
[05/05/2008|19:07] C:\Program Files\Common Files\Macrovision Shared
[12/01/2009|22:35] C:\Program Files\Common Files\Microsoft Shared
[09/02/2008|21:17] C:\Program Files\Common Files\MSSoap
[09/02/2008|21:17] C:\Program Files\Common Files\Nullsoft
[07/08/2008|17:38] C:\Program Files\Common Files\Oberon Media
[09/02/2008|21:17] C:\Program Files\Common Files\ODBC
[09/02/2008|18:18] C:\Program Files\Common Files\PC Tools
[21/02/2008|13:30] C:\Program Files\Common Files\PCCamera
[09/02/2008|21:17] C:\Program Files\Common Files\Real
[09/02/2008|21:17] C:\Program Files\Common Files\Services
[09/02/2008|21:17] C:\Program Files\Common Files\Sonic Shared
[09/02/2008|21:17] C:\Program Files\Common Files\SpeechEngines
[09/07/2008|13:23] C:\Program Files\Common Files\SureThing Shared
[12/01/2009|22:43] C:\Program Files\Common Files\System
[12/02/2008|20:22] C:\Program Files\Common Files\Ulead Systems
[11/11/2008|18:59] C:\Program Files\Common Files\Windows Live
[11/02/2008|10:31] C:\Program Files\Common Files\WindowsLiveInstaller
[19/08/2008|18:54] C:\Program Files\Common Files\Wise Installation Wizard
[09/02/2008|21:17] C:\Program Files\Common Files\xing shared

——————–\\ Process

( 52 Processes )

iexplore.exe ~ [PID:3704]

——————–\\ Searching with S_Lop

No Lop folder found !

——————–\\ Searching for Lop Files - Folders

No Lop folder found !

——————–\\ Searching within the Registry

….. OK !

——————–\\ Checking the Hosts file

Hosts file CLEAN

——————–\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-17 00:20:59
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden files …
folder error: D:\DOCUME~1\RENSHA~1.001\LOCALS~1\APPLIC~1

——————–\\ Searching for other infections

——————–\\ Cracks & Keygens ..

D:\DOCUME~1\RENSHA~1.001\Desktop\My Music\License Backup\iTunes\iTunes Music\Compilations\Shagadelia\14 Cracklin' Rosie.m4a
D:\DOCUME~1\RENSHA~1.001\Desktop\My Music\License Backup\iTunes\iTunes Music\Kanye West\Late Orchestration\03 Crack Music.m4a
D:\DOCUME~1\RENSHA~1.001\Favorites\The Sims Livin Large Crack Keygen Serial Torrent Free Full Version Download.url
D:\DOCUME~1\RENSHA~1.001\My Documents\My Music\Pixies\Doolittle\09 Crackity Jones.wma

[F:5][D:2]-> D:\DOCUME~1\RENSHA~1.001\LOCALS~1\Temp
[F:38][D:0]-> D:\DOCUME~1\RENSHA~1.001\Cookies
[F:878][D:17]-> D:\DOCUME~1\RENSHA~1.001\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 17/01/2009| 0:21 - Option : [1]

——————–\\ Scan completed at 0:21:48

Tomk

Post #8January 17, 2009, 1:00 AM UTC

lisafunkypants,

Messenger Plus! (MessengerPlus2, MessengerPlus3) (MP) is an add‑on for Microsoft's free messaging programs Windows Messenger and MSN Messenger. It is a 'free' download (with a few stingers in its tail). MP includes an optional Sponsor Program provided by C2Media. The Sponsor Program is commonly known in the anti‑spyware and adware world as 'Lop' or 'Lop.com'. There has been a problem since Messenger Plus! first started including the Sponsor Program in approximately May 2003, with users installing the Sponsor Program without understanding what the Sponsor Program is, what it does to a user's system, or the privacy implications involved.

Messenger Plus!, if installed to include the 'sponsor program', will install adware on your computer that generates pop up windows. The Sponsor Program will also change your home page, your search engine settings, place numerous links in IE favorites (including online casino and gambling links) and place more links on your desktop. The search toolbar that is installed cannot be turned off. The pop up advertising windows will appear even if you are running IE's pop‑up blocker. This is because the Sponsor Program adds its advertisement URLs to the pop‑up blocker exclusion list.

We did not find any LOP in the scan you just did so it looks OK.

LimeWire
You have LimeWire, a P2P/file sharing programs installed on your computer. P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it.

