Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Weather bug, Xerox, my web search

Started by cruz619sd , Jan 05 2007 09:47 PM

  • This topic is locked This topic is locked

#1
cruz619sd
Posted 05 January 2007 - 09:47 PM

cruz619sd

    New Member

  • Member
  • Pip
  • 8 posts
Logfile of HijackThis v1.99.1
Scan saved at 7:43:06 PM, on 01/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINNT\system32\cisvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Common Files\AOL\1138205062\ee\AOLSoftware.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\Daddy\LOCALS~1\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn13\yt.dll
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,owhmfub.exe,ddjfihw.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn13\yt.dll
O2 - BHO: (no name) - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {44FDA5DF-3D1C-6CC9-38D3-63837ABCAA9B} - (no file)
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {81C5FE14-6EDD-6708-A2AD-641340DC6DC7} - C:\WINNT\system32\tjzelq.dll (file missing)
O2 - BHO: My Web Search Bar BHO - {8EAB99C1-F9EC-4b64-A4BA-D9BCAE8779C2} - C:\Program Files\MyWebSearchWB\bar\1.bin\W6BAR.DLL (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {F6524263-87F0-DD7F-D74C-8F1D834143C9} - (no file)
O3 - Toolbar: (no name) - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn13\yt.dll
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-8DBC-A42EB79CB428} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: WeatherBug Browser Bar - powered by MyWebSearch - {8EAB99C9-F9EC-4b64-A4BA-D9BCAE8779C2} - C:\Program Files\MyWebSearchWB\bar\1.bin\W6BAR.DLL (file missing)
O4 - HKLM\..\Run: [NvMixerTray] C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [PowerDVD] C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe /autostart
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Qtgfafw] C:\Program Files\Lzrybcc\Vjnz.exe
O4 - HKLM\..\Run: [cdkxifil] C:\WINNT\cdkxifil.exe
O4 - HKLM\..\Run: [<°‡@¡±§Tlçÿ[Ì…*9ÀøC:\Program Files\ISTsvc\istsvc.exe] C:\WINNT\lubrbwok.exe
O4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /auto
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Micro Innovations\Wireless Laser Travel Mouse\mouse32a.exe
O4 - HKLM\..\Run: [PicasaNet] "C:\Documents and Settings\All Users\Documents\my down loads\Hello\Hello.exe" -b
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [stb] C:\WINNT\system32\stb.exe
O4 - HKLM\..\Run: [DisplayTrayIcon] C:\WINNT\System32\TrayIcon.exe
O4 - HKLM\..\Run: [noC=] c:\windows\mrjj.exe
O4 - HKLM\..\Run: [F ma] C:\windows\mrjj.exe
O4 - HKLM\..\Run: [LiveMonitor] C:\Program Files\MSI\Live Update 3\LMonitor.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1138205062\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [HP Software Update] "c:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [w15b364a.dll] RUNDLL32.EXE w15b364a.dll,I2 0009243e015b364a
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [bppoxa] C:\WINNT\system32\bxlwxc.exe reg_run
O4 - HKLM\..\Run: [SemanticInsight] C:\Program Files\RXToolBar\Semantic Insight\SemanticInsight.exe
O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINNT\system32\oodevped.exe DO0605
O4 - HKLM\..\Run: [gycfjg] C:\WINNT\system32\bxlwxc.exe reg_run
O4 - HKLM\..\Run: [mjnvun] C:\WINNT\system32\mrjeup.exe reg_run
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [License Manager] "C:\Program Files\License_Manager\license_manager.exe " /silent
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [iguwv] C:\WINNT\system32\mrjeup.exe reg_run
O4 - Startup: Think-Adz.lnk = C:\WINNT\system32\oodevped.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Search - http://km.bar.need2f...earch.html?p=KM
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: (no name) - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - (no file)
O9 - Extra 'Tools' menuitem: Java - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - (no file)
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\WINNT\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\WINNT\System32\shdocvw.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\system32\Shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.elitemediagroup.net
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://tdserver.bits...om/tdserver.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=48835
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfar...tup1.0.0.15.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540006} (CInstall Class) - http://www.errorguar...ion/Install.cab
O16 - DPF: {26FCCDF9-A7E1-452A-A73D-7BF7B4D0BA6C} (AOL Pictures Uploader Class) - http://pictures.aolc...ns.10.1.0.0.cab
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://drivecleaner....leanerstart.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://loveslay.spac...ad/MsnPUpld.cab
O16 - DPF: {528C14CD-CF9E-489C-A365-5999F17B69B9} (LightSurfUploadCtl Class) - http://pictures.spri...loadControl.cab
O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} (Install Class) - http://updates.lifes...ll/pinstall.cab
O16 - DPF: {98BFD494-F6AD-4794-9038-832C0654CC43} - http://pak05.picture...-US.9.2.4.0.cab
O16 - DPF: {9AC54695-69A4-46F1-BE10-10C74F9520D5} - http://cabs.elitemed...s/mediaview.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1....loadManager.ocx
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.h.../qdiagh.cab?326
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Filter: text/html - (no CLSID) - (no file)
O20 - Winlogon Notify: WgaLogon - C:\WINNT\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINNT\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINNT\TWFudWVsIENydXo\command.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\vsmon.exe
  • 0

Advertisements

#2
Buckeye_Sam
Posted 06 January 2007 - 07:05 AM

Buckeye_Sam

    Malware Expert

  • Member
  • PipPipPipPipPipPipPipPip
  • 10,019 posts
Hi and welcome to GeeksToGo! My name is Sam and I will be helping you. :whistling:

You've got a load of malware there my friend. Let's see what we can get rid of with a scan first.

Please download AVG Anti-Spyware and save that file to your desktop.
This is a 30 day trial of the program
  • Once you have downloaded AVG Anti-Spyware, locate the icon on the desktop and double-click it to launch the set up program.
  • Once the setup is complete you will need run ewido and update the definition files.
  • On the main screen select the icon "Update" then select the "Update now" link.
    • Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.
  • Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
  • Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
  • Under "Reports"
    • Select "Automatically generate report after every scan"
    • Un-Select "Only if threats were found"
Close AVG Anti-Spyware. Do not run a scan just yet. We will shortly.
  • Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter.

  • Clean out your Temporary Internet files.
    • Internet Explorer
      • Close Internet Explorer and close any instances of Windows Explorer.
      • Click Start -> Control Panel and then double-click Internet Options.
      • On the General tab, click Delete Files under Temporary Internet Files.
      • In the Delete Files dialog box, tick the Delete all offline content check box , and then click OK.
      • On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
      • Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
      • Click OK.
    • Firefox (In case you also have Firefox installed)
      • Open Firefox and go to Tools -> Options.
      • Click Privacy in the menu on the left side of the Options window.
      • Click the Clear button located to the right of each option (History, Cookies, Cache).
      • Click OK to close the Options window.
        Alternatively, you can clear all information stored while browsing by clicking Clear All.
        A confirmation dialog box will be shown before clearing the information.
    IMPORTANT: Close all windows and do not open any other windows or programs while AVG Anti-Spyware is scanning, it may interfere with the scanning proccess.

  • Lauch AVG Anti-Spyware by double-clicking the icon on your desktop.
  • Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".
  • AVG Anti-Spyware will now begin the scanning process, be patient this may take a little time.
    Once the scan is complete do the following:
  • If you have any infections you will prompted, then select "Apply all actions"
  • Next select the "Reports" icon at the top.
  • Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).
Close AVG Anti-Spyware and reboot your system back into Normal Mode.
Post the results of the AVG Anti-Spyware scan report along with a new hijackthis log.
  • 0

#3
cruz619sd
Posted 06 January 2007 - 11:15 PM

cruz619sd

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts
Pretty lengthy
Attached File  Report_Scan_20070106_124051.txt   161.84KB   97 downloadsAttached File  hijackthis2.txt   13KB   171 downloads

