[JuguarPaw]

Ok first, Hi everyone :]

This is my cousins computer so im not sure how it has gotten like this.

I have selected in folder options to show hidden folders and heres the log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:12:32 PM, on 2/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\AOL\1151382160\ee\services\safetyCore\ver210_5_4_1\aolavupd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
c:\PROGRA~1\mcafee.com\mps\mscifapp.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\CNYHKey.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\mHotkey.exe
C:\Program Files\Common Files\AOL\1151382160\ee\services\safetyCore\ver210_5_4_1\AOLSP Scheduler.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\ctfmon.exe
c:\program files\common files\aol\1151382160\ee\aolsoftware.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\drwtsn32.exe
C:\Program Files\America Online 9.0a\waol.exe
C:\WINDOWS\system32\lxcgcoms.exe
C:\WINDOWS\system32\windows
C:\Program Files\America Online 9.0a\shellmon.exe
C:\WINDOWS\system32\svchost.exe
c:\program files\common files\aol\1151382160\ee\aolsoftware.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\svchost.exe
C:\WINDOWS\system32\drwtsn32.exe
c:\program files\common files\aol\1151382160\ee\aolsoftware.exe
c:\program files\common files\aol\1151382160\ee\anotify.exe
c:\program files\common files\aol\1151382160\ee\aolsoftware.exe
c:\program files\common files\aol\1151382160\ee\aolsoftware.exe
c:\program files\common files\aol\1151382160\ee\aolsoftware.exe
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\5RXZJWHG\VundoFix[1].exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearsh...ar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearsh...ar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearsh...ar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.c...spx?tb_id=60314
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.c...aspx?TbId=60314
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearsh...ar.html?src=ssb
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.c...aspx?TbId=60314
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\5.bin\MWSSRCAS.DLL
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
R3 - URLSearchHook: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no file)
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
R3 - URLSearchHook: P2P Energy Toolbar - {2bae58c2-79f9-45d1-a286-81f911301c3a} - C:\Program Files\P2P_Energy\tbP2P0.dll (file missing)
F2 - REG:system.ini: Shell=Explorer.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\mpreg.exe
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O3 - Toolbar: (no name) - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - (no file)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - (no file)
O3 - Toolbar: (no name) - {DF4E7A0C-E233-4906-B4C1-A404356541FF} - (no file)
O3 - Toolbar: (no name) - {29C5A3B6-9A8D-4FA0-B5AD-3E20F4AA5C00} - (no file)
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll
O3 - Toolbar: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O3 - Toolbar: P2P Energy Toolbar - {2bae58c2-79f9-45d1-a286-81f911301c3a} - C:\Program Files\P2P_Energy\tbP2P0.dll (file missing)
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll
O4 - HKLM\..\Run: [MPFEXE] C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [LXCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1151382160\ee\SSCRun.exe
O4 - HKLM\..\Run: [Salestart] "C:\Program Files\Common Files\WinAntiVirus Pro 2007\mav_startupmon.exe"
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\mcafee.com\antivirus\oasclnt.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\5.bin\MWSBAR.DLL,S
O4 - HKLM\..\Run: [MPSExe] C:\Program Files\mcafee.com\MPS\mscifapp.exe /embedding
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [Lexmark 5400 Series Fax Server] "C:\Program Files\Lexmark 5400 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [IntelAudioStudio] "C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" BOOT
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1151382160\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [EmailScan] C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [AOLSPScheduler] C:\Program Files\Common Files\AOL\1151382160\ee\services\safetyCore\ver210_5_4_1\AOLSP Scheduler.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [03Q1213445347E57CBB%2DC195%2DE723%2DDACE3A2821BBBBB0] C:\Program Files\03Q1213445347E57CBB%2DC195%2DE723%2DDACE3A2821BBBBB0\pgs.exe
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [846c0afa] rundll32.exe "C:\WINDOWS\system32\ocjxsrhm.dll",b
O4 - HKCU\..\Run: [QdrModule9] "C:\Program Files\QdrModule\QdrModule9.exe"
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0a\AOL.EXE" -b
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [QdrPack13] "C:\Program Files\QdrPack\QdrPack13.exe"
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [{846C0A55-0AEF-1033-0915-050820200001}] "C:\Program Files\Common Files\{846C0A55-0AEF-1033-0915-050820200001}\Update.exe" mc-110-12-0000488 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [{846C0A55-0AEF-1033-0915-050820200001}] "C:\Program Files\Common Files\{846C0A55-0AEF-1033-0915-050820200001}\Update.exe" mc-110-12-0000488 (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Install Pending Files.LNK = C:\Program Files\SIFXINST\SIFXINST.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Search - http://edits.mywebse...?p=ZNxmk572YYUS
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=67633
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfar...p1.0.0.15-3.cab
O16 - DPF: {201B9B37-848F-40BD-90EA-7B8F0AA89D6A} - http://us2-scripts.d..._1071_em_XP.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {341FF14B-00CB-49F5-A427-A164DF1D5E1F} (MALPlaybackCtrl Class) - http://musicstore.co...ALStreaming.cab
O16 - DPF: {37A273C2-5129-11D5-BF37-00A0CCE8754B} (TTestGenXInstallObject) - http://www.mathxl.co...GenXInstall.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace....ploader1006.cab
O16 - DPF: {4FE89055-5300-469E-AFAD-DEB3181EDE76} (PearsonAsstX Control) - http://www.mathxl.co...InstallAsst.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1137004416828
O16 - DPF: {C4DD6732-1E82-4AE7-BD94-180331B84082} (DeltaCVX Control) - http://www.mathxl.co...ts/DeltaCVX.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ent/swflash.cab
O16 - DPF: {DF1C8E21-4045-4D67-B528-335F1A4F0DE9} - http://us2-scripts.d..._1073_em_XP.cab
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O18 - Filter hijack: text/html - {07851C6A-1C43-41d9-8319-BC89154A8C00} - C:\Program Files\RcvSystem\httpdchk.dll
O20 - AppInit_DLLs: c:\windows\system32\awvvvtq.dll
O22 - SharedTaskScheduler: cornerer - {9ff419a8-1748-4ca7-99df-d269465b0e8b} - (no file)
O22 - SharedTaskScheduler: cyk - {49f29a27-2451-4314-a480-8d2481ce6c81} - (no file)
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Antivirus Update Service (aolavupd) - AOL LLC - C:\Program Files\Common Files\AOL\1151382160\ee\services\safetyCore\ver210_5_4_1\aolavupd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: lxcg_device - - C:\WINDOWS\system32\lxcgcoms.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe
O23 - Service: Microsoft cache control (MSControlService) - Unknown owner - C:\WINDOWS\system32\windows
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Time Service (Time) - Unknown owner - C:\WINDOWS\system32\nlkfev7qdjpvmcjq.exe (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 18178 bytes

Im also running Vundofix and ATF Cleaner atm.

[Advertisements]

Hello

Before we begin, you should save these instructions in Notepad to your desktop, or print them, for easy reference. Much of our fix will be done in Safe mode, and you will be unable to access this thread at that time. If you have questions at any point, or are unsure of the instructions, feel free to post here and ask for clarification before proceeding.


Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, the Advanced Options Menu should appear;
• Select the first option, to run Windows in Safe Mode, then press Enter.
• Choose your usual account.

• Open the extracted SDFix folder and double click RunThis.bat to start the script.
• Type Y to begin the cleanup process.
• It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
  (Report.txt will also be copied to Clipboard ready for posting back on the forum).
• Finally paste the contents of the Report.txt back on the forum.

Please click on Start > Control Panel > Add/Remove Programs and uninstall the following programs(if present):

MyWebSearch
MyWebSA


Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

• Please, never rename Combofix unless instructed.
• Close any open browsers.
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  

  -----------------------------------------------------------

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    

    -----------------------------------------------------------

  • Close any open browsers.
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

  -----------------------------------------------------------

• Double click on combofix.exe & follow the prompts.
• When finished, it will produce a report for you.
• Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[Rorschach112]

Hello

Before we begin, you should save these instructions in Notepad to your desktop, or print them, for easy reference. Much of our fix will be done in Safe mode, and you will be unable to access this thread at that time. If you have questions at any point, or are unsure of the instructions, feel free to post here and ask for clarification before proceeding.


Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, the Advanced Options Menu should appear;
• Select the first option, to run Windows in Safe Mode, then press Enter.
• Choose your usual account.

• Open the extracted SDFix folder and double click RunThis.bat to start the script.
• Type Y to begin the cleanup process.
• It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
  (Report.txt will also be copied to Clipboard ready for posting back on the forum).
• Finally paste the contents of the Report.txt back on the forum.