References for the risk of these programs can be found in these links:
http://www.microsoft.com/windows/ie/commun…protection.mspx
http://www.techweb.com/wire/160500554
http://www.internetworldstats.com/articles/art053.htm://http://www.techweb.com/wire/1605005…cles/art053.htm

I would recommend that you uninstall LimeWire, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

It is possible that your issue is a BIOS setting. Lets run an online scan. If we can't find a cause for your phenomenon, we will clean you up and send you over to the Tech Team.

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply.

lisafunkypants

Post #9January 17, 2009, 10:36 PM UTC last edited January 17, 2009, 11:02 PM UTC

Well it doesn't look good as I can see myself that most of the problem is from limewire , however the objects in quarantine were in a scan i did around September 08. I have a new problem now, while i have been trying to scan PC, I caught my beloved daughter downloading a site called Bearshare, which i understand is yet another dreaded P2P site. Ive tried to delete via add/remove programs but it wont go. I am furious she has done this as i use my PC for personal uses I thought I'd totally cleared Limewire out of the system is there anywhere other than Add/Remove programs that I should be looking? Also i was told i do not have a firewall, is this the case from what info you have seen? ——————————————————————————– KASPERSKY ONLINE SCANNER 7 REPORT Saturday, January 17, 2009 Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Saturday, January 17, 2009 17:02:26 Records in database: 1637528 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ Scan statistics: Files scanned: 160944 Threat name: 9 Infected objects: 27 Suspicious objects: 1 Duration of the scan: 02:38:48 File name / Threat name / Threats count D:\Documents and Settings\Renshai Warrior.048919120306.001\.housecall6.6\Quarantine\01 Track 1 (rhianna-rolling).wma.bac_a00556 Infected: Trojan-Downloader.WMA.Wimad.l 1 D:\Documents and Settings\Renshai Warrior.048919120306.001\.housecall6.6\Quarantine\02 Track 2 (girlfriend).wma.bac_a00556 Infected: Trojan-Downloader.WMA.Wimad.l 1 D:\Documents and Settings\Renshai Warrior.048919120306.001\.housecall6.6\Quarantine\02 Track 2 (rhianna-rolling).wma.bac_a00556 Infected: Trojan-Downloader.WMA.Wimad.l 1 D:\Documents and Settings\Renshai Warrior.048919120306.001\.housecall6.6\Quarantine\06 Track 6 (rhianna-rolling).wma.bac_a00556 Infected: Trojan-Downloader.WMA.Wimad.l 1 D:\Documents and Settings\Renshai Warrior.048919120306.001\.housecall6.6\Quarantine\A Tribe Called Quest - The love mo.wma.bac_a00556 Infected: Trojan-Downloader.WMA.GetCodec.a 1 D:\Documents and Settings\Renshai Warrior.048919120306.001\.housecall6.6\Quarantine\avril lavigne best dayam thing.mp3.bac_a00556 Infected: Trojan-Downloader.WMA.GetCodec.c 1 D:\Documents and Settings\Renshai Warrior.048919120306.001\.housecall6.6\Quarantine\cow moos.mp3.bac_a00556 Infected: Trojan-Downloader.WMA.GetCodec.c 1 D:\Documents and Settings\Renshai Warrior.048919120306.001\.housecall6.6\Quarantine\gicchi gicch goo phineas ferb.mp3.bac_a00556 Infected: not-a-virus:AdWare.Win32.Agent.zk 1 D:\Documents and Settings\Renshai Warrior.048919120306.001\.housecall6.6\Quarantine\good & broken hannah