Logfile of HijackThis v1.99.1
Scan saved at 9:09:54 PM, on 01/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\system32\cisvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Common Files\AOL\1138205062\ee\AOLSoftware.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Daddy\Local Settings\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn13\yt.dll
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,owhmfub.exe,ddjfihw.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn13\yt.dll
O2 - BHO: (no name) - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {44FDA5DF-3D1C-6CC9-38D3-63837ABCAA9B} - (no file)
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {81C5FE14-6EDD-6708-A2AD-641340DC6DC7} - C:\WINNT\system32\tjzelq.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn13\yt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvMixerTray] C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [PowerDVD] C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe /autostart
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Qtgfafw] C:\Program Files\Lzrybcc\Vjnz.exe
O4 - HKLM\..\Run: [cdkxifil] C:\WINNT\cdkxifil.exe
O4 - HKLM\..\Run: [<°‡@¡±§Tlçÿ[Ì…*9ÀøC:\Program Files\ISTsvc\istsvc.exe] C:\WINNT\lubrbwok.exe
O4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /auto
O4 - HKLM\..\Run: [PicasaNet] "C:\Documents and Settings\All Users\Documents\my down loads\Hello\Hello.exe" -b
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [stb] C:\WINNT\system32\stb.exe
O4 - HKLM\..\Run: [DisplayTrayIcon] C:\WINNT\System32\TrayIcon.exe
O4 - HKLM\..\Run: [noC=] c:\windows\mrjj.exe
O4 - HKLM\..\Run: [F ma] C:\windows\mrjj.exe
O4 - HKLM\..\Run: [LiveMonitor] C:\Program Files\MSI\Live Update 3\LMonitor.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1138205062\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [HP Software Update] "c:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [w15b364a.dll] RUNDLL32.EXE w15b364a.dll,I2 0009243e015b364a
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [bppoxa] C:\WINNT\system32\bxlwxc.exe reg_run
O4 - HKLM\..\Run: [gycfjg] C:\WINNT\system32\bxlwxc.exe reg_run
O4 - HKLM\..\Run: [mjnvun] C:\WINNT\system32\mrjeup.exe reg_run
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINNT\system32\oodevpeb.exe DO0605
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [License Manager] "C:\Program Files\License_Manager\license_manager.exe " /silent
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [iguwv] C:\WINNT\system32\mrjeup.exe reg_run
O4 - Startup: Think-Adz.lnk = C:\WINNT\system32\oodevpeb.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Search - http://km.bar.need2f...earch.html?p=KM
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: (no name) - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - (no file)
O9 - Extra 'Tools' menuitem: Java - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - (no file)
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\WINNT\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\WINNT\System32\shdocvw.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\system32\Shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=48835
O16 - DPF: {26FCCDF9-A7E1-452A-A73D-7BF7B4D0BA6C} (AOL Pictures Uploader Class) - http://pictures.aolc...ns.10.1.0.0.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1....loadManager.ocx
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.h.../qdiagh.cab?326
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINNT\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINNT\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINNT\TWFudWVsIENydXo\command.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\vsmon.exe

Edited by Buckeye_Sam, 07 January 2007 - 02:34 PM.

  • 0

#4
Buckeye_Sam
Posted 07 January 2007 - 02:40 PM

Buckeye_Sam

    Malware Expert

  • Member
  • PipPipPipPipPipPipPipPip
  • 10,019 posts
Yes, it is quite lengthy.
We need to get hijackthis out of your temp folder and into a permanent location.
  • Download and run the HijackThis autoinstall program
  • Please choose the default location of C:\Program Files as the destination.
  • Run the program only from that location from now on. It is essential that you follow these steps or certain important features of the program will not function correctly.

Once you've done that, proceed with these next steps.


You must disable Spybot's Teatimer function before proceeding with this fix. Otherwise it will intefere with hijackthis.
  • Open Spybot Search & Destroy.
  • In the Mode menu click "Advanced mode" if not already selected.
  • Choose "Yes" at the Warning prompt.
  • Expand the "Tools" menu.
  • Click "Resident".
  • Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
  • In the File menu click "Exit" to exit Spybot Search & Destroy.


Run Hijackthis again, click scan, and Put a checkmark next to each of the lines listed below. Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix Checked button.

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,owhmfub.exe,ddjfihw.exe
O2 - BHO: (no name) - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - (no file)
O2 - BHO: (no name) - {44FDA5DF-3D1C-6CC9-38D3-63837ABCAA9B} - (no file)
O2 - BHO: (no name) - {81C5FE14-6EDD-6708-A2AD-641340DC6DC7} - C:\WINNT\system32\tjzelq.dll (file missing)
O4 - HKLM\..\Run: [Qtgfafw] C:\Program Files\Lzrybcc\Vjnz.exe
O4 - HKLM\..\Run: [cdkxifil] C:\WINNT\cdkxifil.exe
O4 - HKLM\..\Run: [<°‡@¡±§Tlçÿ[Ì…*9ÀøC:\Program Files\ISTsvc\istsvc.exe] C:\WINNT\lubrbwok.exe
O4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /auto
O4 - HKLM\..\Run: [stb] C:\WINNT\system32\stb.exe
O4 - HKLM\..\Run: [noC=] c:\windows\mrjj.exe
O4 - HKLM\..\Run: [F ma] C:\windows\mrjj.exe
O4 - HKLM\..\Run: [w15b364a.dll] RUNDLL32.EXE w15b364a.dll,I2 0009243e015b364a
O4 - HKLM\..\Run: [bppoxa] C:\WINNT\system32\bxlwxc.exe reg_run
O4 - HKLM\..\Run: [gycfjg] C:\WINNT\system32\bxlwxc.exe reg_run
O4 - HKLM\..\Run: [mjnvun] C:\WINNT\system32\mrjeup.exe reg_run
O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINNT\system32\oodevpeb.exe DO0605
O4 - HKCU\..\Run: [License Manager] "C:\Program Files\License_Manager\license_manager.exe " /silent
O4 - HKCU\..\Run: [iguwv] C:\WINNT\system32\mrjeup.exe reg_run
O4 - Startup: Think-Adz.lnk = C:\WINNT\system32\oodevpeb.exe
O8 - Extra context menu item: &Search - http://km.bar.need2f...earch.html?p=KM
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINNT\TWFudWVsIENydXo\command.exe (file missing)




==============


Please download ComboFix and save it to your desktop.
Double click combofix.exe and follow the prompts.
When it's done running it will produce a log for you. Please post that log in your next reply.

Important Note - Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  • 0

#5
cruz619sd
Posted 07 January 2007 - 11:23 PM

cruz619sd

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts
Scan is attached.

Attached Files


  • 0

#6
Buckeye_Sam
Posted 09 January 2007 - 03:20 PM

Buckeye_Sam

    Malware Expert

  • Member
  • PipPipPipPipPipPipPipPip
  • 10,019 posts
You've posted the log from your AVG scan. I need to see the log from Combofix. :whistling:
  • 0

#7
cruz619sd
Posted 14 January 2007 - 07:40 PM

cruz619sd

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts
combofix scan attached

Catalina - 07-01-07 20:34:42.37 Service Pack 2
ComboFix 06.11.27 - Running from: "C:\Documents and Settings\Catalina\Desktop"

((((((((((((((((((((((((((((((((((((((((((( E-Give / Ssk's Log )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINNT\system32\repairs302972946.dll
C:\Documents and Settings\the mommy\Application Data\Sskcwrd.dll
C:\Documents and Settings\the mommy\Application Data\Sskknwrd.dll


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Documents and Settings\Catalina\Start Menu\Programs\Startup\z_start.lnk
C:\secure32.html
C:\WINNT\system32\cmd.com
C:\WINNT\system32\netstat.com
C:\WINNT\system32\ping.com
C:\WINNT\system32\regedit.com
C:\WINNT\system32\stb.exe
C:\WINNT\system32\taskkill.com
C:\WINNT\system32\tasklist.com
C:\WINNT\system32\tracert.com
C:\WINNT\system32\w002a493.dll
C:\Documents and Settings\LocalService\Application Data\NetMon
C:\Documents and Settings\All Users\Documents\Settings
C:\Program Files\winupdates

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

Folders Quarantined:

C:\QooBox\Purity\Program Files\FNTS~1
C:\QooBox\Purity\Program Files\Common Files\RACLE~1
C:\QooBox\Purity\Program Files\Common Files\SMANTE~1
C:\QooBox\Purity\WINNT\DOBE~1
C:\QooBox\Purity\WINNT\STEM~1
C:\QooBox\Purity\WINNT\system32\MCROSO~1
C:\QooBox\Purity\WINNT\system32\PPATCH~1
C:\QooBox\Purity\WINNT\system32\RACLE~1
C:\QooBox\Purity\WINNT\system32\SMBOLS~1
C:\QooBox\Purity\WINNT\system32\SSTEM~1
C:\QooBox\Purity\WINNT\system32\STEM~1
C:\QooBox\Purity\WINNT\system32\PPATCH~1\winspool.exe


((((((((((((((((((((((((((((((( Files Created from 2001-06-07 to 2001/07/2007 ))))))))))))))))))))))))))))))))))