Please click on Start > Control Panel > Add/Remove Programs and uninstall the following programs(if present):

MyWebSearch
MyWebSA


Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

• Please, never rename Combofix unless instructed.
• Close any open browsers.
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  

  -----------------------------------------------------------

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    

    -----------------------------------------------------------

  • Close any open browsers.
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

  -----------------------------------------------------------

• Double click on combofix.exe & follow the prompts.
• When finished, it will produce a report for you.
• Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[JuguarPaw]

Rebooting


Checking Files :

No Trojan Files Found




Folder C:\Program Files\e-zshopper - Removed
Folder C:\Program Files\QdrPack - Removed
Folder C:\Program Files\QdrModule - Removed
Folder C:\WINDOWS\Fonts\' - Removed
Folder C:\WINDOWS\system32\acespy - Removed


Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-24 16:17:56
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update]
"OfflineDetectionPending"=dword:00000001

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\WINDOWS\\system32\\dpnsvr.exe"="C:\\WINDOWS\\system32\\dpnsvr.exe:*:Disabled:Microsoft DirectPlay8 Server"
"C:\\Program Files\\America Online 9.0a\\waol.exe"="C:\\Program Files\\America Online 9.0a\\waol.exe:*:Enabled:America Online 9.0a"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\FrostWire\\FrostWire.exe"="C:\\Program Files\\FrostWire\\FrostWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"="C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe:*:Enabled:MySpaceIM"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files :



Files with Hidden Attributes :

Thu 22 Jun 2006 4,002 A..H. --- "C:\TEMP\t4.bak"
Sun 9 Jul 2006 7,155 A..H. --- "C:\TEMP\t4.bak6"
Sun 9 Jul 2006 4,592 A..H. --- "C:\TEMP\t4.bak7"
Fri 23 Jun 2006 1,673 A..H. --- "C:\TEMP\t4.bak1"
Sat 24 Jun 2006 2,602 A..H. --- "C:\TEMP\t4.bak2"
Sat 24 Jun 2006 7,218 A..H. --- "C:\TEMP\t4.bak3"
Sat 24 Jun 2006 8,843 A..H. --- "C:\TEMP\t4.bak4"
Mon 26 Jun 2006 9,839 A..H. --- "C:\TEMP\t4.bak5"
Fri 19 Nov 2004 54,872 A..H. --- "C:\Program Files\America Online 9.0a\AOLphx.exe"
Fri 19 Nov 2004 31,832 A..H. --- "C:\Program Files\America Online 9.0a\rbm.exe"
Fri 29 Jun 2007 183,296 ..SH. --- "C:\Program Files\Common Files\Yazzle1552OinAdmin.exe"
Sat 27 Oct 2007 40,183 ..SH. --- "C:\Program Files\Common Files\Yazzle1552OinUninstaller.exe"
Wed 19 Sep 2007 0 ..SH. --- "C:\WINDOWS\system32\cmd.com"
Sun 13 May 2007 74 ..SH. --- "C:\WINDOWS\system32\gfhkj.tmp"
Fri 20 Jul 2007 1,805,088 ..SH. --- "C:\WINDOWS\system32\gfhkj.bak1"
Fri 20 Jul 2007 1,806,466 ..SH. --- "C:\WINDOWS\system32\gfhkj.bak2"
Sun 4 Feb 2007 975,821 ..SH. --- "C:\WINDOWS\system32\mnnmp.tmp"
Thu 3 May 2007 1,376,955 ..SH. --- "C:\WINDOWS\system32\mnnmp.bak1"
Thu 3 May 2007 1,376,216 ..SH. --- "C:\WINDOWS\system32\mnnmp.bak2"
Wed 19 Sep 2007 0 ..SH. --- "C:\WINDOWS\system32\netstat.com"
Wed 19 Sep 2007 0 ..SH. --- "C:\WINDOWS\system32\ping.com"
Thu 31 Jan 2008 0 ..SH. --- "C:\WINDOWS\system32\regedit.com"
Wed 19 Sep 2007 0 ..SH. --- "C:\WINDOWS\system32\taskkill.com"
Wed 19 Sep 2007 0 ..SH. --- "C:\WINDOWS\system32\tasklist.com"
Wed 19 Sep 2007 0 ..SH. --- "C:\WINDOWS\system32\tracert.com"
Sun 18 Mar 2007 1,615,875 ..SH. --- "C:\WINDOWS\system32\vidnrrmg.tmp"
Sun 24 Feb 2008 24,104 ..SH. --- "C:\WINDOWS\system32\ywmivqtt.dllbox"
Sun 25 Dec 2005 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun 5 Aug 2007 150 A..H. --- "C:\Program Files\InterActual\InterActual Player\iti78C.tmp"
Fri 18 Jan 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Tue 25 Sep 2007 4,608 A..H. --- "C:\Documents and Settings\Danielle\Local Settings\Temp\vpnhtuay.sys"
Fri 16 Mar 2007 10,260 ..SH. --- "C:\Documents and Settings\Donald Robertson\Local Settings\Temp\sikqklri.exe"
Wed 19 Sep 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\cf7ced0e70c80a1e476f1abf49afecb1\BIT9.tmp"
Sun 25 Dec 2005 4,348 ...H. --- "C:\Documents and Settings\Donald Robertson\My Documents\cbvfgfjty guty6\License Backup\drmv1key.bak"
Sat 2 Dec 2006 20 A..H. --- "C:\Documents and Settings\Donald Robertson\My Documents\cbvfgfjty guty6\License Backup\drmv1lic.bak"
Sun 25 Dec 2005 400 A.SH. --- "C:\Documents and Settings\Donald Robertson\My Documents\cbvfgfjty guty6\License Backup\drmv2key.bak"
Sun 25 Dec 2005 4,348 ...H. --- "C:\Documents and Settings\Owner\My Documents\My Music\License Backup\drmv1key.bak"
Sun 25 Jun 2006 20 A..H. --- "C:\Documents and Settings\Owner\My Documents\My Music\License Backup\drmv1lic.bak"
Sun 25 Dec 2005 400 A.SH. --- "C:\Documents and Settings\Owner\My Documents\My Music\License Backup\drmv2key.bak"
Sat 21 Jan 2006 2,202 A.SH. --- "C:\Documents and Settings\Owner\Application Data\Roxio\Dragon\DiscInfoCache\LITE-ON__DVDRW_SHW-1635S__YGS3_300_DICV018_DRGV20100BC.TMP"
Sun 13 May 2007 34,308 ...H. --- "C:\Documents and Settings\Donald Robertson\Application Data\Macromedia\Shockwave Player\xtras\download\AndradeArts\Music\BASSMOD.dll"

Finished!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:56:22 PM, on 2/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\svchost.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.exe
c:\PROGRA~1\mcafee.com\mps\mscifapp.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\CNYHKey.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Common Files\AOL\1151382160\ee\aolsoftware.exe
C:\WINDOWS\mHotkey.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\AOL\1151382160\ee\aolsoftware.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
c:\program files\common files\aol\1151382160\ee\anotify.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
c:\program files\common files\aol\1151382160\ee\aolsoftware.exe
c:\program files\common files\aol\1151382160\ee\aolsoftware.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearsh...ar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearsh...ar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearsh...ar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.c...spx?tb_id=60314
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.c...aspx?TbId=60314
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearsh...ar.html?src=ssb
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.c...aspx?TbId=60314
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\5.bin\MWSSRCAS.DLL
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
R3 - URLSearchHook: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no file)
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
R3 - URLSearchHook: P2P Energy Toolbar - {2bae58c2-79f9-45d1-a286-81f911301c3a} - C:\Program Files\P2P_Energy\tbP2P0.dll (file missing)
F2 - REG:system.ini: Shell=Explorer.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\mpreg.exe
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O3 - Toolbar: (no name) - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - (no file)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - (no file)
O3 - Toolbar: (no name) - {DF4E7A0C-E233-4906-B4C1-A404356541FF} - (no file)
O3 - Toolbar: (no name) - {29C5A3B6-9A8D-4FA0-B5AD-3E20F4AA5C00} - (no file)
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll
O3 - Toolbar: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O3 - Toolbar: P2P Energy Toolbar - {2bae58c2-79f9-45d1-a286-81f911301c3a} - C:\Program Files\P2P_Energy\tbP2P0.dll (file missing)
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll
O4 - HKLM\..\Run: [MPFEXE] C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [LXCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1151382160\ee\SSCRun.exe
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\mcafee.com\antivirus\oasclnt.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\5.bin\MWSBAR.DLL,S
O4 - HKLM\..\Run: [MPSExe] C:\Program Files\mcafee.com\MPS\mscifapp.exe /embedding
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [Lexmark 5400 Series Fax Server] "C:\Program Files\Lexmark 5400 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [IntelAudioStudio] "C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" BOOT
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1151382160\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [EmailScan] C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [AOLSPScheduler] C:\Program Files\Common Files\AOL\1151382160\ee\services\safetyCore\ver210_5_4_1\AOLSP Scheduler.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [03Q1213445347E57CBB%2DC195%2DE723%2DDACE3A2821BBBBB0] C:\Program Files\03Q1213445347E57CBB%2DC195%2DE723%2DDACE3A2821BBBBB0\pgs.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [846c0afa] rundll32.exe "C:\WINDOWS\system32\kcmiellc.dll",b
O4 - HKCU\..\Run: [QdrModule9] "C:\Program Files\QdrModule\QdrModule9.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [QdrPack13] "C:\Program Files\QdrPack\QdrPack13.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [{846C0A55-0AEF-1033-0915-050820200001}] "C:\Program Files\Common Files\{846C0A55-0AEF-1033-0915-050820200001}\Update.exe" mc-110-12-0000488 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [{846C0A55-0AEF-1033-0915-050820200001}] "C:\Program Files\Common Files\{846C0A55-0AEF-1033-0915-050820200001}\Update.exe" mc-110-12-0000488 (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Install Pending Files.LNK = C:\Program Files\SIFXINST\SIFXINST.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Search - http://edits.mywebse...?p=ZNxmk572YYUS
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=67633
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfar...p1.0.0.15-3.cab
O16 - DPF: {201B9B37-848F-40BD-90EA-7B8F0AA89D6A} - http://us2-scripts.d..._1071_em_XP.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {341FF14B-00CB-49F5-A427-A164DF1D5E1F} (MALPlaybackCtrl Class) - http://musicstore.co...ALStreaming.cab
O16 - DPF: {37A273C2-5129-11D5-BF37-00A0CCE8754B} (TTestGenXInstallObject) - http://www.mathxl.co...GenXInstall.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace....ploader1006.cab
O16 - DPF: {4FE89055-5300-469E-AFAD-DEB3181EDE76} (PearsonAsstX Control) - http://www.mathxl.co...InstallAsst.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1137004416828
O16 - DPF: {C4DD6732-1E82-4AE7-BD94-180331B84082} (DeltaCVX Control) - http://www.mathxl.co...ts/DeltaCVX.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ent/swflash.cab
O16 - DPF: {DF1C8E21-4045-4D67-B528-335F1A4F0DE9} - http://us2-scripts.d..._1073_em_XP.cab
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O18 - Filter hijack: text/html - {07851C6A-1C43-41d9-8319-BC89154A8C00} - C:\Program Files\RcvSystem\httpdchk.dll
O20 - AppInit_DLLs: c:\windows\system32\awvvvtq.dll
O22 - SharedTaskScheduler: cornerer - {9ff419a8-1748-4ca7-99df-d269465b0e8b} - (no file)
O22 - SharedTaskScheduler: cyk - {49f29a27-2451-4314-a480-8d2481ce6c81} - (no file)
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Antivirus Update Service (aolavupd) - AOL LLC - C:\Program Files\Common Files\AOL\1151382160\ee\services\safetyCore\ver210_5_4_1\aolavupd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: lxcg_device - - C:\WINDOWS\system32\lxcgcoms.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 17003 bytes