montana.mp3.bac_a00556 Infected: Trojan-Downloader.WMA.GetCodec.c 1 D:\Documents and Settings\Renshai Warrior.048919120306.001\.housecall6.6\Quarantine\jesse mccartney beautiful soul.mpg.bac_a00556 Infected: Trojan-Downloader.WMA.GetCodec.c 1 D:\Documents and Settings\Renshai Warrior.048919120306.001\.housecall6.6\Quarantine\lets dance hannah montana.mp3.bac_a00556 Infected: Trojan-Downloader.WMA.GetCodec.c 1 D:\Documents and Settings\Renshai Warrior.048919120306.001\.housecall6.6\Quarantine\love at first degree cascada.mp3.bac_a00556 Infected: Trojan-Downloader.WMA.GetCodec.c 1 D:\Documents and Settings\Renshai Warrior.048919120306.001\.housecall6.6\Quarantine\Rare Recording (gang).wma.bac_a00556 Infected: Trojan-Downloader.WMA.Wimad.l 1 D:\Documents and Settings\Renshai Warrior.048919120306.001\.housecall6.6\Quarantine\short cow sounds.mp3.bac_a00556 Infected: Trojan-Downloader.WMA.GetCodec.c 1 D:\Documents and Settings\Renshai Warrior.048919120306.001\.housecall6.6\Quarantine\TOTALLY HIP TRACK (rhianna-rolling).wma.bac_a00556 Infected: Trojan-Downloader.WMA.Wimad.l 1 D:\Documents and Settings\Renshai Warrior.048919120306.001\.housecall6.6\Quarantine\when it was me dj boonie.mp3.bac_a00556 Infected: Trojan-Downloader.WMA.GetCodec.c 1 D:\Documents and Settings\Renshai Warrior.048919120306.001\.housecall6.6\Quarantine\Wicked Remix (girlfriend).wma.bac_a00556 Infected: Trojan-Downloader.WMA.Wimad.l 1 D:\Documents and Settings\Renshai Warrior.048919120306.001\.housecall6.6\Quarantine\Wicked Remix (girls).wma.bac_a00556 Infected: Trojan-Downloader.WMA.Wimad.l 1 D:\Documents and Settings\Renshai Warrior.048919120306.001\.housecall6.6\Quarantine\Wicked Remix (rhianna-rolling).wma.bac_a00556 Infected: Trojan-Downloader.WMA.Wimad.l 1 D:\Documents and Settings\Renshai Warrior.048919120306.001\.housecall6.6\Quarantine\wiley wearing my rolex.mp3.bac_a00556 Infected: Trojan-Downloader.WMA.GetCodec.c 1 D:\Documents and Settings\Renshai Warrior.048919120306.001\Local Settings\Application Data\Microsoft\Windows Live Mail\Hotmail (li 208\Junk e-mail\53D13821-00000010.eml Suspicious: Trojan-Spy.HTML.Fraud.gen 1 D:\Documents and Settings\Renshai Warrior.048919120306.001\My Documents\LimeWire\Saved\darren styles disco lights MTV.mp3 Infected: Trojan-Downloader.WMA.GetCodec.f 1 D:\Documents and Settings\Renshai Warrior.048919120306.001\My Documents\LimeWire\Saved\Diana Vickers - Hallelujah.mp3 Infected: Trojan-Downloader.WMA.GetCodec.n 1 D:\Documents and Settings\Renshai Warrior.048919120306.001\My Documents\LimeWire\Saved\mc nick i kissed a girl [unreleased rare track].mp3 Infected: Trojan-Downloader.WMA.GetCodec.r 1 D:\Documents and Settings\Renshai Warrior.048919120306.001\My Documents\My Music\phineas and ferb intro .wma Infected: Trojan-Downloader.WMA.Wimad.n 1 D:\Documents and Settings\Renshai Warrior.048919120306.001\My Documents\Saved\darren styles disco lights MTV.mp3 Infected: Trojan-Downloader.WMA.GetCodec.f 1 D:\Documents and Settings\Renshai Warrior.048919120306.001\My Documents\Saved\Diana Vickers - Hallelujah.mp3 Infected: Trojan-Downloader.WMA.GetCodec.n 1 D:\Documents and Settings\Renshai Warrior.048919120306.001\My Documents\Saved\mc nick i kissed a girl [unreleased rare track].mp3 Infected: Trojan-Downloader.WMA.GetCodec.r 1 The selected area was scanned.