No new files created in this timespan


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2012/20/2004 05:58 PM 110352 --a--c--- C:\WINNT\system32\drivers\SYMEVENT.SYS
2012/03/2001 11:57 AM 145184 --a--c--- C:\WINNT\system32\drivers\ICAM3D2.SYS
2011/29/2004 04:51 PM 122928 --a------ C:\WINNT\system32\drivers\SPCA561.SYS
2011/24/2001 09:11 AM 81924 -----c--- C:\WINNT\system32\drivers\VC4CB104.SYS
2010/29/2003 12:02 PM 21120 --a------ C:\WINNT\system32\drivers\nv_agp.SYS
2010/26/2005 12:12 PM 20640 --a--c--- C:\WINNT\system32\drivers\pxhelp20.sys
2010/18/2006 08:00 PM 38528 --a------ C:\WINNT\system32\drivers\wpdusb.sys
2010/15/2004 03:24 PM 46208 --a--c--- C:\WINNT\system32\drivers\symndis.sys
2010/15/2004 03:24 PM 34496 --a--c--- C:\WINNT\system32\drivers\symids.sys
2010/15/2004 03:24 PM 266432 --a------ C:\WINNT\system32\drivers\symtdi.sys
2010/15/2004 03:24 PM 25824 --a------ C:\WINNT\system32\drivers\symredrv.sys
2010/15/2004 03:24 PM 171424 --a--c--- C:\WINNT\system32\drivers\symfw.sys
2010/15/2004 03:24 PM 11040 --a--c--- C:\WINNT\system32\drivers\symdns.sys
2009/29/2004 02:28 PM 134912 --a------ C:\WINNT\system32\drivers\ipnat.sys
2009/28/2006 07:00 PM 82944 --------- C:\WINNT\system32\drivers\WudfRd.sys
2009/28/2006 06:55 PM 77568 --------- C:\WINNT\system32\drivers\WudfPf.sys
2009/19/2006 03:44 PM 15664 --a------ C:\WINNT\system32\drivers\GEARAspiWDM.sys
2009/10/2001 08:00 AM 17976 --a------ C:\WINNT\system32\drivers\epusbsto.sys
2009/05/2006 08:03 AM 3968 --a------ C:\WINNT\system32\drivers\AvgAsCln.sys
2008/23/2001 04:00 AM 10496 --a------ C:\WINNT\system32\drivers\dxapi.sys
2008/21/2006 01:14 AM 128896 --------- C:\WINNT\system32\drivers\fltmgr.sys
2008/17/2001 12:53 PM 6784 --a------ C:\WINNT\system32\drivers\serscan.sys
2008/17/2001 05:59 AM 3072 --a------ C:\WINNT\system32\drivers\audstub.sys
2008/17/2001 02:05 PM 141056 --a------ C:\WINNT\system32\drivers\Icam3.sys
2008/17/2001 01:05 PM 48000 --a--c--- C:\WINNT\system32\drivers\OVCam2.sys
2008/17/2001 01:05 PM 351616 --a--c--- C:\WINNT\system32\drivers\OVCodek2.sys
2008/17/2001 01:05 PM 28032 --a------ C:\WINNT\system32\drivers\OVCD.sys
2008/16/2006 01:37 AM 225664 --a--c--- C:\WINNT\system32\drivers\tcpip6.sys
2008/14/2006 02:34 AM 332928 --a------ C:\WINNT\system32\drivers\srv.sys
2008/04/2004 12:01 AM 40840 --a------ C:\WINNT\system32\drivers\termdd.sys
2008/04/2004 12:01 AM 21896 --a--c--- C:\WINNT\system32\drivers\tdtcp.sys
2008/04/2004 12:01 AM 12040 --a--c--- C:\WINNT\system32\drivers\tdpipe.sys
2008/03/2004 10:15 PM 64896 --a------ C:\WINNT\system32\drivers\serial.sys
2008/03/2004 10:15 PM 60800 --a------ C:\WINNT\system32\drivers\sysaudio.sys
2008/03/2004 10:15 PM 574592 --a--c--- C:\WINNT\system32\drivers\ntfs.sys
2008/03/2004 10:15 PM 145792 --a------ C:\WINNT\system32\drivers\portcls.sys
2008/03/2004 10:15 PM 140928 --a------ C:\WINNT\system32\drivers\ks.sys
2008/03/2004 10:15 PM 107904 --a--c--- C:\WINNT\system32\drivers\mup.sys
2008/03/2004 10:14 PM 91776 --a------ C:\WINNT\system32\drivers\ndiswan.sys
2008/03/2004 10:14 PM 74752 --a------ C:\WINNT\system32\drivers\ipsec.sys
2008/03/2004 10:14 PM 63744 --a------ C:\WINNT\system32\drivers\cdfs.sys
2008/03/2004 10:14 PM 52736 --a------ C:\WINNT\system32\drivers\i8042prt.sys
2008/03/2004 10:14 PM 51328 --a------ C:\WINNT\system32\drivers\rasl2tp.sys
2008/03/2004 10:14 PM 49664 --a--c--- C:\WINNT\system32\drivers\classpnp.sys
2008/03/2004 10:14 PM 48384 --a------ C:\WINNT\system32\drivers\raspptp.sys
2008/03/2004 10:14 PM 182912 --a--c--- C:\WINNT\system32\drivers\ndis.sys
2008/03/2004 10:14 PM 162816 --a------ C:\WINNT\system32\drivers\netbt.sys
2008/03/2004 10:14 PM 143360 --a------ C:\WINNT\system32\drivers\fastfat.sys
2008/03/2004 10:14 PM 138496 --a------ C:\WINNT\system32\drivers\afd.sys
2008/03/2004 10:10 PM 85376 --a------ C:\WINNT\system32\drivers\nabtsfec.sys
2008/03/2004 10:10 PM 78464 --------- C:\WINNT\system32\drivers\usbvideo.sys
2008/03/2004 10:10 PM 59648 -----c--- C:\WINNT\system32\drivers\rfcomm.sys
2008/03/2004 10:10 PM 38016 -----c--- C:\WINNT\system32\drivers\bthmodem.sys
2008/03/2004 10:10 PM 35456 -----c--- C:\WINNT\system32\drivers\bthprint.sys
2008/03/2004 10:10 PM 274304 -----c--- C:\WINNT\system32\drivers\bthport.sys
2008/03/2004 10:10 PM 25600 -----c--- C:\WINNT\system32\drivers\hidbth.sys
2008/03/2004 10:10 PM 19328 --a------ C:\WINNT\system32\drivers\wstcodec.sys
2008/03/2004 10:10 PM 18944 -----c--- C:\WINNT\system32\drivers\bthusb.sys
2008/03/2004 10:10 PM 17024 --a------ C:\WINNT\system32\drivers\ccdecode.sys
2008/03/2004 10:10 PM 17024 -----c--- C:\WINNT\system32\drivers\bthenum.sys
2008/03/2004 10:10 PM 15360 --a--c--- C:\WINNT\system32\drivers\mpe.sys
2008/03/2004 10:10 PM 15360 --a------ C:\WINNT\system32\drivers\streamip.sys
2008/03/2004 10:10 PM 11776 --a--c--- C:\WINNT\system32\drivers\bdasup.sys
2008/03/2004 10:10 PM 11136 --a------ C:\WINNT\system32\drivers\slip.sys
2008/03/2004 10:10 PM 10880 --a------ C:\WINNT\system32\drivers\ndisip.sys
2008/03/2004 10:09 PM 51328 --a--c--- C:\WINNT\system32\drivers\msdv.sys
2008/03/2004 10:09 PM 25472 --a--c--- C:\WINNT\system32\drivers\sonydcam.sys
2008/03/2004 10:08 PM 57600 --a------ C:\WINNT\system32\drivers\usbhub.sys
2008/03/2004 10:08 PM 48640 --a------ C:\WINNT\system32\drivers\stream.sys
2008/03/2004 10:08 PM 36224 --a--c--- C:\WINNT\system32\drivers\hidclass.sys
2008/03/2004 10:08 PM 31616 --a------ C:\WINNT\system32\drivers\usbccgp.sys
2008/03/2004 10:08 PM 30080 --a--c--- C:\WINNT\system32\drivers\modem.sys
2008/03/2004 10:08 PM 26624 --a------ C:\WINNT\system32\drivers\usbehci.sys
2008/03/2004 10:08 PM 26496 --a------ C:\WINNT\system32\drivers\usbstor.sys
2008/03/2004 10:08 PM 24960 --a------ C:\WINNT\system32\drivers\hidparse.sys
2008/03/2004 10:08 PM 17024 --a------ C:\WINNT\system32\drivers\usbohci.sys
2008/03/2004 10:08 PM 16000 --a--c--- C:\WINNT\system32\drivers\usbintel.sys
2008/03/2004 10:08 PM 15104 --a--c--- C:\WINNT\system32\drivers\hidir.sys
2008/03/2004 10:08 PM 142976 --a------ C:\WINNT\system32\drivers\usbport.sys
2008/03/2004 10:07 PM 799744 --a------ C:\WINNT\system32\drivers\dmboot.sys
2008/03/2004 10:07 PM 79744 --a------ C:\WINNT\system32\drivers\videoprt.sys
2008/03/2004 10:07 PM 68224 --a------ C:\WINNT\system32\drivers\pci.sys
2008/03/2004 10:07 PM 67584 -----c--- C:\WINNT\system32\drivers\sdbus.sys
2008/03/2004 10:07 PM 63744 --a--c--- C:\WINNT\system32\drivers\mf.sys
2008/03/2004 10:07 PM 60288 --a------ C:\WINNT\system32\drivers\drmk.sys
2008/03/2004 10:07 PM 6016 --a--c--- C:\WINNT\system32\drivers\smbali.sys
2008/03/2004 10:07 PM 59264 --a------ C:\WINNT\system32\drivers\usbaudio.sys
2008/03/2004 10:07 PM 52864 --a------ C:\WINNT\system32\drivers\dmusic.sys
2008/03/2004 10:07 PM 46464 -----c--- C:\WINNT\system32\drivers\gagp30kx.sys
2008/03/2004 10:07 PM 44928 --a--c--- C:\WINNT\system32\drivers\agpcpq.sys
2008/03/2004 10:07 PM 44672 -----c--- C:\WINNT\system32\drivers\uagp35.sys
2008/03/2004 10:07 PM 43008 --a--c--- C:\WINNT\system32\drivers\amdagp.sys
2008/03/2004 10:07 PM 42752 --a--c--- C:\WINNT\system32\drivers\alim1541.sys
2008/03/2004 10:07 PM 42368 --a--c--- C:\WINNT\system32\drivers\agp440.sys