And now im going to do the combofix right?

Edited by JuguarPaw, 24 February 2008 - 04:56 PM.

[Rorschach112]

Yes go on with the ComboFix step

[JuguarPaw]

Combofix log
also it says this computer doesn't have a recovery console.

ComboFix 08-02-25 - Owner 2008-02-24 17:04:43.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.553 [GMT -6:00]
Running from: C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\LTCDZZBB\ComboFix[1].exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\salesmonitor
C:\Documents and Settings\All Users\Application Data\Starware
C:\Documents and Settings\All Users\Application Data\Starware\buttons\cursorcafe.bmp
C:\Documents and Settings\All Users\Application Data\Starware\buttons\cursorcafeA.bmp
C:\Documents and Settings\All Users\Application Data\Starware\buttons\FindIt.bmp
C:\Documents and Settings\All Users\Application Data\Starware\buttons\FindItHot.bmp
C:\Documents and Settings\All Users\Application Data\Starware\buttons\findithotxp.png
C:\Documents and Settings\All Users\Application Data\Starware\buttons\finditxp.png
C:\Documents and Settings\All Users\Application Data\Starware\buttons\games.bmp
C:\Documents and Settings\All Users\Application Data\Starware\buttons\gamesA.bmp
C:\Documents and Settings\All Users\Application Data\Starware\buttons\Highlight.bmp
C:\Documents and Settings\All Users\Application Data\Starware\buttons\HighlightHot.bmp
C:\Documents and Settings\All Users\Application Data\Starware\buttons\highlighthotxp.png
C:\Documents and Settings\All Users\Application Data\Starware\buttons\highlightxp.png
C:\Documents and Settings\All Users\Application Data\Starware\buttons\logo.bmp
C:\Documents and Settings\All Users\Application Data\Starware\buttons\logoxp.bmp
C:\Documents and Settings\All Users\Application Data\Starware\buttons\moviesA.bmp
C:\Documents and Settings\All Users\Application Data\Starware\buttons\PopupBlocker.bmp
C:\Documents and Settings\All Users\Application Data\Starware\buttons\PopupBlockerHot.bmp
C:\Documents and Settings\All Users\Application Data\Starware\buttons\popupblockerhotxp.png
C:\Documents and Settings\All Users\Application Data\Starware\buttons\popupblockerxp.png
C:\Documents and Settings\All Users\Application Data\Starware\buttons\Reference.bmp
C:\Documents and Settings\All Users\Application Data\Starware\buttons\ReferenceHot.bmp
C:\Documents and Settings\All Users\Application Data\Starware\buttons\referencehotxp.png
C:\Documents and Settings\All Users\Application Data\Starware\buttons\referencexp.png
C:\Documents and Settings\All Users\Application Data\Starware\buttons\screensaver.bmp
C:\Documents and Settings\All Users\Application Data\Starware\buttons\screensaverA.bmp
C:\Documents and Settings\All Users\Application Data\Starware\contexts\error.xml
C:\Documents and Settings\All Users\Application Data\Starware\contexts\related.xml
C:\Documents and Settings\All Users\Application Data\Starware\contexts\travel.xml
C:\Documents and Settings\All Users\Application Data\Starware\contexts\Travel.xml.backup
C:\Documents and Settings\All Users\Application Data\Starware\SimpleUpdate\ProductMessagingConfig.xml
C:\Documents and Settings\All Users\Application Data\Starware\SimpleUpdate\ProductMessagingConfig.xml.backup
C:\Documents and Settings\All Users\Application Data\Starware\SimpleUpdate\SimpleUpdateConfig.xml
C:\Documents and Settings\All Users\Application Data\Starware\SimpleUpdate\SimpleUpdateConfig.xml.backup
C:\Documents and Settings\All Users\Application Data\Starware\SimpleUpdate\TimerManagerConfig.xml
C:\Documents and Settings\All Users\Application Data\Starware\SimpleUpdate\TimerManagerConfig.xml.backup
C:\Documents and Settings\All Users\Application Data\Starware316
C:\Documents and Settings\All Users\Application Data\Starware316\buttons\FindIt.bmp
C:\Documents and Settings\All Users\Application Data\Starware316\buttons\FindItHot.bmp
C:\Documents and Settings\All Users\Application Data\Starware316\buttons\findithotxp.png
C:\Documents and Settings\All Users\Application Data\Starware316\buttons\finditxp.png
C:\Documents and Settings\All Users\Application Data\Starware316\buttons\Highlight.bmp
C:\Documents and Settings\All Users\Application Data\Starware316\buttons\HighlightHot.bmp
C:\Documents and Settings\All Users\Application Data\Starware316\buttons\highlighthotxp.png
C:\Documents and Settings\All Users\Application Data\Starware316\buttons\highlightxp.png
C:\Documents and Settings\All Users\Application Data\Starware316\buttons\logo.bmp
C:\Documents and Settings\All Users\Application Data\Starware316\buttons\logoxp.bmp
C:\Documents and Settings\All Users\Application Data\Starware316\buttons\Reference.bmp
C:\Documents and Settings\All Users\Application Data\Starware316\buttons\ReferenceHot.bmp
C:\Documents and Settings\All Users\Application Data\Starware316\buttons\referencehotxp.png
C:\Documents and Settings\All Users\Application Data\Starware316\buttons\referencexp.png
C:\Documents and Settings\All Users\Application Data\Starware316\buttons\screensaver.bmp
C:\Documents and Settings\All Users\Application Data\Starware316\buttons\Screensavers0.bmp
C:\Documents and Settings\All Users\Application Data\Starware316\buttons\Weather.bmp
C:\Documents and Settings\All Users\Application Data\Starware316\buttons\weatherhotxp.png
C:\Documents and Settings\All Users\Application Data\Starware316\buttons\weatherxp.png
C:\Documents and Settings\All Users\Application Data\Starware316\contexts\error.xml
C:\Documents and Settings\All Users\Application Data\Starware316\contexts\related.xml
C:\Documents and Settings\All Users\Application Data\Starware316\contexts\travel.xml
C:\Documents and Settings\All Users\Application Data\Starware316\Games\images\active\Games0.bmp
C:\Documents and Settings\All Users\Application Data\Starware316\images\walertXP.bmp
C:\Documents and Settings\All Users\Application Data\Starware316\Movies\images\active\Movies0.bmp
C:\Documents and Settings\All Users\Application Data\Starware316\ScreensaversMarketingSitePager\images\active\ScreensaversMarketingSitePager0.bmp
C:\Documents and Settings\All Users\Application Data\Starware316\SimpleUpdate\ProductMessagingConfig.xml
C:\Documents and Settings\All Users\Application Data\Starware316\SimpleUpdate\ProductMessagingConfig.xml.backup
C:\Documents and Settings\All Users\Application Data\Starware316\SimpleUpdate\SimpleUpdateConfig.xml
C:\Documents and Settings\All Users\Application Data\Starware316\SimpleUpdate\SimpleUpdateConfig.xml.backup
C:\Documents and Settings\All Users\Application Data\Starware316\SimpleUpdate\TimerManagerConfig.xml
C:\Documents and Settings\All Users\Application Data\Starware316\SimpleUpdate\TimerManagerConfig.xml.backup
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007\Data\Abbr
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007\Data\ActivationCode
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007\Data\ProductCode
C:\Documents and Settings\Danielle\Application Data\macromedia\Flash Player\#SharedObjects\TCRS49SF\www.broadcaster.com
C:\Documents and Settings\Danielle\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\Danielle\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\Documents and Settings\Donald Robertson\Application Data\FunWebProducts
C:\Documents and Settings\Donald Robertson\Application Data\FunWebProducts\Data\Donald Robertson\avatar.dat
C:\Documents and Settings\Donald Robertson\Application Data\FunWebProducts\Data\Donald Robertson\register.dat
C:\Documents and Settings\Donald Robertson\Application Data\macromedia\Flash Player\#SharedObjects\DTWJGEYG\www.broadcaster.com
C:\Documents and Settings\Donald Robertson\Application Data\macromedia\Flash Player\#SharedObjects\DTWJGEYG\www.broadcaster.com\played_list.sol
C:\Documents and Settings\Donald Robertson\Application Data\macromedia\Flash Player\#SharedObjects\DTWJGEYG\www.broadcaster.com\video_queue.sol
C:\Documents and Settings\Donald Robertson\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\Donald Robertson\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\Documents and Settings\Donald Robertson\Application Data\Starware316
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\BrowserSearch\BrowserSearch.xml
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\BrowserSearch\BrowserSearch.xml.backup
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\Configurator\Configurator.xml
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\Configurator\Configurator.xml.backup
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\ErrorSearch\ErrorSearchOptions.xml
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\ErrorSearch\ErrorSearchOptions.xml.backup
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\Games\GamesOptions.xml
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\Games\GamesOptions.xml.backup
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\Layouts\PitchLayout.xml
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\Layouts\PitchLayout.xml.backup
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\Layouts\ToolbarLayout.xml
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\Layouts\ToolbarLayout.xml.backup
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\Manager\ManagerOptions.xml
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\Manager\ManagerOptions.xml.backup
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\Movies\MoviesOptions.xml
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\Movies\MoviesOptions.xml.backup
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\Reference\ReferenceOptions.xml
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\Reference\ReferenceOptions.xml.backup
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\RelatedSearch\RelatedSearchOptions.xml
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\RelatedSearch\RelatedSearchOptions.xml.backup
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\Screensavers\ScreensaversOptions.xml
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\Screensavers\ScreensaversOptions.xml.backup
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\SearchAssistPlus\SearchAssistPlusOptions.xml
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\SearchAssistPlus\SearchAssistPlusOptions.xml.backup
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\SearchMatch\SearchMatchOptions.xml
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\SearchMatch\SearchMatchOptions.xml.backup
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\Toolbar\TBProductsOptions.xml
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\Toolbar\TBProductsOptions.xml.backup
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\ToolbarLogo\ToolbarLogoOptions.xml
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\ToolbarLogo\ToolbarLogoOptions.xml.backup
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\ToolbarSearch\ToolbarSearchOptions.xml
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\ToolbarSearch\ToolbarSearchOptions.xml.backup
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\TravelSearch\TravelSearchOptions.xml
