[CompooterDummy]

I'm using Avast anti-virus software. Apparently, before downloading avast, I got a trojan horse. Avast found it, and being a dummy, I couldn't figure out how to use the software to either get rid of it or isolate it. It ended up destroying a file that my registry needed to be able to read in order to boot. I started over with a new hard drive and installed windows 2000 and peoplepc from the CD. I transferred no information from the old hard drive. I immediately downloaded avast again and on the initial scan, it found another trojan horse named: Win32:Delf-IWD. I got a little more savvy with the software and figured out how to quarantine it. The next time I booted up, avast found another file with a trojan horse named Win32:Delf-IRM. These are the infected file names: the first one was andt.sys, the second one was FireFoxUpdater.exe. I went online to try and get some information on these files because I was concerned I might need them for some reason and well, I have them quarantined. I can't find any information on the first file and information on the second file was always connected to information on trojan horses. This leads me to suspect that the trojan horse is creating files. (which, quite frankly is ingenious if I had decided to try and "repair" the file instead of quarantining it.) I've been looking over this sight a little and quite frankly, I don't know what a "Hijack This" file is. I'm also confused about the information dumps I see in other people's postings. I don't know how to create these for you. Are these common trojan horses? Is it the same trojan horse creating new names for itself? Can someone help me get rid of it all? Thanks.

[Advertisements]

Hello

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

• Please, never rename Combofix unless instructed.
• Close any open browsers.
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  

  -----------------------------------------------------------

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    

    -----------------------------------------------------------

  • Close any open browsers.
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

  -----------------------------------------------------------

• Double click on combofix.exe & follow the prompts.
• When finished, it will produce a report for you.
• Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[Rorschach112]

Hello

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

• Please, never rename Combofix unless instructed.
• Close any open browsers.
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  

  -----------------------------------------------------------

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    

    -----------------------------------------------------------

  • Close any open browsers.
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

  -----------------------------------------------------------

• Double click on combofix.exe & follow the prompts.
• When finished, it will produce a report for you.
• Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[CompooterDummy]

Please forgive my ignorance but what is a "Hijack This" log and how do I find and/or create one? Once I have it, do I post here with this thread or under the "Hijack This" log forum?

[Rorschach112]

Sorry my mistake

Just go and run ComboFix for now

[CompooterDummy]

OK. I ran combofix. I hope I didn't mess anything up. Here's everything that happened:

First run: After starting the run I got this message: "The procedure entry point ?ExitProgram@Program@@SGXK@Z could not be located in the dynamic link library ulib.dll. I clicked OK on the message and the program began running giving me the disclaimers. I clicked OK and the computer restarted.

Second Run: After starting the run I got the same message above. After clicking OK I got the disclaimers and clicked OK and the program began running showing me deleted files and a messages about stages which ran stage 1 through 7. Then the computer reset.

I wasn't sure if it had done its thing so I ran it one more time and everything that happened on the second happened again except no files were deleted.

Hope I didn't screw anything up. What now?

[Rorschach112]

Can you post the ComboFix log ?

It should be in the folder C:\ComboFix

[CompooterDummy]

I found this in a combofix text file:
ComboFix 08-04-02.1 - Jo Ann Christinese 2008-04-03 11:58:08.2 - NTFSx86
Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.129 [GMT -7:00]
Running from: C:\Documents and Settings\Jo Ann Christinese\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

Is this what you're looking for?

I don't see anything called a fix log.

[Rorschach112]

Was that all there was ?

Do this if so

Please download Deckard's System Scanner (DSS) and save it to your Desktop.

• Close all other windows before proceeding.
• Double-click on dss.exe and follow the prompts.
• If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
• When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

[CompooterDummy]

here's the main.txt file:
Deckard's System Scanner v20071014.68
Run by Jo Ann Christinese on 2008-04-03 15:01:19
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Backed up registry hives.
Performed disk cleanup.

Total Physical Memory: 255 MiB (256 MiB recommended).


-- HijackThis (run as Jo Ann Christinese.exe) ----------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:05, on 2008-04-03
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\perfs.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\sm56hlpr.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\PeoplePC\ISP6500\Browser\Bartshel.exe
C:\PROGRA~1\PeoplePC\ISP6500\Browser\PPShared.exe
C:\WINNT\system32\wuauclt.exe
C:\Documents and Settings\Jo Ann Christinese\Desktop\dss.exe
C:\Program Files\PeoplePC\ISP6500\Browser\Bartshel.exe
C:\Program Files\PeoplePC Accelerated\PeoplePC.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Jo Ann Christinese.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.peoplepc.com/search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.peoplepc.com/websearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://home.peoplepc.com/search
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
O2 - BHO: EarthLink BHO Guard - {00000000-0000-0000-0000-000000000002} - C:\Program Files\PeoplePC\Toolbar\ScamGrd.dll
O2 - BHO: EarthLink ScamBlocker V3 - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\PeoplePC\Toolbar\ScamGrd.dll
O2 - BHO: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - c:\program files\peoplepc\toolbar\ppctoolbar.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - c:\program files\peoplepc\toolbar\ppctoolbar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [Bart Station] C:\Program Files\PeoplePC\ISP6500\BIN\PPCOLink.exe -STATION
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O8 - Extra context menu item: Refresh Pa&ge with Full Quality - C:\Program Files\PeoplePC Accelerated\pac-page.html
O8 - Extra context menu item: Refresh Pi&cture with Full Quality - C:\Program Files\PeoplePC Accelerated\pac-image.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1207048643546
O17 - HKLM\System\CCS\Services\Tcpip\..\{CCEE0E6D-41E2-4091-892A-314B23E8F5C6}: NameServer = 209.244.0.3 209.244.0.4
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINNT\system32\perfs.exe
O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINNT\system32\routing.exe (file missing)

--
End of file - 4117 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

S3 WINIO - d:\winio.sys (file missing)


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 perfmons (perfmons Service) - c:\winnt\system32\perfs.exe

S2 Routing (Routing Service) - c:\winnt\system32\routing.exe (file missing)


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: 3Com 3C920 Integrated Fast Ethernet Controller (3C905C-TX Compatible)
Device ID: PCI\VEN_10B7&DEV_9200&SUBSYS_00B41028&REV_78\4&B80044F&0&60F0
Manufacturer: 3Com
Name: 3Com 3C920 Integrated Fast Ethernet Controller (3C905C-TX Compatible)
PNP Device ID: PCI\VEN_10B7&DEV_9200&SUBSYS_00B41028&REV_78\4&B80044F&0&60F0
Service: EL90BC