2008/03/2004 10:07 PM 42240 --a--c--- C:\WINNT\system32\drivers\viaagp.sys
2008/03/2004 10:07 PM 41088 --a--c--- C:\WINNT\system32\drivers\sisagp.sys
2008/03/2004 10:07 PM 2944 --a------ C:\WINNT\system32\drivers\drmkaud.sys
2008/03/2004 10:07 PM 20992 --a------ C:\WINNT\system32\drivers\vga.sys
2008/03/2004 10:07 PM 187776 --a------ C:\WINNT\system32\drivers\acpi.sys
2008/03/2004 10:07 PM 18560 --a------ C:\WINNT\system32\drivers\tdi.sys
2008/03/2004 10:07 PM 15488 --------- C:\WINNT\system32\drivers\mssmbios.sys
2008/03/2004 10:07 PM 153344 --a--c--- C:\WINNT\system32\drivers\dmio.sys
2008/03/2004 10:07 PM 119936 --a------ C:\WINNT\system32\drivers\pcmcia.sys
2008/03/2004 10:06 PM 73472 --a------ C:\WINNT\system32\drivers\sr.sys
2008/03/2004 10:05 PM 41472 --a------ C:\WINNT\system32\drivers\raspppoe.sys
2008/03/2004 10:05 PM 14336 --a------ C:\WINNT\system32\drivers\asyncmac.sys
2008/03/2004 10:04 PM 69120 --a------ C:\WINNT\system32\drivers\psched.sys
2008/03/2004 10:04 PM 35072 --a------ C:\WINNT\system32\drivers\msgpc.sys
2008/03/2004 10:04 PM 34560 --a------ C:\WINNT\system32\drivers\wanarp.sys
2008/03/2004 10:04 PM 30080 --a--c--- C:\WINNT\system32\drivers\rndismp.sys
2008/03/2004 10:04 PM 30080 -----c--- C:\WINNT\system32\drivers\rndismpx.sys
2008/03/2004 10:04 PM 20992 --a------ C:\WINNT\system32\drivers\ipinip.sys
2008/03/2004 10:04 PM 13568 --a--c--- C:\WINNT\system32\drivers\wacompen.sys
2008/03/2004 10:04 PM 12672 --a--c--- C:\WINNT\system32\drivers\mutohpen.sys
2008/03/2004 10:04 PM 12672 --a------ C:\WINNT\system32\drivers\usb8023.sys
2008/03/2004 10:04 PM 12672 -----c--- C:\WINNT\system32\drivers\usb8023x.sys
2008/03/2004 10:03 PM 88448 --a--c--- C:\WINNT\system32\drivers\nwlnkipx.sys
2008/03/2004 10:03 PM 34560 --a------ C:\WINNT\system32\drivers\netbios.sys
2008/03/2004 10:03 PM 12928 --a------ C:\WINNT\system32\drivers\ndisuio.sys
2008/03/2004 10:03 PM 12416 --a--c--- C:\WINNT\system32\drivers\tunmp.sys
2008/03/2004 10:01 PM 25856 --a------ C:\WINNT\system32\drivers\usbprint.sys
2008/03/2004 10:01 PM 196864 --a--c--- C:\WINNT\system32\drivers\rdpdr.sys
2008/03/2004 10:00 PM 71040 --a--c--- C:\WINNT\system32\drivers\dxg(2)(2).sys
2008/03/2004 10:00 PM 71040 --a------ C:\WINNT\system32\drivers\dxg.sys
2008/03/2004 10:00 PM 66176 --a--c--- C:\WINNT\system32\drivers\udfs.sys
2008/03/2004 10:00 PM 52352 --a--c--- C:\WINNT\system32\drivers\volsnap.sys
2008/03/2004 10:00 PM 41856 --a------ C:\WINNT\system32\drivers\imapi.sys
2008/03/2004 10:00 PM 30848 --a------ C:\WINNT\system32\drivers\npfs.sys
2008/03/2004 10:00 PM 29056 --------- C:\WINNT\system32\drivers\ip6fw.sys
2008/03/2004 10:00 PM 19072 --a------ C:\WINNT\system32\drivers\msfs.sys
2008/03/2004 10:00 PM 181248 --a------ C:\WINNT\system32\drivers\mrxdav.sys
2008/03/2004 10:00 PM 11264 --a------ C:\WINNT\system32\drivers\irenum.sys
2008/03/2004 09:59 PM 96256 --a------ C:\WINNT\system32\drivers\scsiport.sys
2008/03/2004 09:59 PM 95360 --a------ C:\WINNT\system32\drivers\atapi.sys
2008/03/2004 09:59 PM 92032 --a--c--- C:\WINNT\system32\drivers\ksecdd.sys
2008/03/2004 09:59 PM 80128 --a------ C:\WINNT\system32\drivers\parport.sys
2008/03/2004 09:59 PM 71552 --a------ C:\WINNT\system32\drivers\bridge.sys
2008/03/2004 09:59 PM 57472 --a------ C:\WINNT\system32\drivers\redbook.sys
2008/03/2004 09:59 PM 49536 --a------ C:\WINNT\system32\drivers\cdrom.sys
2008/03/2004 09:59 PM 42496 --a--c--- C:\WINNT\system32\drivers\p3.sys
2008/03/2004 09:59 PM 40320 --a--c--- C:\WINNT\system32\drivers\nmnt.sys
2008/03/2004 09:59 PM 37376 --a------ C:\WINNT\system32\drivers\amdk7.sys
2008/03/2004 09:59 PM 36992 --a--c--- C:\WINNT\system32\drivers\amdk6.sys
2008/03/2004 09:59 PM 36480 --a--c--- C:\WINNT\system32\drivers\crusoe.sys
2008/03/2004 09:59 PM 36352 --a------ C:\WINNT\system32\drivers\disk.sys
2008/03/2004 09:59 PM 36096 -----c--- C:\WINNT\system32\drivers\intelppm.sys
2008/03/2004 09:59 PM 35328 --a------ C:\WINNT\system32\drivers\processr.sys
2008/03/2004 09:59 PM 27392 --a------ C:\WINNT\system32\drivers\fdc.sys
2008/03/2004 09:59 PM 25088 --a--c--- C:\WINNT\system32\drivers\pciidex.sys
2008/03/2004 09:59 PM 20480 --a------ C:\WINNT\system32\drivers\flpydisk.sys
2008/03/2004 09:59 PM 15488 --a------ C:\WINNT\system32\drivers\serenum.sys
2008/03/2004 09:59 PM 14976 --a--c--- C:\WINNT\system32\drivers\tape.sys
2008/03/2004 09:59 PM 14208 --a--c--- C:\WINNT\system32\drivers\diskdump.sys
2008/03/2004 09:59 PM 11392 --a------ C:\WINNT\system32\drivers\sfloppy.sys
2008/03/2004 09:59 PM 11136 -----c--- C:\WINNT\system32\drivers\sffdisk.sys
2008/03/2004 09:59 PM 10240 -----c--- C:\WINNT\system32\drivers\sffp_sd.sys
2008/03/2004 09:58 PM 7552 --a------ C:\WINNT\system32\drivers\mskssrv.sys
2008/03/2004 09:58 PM 61824 --a--c--- C:\WINNT\system32\drivers\nic1394.sys
2008/03/2004 09:58 PM 60800 --a--c--- C:\WINNT\system32\drivers\arp1394.sys
2008/03/2004 09:58 PM 59904 --a------ C:\WINNT\system32\drivers\atmarpc.sys
2008/03/2004 09:58 PM 55936 --a--c--- C:\WINNT\system32\drivers\atmlane.sys
2008/03/2004 09:58 PM 5504 --a------ C:\WINNT\system32\drivers\mstee.sys
2008/03/2004 09:58 PM 5376 --a------ C:\WINNT\system32\drivers\mspclock.sys
2008/03/2004 09:58 PM 4992 --a------ C:\WINNT\system32\drivers\mspqm.sys
2008/03/2004 09:58 PM 4352 --a------ C:\WINNT\system32\drivers\swenum.sys
2008/03/2004 09:58 PM 42240 --a--c--- C:\WINNT\system32\drivers\mountmgr.sys
2008/03/2004 09:58 PM 24576 --a------ C:\WINNT\system32\drivers\kbdclass.sys
2008/03/2004 09:58 PM 23040 --a------ C:\WINNT\system32\drivers\mouclass.sys
2008/03/2004 09:58 PM 209408 --a------ C:\WINNT\system32\drivers\update.sys
2008/03/2004 09:58 PM 15104 --a------ C:\WINNT\system32\drivers\usbscan.sys
2008/03/2004 09:58 PM 14848 --a------ C:\WINNT\system32\drivers\kbdhid.sys
2008/03/2004 09:58 PM 100992 -----c--- C:\WINNT\system32\drivers\bthpan.sys
2008/03/2004 09:41 PM 95424 -----c--- C:\WINNT\system32\drivers\slnthal.sys
2008/03/2004 09:41 PM 685056 -----c--- C:\WINNT\system32\drivers\hsfcxts2.sys
2008/03/2004 09:41 PM 404990 -----c--- C:\WINNT\system32\drivers\slntamr.sys
2008/03/2004 09:41 PM 220032 -----c--- C:\WINNT\system32\drivers\hsfbs2s2.sys
2008/03/2004 09:41 PM 180360 -----c--- C:\WINNT\system32\drivers\ntmtlfax.sys
2008/03/2004 09:41 PM 13776 -----c--- C:\WINNT\system32\drivers\recagent.sys
2008/03/2004 09:41 PM 13240 -----c--- C:\WINNT\system32\drivers\slwdmsup.sys
2008/03/2004 09:41 PM 1309184 -----c--- C:\WINNT\system32\drivers\mtlstrm.sys
2008/03/2004 09:41 PM 129535 -----c--- C:\WINNT\system32\drivers\slnt7554.sys
2008/03/2004 09:41 PM 126686 -----c--- C:\WINNT\system32\drivers\mtlmnt5.sys
2008/03/2004 09:41 PM 11868 -----c--- C:\WINNT\system32\drivers\mdmxsdk.sys
2008/03/2004 09:41 PM 1041536 -----c--- C:\WINNT\system32\drivers\hsfdpsp2.sys
2008/03/2004 09:29 PM 73216 --a--c--- C:\WINNT\system32\drivers\atintuxx.sys
2008/03/2004 09:29 PM 701440 --a--c--- C:\WINNT\system32\drivers\ati2mtag.sys
2008/03/2004 09:29 PM 63663 -----c--- C:\WINNT\system32\drivers\ati1rvxx.sys
2008/03/2004 09:29 PM 63488 --a--c--- C:\WINNT\system32\drivers\atinxsxx.sys
2008/03/2004 09:29 PM 57856 --a--c--- C:\WINNT\system32\drivers\atinbtxx.sys
2008/03/2004 09:29 PM 56623 -----c--- C:\WINNT\system32\drivers\ati1btxx.sys