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\TravelSearch\TravelSearchOptions.xml.backup
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\Weather\AlertArchive.xml
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\Weather\WeatherOptions.xml
C:\Documents and Settings\Donald Robertson\Application Data\Starware316\Weather\WeatherOptions.xml.backup
C:\Documents and Settings\Donald Robertson\Application Data\tmp90F.tmp.exe
C:\Documents and Settings\Donald Robertson\Application Data\tmpABB.tmp.exe
C:\Documents and Settings\Donald Robertson\Application Data\tmpABF.tmp.exe
C:\Documents and Settings\Donald Robertson\err.log
C:\Documents and Settings\Donald Robertson\ResErrors.log
C:\Documents and Settings\Donald Robertson\Start Menu\crazy girls.lnk
C:\Documents and Settings\Donald Robertson\Start Menu\Programs\Internet Speed Monitor
C:\Documents and Settings\Donald Robertson\Start Menu\Programs\Internet Speed Monitor\Check Now.lnk
C:\Documents and Settings\Donald Robertson\Start Menu\Programs\Internet Speed Monitor\Uninstall.lnk
C:\Documents and Settings\Donald Robertson\Start Menu\Programs\Outerinfo
C:\Documents and Settings\Donald Robertson\Start Menu\Programs\Outerinfo\Terms.lnk
C:\Documents and Settings\Donald Robertson\Start Menu\Programs\Outerinfo\Uninstall.lnk
C:\Documents and Settings\LocalService\Application Data\Starware
C:\Documents and Settings\LocalService\Application Data\Starware\BrowserSearch\BrowserSearch.xml
C:\Documents and Settings\LocalService\Application Data\Starware\BrowserSearch\BrowserSearch.xml.backup
C:\Documents and Settings\LocalService\Application Data\Starware\ErrorSearch\ErrorSearchOptions.xml
C:\Documents and Settings\LocalService\Application Data\Starware\ErrorSearch\ErrorSearchOptions.xml.backup
C:\Documents and Settings\LocalService\Application Data\Starware\Games\GamesOptions.xml
C:\Documents and Settings\LocalService\Application Data\Starware\Games\GamesOptions.xml.backup
C:\Documents and Settings\LocalService\Application Data\Starware\Layouts\PreferencesLayout.xml
C:\Documents and Settings\LocalService\Application Data\Starware\Layouts\PreferencesLayout.xml.backup
C:\Documents and Settings\LocalService\Application Data\Starware\Layouts\ToolbarLayout.xml
C:\Documents and Settings\LocalService\Application Data\Starware\Layouts\ToolbarLayout.xml.backup
C:\Documents and Settings\LocalService\Application Data\Starware\Manager\ManagerOptions.xml
C:\Documents and Settings\LocalService\Application Data\Starware\Manager\ManagerOptions.xml.backup
C:\Documents and Settings\LocalService\Application Data\Starware\Movies\MoviesOptions.xml
C:\Documents and Settings\LocalService\Application Data\Starware\Movies\MoviesOptions.xml.backup
C:\Documents and Settings\LocalService\Application Data\Starware\PopupBlocker\PopupBlockerOptions.xml
C:\Documents and Settings\LocalService\Application Data\Starware\PopupBlocker\PopupBlockerOptions.xml.backup
C:\Documents and Settings\LocalService\Application Data\Starware\Reference\ReferenceOptions.xml
C:\Documents and Settings\LocalService\Application Data\Starware\Reference\ReferenceOptions.xml.backup
C:\Documents and Settings\LocalService\Application Data\Starware\RelatedSearch\RelatedSearchOptions.xml
C:\Documents and Settings\LocalService\Application Data\Starware\RelatedSearch\RelatedSearchOptions.xml.backup
C:\Documents and Settings\LocalService\Application Data\Starware\Screensavers\ScreensaversOptions.xml
C:\Documents and Settings\LocalService\Application Data\Starware\Screensavers\ScreensaversOptions.xml.backup
C:\Documents and Settings\LocalService\Application Data\Starware\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml
C:\Documents and Settings\LocalService\Application Data\Starware\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup
C:\Documents and Settings\LocalService\Application Data\Starware\SearchAssistPlus\SearchAssistPlusOptions.xml
C:\Documents and Settings\LocalService\Application Data\Starware\SearchAssistPlus\SearchAssistPlusOptions.xml.backup
C:\Documents and Settings\LocalService\Application Data\Starware\SearchMatch\SearchMatchOptions.xml
C:\Documents and Settings\LocalService\Application Data\Starware\SearchMatch\SearchMatchOptions.xml.backup
C:\Documents and Settings\LocalService\Application Data\Starware\Toolbar\TBProductsOptions.xml
C:\Documents and Settings\LocalService\Application Data\Starware\Toolbar\TBProductsOptions.xml.backup
C:\Documents and Settings\LocalService\Application Data\Starware\ToolbarLogo\ToolbarLogoOptions.xml
C:\Documents and Settings\LocalService\Application Data\Starware\ToolbarLogo\ToolbarLogoOptions.xml.backup
C:\Documents and Settings\LocalService\Application Data\Starware\ToolbarSearch\ToolbarSearchOptions.xml
C:\Documents and Settings\LocalService\Application Data\Starware\ToolbarSearch\ToolbarSearchOptions.xml.backup
C:\Documents and Settings\LocalService\Application Data\Starware\TravelSearch\TravelSearchOptions.xml
C:\Documents and Settings\LocalService\Application Data\Starware\TravelSearch\TravelSearchOptions.xml.backup
C:\Documents and Settings\Owner\Application Data\FunWebProducts
C:\Documents and Settings\Owner\Application Data\FunWebProducts\Data\Owner\avatar.dat
C:\Documents and Settings\Owner\Application Data\macromedia\Flash Player\#SharedObjects\EU4Z8SRA\www.broadcaster.com
C:\Documents and Settings\Owner\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\Owner\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\Documents and Settings\Owner\Application Data\Starware316
C:\Documents and Settings\Owner\Application Data\Starware316\BrowserSearch\BrowserSearch.xml
C:\Documents and Settings\Owner\Application Data\Starware316\BrowserSearch\BrowserSearch.xml.backup
C:\Documents and Settings\Owner\Application Data\Starware316\Manager\ManagerOptions.xml
C:\Documents and Settings\Owner\Application Data\Starware316\Manager\ManagerOptions.xml.backup
C:\Documents and Settings\Owner\Application Data\tmp104.tmp.exe
C:\Documents and Settings\Owner\Application Data\tmp105.tmp.exe
C:\Documents and Settings\Owner\Desktop\Security Updates.URL
C:\Documents and Settings\Owner\Start Menu\crazy girls.lnk
C:\Documents and Settings\Owner\Start Menu\Programs\Internet Speed Monitor
C:\Documents and Settings\Owner\Start Menu\Programs\Internet Speed Monitor\Check Now.lnk
C:\Documents and Settings\Owner\Start Menu\Programs\Internet Speed Monitor\Uninstall.lnk
C:\Documents and Settings\Owner\Start Menu\Programs\Outerinfo
C:\Documents and Settings\Owner\Start Menu\Programs\Outerinfo\Terms.lnk
C:\Documents and Settings\Owner\Start Menu\Programs\Outerinfo\Uninstall.lnk
C:\Program Files\Common Files\{346C0~1
C:\Program Files\Common Files\{846C0~1
C:\Program Files\Common Files\companion wizard
C:\Program Files\Common Files\companion wizard\compwiz.exe
C:\Program Files\Common Files\companion wizard\WapCHK.dll
C:\Program Files\Common Files\Yazzle1552OinAdmin.exe
C:\Program Files\Common Files\Yazzle1552OinUninstaller.exe
C:\Program Files\FunWebProducts
C:\Program Files\FunWebProducts\ScreenSaver\Images\000A6408.urr
C:\Program Files\FunWebProducts\ScreenSaver\Images\0018D1C2.urr
C:\Program Files\FunWebProducts\ScreenSaver\Images\004BFDAC.urr
C:\Program Files\FunWebProducts\ScreenSaver\Images\0274B8F1.urr
C:\Program Files\FunWebProducts\Shared\0129C8C9.dat
C:\Program Files\FunWebProducts\Shared\Cache\AvatarSmallBtn.html
C:\Program Files\FunWebProducts\Shared\Cache\CursorManiaBtn.html
C:\Program Files\FunWebProducts\Shared\Cache\FunBuddyIconBtn.html
C:\Program Files\FunWebProducts\Shared\Cache\MailStampBtn.html
C:\Program Files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html
C:\Program Files\FunWebProducts\Shared\Cache\MySignatureInsertBtn.html
C:\Program Files\FunWebProducts\Shared\Cache\MySignaturePreviewBtn.html
C:\Program Files\FunWebProducts\Shared\Cache\MyStationeryBtn.html
C:\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
C:\Program Files\icroso~1.net
C:\Program Files\internet explorer\msimg32.dll
C:\Program Files\internetgamebox
C:\Program Files\internetgamebox\InternetGameBox.exe
C:\Program Files\internetgamebox\InternetGameBox.url
C:\Program Files\internetgamebox\language
C:\Program Files\internetgamebox\ressources\AttenteOff.html
C:\Program Files\internetgamebox\ressources\AttenteOn.html
C:\Program Files\internetgamebox\ressources\configv3_en.xml
C:\Program Files\internetgamebox\ressources\configv3_es.xml
C:\Program Files\internetgamebox\ressources\configv3_fr.xml
C:\Program Files\internetgamebox\ressources\favoris\defaultv2.swf
C:\Program Files\internetgamebox\ressources\NoS2F.bin
C:\Program Files\internetgamebox\skins\skinv3.skn
C:\Program Files\internetgamebox\uninst.exe
C:\Program Files\ISM
C:\Program Files\ISM\bndloader.exe
C:\Program Files\ISM\dictionary.gz
C:\Program Files\ISM\kazooupd.exe
C:\Program Files\ISM\syncupd.exe
C:\Program Files\ISM\targets.gz
C:\Program Files\ISM\Uninstall.exe
C:\Program Files\MyWebSearch
C:\Program Files\MyWebSearch\bar\4.bin\MWSBAR.DLL
C:\Program Files\MyWebSearch\bar\4.bin\MWSOEMON.EXE
C:\Program Files\MyWebSearch\bar\4.bin\MWSOESTB.DLL
C:\Program Files\MyWebSearch\bar\5.bin\F3BKGERR.JPG
C:\Program Files\MyWebSearch\bar\5.bin\F3BROVLY.DLL
C:\Program Files\MyWebSearch\bar\5.bin\F3CJPEG.DLL
C:\Program Files\MyWebSearch\bar\5.bin\F3DTACTL.DLL
C:\Program Files\MyWebSearch\bar\5.bin\F3HISTSW.DLL
C:\Program Files\MyWebSearch\bar\5.bin\F3HTMLMU.DLL
C:\Program Files\MyWebSearch\bar\5.bin\F3HTTPCT.DLL
C:\Program Files\MyWebSearch\bar\5.bin\F3IMSTUB.DLL
C:\Program Files\MyWebSearch\bar\5.bin\F3POPSWT.DLL
C:\Program Files\MyWebSearch\bar\5.bin\F3PSSAVR.SCR
C:\Program Files\MyWebSearch\bar\5.bin\F3REPROX.DLL
C:\Program Files\MyWebSearch\bar\5.bin\F3RESTUB.DLL
C:\Program Files\MyWebSearch\bar\5.bin\F3SCHMON.EXE
C:\Program Files\MyWebSearch\bar\5.bin\F3SCRCTR.DLL
C:\Program Files\MyWebSearch\bar\5.bin\F3SHLLVW.DLL
C:\Program Files\MyWebSearch\bar\5.bin\F3SPACER.WMV
C:\Program Files\MyWebSearch\bar\5.bin\F3WALLPP.DAT
C:\Program Files\MyWebSearch\bar\5.bin\F3WPHOOK.DLL
C:\Program Files\MyWebSearch\bar\5.bin\M3FFXTBR.JAR
C:\Program Files\MyWebSearch\bar\5.bin\M3FFXTBR.MANIFEST
C:\Program Files\MyWebSearch\bar\5.bin\M3HTML.DLL
C:\Program Files\MyWebSearch\bar\5.bin\M3IDLE.DLL
C:\Program Files\MyWebSearch\bar\5.bin\M3IMPIPE.EXE
C:\Program Files\MyWebSearch\bar\5.bin\M3MSG.DLL
C:\Program Files\MyWebSearch\bar\5.bin\M3NTSTBR.JAR
C:\Program Files\MyWebSearch\bar\5.bin\M3NTSTBR.MANIFEST
C:\Program Files\MyWebSearch\bar\5.bin\M3OUTLCN.DLL
C:\Program Files\MyWebSearch\bar\5.bin\M3PLUGIN.DLL
C:\Program Files\MyWebSearch\bar\5.bin\M3SKIN.DLL
C:\Program Files\MyWebSearch\bar\5.bin\M3SKPLAY.EXE
C:\Program Files\MyWebSearch\bar\5.bin\M3SLSRCH.EXE
C:\Program Files\MyWebSearch\bar\5.bin\M3SRCHMN.EXE
C:\Program Files\MyWebSearch\bar\5.bin\MWSOEMON.EXE
C:\Program Files\MyWebSearch\bar\5.bin\MWSOEPLG.DLL
C:\Program Files\MyWebSearch\bar\5.bin\MWSOESTB.DLL
C:\Program Files\MyWebSearch\bar\5.bin\NPMYWEBS.DLL
C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\avatar.htm