-- Files created between 2008-03-03 and 2008-04-03 -----------------------------

2008-04-03 15:05:06 0 d-------- C:\Program Files\Trend Micro
2008-04-03 14:45:44 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_1f0.dat
2008-04-03 11:53:12 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_30c.dat
2008-04-03 11:48:56 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_1f8.dat
2008-04-03 11:47:08 68096 --a------ C:\WINNT\system32\zip.exe
2008-04-03 11:47:08 98816 --a------ C:\WINNT\system32\sed.exe
2008-04-03 11:47:08 80412 --a------ C:\WINNT\system32\grep.exe
2008-04-03 11:47:08 73728 --a------ C:\WINNT\system32\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-04-03 08:36:47 0 d-------- C:\Program Files\Common Files\InstallShield
2008-04-02 15:48:01 171021 --a------ C:\yoyo1043_ajdfnukh.exe
2008-04-02 15:47:34 53 --a------ C:\1.vbs
2008-04-02 15:47:34 175 --a------ C:\1.bat
2008-04-02 15:44:56 219594 --a------ C:\WINNT\IireFoxUpdater.exe
2008-04-02 14:28:38 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_1ec.dat
2008-04-02 11:13:13 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Adobe
2008-04-01 20:53:14 0 d-------- C:\WINNT\PreInstall
2008-04-01 20:17:01 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Help
2008-04-01 19:20:39 0 d-------- C:\Program Files\Alwil Software
2008-04-01 16:33:21 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Macromedia
2008-04-01 16:09:02 0 d-------- C:\Program Files\PeoplePC Accelerated
2008-04-01 16:04:01 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\ScamBlocker
2008-04-01 15:59:52 0 d-------- C:\Program Files\Common Files\PeoplePC
2008-04-01 15:59:51 67584 -----n--- C:\WINNT\system32\unPPC.exe <Not Verified; PeoplePC; PeoplePC unPPC>
2008-04-01 15:59:51 28672 -----n--- C:\WINNT\system32\RegHero.exe <Not Verified; ; RegHero Module>
2008-04-01 15:59:51 18432 -----n--- C:\WINNT\system32\PPCInfo.exe <Not Verified; PeoplePC, Inc.; PPCInfo Module>
2008-04-01 15:59:51 0 d-------- C:\Program Files\PeoplePC
2008-04-01 15:59:47 0 d-------- C:\WINNT\system32\Macromed
2008-04-01 07:48:02 306688 --a------ C:\WINNT\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller>
2008-04-01 07:47:47 0 d-------- C:\Dell
2008-04-01 06:52:52 0 d-------- C:\WINNT\winsxs
2008-04-01 06:52:51 0 d-------- C:\WINNT\PCHEALTH
2008-04-01 06:50:12 0 d-------- C:\WINNT\system32\URTTemp
2008-04-01 06:07:18 57344 --a------ C:\WINNT\uneng.exe <Not Verified; Roxio; Roxio Update Wizard>
2008-04-01 06:07:18 0 d-------- C:\Program Files\Common Files\Adaptec Shared
2008-04-01 06:07:10 225280 --a------ C:\WINNT\system32\wmpdxm.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Player>
2008-04-01 06:07:10 106496 --a------ C:\WINNT\system32\wmpasf.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Player>
2008-04-01 06:07:01 52224 --a------ C:\WINNT\system32\mspmsnsv.dll <Not Verified; Microsoft Corporation; Windows Media Device Manager>
2008-04-01 06:06:57 997888 --a------ C:\WINNT\system32\wmvdmoe2.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2008-04-01 06:06:57 892416 --a------ C:\WINNT\system32\wmspdmoe.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2008-04-01 06:06:57 1111040 --a------ C:\WINNT\system32\wmsdmoe2.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2008-04-01 06:01:20 0 d-------- C:\WINNT\Motorola
2008-04-01 05:52:34 1222656 --a------ C:\WINNT\system32\quartz.dll
2008-04-01 05:52:33 524800 --a------ C:\WINNT\system32\qedit.dll
2008-04-01 05:52:33 194560 --a------ C:\WINNT\system32\mswebdvd.dll <Not Verified; Microsoft Corporation; DirectShow>
2008-04-01 05:52:33 1769472 --a------ C:\WINNT\system32\dxdiagn.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:33 1689600 --a------ C:\WINNT\system32\d3d9.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:33 1179648 --a------ C:\WINNT\system32\d3d8.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 68096 --a------ C:\WINNT\system32\dsdmoprp.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 203264 --a------ C:\WINNT\system32\dpvoice.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 16896 --a------ C:\WINNT\system32\dpnsvr.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 377856 --a------ C:\WINNT\system32\dpnet.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 166400 --a------ C:\WINNT\system32\dinput8.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 386048 --a------ C:\WINNT\system32\diactfrm.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 733184 --a------ C:\WINNT\system32\qedwipes.dll
2008-04-01 05:52:30 13312 --a------ C:\WINNT\system32\msdmo.dll
2008-04-01 05:52:30 18944 --a------ C:\WINNT\system32\encapi.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 1189888 --a------ C:\WINNT\system32\dx8vb.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 18432 --a------ C:\WINNT\system32\dswave.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 186880 --a------ C:\WINNT\system32\dsdmo.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 112128 --a------ C:\WINNT\system32\dpvvox.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 80896 --a------ C:\WINNT\system32\dpvsetup.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 19968 --a------ C:\WINNT\system32\dpvacm.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 3072 --a------ C:\WINNT\system32\dpnlobby.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 68096 --a------ C:\WINNT\system32\dpnhupnp.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 32768 --a------ C:\WINNT\system32\dpnhpast.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 3072 --a------ C:\WINNT\system32\dpnaddr.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 76800 --a------ C:\WINNT\system32\dmscript.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 44032 --a------ C:\WINNT\system32\dimap.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 7168 --a------ C:\WINNT\system32\d3d8thk.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:50:03 0 d-------- C:\WINNT\system32\directx
2008-04-01 05:23:05 641378 ---h----- C:\WINNT\ShellIconCache
2008-04-01 05:15:48 0 d-------- C:\WINNT\system32\Windows Media
2008-04-01 05:15:14 0 d--h---c- C:\WINNT\$NtUpdateRollupPackUninstall$
2008-04-01 05:15:11 0 d-------- C:\WINNT\msiinst.tmp
2008-04-01 05:13:44 0 d--h---c- C:\WINNT\$SQLUninstallMDAC25SP3-KB927779-x86-ENU$
2008-04-01 05:11:56 0 d-------- C:\WINNT\mui
2008-04-01 05:09:36 171280 --a------ C:\WINNT\system32\jit.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:36 139536 --a------ C:\WINNT\system32\javaee.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:36 313856 --a------ C:\WINNT\system32\dx3j.dll <Not Verified; Microsoft Corporation; Microsoft® DirectX for Java>
2008-04-01 05:09:36 46352 --a------ C:\WINNT\setdebug.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:36 6550 --a------ C:\WINNT\jautoexp.dat
2008-04-01 05:09:31 113 --a------ C:\WINNT\system32\zonedon.reg
2008-04-01 05:09:31 113 --a------ C:\WINNT\system32\zonedoff.reg