Tomk

Post #10January 18, 2009, 1:35 AM UTC

lisafunkypants,

You may have the windows firewall that comes with XP running. You have no "third party" firewall.

Limewire may not be installed. If it is, it is located at C:\Program Files\LimeWire. It may be that all that exist are files that were downloaded using it.

You have several user accounts with limewire downloads on the D drive. They appear to be located:
D:\Documents and Settings\LISA~1.048\Application Data\LimeWire
D:\Documents and Settings\LISA04~1.000\Application Data\LimeWire
D:\Documents and Settings\LISA~1.SN0\Application Data\LimeWire
D:\Documents and Settings\MINIRA~1\Application Data\LimeWire
D:\Documents and Settings\RENSHA~1.048\Application Data\LimeWire
D:\Documents and Settings\RENSHA~1.001\Application Data\LimeWire
D:\Documents and Settings\SHANE~1.048\Application Data\LimeWire

The "~" symbol fills in for additional text. For example, Renshai Warrior.048919120306.001 is one of your user accounts. It is either represented above as RENSHA~1.048 or RENSHA~1.001. You will just have to look at your folders.

Please download the OTMoveIt3 by OldTimer.

Save it to your desktop.
Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).

Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe

:Services

:Reg

:Files
D:\Documents and Settings\Renshai Warrior.048919120306.001\Local Settings\Application Data\Microsoft\Windows Live Mail\Hotmail (li 208\Junk e-mail\53D13821-00000010.eml
D:\Documents and Settings\Renshai Warrior.048919120306.001\My Documents\LimeWire\Saved\darren styles disco lights MTV.mp3
D:\Documents and Settings\Renshai Warrior.048919120306.001\My Documents\LimeWire\Saved\Diana Vickers - Hallelujah.mp3
D:\Documents and Settings\Renshai Warrior.048919120306.001\My Documents\LimeWire\Saved\mc nick i kissed a girl [unreleased rare track].mp3
D:\Documents and Settings\Renshai Warrior.048919120306.001\My Documents\My Music\phineas and ferb intro .wma
D:\Documents and Settings\Renshai Warrior.048919120306.001\My Documents\Saved\darren styles disco lights MTV.mp3
D:\Documents and Settings\Renshai Warrior.048919120306.001\My Documents\Saved\Diana Vickers - Hallelujah.mp3
D:\Documents and Settings\Renshai Warrior.048919120306.001\My Documents\Saved\mc nick i kissed a girl [unreleased rare track].mp3
D:\DOCUME~1\RENSHA~1.001\Favorites\The Sims Livin Large Crack Keygen Serial Torrent Free Full Version Download.url

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Then give me a new HijackThis log and let me know how things are running.

lisafunkypants

Post #11January 18, 2009, 11:28 AM UTC last edited January 18, 2009, 11:32 AM UTC

Hi Tomk ========== PROCESSES ========== Process explorer.exe killed successfully. ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== D:\Documents and Settings\Renshai Warrior.048919120306.001\Local Settings\Application Data\Microsoft\Windows Live Mail\Hotmail (li 208\Junk e-mail\53D13821-00000010.eml moved successfully. D:\Documents and Settings\Renshai Warrior.048919120306.001\My Documents\LimeWire\Saved\darren styles disco lights MTV.mp3 moved successfully. D:\Documents and Settings\Renshai Warrior.048919120306.001\My Documents\LimeWire\Saved\Diana Vickers - Hallelujah.mp3 moved successfully. D:\Documents and Settings\Renshai Warrior.048919120306.001\My Documents\LimeWire\Saved\mc nick i kissed a girl [unreleased rare track].mp3 moved successfully. D:\Documents and Settings\Renshai Warrior.048919120306.001\My Documents\My Music\phineas and ferb intro .wma moved successfully. D:\Documents and Settings\Renshai Warrior.048919120306.001\My Documents\Saved\darren styles disco lights MTV.mp3 moved successfully. D:\Documents and Settings\Renshai Warrior.048919120306.001\My Documents\Saved\Diana Vickers - Hallelujah.mp3 moved successfully. D:\Documents and Settings\Renshai Warrior.048919120306.001\My Documents\Saved\mc nick i kissed a girl [unreleased rare track].mp3 moved successfully. D:\DOCUME~1\RENSHA~1.001\Favorites\The Sims Livin Large Crack Keygen Serial Torrent Free Full Version Download.url moved successfully. ========== COMMANDS ========== File delete failed. D:\DOCUME~1\RENSHA~1.001\LOCALS~1\Temp\~DFBF12.tmp scheduled to be deleted on reboot. File delete failed. D:\DOCUME~1\RENSHA~1.001\LOCALS~1\Temp\~DFBF1F.tmp scheduled to be deleted on reboot. User's Temp folder emptied. User's Temporary Internet Files folder emptied. User's Internet Explorer cache folder emptied. Local Service Temp folder emptied. Local Service Temporary Internet Files folder emptied. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_748.dat scheduled to be deleted on reboot. Windows Temp folder emptied. Java cache emptied. Temp folders emptied. Explorer started successfully OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01182009_112212

lisafunkypants

Post #12January 18, 2009, 11:41 AM UTC

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
D:\Documents and Settings\Renshai Warrior.048919120306.001\Local Settings\Application Data\Microsoft\Windows Live Mail\Hotmail (li 208\Junk e-mail\53D13821-00000010.eml moved successfully.
D:\Documents and Settings\Renshai Warrior.048919120306.001\My Documents\LimeWire\Saved\darren styles disco lights MTV.mp3 moved successfully.
D:\Documents and Settings\Renshai Warrior.048919120306.001\My Documents\LimeWire\Saved\Diana Vickers - Hallelujah.mp3 moved successfully.
D:\Documents and Settings\Renshai Warrior.048919120306.001\My Documents\LimeWire\Saved\mc nick i kissed a girl [unreleased rare track].mp3 moved successfully.
D:\Documents and Settings\Renshai Warrior.048919120306.001\My Documents\My Music\phineas and ferb intro .wma moved successfully.
D:\Documents and Settings\Renshai Warrior.048919120306.001\My Documents\Saved\darren styles disco lights MTV.mp3 moved successfully.
D:\Documents and Settings\Renshai Warrior.048919120306.001\My Documents\Saved\Diana Vickers - Hallelujah.mp3 moved successfully.
D:\Documents and Settings\Renshai Warrior.048919120306.001\My Documents\Saved\mc nick i kissed a girl [unreleased rare track].mp3 moved successfully.
D:\DOCUME~1\RENSHA~1.001\Favorites\The Sims Livin Large Crack Keygen Serial Torrent Free Full Version Download.url moved successfully.
========== COMMANDS ==========
File delete failed. D:\DOCUME~1\RENSHA~1.001\LOCALS~1\Temp\~DFBF12.tmp scheduled to be deleted on reboot.
File delete failed. D:\DOCUME~1\RENSHA~1.001\LOCALS~1\Temp\~DFBF1F.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_748.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01182009_112212