2008/03/2004 09:29 PM 52224 --a--c--- C:\WINNT\system32\drivers\atinraxx.sys
2008/03/2004 09:29 PM 452736 -----c--- C:\WINNT\system32\drivers\mtxparhm.sys
2008/03/2004 09:29 PM 36463 -----c--- C:\WINNT\system32\drivers\ati1tuxx.sys
2008/03/2004 09:29 PM 34735 -----c--- C:\WINNT\system32\drivers\ati1xsxx.sys
2008/03/2004 09:29 PM 327040 --a--c--- C:\WINNT\system32\drivers\ati2mtaa.sys
2008/03/2004 09:29 PM 31744 --a--c--- C:\WINNT\system32\drivers\atinxbxx.sys
2008/03/2004 09:29 PM 30671 -----c--- C:\WINNT\system32\drivers\ati1raxx.sys
2008/03/2004 09:29 PM 29455 -----c--- C:\WINNT\system32\drivers\ati1xbxx.sys
2008/03/2004 09:29 PM 28672 --a--c--- C:\WINNT\system32\drivers\atinsnxx.sys
2008/03/2004 09:29 PM 26367 -----c--- C:\WINNT\system32\drivers\ati1snxx.sys
2008/03/2004 09:29 PM 25471 -----c--- C:\WINNT\system32\drivers\watv10nt.sys
2008/03/2004 09:29 PM 22271 -----c--- C:\WINNT\system32\drivers\watv06nt.sys
2008/03/2004 09:29 PM 21343 -----c--- C:\WINNT\system32\drivers\ati1ttxx.sys
2008/03/2004 09:29 PM 166912 -----c--- C:\WINNT\system32\drivers\s3gnbm.sys
2008/03/2004 09:29 PM 14336 --a--c--- C:\WINNT\system32\drivers\atinpdxx.sys
2008/03/2004 09:29 PM 13824 --a--c--- C:\WINNT\system32\drivers\atinttxx.sys
2008/03/2004 09:29 PM 13824 --a--c--- C:\WINNT\system32\drivers\atinmdxx.sys
2008/03/2004 09:29 PM 12047 -----c--- C:\WINNT\system32\drivers\ati1pdxx.sys
2008/03/2004 09:29 PM 11935 -----c--- C:\WINNT\system32\drivers\wadv11nt.sys
2008/03/2004 09:29 PM 11871 -----c--- C:\WINNT\system32\drivers\wadv09nt.sys
2008/03/2004 09:29 PM 11807 -----c--- C:\WINNT\system32\drivers\wadv07nt.sys
2008/03/2004 09:29 PM 11615 -----c--- C:\WINNT\system32\drivers\ati1mdxx.sys
2008/03/2004 09:29 PM 11295 -----c--- C:\WINNT\system32\drivers\wadv08nt.sys
2008/03/2004 09:29 PM 104960 --a--c--- C:\WINNT\system32\drivers\atinrvxx.sys
2007/16/2003 12:53 PM 12032 --a------ C:\WINNT\system32\drivers\ws2ifsl.sys
2007/16/2003 12:52 PM 4352 --a------ C:\WINNT\system32\drivers\wmilib.sys
2007/16/2003 12:49 PM 4736 --a------ C:\WINNT\system32\drivers\usbd.sys
2007/16/2003 12:45 PM 14592 --a--c--- C:\WINNT\system32\drivers\smclib.sys
2007/16/2003 12:44 PM 27440 --a------ C:\WINNT\system32\drivers\secdrv.sys
2007/16/2003 12:43 PM 5888 --a--c--- C:\WINNT\system32\drivers\rootmdm.sys
2007/16/2003 12:42 PM 8832 --a------ C:\WINNT\system32\drivers\rasacd.sys
2007/16/2003 12:42 PM 4224 --a------ C:\WINNT\system32\drivers\rdpcdd.sys
2007/16/2003 12:42 PM 34432 --a--c--- C:\WINNT\system32\drivers\rawwan.sys
2007/16/2003 12:42 PM 17792 --a------ C:\WINNT\system32\drivers\ptilink.sys
2007/16/2003 12:42 PM 16512 --a------ C:\WINNT\system32\drivers\raspti.sys
2007/16/2003 12:41 PM 6784 --a------ C:\WINNT\system32\drivers\parvdm.sys
2007/16/2003 12:41 PM 3328 --a--c--- C:\WINNT\system32\drivers\pciide.sys
2007/16/2003 12:41 PM 18688 --a--c--- C:\WINNT\system32\drivers\partmgr.sys
2007/16/2003 12:40 PM 63232 --a--c--- C:\WINNT\system32\drivers\nwlnknb.sys
2007/16/2003 12:40 PM 55936 --a--c--- C:\WINNT\system32\drivers\nwlnkspx.sys
2007/16/2003 12:40 PM 3456 --a--c--- C:\WINNT\system32\drivers\oprghdlr.sys
2007/16/2003 12:40 PM 32512 --a------ C:\WINNT\system32\drivers\nwlnkfwd.sys
2007/16/2003 12:40 PM 2944 --a------ C:\WINNT\system32\drivers\null.sys
2007/16/2003 12:40 PM 12416 --a------ C:\WINNT\system32\drivers\nwlnkflt.sys
2007/16/2003 12:37 PM 9600 --a------ C:\WINNT\system32\drivers\ndistapi.sys
2007/16/2003 12:37 PM 38016 --a------ C:\WINNT\system32\drivers\ndproxy.sys
2007/16/2003 12:33 PM 4224 --a------ C:\WINNT\system32\drivers\mnmdd.sys
2007/16/2003 12:32 PM 7680 --a--c--- C:\WINNT\system32\drivers\mcd.sys
2007/16/2003 12:30 PM 35840 --a------ C:\WINNT\system32\drivers\isapnp.sys
2007/16/2003 12:30 PM 32896 --a------ C:\WINNT\system32\drivers\ipfltdrv.sys
2007/16/2003 12:29 PM 9600 --a------ C:\WINNT\system32\drivers\hidusb.sys
2007/16/2003 12:28 PM 7936 --a------ C:\WINNT\system32\drivers\fs_rec.sys
2007/16/2003 12:28 PM 34944 --a------ C:\WINNT\system32\drivers\fips.sys
2007/16/2003 12:28 PM 125056 --a------ C:\WINNT\system32\drivers\ftdisk.sys
2007/16/2003 12:27 PM 5888 --a--c--- C:\WINNT\system32\drivers\dmload.sys
2007/16/2003 12:27 PM 58112 --a--c--- C:\WINNT\system32\drivers\vdmindvd.sys
2007/16/2003 12:27 PM 54272 --a------ C:\WINNT\system32\drivers\swmidi.sys
2007/16/2003 12:27 PM 51712 --a--c--- C:\WINNT\system32\drivers\tosdvd.sys
2007/16/2003 12:27 PM 3328 --a------ C:\WINNT\system32\drivers\dxgthk.sys
2007/16/2003 12:27 PM 262528 --a--c--- C:\WINNT\system32\drivers\cinemst2.sys
2007/16/2003 12:27 PM 23936 --a------ C:\WINNT\system32\drivers\usbcamd2.sys
2007/16/2003 12:27 PM 23808 --a--c--- C:\WINNT\system32\drivers\usbcamd.sys
2007/16/2003 12:27 PM 21376 --a--c--- C:\WINNT\system32\drivers\tsbvcap.sys
2007/16/2003 12:27 PM 18688 --a------ C:\WINNT\system32\drivers\cdaudio.sys
2007/16/2003 12:27 PM 12160 --a--c--- C:\WINNT\system32\drivers\fsvga.sys
2007/16/2003 12:27 PM 12160 --a------ C:\WINNT\system32\drivers\mouhid.sys
2007/16/2003 12:27 PM 12032 --a--c--- C:\WINNT\system32\drivers\riodrv.sys
2007/16/2003 12:27 PM 12032 --a--c--- C:\WINNT\system32\drivers\rio8drv.sys
2007/16/2003 12:27 PM 12032 --a--c--- C:\WINNT\system32\drivers\nikedrv.sys
2007/16/2003 12:27 PM 11776 --a--c--- C:\WINNT\system32\drivers\cpqdap01.sys
2007/16/2003 12:25 PM 13952 --a--c--- C:\WINNT\system32\drivers\cbidf2k.sys
2007/16/2003 12:24 PM 4224 --a------ C:\WINNT\system32\drivers\beep.sys
2007/16/2003 12:24 PM 352256 --a--c--- C:\WINNT\system32\drivers\atmuni.sys
2007/16/2003 12:24 PM 31360 --a--c--- C:\WINNT\system32\drivers\atmepvc.sys
2007/16/2003 12:23 PM 11648 --a--c--- C:\WINNT\system32\drivers\acpiec.sys
2007/15/2004 10:42 AM 2459712 --a------ C:\WINNT\system32\drivers\nv4_mini.sys
2007/13/2006 12:48 AM 202240 --a--c--- C:\WINNT\system32\drivers\rmcast.sys
2006/22/2004 07:05 AM 51088 --a------ C:\WINNT\system32\drivers\hpzid412.sys
2006/22/2004 07:05 AM 21744 --a------ C:\WINNT\system32\drivers\HPZius12.sys
2006/22/2004 07:05 AM 16496 --a------ C:\WINNT\system32\drivers\HPZipr12.sys
2006/14/2006 12:47 AM 6400 --a------ C:\WINNT\system32\drivers\splitter.sys
2006/14/2006 12:47 AM 172416 --a------ C:\WINNT\system32\drivers\kmixer.sys
2006/14/2006 01:00 AM 82944 --a------ C:\WINNT\system32\drivers\wdmaud.sys
2006/09/2005 08:09 PM 139528 --a--c--- C:\WINNT\system32\drivers\rdpwd.sys
2005/05/2006 01:47 AM 174592 --a------ C:\WINNT\system32\drivers\rdbss.sys
2005/05/2006 01:41 AM 453120 --a------ C:\WINNT\system32\drivers\mrxsmb.sys
2005/02/2005 02:30 PM 6702 --a------ C:\WINNT\system32\drivers\FlashSys.sys
2004/20/2006 03:51 AM 359808 --a------ C:\WINNT\system32\drivers\tcpip.sys
2003/16/2006 04:33 PM 262784 --------- C:\WINNT\system32\drivers\http.sys
2003/03/2004 01:02 PM 737024 --a------ C:\WINNT\system32\drivers\nvmcp.sys
2003/03/2004 01:02 PM 66688 --a------ C:\WINNT\system32\drivers\nvarm.sys
2003/03/2004 01:02 PM 40832 --a------ C:\WINNT\system32\drivers\nvax.sys
2003/03/2004 01:02 PM 320640 --a------ C:\WINNT\system32\drivers\nvapu.sys
2002/19/2005 01:13 PM 8552 --a------ C:\WINNT\system32\drivers\asctrm.sys
2002/14/2006 04:22 PM 142464 --a------ C:\WINNT\system32\drivers\aec.sys