2008-04-01 05:09:31 171792 --a------ C:\WINNT\system32\wjview.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:31 286992 --a------ C:\WINNT\system32\vmhelper.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:30 21264 --a------ C:\WINNT\system32\msjdbc10.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:30 947472 --a------ C:\WINNT\system32\msjava.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 154384 --a------ C:\WINNT\system32\msawt.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 172304 --a------ C:\WINNT\system32\jview.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 15120 --a------ C:\WINNT\system32\jdbgmgr.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 404752 --a------ C:\WINNT\system32\javart.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 63248 --a------ C:\WINNT\system32\javaprxy.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 187152 --a------ C:\WINNT\system32\javacypt.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:27 49424 --a------ C:\WINNT\system32\clspack.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 04:49:32 0 d-------- C:\WINNT\RegisteredPackages
2008-04-01 04:47:46 0 d--h----- C:\WINNT\msdownld.tmp
2008-04-01 04:47:42 0 d-------- C:\WINNT\Windows Update Setup Files
2008-04-01 04:44:00 0 d-------- C:\WINNT\system32\Microsoft
2008-04-01 04:40:51 0 d-------- C:\WINNT\system32\ie_de
2008-04-01 04:40:51 0 d-------- C:\WINNT\system32\CertSrv
2008-04-01 04:40:51 0 d-------- C:\WINNT\ServicePackFiles
2008-04-01 04:19:29 0 d-------- C:\WINNT\system32\BITS
2008-04-01 04:17:31 0 d-------- C:\WINNT\SoftwareDistribution
2008-04-01 04:04:55 0 d-------- C:\WINNT\system32\NtmsData
2008-04-01 04:04:39 0 d--hs---- C:\WINNT\Installer
2008-04-01 04:04:39 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Identities
2008-04-01 04:04:34 0 d--h----- C:\WINNT\system32\GroupPolicy
2008-04-01 04:04:33 0 d--hs---- C:\WINNT\CSC
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\Templates
2008-04-01 04:04:33 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Start Menu
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\SendTo
2008-04-01 04:04:33 0 dr-h----- C:\Documents and Settings\Jo Ann Christinese\Recent
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\PrintHood
2008-04-01 04:04:33 536576 --ah----- C:\Documents and Settings\Jo Ann Christinese\NTUSER.DAT
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\NetHood
2008-04-01 04:04:33 0 d-------- C:\Documents and Settings\Jo Ann Christinese\My Documents
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\Local Settings
2008-04-01 04:04:33 0 dr------- C:\Documents and Settings\Jo Ann Christinese\Favorites
2008-04-01 04:04:33 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Desktop
2008-04-01 04:04:33 0 d---s---- C:\Documents and Settings\Jo Ann Christinese\Cookies
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\Application Data
2008-04-01 04:04:14 0 d--hs---- C:\System Volume Information
2008-04-01 03:48:47 0 d-------- C:\WINNT\system32\rpcproxy
2008-04-01 03:48:47 0 d-------- C:\WINNT\system32\rocket
2008-04-01 03:48:47 0 d-------- C:\WINNT\system32\inetsrv
2008-04-01 03:48:47 0 d-------- C:\WINNT\mww32
2008-04-01 03:48:47 0 d-------- C:\WINNT\ime
2008-04-01 03:48:47 0 d-------- C:\Program Files\microsoft frontpage
2008-04-01 03:48:17 122880 ---h----- C:\Documents and Settings\Default User\NTUSER.DAT
2008-04-01 03:47:51 0 -rahs---- C:\MSDOS.SYS
2008-04-01 03:47:51 0 -rahs---- C:\IO.SYS
2008-04-01 03:47:51 0 ---h----- C:\CONFIG.SYS
2008-04-01 03:47:51 0 ---h----- C:\AUTOEXEC.BAT
2008-04-01 03:47:06 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft
2008-04-01 03:46:53 0 d--hs---- C:\Documents and Settings\All Users\DRM
2008-04-01 03:46:49 0 dr------- C:\WINNT\Offline Web Pages
2008-04-01 03:46:49 0 d---s---- C:\WINNT\Downloaded Program Files
2008-04-01 03:46:29 0 d-a-s---- C:\WINNT\Tasks
2008-04-01 03:45:55 15012 --a------ C:\WINNT\system32\emptyregdb.dat
2008-04-01 03:45:25 0 d-------- C:\WINNT\Registration
2008-04-01 03:45:10 0 d-------- C:\WINNT\system32\DTCLog
2008-04-01 03:45:05 0 d-ah----- C:\Program Files\WindowsUpdate
2008-04-01 03:44:36 0 d-------- C:\Program Files\Accessories
2008-04-01 03:44:27 0 d-------- C:\Program Files\Windows NT
2008-04-01 03:44:23 0 d-------- C:\WINNT\system32\Com
2008-04-01 03:36:14 0 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-03-31 20:04:29 0 d-a------ C:\Program Files\Common Files\ODBC
2008-03-31 20:04:26 0 d-a------ C:\WINNT\Speech
2008-03-31 20:04:24 0 dra------ C:\Program Files
2008-03-31 20:04:24 0 d-a------ C:\Program Files\Common Files
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Templates
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\Start Menu
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\SendTo
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Recent
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\PrintHood
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\NetHood
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\My Documents
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Local Settings
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\Favorites
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\Desktop
2008-03-31 20:04:11 0 d---s---- C:\Documents and Settings\Default User\Cookies
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Application Data
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\All Users\Templates
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\All Users\Start Menu
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\All Users\Favorites
2008-03-31 20:04:11 0 d-a------ C:\Documents and Settings\All Users\Documents
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\All Users\Desktop
2008-03-31 20:04:11 0 d-ah----- C:\Documents and Settings\All Users\Application Data
2008-03-31 20:03:56 0 d-a------ C:\WINNT\system32\CatRoot
2008-03-31 20:03:43 0 d-a------ C:\Documents and Settings
2008-03-31 20:00:18 0 d-a------ C:\WINNT
2008-03-31 20:00:18 0 d---s---- C:\WINNT\Web
2008-03-31 20:00:18 0 d-a------ C:\WINNT\twain_32
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\wins
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\wbem
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\spool
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\ShellExt
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\Setup
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\ras
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\os2
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\npp
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\mui
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\ias
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\export
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\drivers
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\drivers\etc
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\drivers\disdn
2008-03-31 20:00:18 0 drahs--c- C:\WINNT\system32\dllcache
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\dhcp
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\config
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system
2008-03-31 20:00:18 0 d-a------ C:\WINNT\security
2008-03-31 20:00:18 0 d-a------ C:\WINNT\repair
2008-03-31 20:00:18 0 d-a------ C:\WINNT\msapps
2008-03-31 20:00:18 0 d-a------ C:\WINNT\msagent
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Media
2008-03-31 20:00:18 0 d-a------ C:\WINNT\java
2008-03-31 20:00:18 0 d--h----- C:\WINNT\inf
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Help
2008-03-31 20:00:18 0 dra-s---- C:\WINNT\Fonts
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Driver Cache
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Debug
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Cursors
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Connection Wizard
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Config
2008-03-31 20:00:18 0 d-a------ C:\WINNT\AppPatch
2008-03-31 20:00:18 0 d-a------ C:\WINNT\addins