Files moved on Reboot…
File D:\DOCUME~1\RENSHA~1.001\LOCALS~1\Temp\~DFBF12.tmp not found!
File D:\DOCUME~1\RENSHA~1.001\LOCALS~1\Temp\~DFBF1F.tmp not found!
File C:\WINDOWS\temp\Perflib_Perfdata_748.dat not found!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:41:07, on 18/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
C:\apps\ABoard\ABoard.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\STK02N\STK02NM.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\trend micro\HijackThis\HijackThis.exe
C:\Program Files\trend micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: UrlHelper Class - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll (file missing)
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - (no file)
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll (file missing)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: STK02N 2.3 PNP Monitor.lnk = ?
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\uk.htm
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} (Bebo Uploader Control) - http://www.bebo.com/files/BeboUploader.5.1.4.cab
O16 - DPF: {17D667BA-5675-4AAB-9221-08B9379384D4} (Image Uploader Control) - http://cdnimg.piczo.com/images/uploader/pi…st_uploader.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/OnlineScanner.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1202757372421
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://leahminiratssexy.spaces.live.com/Ph…ad/MsnPUpld.cab
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://bmm.imgag.com/imgag/cp/install/crusher-uk.cab
O16 - DPF: {BF6BBE9A-0656-4598-A0CD-32DAC03959B5} (Image Uploader 3.0 Control) - https://www.tescophoto.com/wpp/tesco/app/opcuploader.cab
O16 - DPF: {D1548A26-B8F6-4E86-AE74-E7062CCC2E2A} (igLoader Content on Demand) - http://www.miniclip.com/igloader/igloader.CAB
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.auctiva.com/hostedimages/active…oad/XUpload.ocx
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

–
End of file - 11720 bytes

Tomk

Post #13January 18, 2009, 3:25 PM UTC

lisafunkypants,

How's it running now?

Please open HijackThis and run Do a system scan only
Check the boxes next to ONLY the entries listed below(if present):
- O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
  O2 - BHO: UrlHelper Class - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll (file missing)
  O3 - Toolbar: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - (no file)
  O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll (file missing)
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
Close all programs except for HijackThis.
Click on Fix checked
A box will pop up asking you if you wish to fix the selected items. Please choose YES.
Once it has fixed them, please exit/close HijackThis.

lisafunkypants

Post #14January 18, 2009, 5:27 PM UTC last edited January 18, 2009, 5:30 PM UTC

Hi Tomk Ive done everything it seems to be running alot better but still abit sluggish so i'm trying to clear some old pics & files etc see if that does the trick, Also is there any way to delete the old accounts on this PC as i only use the Renshai Account the others are from years ago but they still seem to take up loads of space and have to get scanned everytime which can take ages. Thanks for your time and help it is much appreciated. Lisa

Tomk

Post #15January 18, 2009, 5:50 PM UTC

lisafunkypants,

Try reviewing this tutorial to remove user accounts.

Log looks good

Double click on OTMoveIt3.exe to run it.
Click on CleanUp!
When done, you will be prompted to restart your computer. Please restart your computer.

You need to create a new Clean restore point.
Click Start Menu > Run > copy and paste

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it (something you'll remember) and click Create, when the confirmation screen shows the restore point has been created click Close.

Remove all previous Restore Points
Click Start Menu > Run > copy and paste

cleanmgr

At top, click on More Options tab. Click Clean up… button in the System Restore box. Click on Yes button. When finished, click on Cancel button to exit.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.

Delete LOP S&D, Javara, and DDS if they still exist.

The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. I'll leave the thread open a couple of days in case symptoms return, Otherwise, this thread will be closed Resolved.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] My PC can turn itself on! What the Tech?

✨ Ask AI

Ask AI