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Yahoo! Pager"="\"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe\" -quiet"
"Aim6"="\"C:\\Program Files\\Common Files\\AOL\\Launch\\AOLLaunch.exe\" /d locale=en-US ee://aol/imApp"
"SpybotSD TeaTimer"="C:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe"
"License Manager"="\"C:\\Program Files\\License_Manager\\license_manager.exe \" /silent"
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.908.5008\\GoogleToolbarNotifier.exe"
"iguwv"="C:\\WINNT\\system32\\mrjeup.exe reg_run"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"NvMixerTray"="C:\\Program Files\\NVIDIA Corporation\\NvMixer\\NvMixerTray.exe"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINNT\\System32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINNT\\System32\\NvMcTray.dll,NvTaskbarInit"
"RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\""
"REGSHAVE"="C:\\Program Files\\REGSHAVE\\REGSHAVE.EXE /AUTORUN"
"PowerDVD"="C:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe /autostart"
"Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\""
"DisplayTrayIcon"="C:\\WINNT\\System32\\TrayIcon.exe"
"LiveMonitor"="C:\\Program Files\\MSI\\Live Update 3\\LMonitor.exe"
"HostManager"="C:\\Program Files\\Common Files\\AOL\\1138205062\\ee\\AOLSoftware.exe"
"HP Software Update"="\"c:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe\""
"HP Component Manager"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\""
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"IPHSend"="C:\\Program Files\\Common Files\\AOL\\IPHSend\\IPHSend.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="file:///C:/Documents%20and%20Settings/Daddy/Desktop/New%20Folder%20(2)/Picture%20023.jpg"
"SubscribedURL"="file:///C:/Documents%20and%20Settings/Daddy/Desktop/New%20Folder%20(2)/Picture%20023.jpg"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,d7,00,00,00,ca,01,00,00,e8,00,00,00,f0,00,00,00,e8,\
03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,d7,00,00,00,ca,01,00,00,e8,00,00,00,f0,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:dc,ff,39,03,f3,99,83,7c,70,9a,80,7c,ff,ff,ff,ff,66,9a,\
80,7c,66,9a,80,7c