-- Find3M Report ---------------------------------------------------------------

Nothing modified in this timespan.


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A8FB8EB3-183B-4598-924D-86F0E5E37085}]
08-04-02 08:39 237056 --a------ c:\program files\peoplepc\toolbar\ppctoolbar.dll

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{A8FB8EB3-183B-4598-924D-86F0E5E37085}"= c:\program files\peoplepc\toolbar\ppctoolbar.dll [08-04-02 08:39 237056]

[-HKEY_CLASSES_ROOT\CLSID\{A8FB8EB3-183B-4598-924D-86F0E5E37085}]
[HKEY_CLASSES_ROOT\PeoplePC.Toolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{994D628D-4D22-4DB9-B6DB-F7D9F1635817}]
[HKEY_CLASSES_ROOT\PeoplePC.Toolbar]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [03-06-19 12:05 C:\WINNT\system32\mobsync.exe]
"SMSERIAL"="sm56hlpr.exe" [03-10-07 19:15 C:\WINNT\sm56hlpr.exe]
"Bart Station"="C:\Program Files\PeoplePC\ISP6500\BIN\PPCOLink.exe" [07-03-12 15:11 ]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [08-03-29 11:37 ]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"disableregistrytools"=0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"




-- End of Deckard's System Scanner: finished at 2008-04-03 15:07:51 ------------

here's the extra.txt file:
Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows 2000 Professional (build 2195) SP 4.0
Architecture: X86; Language: English

CPU 0: Intel Pentium III processor
Percentage of Memory in Use: 62%
Physical Memory (total/avail): 254.23 MiB / 95.28 MiB
Pagefile Memory (total/avail): 617.03 MiB / 427.06 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1944.39 MiB

A: is Removable (No Media)
C: is Fixed (NTFS) - 37.27 GiB total, 34.68 GiB free.
D: is CDROM (CDFS)

\\.\PHYSICALDRIVE0 - QUANTUM FIREBALLP AS40.0 - 37.28 GiB - 1 partition
\PARTITION0 (bootable) - Installable File System - 37.27 GiB - C:



-- Security Center -------------------------------------------------------------

Thanks!

[Rorschach112]

Hello

1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINNT\system32\perfs.exe
O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINNT\system32\routing.exe (file missing)

2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.



Open Notepad and Copy (Control+C) and Paste (Control+V) the following code into the Notepad window.

@echo off
sc stop perfmons
sc delete perfmons
sc stop Routing
sc delete Routing
del C:\yoyo1043_ajdfnukh.exe
del C:\1.vbs
del C:\1.bat
del C:\WINNT\IireFoxUpdater.exe
del C:\WINNT\system32\perfs.exe
del C:\WINNT\web\related.htm
del FixService.bat

Click on 'File' then 'Save As'
In the Save in drop down box select Desktop
In the File name box type in FixService.bat
In the Save as type drop down box select All Files
Close Notepad.

Now, find FixService.bat on your Desktop and Double click it
A window will open and close, do not be concerned this is normal.


Reboot and post a new DSS log

[CompooterDummy]

Is this the dss log you're looking for?
main.txt:
Deckard's System Scanner v20071014.68
Run by Jo Ann Christinese on 2008-04-03 16:00:37
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Total Physical Memory: 255 MiB (256 MiB recommended).


-- HijackThis (run as Jo Ann Christinese.exe) ----------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:00, on 2008-04-03
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\perfs.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINNT\sm56hlpr.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\PeoplePC\ISP6500\Browser\Bartshel.exe
C:\PROGRA~1\PeoplePC\ISP6500\Browser\PPShared.exe
C:\Documents and Settings\Jo Ann Christinese\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\JOANNC~1.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.peoplepc.com/search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.peoplepc.com/websearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://home.peoplepc.com/search
O2 - BHO: EarthLink BHO Guard - {00000000-0000-0000-0000-000000000002} - C:\Program Files\PeoplePC\Toolbar\ScamGrd.dll
O2 - BHO: EarthLink ScamBlocker V3 - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\PeoplePC\Toolbar\ScamGrd.dll
O2 - BHO: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - c:\program files\peoplepc\toolbar\ppctoolbar.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - c:\program files\peoplepc\toolbar\ppctoolbar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [Bart Station] C:\Program Files\PeoplePC\ISP6500\BIN\PPCOLink.exe -STATION
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1207048643546
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINNT\system32\perfs.exe
O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINNT\system32\routing.exe (file missing)