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\bgfadel.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\bgfader.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\close.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\common-x.css
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\common.css
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\cornerbl.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\cornerbr.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\htmlctrl.js
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\include.js
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\index.htm
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\loading.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\login.htm
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\logo.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\max.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\min.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\noflash.htm
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\spacer.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\spacer.swf
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\unmax.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\wardrobe.htm
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\window.ico
C:\Program Files\MyWebSearch\bar\Cache\000733A0
C:\Program Files\MyWebSearch\bar\Cache\00095603
C:\Program Files\MyWebSearch\bar\Cache\000BAFA3.bin
C:\Program Files\MyWebSearch\bar\Cache\000BE26B.bin
C:\Program Files\MyWebSearch\bar\Cache\000CA492.bin
C:\Program Files\MyWebSearch\bar\Cache\000CAE95.bin
C:\Program Files\MyWebSearch\bar\Cache\0019745B.bin
C:\Program Files\MyWebSearch\bar\Cache\001AB373.bin
C:\Program Files\MyWebSearch\bar\Cache\002A8CD2.bin
C:\Program Files\MyWebSearch\bar\Cache\002E8ABB
C:\Program Files\MyWebSearch\bar\Cache\0031665C
C:\Program Files\MyWebSearch\bar\Cache\0031809B
C:\Program Files\MyWebSearch\bar\Cache\004A3168.bin
C:\Program Files\MyWebSearch\bar\Cache\00573E79
C:\Program Files\MyWebSearch\bar\Cache\005C6FB2.bin
C:\Program Files\MyWebSearch\bar\Cache\00656314
C:\Program Files\MyWebSearch\bar\Cache\00D68F9C.bin
C:\Program Files\MyWebSearch\bar\Cache\00D69A3B.bin
C:\Program Files\MyWebSearch\bar\Cache\00FB337E
C:\Program Files\MyWebSearch\bar\Cache\00FB728B.bin
C:\Program Files\MyWebSearch\bar\Cache\00FC9A81.bin
C:\Program Files\MyWebSearch\bar\Cache\00FCB8B7.bin
C:\Program Files\MyWebSearch\bar\Cache\00FCC941.bin
C:\Program Files\MyWebSearch\bar\Cache\00FCDC5C.bin
C:\Program Files\MyWebSearch\bar\Cache\00FCED06.bin
C:\Program Files\MyWebSearch\bar\Cache\00FCFDEE.bin
C:\Program Files\MyWebSearch\bar\Cache\00FD0A13.bin
C:\Program Files\MyWebSearch\bar\Cache\017A7CC2
C:\Program Files\MyWebSearch\bar\Cache\01AD4688
C:\Program Files\MyWebSearch\bar\Cache\01B6242F.bin
C:\Program Files\MyWebSearch\bar\Cache\01B628D2.bin
C:\Program Files\MyWebSearch\bar\Cache\01B62AB7.bin
C:\Program Files\MyWebSearch\bar\Cache\01BE3128
C:\Program Files\MyWebSearch\bar\Cache\01C1FB21
C:\Program Files\MyWebSearch\bar\Cache\0218694A
C:\Program Files\MyWebSearch\bar\Cache\0229AD84
C:\Program Files\MyWebSearch\bar\Cache\02918CF2
C:\Program Files\MyWebSearch\bar\Cache\029B8CB3.bin
C:\Program Files\MyWebSearch\bar\Cache\02D70D9C
C:\Program Files\MyWebSearch\bar\Cache\02F73FFB
C:\Program Files\MyWebSearch\bar\Cache\files.ini
C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S
C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S
C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S
C:\Program Files\MyWebSearch\bar\History\search2
C:\Program Files\MyWebSearch\bar\icons\CM.ICO
C:\Program Files\MyWebSearch\bar\icons\MFC.ICO
C:\Program Files\MyWebSearch\bar\icons\PSS.ICO
C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO
C:\Program Files\MyWebSearch\bar\icons\WB.ICO
C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO
C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S
C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S
C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S
C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S
C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S
C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S
C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S
C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S
C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S
C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S
C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S
C:\Program Files\MyWebSearch\bar\Search\COMMON.F3S
C:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm
C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat
C:\Program Files\MyWebSearch\bar\Settings\setting2.htm
C:\Program Files\MyWebSearch\bar\Settings\setting2.htm.bak
C:\Program Files\MyWebSearch\bar\Settings\settings.dat
C:\Program Files\MyWebSearch\bar\Settings\settings.dat.bak
C:\Program Files\MyWebSearch\SrchAstt\4.bin\MWSSRCAS.DLL
C:\Program Files\MyWebSearch\SrchAstt\5.bin\MWSSRCAS.DLL
C:\Program Files\outlook
C:\Program Files\outlook\p.zip
C:\Program Files\outlook\v.tmp
C:\Program Files\screensavers.com
C:\Program Files\screensavers.com\SSSInst\bin\iebyterange.xml
C:\Program Files\screensavers.com\SSSInst\bin\iebyterange.xml.backup
C:\Program Files\screensavers.com\SSSInst\bin\SSSUninst.exe
C:\Program Files\screensavers.com\Wallpaper\swpstart.exe
C:\Program Files\spycrush 3.2
C:\Program Files\spycrush 3.2\sd.ini
C:\Program Files\spycrush 3.2\SpyCrush 3.2.exe
C:\Program Files\Starware316
C:\Program Files\Starware316\brand.bmp
C:\Program Files\Starware316\Starware316Config.xml
C:\Program Files\VirusProtectPro 3.4
C:\Program Files\VirusProtectPro 3.4\blacklist.txt
C:\Program Files\VirusProtectPro 3.4\ignored.lst
C:\Program Files\VirusProtectPro 3.4\Lang\English.ini
C:\Program Files\VirusProtectPro 3.4\msvcp71.dll
C:\Program Files\VirusProtectPro 3.4\msvcr71.dll
C:\Program Files\VirusProtectPro 3.4\uninst.exe
C:\Program Files\VirusProtectPro 3.4\VirusProtectPro 3.4.exe
C:\Program Files\VirusProtectPro 3.4\VirusProtectPro 3.4.url
C:\Program Files\VirusProtectPro 3.4\vpp.dat
C:\Program Files\VirusProtectPro 3.4\vpp.ini
C:\Program Files\vsadd-in
C:\WINDOWS\cookies.ini
C:\WINDOWS\Fonts\a.zip
C:\WINDOWS\Fonts\Crack.exe
C:\WINDOWS\IA
C:\WINDOWS\mbols~1
C:\WINDOWS\mbols~1\??mbols\
C:\WINDOWS\pack.epk
C:\WINDOWS\sks~1
C:\WINDOWS\sks~1\??sks\
C:\WINDOWS\svchost.exe
C:\WINDOWS\system32\ace16win.dll
C:\WINDOWS\system32\bbesnicl.ini
C:\WINDOWS\system32\bdeeg.ini
C:\WINDOWS\system32\bdeeg.ini2
C:\WINDOWS\system32\bszip.dll
C:\WINDOWS\system32\clleimck.ini
C:\WINDOWS\system32\cmd.com
C:\WINDOWS\system32\datacle.dll
C:\WINDOWS\system32\dcjojlsb.ini
C:\WINDOWS\system32\din.ip
C:\WINDOWS\system32\dklexg.dat
C:\WINDOWS\system32\dklexg.exe
c:\WINDOWS\system32\dklexg_nav.dat
c:\WINDOWS\system32\dklexg_navps.dat
C:\WINDOWS\system32\dn846c0a55.dat
C:\WINDOWS\system32\dpvvo.dll
C:\WINDOWS\system32\drivers\bg_bg.gif
C:\WINDOWS\system32\drivers\blank.gif
C:\WINDOWS\system32\drivers\box_1.gif
C:\WINDOWS\system32\drivers\box_2.gif
C:\WINDOWS\system32\drivers\box_3.gif
C:\WINDOWS\system32\drivers\button_buynow.gif
C:\WINDOWS\system32\drivers\button_freescan.gif
C:\WINDOWS\system32\drivers\cell_bg.gif
C:\WINDOWS\system32\drivers\cell_footer.gif
C:\WINDOWS\system32\drivers\cell_header_block.gif
C:\WINDOWS\system32\drivers\cell_header_remove.gif
C:\WINDOWS\system32\drivers\cell_header_scan.gif
C:\WINDOWS\system32\drivers\close_ico.gif
C:\WINDOWS\system32\drivers\detect.htm
C:\WINDOWS\system32\drivers\download_box.gif
C:\WINDOWS\system32\drivers\download_btn.jpg
C:\WINDOWS\system32\drivers\download_now_btn.gif
C:\WINDOWS\system32\drivers\footer_back.jpg
C:\WINDOWS\system32\drivers\fopf.sys
C:\WINDOWS\system32\drivers\header_1.gif
C:\WINDOWS\system32\drivers\header_2.gif
C:\WINDOWS\system32\drivers\header_3.gif
C:\WINDOWS\system32\drivers\header_4.gif
C:\WINDOWS\system32\drivers\header_red_bg.gif
C:\WINDOWS\system32\drivers\header_red_free_scan.gif
C:\WINDOWS\system32\drivers\header_red_free_scan_bg.gif
C:\WINDOWS\system32\drivers\header_red_protect_your_pc.gif
C:\WINDOWS\system32\drivers\icon_warning_big.gif
C:\WINDOWS\system32\drivers\infected.gif
C:\WINDOWS\system32\drivers\main_back.gif
C:\WINDOWS\system32\drivers\perfect_cleaner_box.jpg
C:\WINDOWS\system32\drivers\product_1_header.gif
C:\WINDOWS\system32\drivers\product_1_name_small.gif
C:\WINDOWS\system32\drivers\product_2_header.gif
C:\WINDOWS\system32\drivers\product_2_name_small.gif
C:\WINDOWS\system32\drivers\product_3_header.gif
C:\WINDOWS\system32\drivers\product_3_name_small.gif
C:\WINDOWS\system32\drivers\product_features.gif
C:\WINDOWS\system32\drivers\pt.htm
C:\WINDOWS\system32\drivers\rating.gif
C:\WINDOWS\system32\drivers\remove_spyware_header.gif
C:\WINDOWS\system32\drivers\s_detect.htm
C:\WINDOWS\system32\drivers\screenshot.jpg
C:\WINDOWS\system32\drivers\sep_hor.gif
C:\WINDOWS\system32\drivers\sep_vert.gif
C:\WINDOWS\system32\drivers\shadow.jpg
C:\WINDOWS\system32\drivers\shadow_bg.gif
C:\WINDOWS\system32\drivers\spacer.gif
C:\WINDOWS\system32\drivers\spy_away_box.jpg
C:\WINDOWS\system32\drivers\spyware_detected.gif
C:\WINDOWS\system32\drivers\star.gif
C:\WINDOWS\system32\drivers\star_gray.gif
C:\WINDOWS\system32\drivers\star_gray_small.gif
C:\WINDOWS\system32\drivers\star_small.gif
C:\WINDOWS\system32\drivers\style.css
C:\WINDOWS\system32\drivers\tyawqway.dat
C:\WINDOWS\system32\drivers\v.gif
C:\WINDOWS\system32\drivers\warning_ico.gif
C:\WINDOWS\system32\drivers\warning_icon.gif
C:\WINDOWS\system32\drivers\win_logo.gif
C:\WINDOWS\system32\drivers\x.gif
C:\WINDOWS\system32\drivers\yellow_warning_ico.gif
C:\WINDOWS\system32\f3PSSavr.scr
C:\WINDOWS\system32\fxfyoeol.dll
C:\WINDOWS\system32\geedb.dll
C:\WINDOWS\system32\hgorcacv.ini
C:\WINDOWS\system32\hvivpyua.ini
C:\WINDOWS\system32\iwvwhcyt.ini
C:\WINDOWS\system32\kcmiellc.dll
C:\WINDOWS\system32\knsgpuxr.ini
C:\WINDOWS\system32\linkprd.exe
C:\WINDOWS\system32\lnaccess.exe
C:\WINDOWS\system32\lt.res
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mhrsxjco.ini
C:\WINDOWS\system32\mljhgee.dll
C:\WINDOWS\system32\netstat.com
C:\WINDOWS\system32\nscCB69.dll
C:\WINDOWS\system32\nvs2.inf
C:\WINDOWS\system32\ping.com
C:\WINDOWS\system32\pxpphdhj.dll
C:\WINDOWS\system32\racle~1
C:\WINDOWS\system32\regedit.com
C:\WINDOWS\system32\rt25.exe
C:\WINDOWS\system32\sft.res
C:\WINDOWS\system32\stera.job
C:\WINDOWS\system32\stera.log
C:\WINDOWS\system32\stfv.bin
C:\WINDOWS\system32\sznf.ascii
C:\WINDOWS\system32\taskkill.com
C:\WINDOWS\system32\tasklist.com
C:\WINDOWS\system32\tlmfmohw.ini
C:\WINDOWS\system32\tracert.com
C:\WINDOWS\system32\tvreyiad.ini
C:\WINDOWS\system32\ufuqmoai.dll
C:\WINDOWS\system32\uiqpyocb.dll
C:\WINDOWS\system32\unsvchosts.lzma
C:\WINDOWS\system32\vgodfwvk.ini
C:\WINDOWS\system32\windows
C:\WINDOWS\system32\winticom32.exe
C:\WINDOWS\system32\wwdlfkbs.ini
C:\WINDOWS\system32\yadcpyli.ini
C:\WINDOWS\system32\ywmivqtt.dll
C:\WINDOWS\system32\ywmivqtt.dllbox
C:\WINDOWS\winh32.exe
D:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_FOPF
-------\LEGACY_NETWORK_MONITOR
-------\LEGACY_POWERMANAGER
-------\LEGACY_XTZQDBUF
-------\FOPF
-------\xtzqdbuf


((((((((((((((((((((((((( Files Created from 2008-01-25 to 2008-02-25 )))))))))))))))))))))))))))))))
.

2008-02-25 17:17 . 2008-02-25 17:18 14,033 --a------ C:\posDA5E.tmp
2008-02-24 16:01 . 2008-02-24 16:01 <DIR> d-------- C:\WINDOWS\ERUNT
2008-02-24 15:45 . 2008-02-24 16:48 <DIR> d-------- C:\SDFix
2008-02-24 15:33 . 2008-02-24 15:33 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-24 15:33 . 2008-02-24 15:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-24 15:31 . 2008-02-24 15:31 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2008-02-24 15:04 . 2008-02-24 15:04 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-24 15:01 . 2008-02-24 15:01 <DIR> d-------- C:\VundoFix Backups
2008-02-24 07:44 . 2008-02-24 07:44 <DIR> d-------- C:\Program Files\JEDISware
2008-02-24 07:41 . 2008-02-24 07:41 833 --a------ C:\WINDOWS\ST5UNST.001
2008-02-24 07:41 . 2008-02-24 07:41 810 --a------ C:\WINDOWS\ST5UNST.002
2008-02-24 01:09 . 2008-02-24 01:14 <DIR> d-------- C:\divx
2008-02-23 05:29 . 2008-02-24 02:16 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\DivX
2008-02-23 05:27 . 2008-02-20 20:05 120,056 --------- C:\WINDOWS\system32\pxcpyi64.exe
2008-02-23 05:27 . 2008-02-20 20:05 118,520 --------- C:\WINDOWS\system32\pxinsi64.exe
2008-02-20 20:05 . 2008-02-20 20:05 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2008-02-20 20:05 . 2008-02-20 20:05 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2008-02-20 20:05 . 2008-02-20 20:05 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe
2008-02-20 20:05 . 2008-02-20 20:05 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2008-02-20 20:05 . 2008-02-20 20:05 4,816 --a------ C:\WINDOWS\system32\divxsm.tlb
2008-02-20 20:03 . 2008-02-20 20:03 630,784 --a------ C:\WINDOWS\system32\divxdec.ax
2008-02-20 20:03 . 2008-02-20 20:03 352,401 --a------ C:\WINDOWS\system32\DivXMedia.ax
2008-02-20 20:03 . 2008-02-20 20:03 156,992 --a------ C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-02-20 20:03 . 2008-02-20 20:03 12,288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll
2008-02-16 23:00 . 2008-02-16 23:00 833 --a------ C:\WINDOWS\ST5UNST.000
2008-02-16 23:00 . 2008-02-24 07:41 0 --a------ C:\WINDOWS\SETUP.LST
2008-02-16 20:10 . 2008-02-24 00:36 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\LimeWire
2008-02-16 20:09 . 2008-02-17 03:56 <DIR> d-------- C:\Program Files\LimeWire
2008-02-14 22:14 . 2008-02-14 22:14 <DIR> d-------- C:\Program Files\Red Kawa
2008-02-14 22:14 . 2008-02-14 22:14 <DIR> d-------- C:\Program Files\AviSynth 2.5
2008-02-14 20:27 . 2008-02-14 20:27 <DIR> d-------- C:\Program Files\Xilisoft
2008-02-13 21:52 . 2008-02-24 16:49 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-13 21:52 . 2008-02-13 21:52 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-13 21:46 . 2008-02-13 21:47 <DIR> d-------- C:\Program Files\iTunes
2008-02-13 21:46 . 2008-02-13 21:46 <DIR> d-------- C:\Program Files\iPod
2008-02-13 21:44 . 2008-02-13 21:44 <DIR> d-------- C:\Program Files\Bonjour
2008-02-13 21:29 . 2008-02-13 21:29 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-02-13 21:29 . 2008-01-15 02:39 30,464 --a------ C:\WINDOWS\system32\drivers\usbaapl.sys
2008-02-13 21:27 . 2008-02-13 21:27 <DIR> d-------- C:\Program Files\Common Files\Apple
2008-02-10 01:26 . 2008-02-10 01:30 4,214,135 ---hs---- C:\WINDOWS\system32\ggluctpg.ini
2008-02-10 01:25 . 2008-02-10 01:26 0 --a------ C:\WINDOWS\system32\vpopjxdy.tmp
2008-02-09 16:01 . 2008-02-10 01:15 4,214,645 ---hs---- C:\WINDOWS\system32\vpopjxdy.ini
2008-02-09 08:50 . 2008-02-09 15:46 4,216,541 ---hs---- C:\WINDOWS\system32\oabchcwa.ini
2008-02-07 21:04 . 2008-02-09 08:51 4,217,366 ---hs---- C:\WINDOWS\system32\uthcumqj.ini
2008-02-07 19:30 . 2008-02-07 21:00 4,218,556 ---hs---- C:\WINDOWS\system32\xqfhiqme.ini
2008-02-06 20:23 . 2008-02-06 20:40 4,219,873 ---hs---- C:\WINDOWS\system32\xgkixqvf.ini
2008-02-05 05:23 . 2008-02-06 23:25 4,220,345 ---hs---- C:\WINDOWS\system32\gamrnubn.ini
2008-02-05 04:19 . 2008-02-05 04:19 <DIR> d-------- C:\Program Files\RcvSystem
2008-02-04 02:11 . 2008-02-05 05:18 2,734,396 ---hs---- C:\WINDOWS\system32\frngxhgi.ini
2008-02-03 19:18 . 2008-02-03 23:36 <DIR> d-------- C:\Program Files\FrostWire
2008-01-31 23:13 . 2008-01-31 23:13 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-01-31 23:13 . 2008-01-31 23:13 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-01-30 23:57 . 2008-01-30 23:57 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll
2008-01-30 02:10 . 2008-01-30 02:10 <DIR> d-------- C:\WINDOWS\update

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-24 14:16 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-23 11:27 --------- d-----w C:\Program Files\DivX
2008-02-22 08:51 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-20 08:55 --------- d-----w C:\Program Files\Lx_cats
2008-02-14 03:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-02-14 03:42 --------- d-----w C:\Program Files\QuickTime
2008-02-05 03:39 195,304 ----a-w C:\Documents and Settings\Donald Robertson\Application Data\install_en[1].exe
2008-02-04 12:18 --------- d-----w C:\Documents and Settings\Owner\Application Data\FrostWire
2008-02-04 12:09 --------- d-----w C:\Program Files\P2P_Energy
2008-02-01 23:43 --------- d-----w C:\Program Files\VstPlugins
2008-02-01 23:43 --------- d-----w C:\Program Files\BitTorrent
2008-01-30 08:09 --------- d-----w C:\Program Files\Ares
2008-01-22 05:30 --------- d-----w C:\Program Files\NCH Swift Sound
2008-01-19 08:50 --------- d-----w C:\Program Files\Winamp
2008-01-19 01:27 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-01-13 04:47 --------- d-----w C:\Documents and Settings\Owner\Application Data\WinMX Music
2008-01-08 09:45 --------- d-----w C:\Documents and Settings\Owner\Application Data\BitTorrent
2008-01-05 19:50 --------- d-----w C:\Program Files\Java
2008-01-05 19:36 --------- d-----w C:\Program Files\WildTangent
2008-01-04 19:43 --------- d-----w C:\Documents and Settings\Donald Robertson\Application Data\Yahoo!
2007-12-27 13:30 --------- d-----w C:\Program Files\Digidesign
2007-12-27 13:30 --------- d-----w C:\Program Files\Common Files\Digidesign
2006-11-07 06:12 0 ----a-w C:\Documents and Settings\Donald Robertson\Application Data\wklnhst.dat
2006-01-27 22:30 0 ----a-w C:\Documents and Settings\Owner\Application Data\wklnhst.dat
2005-12-26 06:25 774,144 ----a-w C:\Program Files\RngInterstitial.dll
2007-07-20 06:06 1,805,088 --sh--w C:\WINDOWS\system32\gfhkj.bak1
2007-07-21 01:17 1,806,466 --sh--w C:\WINDOWS\system32\gfhkj.bak2
2007-07-21 05:22 1,855,694 --sh--w C:\WINDOWS\system32\gfhkj.ini2
2007-05-03 16:53 1,376,955 --sh--w C:\WINDOWS\system32\mnnmp.bak1
2007-05-03 16:52 1,376,216 --sh--w C:\WINDOWS\system32\mnnmp.bak2
2007-05-03 17:28 1,378,900 --sh--w C:\WINDOWS\system32\mnnmp.ini2
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]
2007-10-11 20:08 66912 --a------ C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]
2008-01-13 23:44 1502232 --a------ C:\Program Files\Freecorder\tbFre1.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2bae58c2-79f9-45d1-a286-81f911301c3a}]
C:\Program Files\P2P_Energy\tbP2P0.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AB5FE6E5-7C72-4B89-85D0-D57E7AEAC236}]
C:\WINDOWS\system32\oembios32.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D0652189-D3D8-4EB4-B964-B179D2CE1A7A}]
C:\WINDOWS\system32\pmnnm.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D91B4174-FB52-45FC-9BFF-99B3E1236514}]
C:\WINDOWS\system32\awtqq.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E61B9B49-2001-4b8a-97EB-F1128224DCE3}]
C:\Program Files\DeskAlerts\deskbar.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
2007-10-11 20:08 267592 --a------ C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88}
{2318C2B1-4965-11D4-9B18-009027A5CD4F}
{A8FB8EB3-183B-4598-924D-86F0E5E37085}
{DE9C389F-3316-41A7-809B-AA305ED9D922}
{37B85A29-692B-4205-9CAD-2626E4993404}
{DF4E7A0C-E233-4906-B4C1-A404356541FF}
{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A}
{1392B8D2-5C05-419F-A8F6-B9F15A596612}
{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}
{4B3803EA-5230-4DC3-A7FC-33638F3D3542}
{2BAE58C2-79F9-45D1-A286-81F911301C3A}
{F8AD5AA5-D966-4667-9DAF-2561D68B2012}

[HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CLASSES_ROOT\clsid\{2bae58c2-79f9-45d1-a286-81f911301c3a}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{2BAE58C2-79F9-45D1-A286-81F911301C3A}"= C:\Program Files\P2P_Energy\tbP2P0.dll [ ]

[HKEY_CLASSES_ROOT\clsid\{2bae58c2-79f9-45d1-a286-81f911301c3a}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QdrModule9"="C:\Program Files\QdrModule\QdrModule9.exe" [ ]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-03-27 14:22 4670968]
"QdrPack13"="C:\Program Files\QdrPack\QdrPack13.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MPFEXE"="C:\Program Files\mcafee.com\personal firewall\MPfTray.exe" [2006-03-07 15:05 992808]
"MCUpdateExe"="c:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 12:05 212992]
"LXCGCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll" [2005-07-20 11:48 73728]
"SunKistEM"="C:\Program Files\Digital Media Reader\shwiconem.exe" [2004-11-15 16:04 135168]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"sscRun"="C:\Program Files\Common Files\AOL\1151382160\ee\SSCRun.exe" [2007-01-25 15:34 153168]
"Recguard"="%WINDIR%\SMINST\RECGUARD.EXE" [ ]
"Pure Networks Port Magic"="C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" [2004-04-05 15:33 99480]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2005-04-25 11:32 114688]
"OASClnt"="C:\Program Files\mcafee.com\antivirus\oasclnt.exe" [2006-07-28 10:43 116272]
"NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-08-06 21:03 155648]
"MPSExe"="C:\Program Files\mcafee.com\MPS\mscifapp.exe" [2006-04-10 14:37 316968]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-09-22 18:29 339456]
"Lexmark 5400 Series Fax Server"="C:\Program Files\Lexmark 5400 Series\fm3032.exe" [ ]
"ledpointer"="CNYHKey.exe" [2004-03-02 21:24 5576704 C:\WINDOWS\CNYHKey.exe]
"IntelAudioStudio"="C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" [2005-05-10 17:02 7122432]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-04-25 11:32 94208]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd

Edited by JuguarPaw, 24 February 2008 - 06:02 PM.

[Rorschach112]

Hello

1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\Program Files\Common Files\Yazzle1552OinAdmin.exe
C:\Program Files\Common Files\Yazzle1552OinUninstaller.exe
C:\WINDOWS\system32\gfhkj.tmp
C:\WINDOWS\system32\gfhkj.bak1
C:\WINDOWS\system32\gfhkj.bak2
C:\WINDOWS\system32\mnnmp.tmp
C:\WINDOWS\system32\mnnmp.bak1
C:\WINDOWS\system32\mnnmp.bak2
C:\WINDOWS\system32\vidnrrmg.tmp
C:\WINDOWS\system32\ywmivqtt.dllbox
C:\Documents and Settings\Danielle\Local Settings\Temp\vpnhtuay.sys
C:\Documents and Settings\Donald Robertson\Local Settings\Temp\sikqklri.exe
C:\WINDOWS\system32\mpreg.exe
C:\WINDOWS\system32\kcmiellc.dll
c:\windows\system32\awvvvtq.dll
C:\posDA5E.tmp
C:\WINDOWS\system32\ggluctpg.ini
C:\WINDOWS\system32\vpopjxdy.tmp
C:\WINDOWS\system32\vpopjxdy.ini
C:\WINDOWS\system32\oabchcwa.ini
C:\WINDOWS\system32\uthcumqj.ini
C:\WINDOWS\system32\xqfhiqme.ini
C:\WINDOWS\system32\xgkixqvf.ini
C:\WINDOWS\system32\gamrnubn.ini
C:\WINDOWS\system32\frngxhgi.ini
C:\WINDOWS\system32\gfhkj.bak1
C:\WINDOWS\system32\gfhkj.bak2
C:\WINDOWS\system32\gfhkj.ini2
C:\WINDOWS\system32\mnnmp.bak1
C:\WINDOWS\system32\mnnmp.bak2
C:\WINDOWS\system32\mnnmp.ini2

Folder::
C:\Program Files\RcvSystem
C:\Program Files\QdrModule
C:\Program Files\QdrPack
C:\Program Files\Common Files\{846C0A55-0AEF-1033-0915-050820200001}
C:\PROGRA~1\MYWEBS~1
C:\Program Files\03Q1213445347E57CBB%2DC195%2DE723%2DDACE3A2821BBBBB0

Dirlook::
C:\WINDOWS\update

Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at "C:\ComboFix.txt"

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall


Reboot and post a new HijackThis log

[JuguarPaw]

I saved it as CFScript.txt
but when I try dragging it into combofix.exe on the desktop it says run or cancel?
When I click run it just starts the combofix up again?
Should it be like that?

[Rorschach112]

Yes that should be the way

Post the log it produces

[Rorschach112]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.