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
"Source"="file:///C:/Documents%20and%20Settings/Daddy/Desktop/New%20Folder%20(2)/Picture%20022.jpg"
"SubscribedURL"="file:///C:/Documents%20and%20Settings/Daddy/Desktop/New%20Folder%20(2)/Picture%20022.jpg"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,bf,00,00,00,0b,00,00,00,b9,00,00,00,94,00,00,00,ea,\
03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,bf,00,00,00,0b,00,00,00,b9,00,00,00,94,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:dc,ff,39,03,f3,99,83,7c,70,9a,80,7c,ff,ff,ff,ff,66,9a,\
80,7c,66,9a,80,7c

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\10]
"Source"="file:///C:/Documents%20and%20Settings/Daddy/My%20Documents/My%20Pictures/New%20Folder%20(2)/46775457541_468.jpg"
"SubscribedURL"="file:///C:/Documents%20and%20Settings/Daddy/My%20Documents/My%20Pictures/New%20Folder%20(2)/46775457541_468.jpg"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,6a,01,00,00,f8,01,00,00,e3,00,00,00,e5,00,00,00,fc,\
03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,6a,01,00,00,f8,01,00,00,e3,00,00,00,e5,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:dc,ff,1f,03,f3,99,83,7c,70,9a,80,7c,ff,ff,ff,ff,66,9a,\
80,7c,66,9a,80,7c

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\11]
"Source"="http://pictures.spri...&outquality=90"
"SubscribedURL"="http://pictures.spri...&outquality=90"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,01,01,00,00,c3,01,00,00,56,01,00,00,21,01,00,00,fe,\
03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,01,01,00,00,c3,01,00,00,56,01,00,00,21,01,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:14,6d,c5,04,41,c0,b4,74,30,16,c3,02,68,de,c5,04,20,6d,\
c5,04,b9,42,00,00

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\12]
"Source"="file:///C:/Documents%20and%20Settings/Daddy/Local%20Settings/Temporary%20Internet%20Files/Content.IE5/H3V3XLKE/01.%2520stand%2520alone%5B1%5D.jpg"
"SubscribedURL"="file:///C:/Documents%20and%20Settings/Daddy/Local%20Settings/Temporary%20Internet%20Files/Content.IE5/H3V3XLKE/01.%2520stand%2520alone%5B1%5D.jpg"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,dc,01,00,00,4f,01,00,00,dd,00,00,00,1e,00,00,00,00,\
04,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,dc,01,00,00,4f,01,00,00,dd,00,00,00,1e,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:dc,ff,da,02,f3,99,83,7c,70,9a,80,7c,ff,ff,ff,ff,66,9a,\
80,7c,66,9a,80,7c

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\13]
"Source"="file:///C:/Documents%20and%20Settings/All%20Users/Documents/carry/MY%20NENES/Picture%20022.jpg"
"SubscribedURL"="file:///C:/Documents%20and%20Settings/All%20Users/Documents/carry/MY%20NENES/Picture%20022.jpg"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,7b,02,00,00,b6,00,00,00,e4,00,00,00,b1,00,00,00,02,\
04,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,7b,02,00,00,b6,00,00,00,e4,00,00,00,b1,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:dc,ff,39,03,f3,99,83,7c,70,9a,80,7c,ff,ff,ff,ff,66,9a,\
80,7c,66,9a,80,7c

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\14]
"Source"="file:///C:/Documents%20and%20Settings/Daddy/My%20Documents/My%20Pictures/New%20Folder%20(2)/big%20kiss1.jpg"
"SubscribedURL"="file:///C:/Documents%20and%20Settings/Daddy/My%20Documents/My%20Pictures/New%20Folder%20(2)/big%20kiss1.jpg"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,f7,02,00,00,e4,01,00,00,7e,00,00,00,7f,00,00,00,04,\
04,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,f7,02,00,00,e4,01,00,00,7e,00,00,00,7f,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:dc,ff,ba,02,f3,99,83,7c,70,9a,80,7c,ff,ff,ff,ff,66,9a,\
80,7c,66,9a,80,7c

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\15]
"Source"="file:///C:/Documents%20and%20Settings/Daddy/My%20Documents/My%20Pictures/wuv%20u.jpg"
"SubscribedURL"="file:///C:/Documents%20and%20Settings/Daddy/My%20Documents/My%20Pictures/wuv%20u.jpg"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,74,03,00,00,a4,01,00,00,79,00,00,00,6a,00,00,00,06,\
04,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,74,03,00,00,a4,01,00,00,79,00,00,00,6a,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:dc,ff,19,03,f3,99,83,7c,70,9a,80,7c,ff,ff,ff,ff,66,9a,\
80,7c,66,9a,80,7c

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\16]
"Source"="file:///C:/Documents%20and%20Settings/Daddy/My%20Documents/My%20Pictures/New%20Folder%20(2)/45224949509_468.jpg"
"SubscribedURL"="file:///C:/Documents%20and%20Settings/Daddy/My%20Documents/My%20Pictures/New%20Folder%20(2)/45224949509_468.jpg"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,06,03,00,00,75,00,00,00,91,00,00,00,76,00,00,00,08,\
04,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,06,03,00,00,75,00,00,00,91,00,00,00,76,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:dc,ff,29,03,f3,99,83,7c,70,9a,80,7c,ff,ff,ff,ff,66,9a,\
80,7c,66,9a,80,7c

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\17]
"Source"="file:///C:/Documents%20and%20Settings/Daddy/My%20Documents/My%20Pictures/New%20Folder%20(2)/baby1.jpg"
"SubscribedURL"="file:///C:/Documents%20and%20Settings/Daddy/My%20Documents/My%20Pictures/New%20Folder%20(2)/baby1.jpg"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,90,02,00,00,51,00,00,00,74,00,00,00,71,00,00,00,0a,\
04,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,90,02,00,00,51,00,00,00,74,00,00,00,71,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:dc,ff,bb,02,f3,99,83,7c,70,9a,80,7c,ff,ff,ff,ff,66,9a,\
80,7c,66,9a,80,7c

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\18]
"Source"="file:///C:/Documents%20and%20Settings/Daddy/My%20Documents/My%20Pictures/New%20Folder%20(2)/45225360773_468.jpg"
"SubscribedURL"="file:///C:/Documents%20and%20Settings/Daddy/My%20Documents/My%20Pictures/New%20Folder%20(2)/45225360773_468.jpg"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,d6,02,00,00,41,01,00,00,8a,00,00,00,86,00,00,00,0c,\
04,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,d6,02,00,00,41,01,00,00,8a,00,00,00,86,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:18,00,00,00,86,01,00,00,70,01,00,00,91,01,00,00,2c,01,\
00,00,01,00,00,40

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\19]
"Source"="http://pictures.spri...&outquality=90"
"SubscribedURL"="http://pictures.spri...&outquality=90"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,61,01,00,00,aa,01,00,00,b3,00,00,00,97,00,00,00,0e,\
04,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,61,01,00,00,aa,01,00,00,b3,00,00,00,97,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:14,6d,b9,05,41,c0,b4,74,b8,45,e5,04,68,de,b9,05,20,6d,\
b9,05,ed,1e,00,00

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\2]
"Source"="file:///C:/Documents%20and%20Settings/Daddy/Desktop/New%20Folder%20(2)/Picture%20018.jpg"
"SubscribedURL"="file:///C:/Documents%20and%20Settings/Daddy/Desktop/New%20Folder%20(2)/Picture%20018.jpg"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,70,02,00,00,0b,00,00,00,db,00,00,00,d5,00,00,00,ec,\
03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,70,02,00,00,0b,00,00,00,db,00,00,00,d5,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:dc,ff,39,03,f3,99,83,7c,70,9a,80,7c,ff,ff,ff,ff,66,9a,\
80,7c,66,9a,80,7c

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\20]
"Source"="http://pictures.spri...&outquality=90"
"SubscribedURL"="http://pictures.spri...&outquality=90"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,da,00,00,00,d2,01,00,00,94,00,00,00,7f,00,00,00,10,\
04,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,da,00,00,00,d2,01,00,00,94,00,00,00,7f,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:14,6d,1a,0f,41,c0,b4,74,10,b0,23,04,68,de,1a,0f,20,6d,\
1a,0f,ed,1e,00,00

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\21]
"Source"="http://pictures.spri...&outquality=90"
"SubscribedURL"="http://pictures.spri...&outquality=90"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,66,01,00,00,31,02,00,00,a7,00,00,00,a0,00,00,00,12,\
04,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,66,01,00,00,31,02,00,00,a7,00,00,00,a0,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:14,6d,e0,03,41,c0,b4,74,d8,b3,e0,04,68,de,e0,03,20,6d,\
e0,03,ed,1e,00,00