--
End of file - 3399 bytes

-- Files created between 2008-03-03 and 2008-04-03 -----------------------------

2008-04-03 15:59:42 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_1f0.dat
2008-04-03 15:05:06 0 d-------- C:\Program Files\Trend Micro
2008-04-03 11:53:12 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_30c.dat
2008-04-03 11:48:56 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_1f8.dat
2008-04-03 11:47:08 68096 --a------ C:\WINNT\system32\zip.exe
2008-04-03 11:47:08 98816 --a------ C:\WINNT\system32\sed.exe
2008-04-03 11:47:08 80412 --a------ C:\WINNT\system32\grep.exe
2008-04-03 11:47:08 73728 --a------ C:\WINNT\system32\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-04-03 08:36:47 0 d-------- C:\Program Files\Common Files\InstallShield
2008-04-02 14:28:38 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_1ec.dat
2008-04-02 11:13:13 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Adobe
2008-04-01 20:53:14 0 d-------- C:\WINNT\PreInstall
2008-04-01 20:17:01 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Help
2008-04-01 19:20:39 0 d-------- C:\Program Files\Alwil Software
2008-04-01 16:33:21 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Macromedia
2008-04-01 16:09:02 0 d-------- C:\Program Files\PeoplePC Accelerated
2008-04-01 16:04:01 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\ScamBlocker
2008-04-01 15:59:52 0 d-------- C:\Program Files\Common Files\PeoplePC
2008-04-01 15:59:51 67584 -----n--- C:\WINNT\system32\unPPC.exe <Not Verified; PeoplePC; PeoplePC unPPC>
2008-04-01 15:59:51 28672 -----n--- C:\WINNT\system32\RegHero.exe <Not Verified; ; RegHero Module>
2008-04-01 15:59:51 18432 -----n--- C:\WINNT\system32\PPCInfo.exe <Not Verified; PeoplePC, Inc.; PPCInfo Module>
2008-04-01 15:59:51 0 d-------- C:\Program Files\PeoplePC
2008-04-01 15:59:47 0 d-------- C:\WINNT\system32\Macromed
2008-04-01 07:48:02 306688 --a------ C:\WINNT\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller>
2008-04-01 07:47:47 0 d-------- C:\Dell
2008-04-01 06:52:52 0 d-------- C:\WINNT\winsxs
2008-04-01 06:52:51 0 d-------- C:\WINNT\PCHEALTH
2008-04-01 06:50:12 0 d-------- C:\WINNT\system32\URTTemp
2008-04-01 06:07:18 57344 --a------ C:\WINNT\uneng.exe <Not Verified; Roxio; Roxio Update Wizard>
2008-04-01 06:07:18 0 d-------- C:\Program Files\Common Files\Adaptec Shared
2008-04-01 06:07:10 225280 --a------ C:\WINNT\system32\wmpdxm.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Player>
2008-04-01 06:07:10 106496 --a------ C:\WINNT\system32\wmpasf.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Player>
2008-04-01 06:07:01 52224 --a------ C:\WINNT\system32\mspmsnsv.dll <Not Verified; Microsoft Corporation; Windows Media Device Manager>
2008-04-01 06:06:57 997888 --a------ C:\WINNT\system32\wmvdmoe2.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2008-04-01 06:06:57 892416 --a------ C:\WINNT\system32\wmspdmoe.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2008-04-01 06:06:57 1111040 --a------ C:\WINNT\system32\wmsdmoe2.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2008-04-01 06:01:20 0 d-------- C:\WINNT\Motorola
2008-04-01 05:52:34 1222656 --a------ C:\WINNT\system32\quartz.dll
2008-04-01 05:52:33 524800 --a------ C:\WINNT\system32\qedit.dll
2008-04-01 05:52:33 194560 --a------ C:\WINNT\system32\mswebdvd.dll <Not Verified; Microsoft Corporation; DirectShow>
2008-04-01 05:52:33 1769472 --a------ C:\WINNT\system32\dxdiagn.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:33 1689600 --a------ C:\WINNT\system32\d3d9.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:33 1179648 --a------ C:\WINNT\system32\d3d8.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 68096 --a------ C:\WINNT\system32\dsdmoprp.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 203264 --a------ C:\WINNT\system32\dpvoice.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 16896 --a------ C:\WINNT\system32\dpnsvr.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 377856 --a------ C:\WINNT\system32\dpnet.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 166400 --a------ C:\WINNT\system32\dinput8.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 386048 --a------ C:\WINNT\system32\diactfrm.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 733184 --a------ C:\WINNT\system32\qedwipes.dll
2008-04-01 05:52:30 13312 --a------ C:\WINNT\system32\msdmo.dll
2008-04-01 05:52:30 18944 --a------ C:\WINNT\system32\encapi.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 1189888 --a------ C:\WINNT\system32\dx8vb.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 18432 --a------ C:\WINNT\system32\dswave.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 186880 --a------ C:\WINNT\system32\dsdmo.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 112128 --a------ C:\WINNT\system32\dpvvox.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 80896 --a------ C:\WINNT\system32\dpvsetup.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 19968 --a------ C:\WINNT\system32\dpvacm.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 3072 --a------ C:\WINNT\system32\dpnlobby.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 68096 --a------ C:\WINNT\system32\dpnhupnp.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 32768 --a------ C:\WINNT\system32\dpnhpast.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 3072 --a------ C:\WINNT\system32\dpnaddr.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 76800 --a------ C:\WINNT\system32\dmscript.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 44032 --a------ C:\WINNT\system32\dimap.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 7168 --a------ C:\WINNT\system32\d3d8thk.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:50:03 0 d-------- C:\WINNT\system32\directx
2008-04-01 05:23:05 641594 ---h----- C:\WINNT\ShellIconCache
2008-04-01 05:15:48 0 d-------- C:\WINNT\system32\Windows Media
2008-04-01 05:15:14 0 d--h---c- C:\WINNT\$NtUpdateRollupPackUninstall$
2008-04-01 05:15:11 0 d-------- C:\WINNT\msiinst.tmp
2008-04-01 05:13:44 0 d--h---c- C:\WINNT\$SQLUninstallMDAC25SP3-KB927779-x86-ENU$
2008-04-01 05:11:56 0 d-------- C:\WINNT\mui
2008-04-01 05:09:36 171280 --a------ C:\WINNT\system32\jit.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:36 139536 --a------ C:\WINNT\system32\javaee.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:36 313856 --a------ C:\WINNT\system32\dx3j.dll <Not Verified; Microsoft Corporation; Microsoft® DirectX for Java>
2008-04-01 05:09:36 46352 --a------ C:\WINNT\setdebug.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:36 6550 --a------ C:\WINNT\jautoexp.dat
2008-04-01 05:09:31 113 --a------ C:\WINNT\system32\zonedon.reg
2008-04-01 05:09:31 113 --a------ C:\WINNT\system32\zonedoff.reg
2008-04-01 05:09:31 171792 --a------ C:\WINNT\system32\wjview.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:31 286992 --a------ C:\WINNT\system32\vmhelper.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:30 21264 --a------ C:\WINNT\system32\msjdbc10.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:30 947472 --a------ C:\WINNT\system32\msjava.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 154384 --a------ C:\WINNT\system32\msawt.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 172304 --a------ C:\WINNT\system32\jview.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 15120 --a------ C:\WINNT\system32\jdbgmgr.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 404752 --a------ C:\WINNT\system32\javart.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 63248 --a------ C:\WINNT\system32\javaprxy.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 187152 --a------ C:\WINNT\system32\javacypt.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:27 49424 --a------ C:\WINNT\system32\clspack.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 04:49:32 0 d-------- C:\WINNT\RegisteredPackages
2008-04-01 04:47:46 0 d--h----- C:\WINNT\msdownld.tmp
2008-04-01 04:47:42 0 d-------- C:\WINNT\Windows Update Setup Files
2008-04-01 04:44:00 0 d-------- C:\WINNT\system32\Microsoft
2008-04-01 04:40:51 0 d-------- C:\WINNT\system32\ie_de
2008-04-01 04:40:51 0 d-------- C:\WINNT\system32\CertSrv
2008-04-01 04:40:51 0 d-------- C:\WINNT\ServicePackFiles
2008-04-01 04:19:29 0 d-------- C:\WINNT\system32\BITS
2008-04-01 04:17:31 0 d-------- C:\WINNT\SoftwareDistribution
2008-04-01 04:04:55 0 d-------- C:\WINNT\system32\NtmsData
2008-04-01 04:04:39 0 d--hs---- C:\WINNT\Installer
2008-04-01 04:04:39 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Identities
2008-04-01 04:04:34 0 d--h----- C:\WINNT\system32\GroupPolicy
2008-04-01 04:04:33 0 d--hs---- C:\WINNT\CSC
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\Templates
2008-04-01 04:04:33 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Start Menu
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\SendTo
2008-04-01 04:04:33 0 dr-h----- C:\Documents and Settings\Jo Ann Christinese\Recent
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\PrintHood
2008-04-01 04:04:33 536576 --ah----- C:\Documents and Settings\Jo Ann Christinese\NTUSER.DAT
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\NetHood
2008-04-01 04:04:33 0 d-------- C:\Documents and Settings\Jo Ann Christinese\My Documents
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\Local Settings
2008-04-01 04:04:33 0 dr------- C:\Documents and Settings\Jo Ann Christinese\Favorites
2008-04-01 04:04:33 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Desktop
2008-04-01 04:04:33 0 d---s---- C:\Documents and Settings\Jo Ann Christinese\Cookies
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\Application Data
2008-04-01 04:04:14 0 d--hs---- C:\System Volume Information
2008-04-01 03:48:47 0 d-------- C:\WINNT\system32\rpcproxy
2008-04-01 03:48:47 0 d-------- C:\WINNT\system32\rocket
2008-04-01 03:48:47 0 d-------- C:\WINNT\system32\inetsrv
2008-04-01 03:48:47 0 d-------- C:\WINNT\mww32
2008-04-01 03:48:47 0 d-------- C:\WINNT\ime
2008-04-01 03:48:47 0 d-------- C:\Program Files\microsoft frontpage
2008-04-01 03:48:17 122880 ---h----- C:\Documents and Settings\Default User\NTUSER.DAT
2008-04-01 03:47:51 0 -rahs---- C:\MSDOS.SYS
2008-04-01 03:47:51 0 -rahs---- C:\IO.SYS
2008-04-01 03:47:51 0 ---h----- C:\CONFIG.SYS
2008-04-01 03:47:51 0 ---h----- C:\AUTOEXEC.BAT
2008-04-01 03:47:06 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft
2008-04-01 03:46:53 0 d--hs---- C:\Documents and Settings\All Users\DRM
2008-04-01 03:46:49 0 dr------- C:\WINNT\Offline Web Pages
2008-04-01 03:46:49 0 d---s---- C:\WINNT\Downloaded Program Files
2008-04-01 03:46:29 0 d-a-s---- C:\WINNT\Tasks
2008-04-01 03:45:55 15012 --a------ C:\WINNT\system32\emptyregdb.dat
2008-04-01 03:45:25 0 d-------- C:\WINNT\Registration
2008-04-01 03:45:10 0 d-------- C:\WINNT\system32\DTCLog
2008-04-01 03:45:05 0 d-ah----- C:\Program Files\WindowsUpdate
2008-04-01 03:44:36 0 d-------- C:\Program Files\Accessories
2008-04-01 03:44:27 0 d-------- C:\Program Files\Windows NT
2008-04-01 03:44:23 0 d-------- C:\WINNT\system32\Com
2008-04-01 03:36:14 0 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-03-31 20:04:29 0 d-a------ C:\Program Files\Common Files\ODBC
2008-03-31 20:04:26 0 d-a------ C:\WINNT\Speech
2008-03-31 20:04:24 0 dra------ C:\Program Files
2008-03-31 20:04:24 0 d-a------ C:\Program Files\Common Files
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Templates
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\Start Menu
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\SendTo
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Recent
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\PrintHood
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\NetHood
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\My Documents
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Local Settings
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\Favorites
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\Desktop
2008-03-31 20:04:11 0 d---s---- C:\Documents and Settings\Default User\Cookies
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Application Data
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\All Users\Templates
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\All Users\Start Menu
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\All Users\Favorites
2008-03-31 20:04:11 0 d-a------ C:\Documents and Settings\All Users\Documents
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\All Users\Desktop
2008-03-31 20:04:11 0 d-ah----- C:\Documents and Settings\All Users\Application Data
2008-03-31 20:03:56 0 d-a------ C:\WINNT\system32\CatRoot
2008-03-31 20:03:43 0 d-a------ C:\Documents and Settings
2008-03-31 20:00:18 0 d-a------ C:\WINNT
2008-03-31 20:00:18 0 d---s---- C:\WINNT\Web
2008-03-31 20:00:18 0 d-a------ C:\WINNT\twain_32
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\wins
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\wbem
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\spool
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\ShellExt
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\Setup
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\ras
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\os2
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\npp
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\mui
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\ias
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\export
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\drivers
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\drivers\etc
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\drivers\disdn
2008-03-31 20:00:18 0 drahs--c- C:\WINNT\system32\dllcache
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\dhcp
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\config
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system
2008-03-31 20:00:18 0 d-a------ C:\WINNT\security
2008-03-31 20:00:18 0 d-a------ C:\WINNT\repair
2008-03-31 20:00:18 0 d-a------ C:\WINNT\msapps
2008-03-31 20:00:18 0 d-a------ C:\WINNT\msagent
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Media
2008-03-31 20:00:18 0 d-a------ C:\WINNT\java
2008-03-31 20:00:18 0 d--h----- C:\WINNT\inf
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Help
2008-03-31 20:00:18 0 dra-s---- C:\WINNT\Fonts
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Driver Cache
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Debug
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Cursors
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Connection Wizard
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Config
2008-03-31 20:00:18 0 d-a------ C:\WINNT\AppPatch
2008-03-31 20:00:18 0 d-a------ C:\WINNT\addins


-- Find3M Report ---------------------------------------------------------------

Nothing modified in this timespan.


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A8FB8EB3-183B-4598-924D-86F0E5E37085}]
08-04-02 08:39 237056 --a------ c:\program files\peoplepc\toolbar\ppctoolbar.dll

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{A8FB8EB3-183B-4598-924D-86F0E5E37085}"= c:\program files\peoplepc\toolbar\ppctoolbar.dll [08-04-02 08:39 237056]

[-HKEY_CLASSES_ROOT\CLSID\{A8FB8EB3-183B-4598-924D-86F0E5E37085}]
[HKEY_CLASSES_ROOT\PeoplePC.Toolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{994D628D-4D22-4DB9-B6DB-F7D9F1635817}]
[HKEY_CLASSES_ROOT\PeoplePC.Toolbar]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [03-06-19 12:05 C:\WINNT\system32\mobsync.exe]
"SMSERIAL"="sm56hlpr.exe" [03-10-07 19:15 C:\WINNT\sm56hlpr.exe]
"Bart Station"="C:\Program Files\PeoplePC\ISP6500\BIN\PPCOLink.exe" [07-03-12 15:11 ]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [08-03-29 11:37 ]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"disableregistrytools"=0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"




-- End of Deckard's System Scanner: finished at 2008-04-03 16:03:10 ------------

[Rorschach112]

Hello

1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINNT\system32\perfs.exe
O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINNT\system32\routing.exe (file missing)

2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.



Please download the OTMoveIt2 by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt2.exe to run it.
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  [kill explorer]
  C:\WINNT\system32\perfs.exe
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\perfmons
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Routing
  purity 
  [start explorer]

• Return to OTMoveIt2, right click in the "Paste List of Files/Folders to be Moved" window (under the light blue bar) and choose Paste.
  
  
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.



Reboot and post a new DSS log

[CompooterDummy]

here's what i got in the window under the green bar:

File/Folder kill explorer] not found.
C:\WINNT\system32\perfs.exe moved successfully.
File/Folder HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\perfmons not found.
File/Folder HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Routing not found.
< purity >
Explorer started successfully

OTMoveIt2 by OldTimer - Version 1.0.4.0 log created on 04032008_170833

thanks.

[Rorschach112]

Post a new DSS log

[CompooterDummy]

Oops! sorry 'bout that. Here's the dss dump:
Deckard's System Scanner v20071014.68
Run by Jo Ann Christinese on 2008-04-03 19:01:17
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Total Physical Memory: 255 MiB (256 MiB recommended).


-- HijackThis (run as Jo Ann Christinese.exe) ----------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:01, on 2008-04-03
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINNT\sm56hlpr.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\PeoplePC\ISP6500\Browser\Bartshel.exe
C:\PROGRA~1\PeoplePC\ISP6500\Browser\PPShared.exe
C:\Program Files\PeoplePC\ISP6500\Browser\Bartshel.exe
C:\WINNT\system32\wuauclt.exe
C:\Documents and Settings\Jo Ann Christinese\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\JOANNC~1.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.peoplepc.com/search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.peoplepc.com/websearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://home.peoplepc.com/search
O2 - BHO: EarthLink BHO Guard - {00000000-0000-0000-0000-000000000002} - C:\Program Files\PeoplePC\Toolbar\ScamGrd.dll
O2 - BHO: EarthLink ScamBlocker V3 - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\PeoplePC\Toolbar\ScamGrd.dll
O2 - BHO: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - c:\program files\peoplepc\toolbar\ppctoolbar.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - c:\program files\peoplepc\toolbar\ppctoolbar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [Bart Station] C:\Program Files\PeoplePC\ISP6500\BIN\PPCOLink.exe -STATION
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1207048643546
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINNT\system32\perfs.exe (file missing)
O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINNT\system32\routing.exe (file missing)

--
End of file - 3472 bytes

-- Files created between 2008-03-03 and 2008-04-03 -----------------------------

2008-04-03 18:41:34 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_1f4.dat
2008-04-03 15:05:06 0 d-------- C:\Program Files\Trend Micro
2008-04-03 11:53:12 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_30c.dat
2008-04-03 11:48:56 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_1f8.dat
2008-04-03 11:47:08 68096 --a------ C:\WINNT\system32\zip.exe
2008-04-03 11:47:08 98816 --a------ C:\WINNT\system32\sed.exe
2008-04-03 11:47:08 80412 --a------ C:\WINNT\system32\grep.exe
2008-04-03 11:47:08 73728 --a------ C:\WINNT\system32\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-04-03 08:36:47 0 d-------- C:\Program Files\Common Files\InstallShield
2008-04-02 14:28:38 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_1ec.dat
2008-04-02 11:13:13 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Adobe
2008-04-01 20:53:14 0 d-------- C:\WINNT\PreInstall
2008-04-01 20:17:01 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Help
2008-04-01 19:20:39 0 d-------- C:\Program Files\Alwil Software
2008-04-01 16:33:21 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Macromedia
2008-04-01 16:09:02 0 d-------- C:\Program Files\PeoplePC Accelerated
2008-04-01 16:04:01 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\ScamBlocker
2008-04-01 15:59:52 0 d-------- C:\Program Files\Common Files\PeoplePC
2008-04-01 15:59:51 67584 -----n--- C:\WINNT\system32\unPPC.exe <Not Verified; PeoplePC; PeoplePC unPPC>
2008-04-01 15:59:51 28672 -----n--- C:\WINNT\system32\RegHero.exe <Not Verified; ; RegHero Module>
2008-04-01 15:59:51 18432 -----n--- C:\WINNT\system32\PPCInfo.exe <Not Verified; PeoplePC, Inc.; PPCInfo Module>
2008-04-01 15:59:51 0 d-------- C:\Program Files\PeoplePC
2008-04-01 15:59:47 0 d-------- C:\WINNT\system32\Macromed
2008-04-01 07:48:02 306688 --a------ C:\WINNT\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller>
2008-04-01 07:47:47 0 d-------- C:\Dell
2008-04-01 06:52:52 0 d-------- C:\WINNT\winsxs
2008-04-01 06:52:51 0 d-------- C:\WINNT\PCHEALTH
2008-04-01 06:50:12 0 d-------- C:\WINNT\system32\URTTemp
2008-04-01 06:07:18 57344 --a------ C:\WINNT\uneng.exe <Not Verified; Roxio; Roxio Update Wizard>
2008-04-01 06:07:18 0 d-------- C:\Program Files\Common Files\Adaptec Shared
2008-04-01 06:07:10 225280 --a------ C:\WINNT\system32\wmpdxm.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Player>
2008-04-01 06:07:10 106496 --a------ C:\WINNT\system32\wmpasf.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Player>
2008-04-01 06:07:01 52224 --a------ C:\WINNT\system32\mspmsnsv.dll <Not Verified; Microsoft Corporation; Windows Media Device Manager>
2008-04-01 06:06:57 997888 --a------ C:\WINNT\system32\wmvdmoe2.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2008-04-01 06:06:57 892416 --a------ C:\WINNT\system32\wmspdmoe.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2008-04-01 06:06:57 1111040 --a------ C:\WINNT\system32\wmsdmoe2.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2008-04-01 06:01:20 0 d-------- C:\WINNT\Motorola
2008-04-01 05:52:34 1222656 --a------ C:\WINNT\system32\quartz.dll
2008-04-01 05:52:33 524800 --a------ C:\WINNT\system32\qedit.dll
2008-04-01 05:52:33 194560 --a------ C:\WINNT\system32\mswebdvd.dll <Not Verified; Microsoft Corporation; DirectShow>
2008-04-01 05:52:33 1769472 --a------ C:\WINNT\system32\dxdiagn.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:33 1689600 --a------ C:\WINNT\system32\d3d9.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:33 1179648 --a------ C:\WINNT\system32\d3d8.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 68096 --a------ C:\WINNT\system32\dsdmoprp.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 203264 --a------ C:\WINNT\system32\dpvoice.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 16896 --a------ C:\WINNT\system32\dpnsvr.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 377856 --a------ C:\WINNT\system32\dpnet.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 166400 --a------ C:\WINNT\system32\dinput8.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 386048 --a------ C:\WINNT\system32\diactfrm.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 733184 --a------ C:\WINNT\system32\qedwipes.dll
2008-04-01 05:52:30 13312 --a------ C:\WINNT\system32\msdmo.dll
2008-04-01 05:52:30 18944 --a------ C:\WINNT\system32\encapi.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 1189888 --a------ C:\WINNT\system32\dx8vb.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 18432 --a------ C:\WINNT\system32\dswave.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 186880 --a------ C:\WINNT\system32\dsdmo.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 112128 --a------ C:\WINNT\system32\dpvvox.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 80896 --a------ C:\WINNT\system32\dpvsetup.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 19968 --a------ C:\WINNT\system32\dpvacm.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 3072 --a------ C:\WINNT\system32\dpnlobby.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 68096 --a------ C:\WINNT\system32\dpnhupnp.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 32768 --a------ C:\WINNT\system32\dpnhpast.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 3072 --a------ C:\WINNT\system32\dpnaddr.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 76800 --a------ C:\WINNT\system32\dmscript.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 44032 --a------ C:\WINNT\system32\dimap.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 7168 --a------ C:\WINNT\system32\d3d8thk.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:50:03 0 d-------- C:\WINNT\system32\directx
2008-04-01 05:23:05 641684 ---h----- C:\WINNT\ShellIconCache
2008-04-01 05:15:48 0 d-------- C:\WINNT\system32\Windows Media
2008-04-01 05:15:14 0 d--h---c- C:\WINNT\$NtUpdateRollupPackUninstall$
2008-04-01 05:15:11 0 d-------- C:\WINNT\msiinst.tmp
2008-04-01 05:13:44 0 d--h---c- C:\WINNT\$SQLUninstallMDAC25SP3-KB927779-x86-ENU$
2008-04-01 05:11:56 0 d-------- C:\WINNT\mui
2008-04-01 05:09:36 171280 --a------ C:\WINNT\system32\jit.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:36 139536 --a------ C:\WINNT\system32\javaee.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:36 313856 --a------ C:\WINNT\system32\dx3j.dll <Not Verified; Microsoft Corporation; Microsoft® DirectX for Java>
2008-04-01 05:09:36 46352 --a------ C:\WINNT\setdebug.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:36 6550 --a------ C:\WINNT\jautoexp.dat
2008-04-01 05:09:31 113 --a------ C:\WINNT\system32\zonedon.reg
2008-04-01 05:09:31 113 --a------ C:\WINNT\system32\zonedoff.reg
2008-04-01 05:09:31 171792 --a------ C:\WINNT\system32\wjview.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:31 286992 --a------ C:\WINNT\system32\vmhelper.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:30 21264 --a------ C:\WINNT\system32\msjdbc10.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:30 947472 --a------ C:\WINNT\system32\msjava.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 154384 --a------ C:\WINNT\system32\msawt.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 172304 --a------ C:\WINNT\system32\jview.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 15120 --a------ C:\WINNT\system32\jdbgmgr.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 404752 --a------ C:\WINNT\system32\javart.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 63248 --a------ C:\WINNT\system32\javaprxy.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 187152 --a------ C:\WINNT\system32\javacypt.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:27 49424 --a------ C:\WINNT\system32\clspack.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 04:49:32 0 d-------- C:\WINNT\RegisteredPackages
2008-04-01 04:47:46 0 d--h----- C:\WINNT\msdownld.tmp
2008-04-01 04:47:42 0 d-------- C:\WINNT\Windows Update Setup Files
2008-04-01 04:44:00 0 d-------- C:\WINNT\system32\Microsoft
2008-04-01 04:40:51 0 d-------- C:\WINNT\system32\ie_de
2008-04-01 04:40:51 0 d-------- C:\WINNT\system32\CertSrv
2008-04-01 04:40:51 0 d-------- C:\WINNT\ServicePackFiles
2008-04-01 04:19:29 0 d-------- C:\WINNT\system32\BITS
2008-04-01 04:17:31 0 d-------- C:\WINNT\SoftwareDistribution
2008-04-01 04:04:55 0 d-------- C:\WINNT\system32\NtmsData
2008-04-01 04:04:39 0 d--hs---- C:\WINNT\Installer
2008-04-01 04:04:39 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Identities
2008-04-01 04:04:34 0 d--h----- C:\WINNT\system32\GroupPolicy
2008-04-01 04:04:33 0 d--hs---- C:\WINNT\CSC
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\Templates
2008-04-01 04:04:33 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Start Menu
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\SendTo
2008-04-01 04:04:33 0 dr-h----- C:\Documents and Settings\Jo Ann Christinese\Recent
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\PrintHood
2008-04-01 04:04:33 540672 --ah----- C:\Documents and Settings\Jo Ann Christinese\NTUSER.DAT
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\NetHood
2008-04-01 04:04:33 0 d-------- C:\Documents and Settings\Jo Ann Christinese\My Documents
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\Local Settings
2008-04-01 04:04:33 0 dr------- C:\Documents and Settings\Jo Ann Christinese\Favorites
2008-04-01 04:04:33 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Desktop
2008-04-01 04:04:33 0 d---s---- C:\Documents and Settings\Jo Ann Christinese\Cookies
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\Application Data
2008-04-01 04:04:14 0 d--hs---- C:\System Volume Information
2008-04-01 03:48:47 0 d-------- C:\WINNT\system32\rpcproxy
2008-04-01 03:48:47 0 d-------- C:\WINNT\system32\rocket
2008-04-01 03:48:47 0 d-------- C:\WINNT\system32\inetsrv
2008-04-01 03:48:47 0 d-------- C:\WINNT\mww32
2008-04-01 03:48:47 0 d-------- C:\WINNT\ime
2008-04-01 03:48:47 0 d-------- C:\Program Files\microsoft frontpage
2008-04-01 03:48:17 122880 ---h----- C:\Documents and Settings\Default User\NTUSER.DAT
2008-04-01 03:47:51 0 -rahs---- C:\MSDOS.SYS
2008-04-01 03:47:51 0 -rahs---- C:\IO.SYS
2008-04-01 03:47:51 0 ---h----- C:\CONFIG.SYS
2008-04-01 03:47:51 0 ---h----- C:\AUTOEXEC.BAT
2008-04-01 03:47:06 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft
2008-04-01 03:46:53 0 d--hs---- C:\Documents and Settings\All Users\DRM
2008-04-01 03:46:49 0 dr------- C:\WINNT\Offline Web Pages
2008-04-01 03:46:49 0 d---s---- C:\WINNT\Downloaded Program Files
2008-04-01 03:46:29 0 d-a-s---- C:\WINNT\Tasks
2008-04-01 03:45:55 15012 --a------ C:\WINNT\system32\emptyregdb.dat
2008-04-01 03:45:25 0 d-------- C:\WINNT\Registration
2008-04-01 03:45:10 0 d-------- C:\WINNT\system32\DTCLog
2008-04-01 03:45:05 0 d-ah----- C:\Program Files\WindowsUpdate
2008-04-01 03:44:36 0 d-------- C:\Program Files\Accessories
2008-04-01 03:44:27 0 d-------- C:\Program Files\Windows NT
2008-04-01 03:44:23 0 d-------- C:\WINNT\system32\Com
2008-04-01 03:36:14 0 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-03-31 20:04:29 0 d-a------ C:\Program Files\Common Files\ODBC
2008-03-31 20:04:26 0 d-a------ C:\WINNT\Speech
2008-03-31 20:04:24 0 dra------ C:\Program Files
2008-03-31 20:04:24 0 d-a------ C:\Program Files\Common Files
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Templates
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\Start Menu
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\SendTo
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Recent
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\PrintHood
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\NetHood
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\My Documents
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Local Settings
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\Favorites
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\Desktop
2008-03-31 20:04:11 0 d---s---- C:\Documents and Settings\Default User\Cookies
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Application Data
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\All Users\Templates
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\All Users\Start Menu
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\All Users\Favorites
2008-03-31 20:04:11 0 d-a------ C:\Documents and Settings\All Users\Documents
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\All Users\Desktop
2008-03-31 20:04:11 0 d-ah----- C:\Documents and Settings\All Users\Application Data
2008-03-31 20:03:56 0 d-a------ C:\WINNT\system32\CatRoot
2008-03-31 20:03:43 0 d-a------ C:\Documents and Settings
2008-03-31 20:00:18 0 d-a------ C:\WINNT
2008-03-31 20:00:18 0 d---s---- C:\WINNT\Web
2008-03-31 20:00:18 0 d-a------ C:\WINNT\twain_32
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\wins
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\wbem
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\spool
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\ShellExt
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\Setup
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\ras
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\os2
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\npp
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\mui
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\ias
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\export
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\drivers
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\drivers\etc
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\drivers\disdn
2008-03-31 20:00:18 0 drahs--c- C:\WINNT\system32\dllcache
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\dhcp
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\config
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system
2008-03-31 20:00:18 0 d-a------ C:\WINNT\security
2008-03-31 20:00:18 0 d-a------ C:\WINNT\repair
2008-03-31 20:00:18 0 d-a------ C:\WINNT\msapps
2008-03-31 20:00:18 0 d-a------ C:\WINNT\msagent
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Media
2008-03-31 20:00:18 0 d-a------ C:\WINNT\java
2008-03-31 20:00:18 0 d--h----- C:\WINNT\inf
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Help
2008-03-31 20:00:18 0 dra-s---- C:\WINNT\Fonts
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Driver Cache
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Debug
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Cursors
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Connection Wizard
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Config
2008-03-31 20:00:18 0 d-a------ C:\WINNT\AppPatch
2008-03-31 20:00:18 0 d-a------ C:\WINNT\addins


-- Find3M Report ---------------------------------------------------------------

Nothing modified in this timespan.


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A8FB8EB3-183B-4598-924D-86F0E5E37085}]
08-04-02 08:39 237056 --a------ c:\program files\peoplepc\toolbar\ppctoolbar.dll

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{A8FB8EB3-183B-4598-924D-86F0E5E37085}"= c:\program files\peoplepc\toolbar\ppctoolbar.dll [08-04-02 08:39 237056]

[-HKEY_CLASSES_ROOT\CLSID\{A8FB8EB3-183B-4598-924D-86F0E5E37085}]
[HKEY_CLASSES_ROOT\PeoplePC.Toolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{994D628D-4D22-4DB9-B6DB-F7D9F1635817}]
[HKEY_CLASSES_ROOT\PeoplePC.Toolbar]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [03-06-19 12:05 C:\WINNT\system32\mobsync.exe]
"SMSERIAL"="sm56hlpr.exe" [03-10-07 19:15 C:\WINNT\sm56hlpr.exe]
"Bart Station"="C:\Program Files\PeoplePC\ISP6500\BIN\PPCOLink.exe" [07-03-12 15:11 ]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [08-03-29 11:37 ]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"disableregistrytools"=0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"




-- End of Deckard's System Scanner: finished at 2008-04-03 19:03:46 ------------
Thanks again.