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\22]
"Source"="http://pictures.spri...&outquality=90"
"SubscribedURL"="http://pictures.spri...&outquality=90"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,21,02,00,00,0b,01,00,00,b5,00,00,00,ab,00,00,00,14,\
04,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,21,02,00,00,0b,01,00,00,b5,00,00,00,ab,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:14,6d,dd,0f,41,c0,b4,74,10,b0,23,04,68,de,dd,0f,20,6d,\
dd,0f,ed,1e,00,00

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\23]
"Source"="http://pictures.spri...&outquality=90"
"SubscribedURL"="http://pictures.spri...&outquality=90"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,13,02,00,00,b3,01,00,00,46,01,00,00,f6,00,00,00,16,\
04,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,13,02,00,00,b3,01,00,00,46,01,00,00,f6,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:14,6d,1a,0f,41,c0,b4,74,48,b0,df,04,68,de,1a,0f,20,6d,\
1a,0f,ed,1e,00,00

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\24]
"Source"="http://us.f3.yahoofs...F9qRCBYuV504LT"
"SubscribedURL"="http://us.f3.yahoofs...F9qRCBYuV504LT"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,0d,01,00,00,26,00,00,00,4a,01,00,00,df,00,00,00,18,\
04,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,0d,01,00,00,26,00,00,00,4a,01,00,00,df,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:14,6d,dc,04,41,c0,b4,74,88,8a,54,04,68,de,dc,04,20,6d,\
dc,04,3c,90,00,00

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\25]
"Source"="http://pictures.spri...&outquality=90"
"SubscribedURL"="http://pictures.spri...&outquality=90"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,8b,01,00,00,71,01,00,00,b8,00,00,00,b8,00,00,00,1a,\
04,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,8b,01,00,00,71,01,00,00,b8,00,00,00,b8,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:14,6d,dd,0f,41,c0,b4,74,10,b0,23,04,68,de,dd,0f,20,6d,\
dd,0f,ed,1e,00,00

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\26]
"Source"="http://pictures.spri...&outquality=90"
"SubscribedURL"="http://pictures.spri...&outquality=90"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,f0,02,00,00,37,01,00,00,e4,00,00,00,cb,00,00,00,1c,\
04,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,f0,02,00,00,37,01,00,00,e4,00,00,00,cb,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:14,6d,d1,0e,41,c0,b4,74,50,09,51,04,68,de,d1,0e,20,6d,\
d1,0e,96,c8,00,00

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\27]
"Source"="file:///C:/Documents%20and%20Settings/All%20Users/Documents/carry/MY%20NENES/Picture%20015.jpg"
"SubscribedURL"="file:///C:/Documents%20and%20Settings/All%20Users/Documents/carry/MY%20NENES/Picture%20015.jpg"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,08,03,00,00,23,02,00,00,96,00,00,00,91,00,00,00,1e,\
04,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,08,03,00,00,23,02,00,00,96,00,00,00,91,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:dc,ff,39,03,f3,99,83,7c,70,9a,80,7c,ff,ff,ff,ff,66,9a,\
80,7c,66,9a,80,7c

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\28]
"Source"="file:///C:/Documents%20and%20Settings/All%20Users/Documents/navsent%20pics/7da0%5B1%5D.jpg"
"SubscribedURL"="file:///C:/Documents%20and%20Settings/All%20Users/Documents/navsent%20pics/7da0%5B1%5D.jpg"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,03,01,00,00,20,00,00,00,f4,00,00,00,f0,00,00,00,20,\
04,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,03,01,00,00,20,00,00,00,f4,00,00,00,f0,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:dc,ff,26,03,f3,99,83,7c,70,9a,80,7c,ff,ff,ff,ff,66,9a,\
80,7c,66,9a,80,7c

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\29]
"Source"="file:///C:/Documents%20and%20Settings/All%20Users/Documents/carry/MY%20NENES/Picture%20019.jpg"
"SubscribedURL"="file:///C:/Documents%20and%20Settings/All%20Users/Documents/carry/MY%20NENES/Picture%20019.jpg"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,96,02,00,00,65,00,00,00,b0,00,00,00,aa,00,00,00,22,\
04,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,96,02,00,00,65,00,00,00,b0,00,00,00,aa,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:dc,ff,b0,02,f3,99,83,7c,70,9a,80,7c,ff,ff,ff,ff,66,9a,\
80,7c,66,9a,80,7c

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\3]
"Source"="file:///C:/Documents%20and%20Settings/All%20Users/Documents/carry/MY%20NENES/Picture%20025.jpg"
"SubscribedURL"="file:///C:/Documents%20and%20Settings/All%20Users/Documents/carry/MY%20NENES/Picture%20025.jpg"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,d3,01,00,00,d9,00,00,00,e5,00,00,00,d3,00,00,00,ee,\
03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,d3,01,00,00,d9,00,00,00,e5,00,00,00,d3,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:dc,ff,39,03,f3,99,83,7c,70,9a,80,7c,ff,ff,ff,ff,66,9a,\
80,7c,66,9a,80,7c

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\30]
"Source"="http://pictures.spri...&outquality=90"
"SubscribedURL"="http://pictures.spri...&outquality=90"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,2e,01,00,00,0a,00,00,00,cd,00,00,00,c7,00,00,00,24,\
04,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,2e,01,00,00,0a,00,00,00,cd,00,00,00,c7,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:14,6d,1d,06,41,c0,b4,74,38,ba,56,04,68,de,1d,06,20,6d,\
1d,06,bb,5b,00,00

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\31]
"Source"="http://pictures.spri...&outquality=90"
"SubscribedURL"="http://pictures.spri...&outquality=90"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,01,02,00,00,18,00,00,00,e6,00,00,00,52,01,00,00,26,\
04,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,01,02,00,00,18,00,00,00,e6,00,00,00,52,01,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:18,00,00,00,de,f9,ff,ff,55,00,00,00,59,08,00,00,80,0c,\
00,00,01,00,00,40

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\32]
"Source"="http://pictures.spri...&outquality=90"
"SubscribedURL"="http://pictures.spri...&outquality=90"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,4c,03,00,00,0e,02,00,00,68,00,00,00,68,00,00,00,28,\
04,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,4c,03,00,00,0e,02,00,00,68,00,00,00,68,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:14,6d,af,02,41,c0,b4,74,08,b0,56,04,68,de,af,02,20,6d,\
af,02,bb,5b,00,00

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\33]
"Source"="file:///C:/Documents%20and%20Settings/Michelle/My%20Documents/My%20Pictures/63677849605_330_5%5B1%5D.jpg"
"SubscribedURL"="file:///C:/Documents%20and%20Settings/Michelle/My%20Documents/My%20Pictures/63677849605_330_5%5B1%5D.jpg"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,fb,01,00,00,79,01,00,00,e2,00,00,00,50,01,00,00,2a,\
04,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,fb,01,00,00,79,01,00,00,e2,00,00,00,50,01,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:dc,ff,24,03,f3,99,83,7c,70,9a,80,7c,ff,ff,ff,ff,66,9a,\
80,7c,66,9a,80,7c

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\34]
"Source"="http://pictures.spri...&outquality=90"
"SubscribedURL"="http://pictures.spri...&outquality=90"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,12,01,00,00,e8,00,00,00,df,00,00,00,bb,00,00,00,2c,\
04,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,12,01,00,00,e8,00,00,00,df,00,00,00,bb,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:14,6d,93,05,41,c0,b4,74,00,1e,4e,04,68,de,93,05,20,6d,\
93,05,96,c8,00,00

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\35]
"Source"="http://pictures.spri...&outquality=90"
"SubscribedURL"="http://pictures.spri...&outquality=90"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,b1,00,00,00,ba,00,00,00,68,00,00,00,68,00,00,00,2e,\
04,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"C

Attached Files


Edited by Buckeye_Sam, 16 January 2007 - 02:15 PM.

  • 0

#8
Buckeye_Sam
Posted 16 January 2007 - 02:17 PM

Buckeye_Sam

    Malware Expert

  • Member
  • PipPipPipPipPipPipPipPip
  • 10,019 posts
Please do not attach files unless there is a reason for doing so. It's much easier if you just copy the text and paste it into your reply.

How is your computer running now?
Can you please post a new hijackthis log.
  • 0

#9
Buckeye_Sam
Posted 26 January 2007 - 07:24 AM

Buckeye_Sam

    Malware Expert

  • Member
  • PipPipPipPipPipPipPipPip
  • 10,019 posts
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP