[JonRosell]

Alright, So I have followed all of the guidelines in reguards to what you should do before resorting to this. I have multiple malicous programs installed at the moment and I cant seem to get rid of all of them. Its getting to the point where my computer will start to malfunction, and its insanely frustrating. I have got a lot of them off with Spybot Search and Destroy, but some of the more stubborn ones, (Such as Virtumonde and Smitfraud), wont come off. Thank you for taking the time to help me, and any help you can give me is appreciated. Below is an updated Hijackthis Log after my spybot scan on startup.



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:14:18 PM, on 2/23/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Safari\Safari.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: worldadmarketplace browser enhancer - {93748B91-FCC2-F4FB-31DD-EF86E49F3D7D} - C:\WINDOWS\system32\hhnqaxugtanell.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Nkodojewujoxuce] rundll32.exe "C:\WINDOWS\ibihewatebicogic.dll",e
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKLM\..\Policies\Explorer\Run: [xccinit] C:\WINDOWS\system32\inf\rundll33.exe C:\WINDOWS\xccdf16_090131a.dll xccd16
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: &Search - ?p=ZU
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: pttilh.dll
O22 - SharedTaskScheduler: jgzfkj9w38rksndfi7r4 - {C5BF49A2-94F3-42BD-F434-3604812C8955} - (no file)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 5582 bytes

[Advertisements]

Hello JonRosell

Welcome to G2Go.
=====================

• Download OTListIt2 to your desktop.
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, underneath Output at the top change it to Minimal Output.
• Under the Standard Registry box change it to All.
• Check the boxes beside LOP Check and Purity Check.
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTListIt.Txt and Extras.Txt. These are saved in the same location as OTListIt2.
• Please Attach the files with your next reply.

===========
Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<--- ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

• Click NO
• In the right panel, you will see a bunch of boxes that have been checked ... leave everything checked and ensure the Show all box is un-checked.
• Now click the Scan button.
  Once the scan is complete, you may receive another notice about rootkit activity.
• Click OK.
• GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
• Save it where you can easily find it, such as your desktop.

Please also attach contents of GMER.txt in your next reply.

[kahdah]

Hello JonRosell

Welcome to G2Go.
=====================

• Download OTListIt2 to your desktop.
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, underneath Output at the top change it to Minimal Output.
• Under the Standard Registry box change it to All.
• Check the boxes beside LOP Check and Purity Check.
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTListIt.Txt and Extras.Txt. These are saved in the same location as OTListIt2.
• Please Attach the files with your next reply.

===========
Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<--- ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

• Click NO
• In the right panel, you will see a bunch of boxes that have been checked ... leave everything checked and ensure the Show all box is un-checked.
• Now click the Scan button.
  Once the scan is complete, you may receive another notice about rootkit activity.
• Click OK.
• GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
• Save it where you can easily find it, such as your desktop.

Please also attach contents of GMER.txt in your next reply.

[JonRosell]

Just going as you say. heres the scan. havent done anything with rootkit. i will after this.



OTListIt logfile created on: 2/24/2009 5:23:55 AM - Run 3
OTListIt2 by OldTimer - Version 2.0.1.1 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.00 Mb Total Physical Memory | 294.17 Mb Available Physical Memory | 57.68% Memory free
864.70 Mb Paging File | 589.53 Mb Available in Paging File | 68.18% Paging File free
Paging file location(s): C:\pagefile.sys 384 768;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.49 Gb Total Space | 23.05 Gb Free Space | 30.95% Space Free | Partition Type: FAT32
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DELL2400
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

PRC - C:\WINDOWS\system32\LEXBCES.EXE (Lexmark International, Inc.)
PRC - C:\WINDOWS\system32\LEXPPS.EXE (Lexmark International, Inc.)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Grisoft\AVG7\avgamsvr.exe (GRISOFT, s.r.o.)
PRC - C:\Program Files\Grisoft\AVG7\avgupsvc.exe (GRISOFT, s.r.o.)
PRC - C:\Program Files\Grisoft\AVG7\avgemc.exe (GRISOFT, s.r.o.)
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\WINDOWS\system32\drivers\KodakCCS.exe (Eastman Kodak Company)
PRC - C:\WINDOWS\system32\HPZipm12.exe (HP)
PRC - C:\WINDOWS\system32\wscntfy.exe (Microsoft Corporation)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Documents and Settings\Owner\Desktop\OTListIt2.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (Apple Mobile Device [Auto | Running]) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (aspnet_state [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (Microsoft Corporation)
SRV - (Avg7Alrt [Auto | Running]) -- C:\Program Files\Grisoft\AVG7\avgamsvr.exe (GRISOFT, s.r.o.)
SRV - (Avg7UpdSvc [Auto | Running]) -- C:\Program Files\Grisoft\AVG7\avgupsvc.exe (GRISOFT, s.r.o.)
SRV - (AVGEMS [Auto | Running]) -- C:\Program Files\Grisoft\AVG7\avgemc.exe (GRISOFT, s.r.o.)
SRV - (Bonjour Service [Auto | Running]) -- C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (gusvc [On_Demand | Stopped]) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google)
SRV - (helpsvc [Auto | Running]) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (iPod Service [On_Demand | Stopped]) -- C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (KodakCCS [Auto | Running]) -- C:\WINDOWS\system32\drivers\KodakCCS.exe (Eastman Kodak Company)
SRV - (LexBceS [Auto | Running]) -- C:\WINDOWS\system32\LEXBCES.EXE (Lexmark International, Inc.)
SRV - (Pml Driver HPZ12 [Auto | Running]) -- C:\WINDOWS\system32\HPZipm12.exe (HP)

========== Driver Services (SafeList) ==========

DRV - (Avg7Core [System | Running]) -- C:\WINDOWS\System32\Drivers\avg7core.sys (GRISOFT, s.r.o.)
DRV - (Avg7RsW [System | Running]) -- C:\WINDOWS\System32\Drivers\avg7rsw.sys (GRISOFT, s.r.o.)
DRV - (Avg7RsXP [System | Running]) -- C:\WINDOWS\System32\Drivers\avg7rsxp.sys (GRISOFT, s.r.o.)
DRV - (AvgClean [System | Running]) -- C:\WINDOWS\System32\Drivers\avgclean.sys (GRISOFT, s.r.o.)
DRV - (AvgTdi [Auto | Running]) -- C:\WINDOWS\System32\Drivers\avgtdi.sys (GRISOFT, s.r.o.)
DRV - (bcm4sbxp [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\bcm4sbxp.sys (Broadcom Corporation)
DRV - (BCMModem [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\BCMSM.sys (Broadcom Corporation)
DRV - (bvrp_pci [On_Demand | Stopped]) -- C:\WINDOWS\System32\drivers\bvrp_pci.sys ()
DRV - (DcCam [System | Running]) -- C:\WINDOWS\System32\DRIVERS\DcCam.sys (Eastman Kodak Company)
DRV - (DcFpoint [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\DcFpoint.sys (Eastman Kodak Company)
DRV - (DCFS2K [Auto | Running]) -- C:\WINDOWS\system32\drivers\dcfs2k.sys (Eastman Kodak Company)
DRV - (DcLps [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\DcLps.sys (Eastman Kodak Company)
DRV - (DcPTP [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\DcPTP.sys (Eastman Kodak Company)
DRV - (drvmcdb [Boot | Running]) -- C:\WINDOWS\system32\drivers\drvmcdb.sys (Sonic Solutions)
DRV - (drvnddm [Auto | Running]) -- C:\WINDOWS\system32\drivers\drvnddm.sys (Sonic Solutions)
DRV - (Exportit [System | Stopped]) -- C:\WINDOWS\System32\DRIVERS\exportit.sys (Eastman Kodak Company)
DRV - (GEARAspiWDM [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (HPZid412 [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\HPZid412.sys (HP)
DRV - (HPZipr12 [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\HPZipr12.sys (HP)
DRV - (HPZius12 [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\HPZius12.sys (HP)
DRV - (ialm [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\ialmnt5.sys (Intel Corporation)
DRV - (MODEMCSA [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\MODEMCSA.sys (Microsoft Corporation)
DRV - (OMCI [System | Running]) -- C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS (Dell Computer Corporation)
DRV - (Ptilink [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (PxHelp20 [Boot | Running]) -- C:\WINDOWS\System32\DRIVERS\PxHelp20.sys (Sonic Solutions)
DRV - (Secdrv [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (senfilt [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\senfilt.sys (Creative Technology Ltd.)
DRV - (smwdm [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\smwdm.sys (Analog Devices, Inc.)
DRV - (sscdbhk5 [System | Running]) -- C:\WINDOWS\system32\drivers\sscdbhk5.sys (Sonic Solutions)
DRV - (ssrtln [System | Running]) -- C:\WINDOWS\system32\drivers\ssrtln.sys (Sonic Solutions)
DRV - (tfsnboio [Auto | Running]) -- C:\WINDOWS\system32\dla\tfsnboio.sys (Sonic Solutions)
DRV - (tfsncofs [Auto | Running]) -- C:\WINDOWS\system32\dla\tfsncofs.sys (Sonic Solutions)
DRV - (tfsndrct [Auto | Running]) -- C:\WINDOWS\system32\dla\tfsndrct.sys (Sonic Solutions)
DRV - (tfsndres [Auto | Running]) -- C:\WINDOWS\system32\dla\tfsndres.sys (Sonic Solutions)
DRV - (tfsnifs [Auto | Running]) -- C:\WINDOWS\system32\dla\tfsnifs.sys (Sonic Solutions)
DRV - (tfsnopio [Auto | Running]) -- C:\WINDOWS\system32\dla\tfsnopio.sys (Sonic Solutions)
DRV - (tfsnpool [Auto | Running]) -- C:\WINDOWS\system32\dla\tfsnpool.sys (Sonic Solutions)
DRV - (tfsnudf [Auto | Running]) -- C:\WINDOWS\system32\dla\tfsnudf.sys (Sonic Solutions)
DRV - (tfsnudfa [Auto | Running]) -- C:\WINDOWS\system32\dla\tfsnudfa.sys (Sonic Solutions)
DRV - (USBAAPL [On_Demand | Stopped]) -- C:\WINDOWS\System32\Drivers\usbaapl.sys (Apple, Inc.)

========== Standard Registry (All) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = Reg Error: Invalid data type.
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn...st/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.c...rch/search.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = Reg Error: Invalid data type.
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = My Web Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultUrl = http://www.mywebsear...r={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = HTTP://MY.YAHOO.COM
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

O1 HOSTS File: (297250 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 10268 more lines...
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (worldadmarketplace browser enhancer) - {93748B91-FCC2-F4FB-31DD-EF86E49F3D7D} - C:\WINDOWS\system32\hhnqaxugtanell.dll ()
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\System32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\System32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto (Microsoft Corporation)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKLM..\RunOnceEx: [] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFolderOptions = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O8 - Extra context menu item: &Search - ?p=ZU
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra Button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - File not found
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [Tcpip] - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [NTDS] - C:\WINDOWS\System32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [Network Location Awareness (NLA) Namespace] - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [mdnsNSP] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 49 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Sites: ([]msn in My Computer)
O15 - HKCU\..Trusted Domains: 51 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.5.0_12)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_12)
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\ole db\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\ole db\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\ole db\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\ole db\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp Reg Error: Value error. - Reg Error: Key error. File not found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\ole db\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\System32\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp Reg Error: Value error. - Reg Error: Key error. File not found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\ole db\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\ole db\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\System32\wiascr.dll (Microsoft Corporation)
O18 - Protocol\Filter: - application/octet-stream - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter: - application/x-complus - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter: - application/x-msdownload - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter: - Class Install Handler - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter: - deflate - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter: - gzip - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter: - lzdhtml - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter: - text/webviewhtml - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (pttilh.dll) - C:\WINDOWS\system32\pttilh.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\system32\logonui.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\system32\sysdm.cpl (Microsoft Corporation)
O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\system32\crypt32.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\system32\cryptnet.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\system32\cscdll.dll (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\system32\igfxsrvc.dll (Intel Corporation)
O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\system32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\system32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\system32\sclgntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\system32\WlNotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\system32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\system32\wlnotify.dll (Microsoft Corporation)
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\System32\stobject.dll (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\System32\browseui.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\System32\browseui.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {C5BF49A2-94F3-42BD-F434-3604812C8955} - jgzfkj9w38rksndfi7r4 - Reg Error: Key error. File not found
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O27 - HKLM IFEO\Your Image File Name Here without a path: Debugger - C:\WINDOWS\System32\ntsd.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\system32\msapsspc.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - ( schannel.dll) - C:\WINDOWS\system32\schannel.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - ( digest.dll) - C:\WINDOWS\system32\digest.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - ( msnsspc.dll) - C:\WINDOWS\system32\msnsspc.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - ( digeste.dll) - File not found
O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (C:\WINDOWS\system32\awtrQGvw) - File not found
O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - Autorun File - C:\AUTOEXEC.BAT () - [ FAT32 ]

========== Files/Folders - Created Within 30 Days ==========

[2 C:\WINDOWS\System32\*.tmp files]
[4 C:\WINDOWS\*.tmp files]
[2009/02/24 05:20:12 | 00,494,080 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTListIt2.exe
[2009/02/24 00:45:08 | 00,034,512 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2009/02/23 23:20:04 | 00,000,104 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Internet.lnk
[2009/02/23 23:06:25 | 00,001,507 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Safari.lnk
[2009/02/23 23:06:02 | 00,000,000 | ---D | C] -- C:\Program Files\Safari
[2009/02/23 23:02:48 | 20,655,472 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\SafariSetup(2).exe
[2009/02/23 22:03:27 | 15,700,133 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\SafariSetup.exe.part
[2009/02/23 22:01:37 | 00,001,649 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\HijackThis.lnk
[2009/02/23 22:01:37 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2009/02/23 22:01:24 | 00,812,344 | ---- | C] (Trend Micro Inc.) -- C:\Documents and Settings\Owner\Desktop\HJTInstall.exe
[2009/02/23 21:33:39 | 16,409,960 | ---- | C] (Safer Networking Limited ) -- C:\Documents and Settings\Owner\Desktop\spybotsd162.exe
[2009/02/23 21:33:34 | 00,000,000 | ---D | C] -- C:\Program Files\SDHelper (Spybot - Search & Destroy)
[2009/02/23 21:33:34 | 00,000,000 | ---D | C] -- C:\Program Files\File Scanner Library (Spybot - Search & Destroy)
[2009/02/23 21:33:33 | 00,000,000 | ---D | C] -- C:\Program Files\Misc. Support Library (Spybot - Search & Destroy)
[2009/02/23 21:30:45 | 00,000,000 | ---D | C] -- C:\WINDOWS\pss
[2009/02/23 17:43:56 | 00,000,000 | -HSD | C] -- C:\FOUND.001
[2009/02/23 00:32:47 | 00,071,061 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\index.cfm
[2009/02/22 20:42:06 | 00,029,792 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\l_dc3c727249554cbabadd826ec04c4043.jpg
[2009/02/22 20:42:00 | 00,037,600 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\l_9f9af0b122ec4e579f567bbb3cf60f28.jpg
[2009/02/22 20:41:51 | 00,033,923 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\l_912510f96fc44c918354d79f65c7ab07.jpg
[2009/02/22 20:41:42 | 00,041,214 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\l_38235506485148e2b0e966f0bfb6058f.jpg
[2009/02/22 20:41:37 | 00,025,705 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\l_b49ced49ec0543e1ab0d196a99f5225c.jpg
[2009/02/22 20:41:30 | 00,031,848 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\l_e20d8c01af19464899a088f605251ad5.jpg
[2009/02/22 20:41:17 | 00,023,040 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\lol.jpg
[2009/02/21 22:41:13 | 00,000,026 | ---- | C] () -- C:\WINDOWS\ulead32.ini
[2009/02/21 22:41:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Ulead Systems
[2009/02/21 06:23:46 | 00,000,000 | -HSD | C] -- C:\FOUND.000
[2009/02/18 20:46:33 | 00,000,000 | -H-D | C] -- C:\Documents and Settings\Owner\Desktop\Originals
[2009/02/18 16:36:51 | 00,000,674 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Picasa 3.lnk
[2009/02/18 16:28:29 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\IOSUBSYS
[2009/02/16 20:38:46 | 00,000,000 | -HSD | C] -- C:\FOUND.031
[2009/02/13 12:36:05 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\{DD91BB2D-7EA1-4E38-B426-1055538DB084}
[2009/02/13 12:24:48 | 00,005,189 | ---- | C] () -- C:\WINDOWS\System32\uacinit.dll
[2009/02/13 12:24:34 | 00,000,127 | ---- | C] () -- C:\WINDOWS\System32\UACelhykxlx.dat
[2009/02/13 12:24:27 | 00,131,072 | ---- | C] () -- C:\WINDOWS\System32\drivers\77cda61.sys
[2009/02/13 12:24:27 | 00,019,214 | ---- | C] () -- C:\WINDOWS\System32\sf.ico
[2009/02/13 12:24:27 | 00,013,942 | ---- | C] () -- C:\WINDOWS\System32\m3.ico
[2009/02/13 12:24:27 | 00,004,286 | ---- | C] () -- C:\WINDOWS\System32\s.ico
[2009/02/13 12:24:25 | 00,003,182 | ---- | C] () -- C:\WINDOWS\ios.dat
[2009/02/13 12:24:21 | 00,106,496 | ---- | C] () -- C:\WINDOWS\System32\fejokt.dll
[2009/02/13 12:24:18 | 00,065,536 | ---- | C] () -- C:\WINDOWS\System32\drivers\UACpxgxtfor.sys
[2009/02/13 12:24:16 | 00,090,119 | ---- | C] () -- C:\xyephkl.exe
[2009/02/13 12:24:13 | 00,082,432 | ---- | C] () -- C:\dykhyp.exe
[2009/02/13 12:24:08 | 00,155,156 | ---- | C] () -- C:\WINDOWS\System\xccef090131.exe
[2009/02/13 12:24:00 | 00,000,002 | ---- | C] () -- C:\372317438
[2009/02/13 12:23:58 | 00,000,460 | ---- | C] () -- C:\WINDOWS\xccwinsys.ini
[2009/02/13 12:23:58 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\inf
[2009/02/13 12:20:49 | 00,129,024 | ---- | C] () -- C:\WINDOWS\System32\pttilh.dll
[2009/02/13 12:20:46 | 00,129,024 | ---- | C] () -- C:\WINDOWS\System32\shmkuqya.dll
[2009/02/11 12:23:47 | 00,129,024 | ---- | C] () -- C:\WINDOWS\System32\wodoli.dll
[2009/02/11 12:23:45 | 00,129,024 | ---- | C] () -- C:\WINDOWS\System32\kfphhtkm.dll
[2009/02/11 12:20:46 | 00,032,768 | ---- | C] () -- C:\WINDOWS\System32\xmswhdih.dll
[2009/02/09 21:56:05 | 00,085,637 | ---- | C] () -- C:\WINDOWS\System32\a88a5f6e-9a6e-4484-17df-7210623ed19c.exe
[2009/02/09 21:55:45 | 00,129,024 | ---- | C] () -- C:\WINDOWS\System32\mjqhgq.dll
[2009/02/09 21:55:41 | 00,129,024 | ---- | C] () -- C:\WINDOWS\System32\totxistn.dll
[2009/02/09 21:55:39 | 00,048,266 | ---- | C] () -- C:\WINDOWS\System32\msryiydwkldbkfl.exe
[2009/02/05 12:56:14 | 00,674,304 | ---- | C] () -- C:\WINDOWS\System32\nsd175.dll
[2009/01/27 20:12:09 | 00,001,495 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\LimeWire 4.18.8.lnk
[2009/01/27 09:45:20 | 00,192,588 | ---- | C] () -- C:\WINDOWS\System32\nwinpldt.exe
[2009/01/25 22:18:47 | 00,000,120 | -HS- | C] () -- C:\WINDOWS\System32\getbicjt.ini
[2009/01/25 22:16:46 | 00,000,000 | -HSD | C] -- C:\FOUND.030
[2009/01/25 22:13:01 | 00,000,000 | ---D | C] -- C:\Program Files\Lavasoft
[2009/01/25 22:13:01 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2009/01/25 22:13:00 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Adobe
[2009/01/25 22:12:35 | 00,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
[2009/01/25 22:12:33 | 00,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2009/01/25 22:12:32 | 00,000,000 | ---D | C] -- C:\Program Files\Broadcom
[2009/01/25 22:12:26 | 00,000,000 | ---D | C] -- C:\Program Files\FaxTools
[2009/01/25 22:12:26 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\BVRP Software
[2009/01/25 22:12:25 | 00,000,000 | ---D | C] -- C:\desktop
[2009/01/25 22:12:18 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2009/01/25 22:11:58 | 00,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0
[2009/01/25 22:11:39 | 00,000,000 | ---D | C] -- C:\Program Files\On2 Technologies
[2009/01/25 22:11:39 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Ahead
[2009/01/25 22:11:38 | 00,000,000 | ---D | C] -- C:\Program Files\Sun
[2009/01/25 22:11:38 | 00,000,000 | ---D | C] -- C:\Program Files\Ascentive
[2009/01/25 22:11:37 | 00,000,000 | ---D | C] -- C:\Program Files\Pivot Stickfigure Animator
[2009/01/25 22:11:35 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Sonic
[2009/01/25 22:11:33 | 00,000,000 | ---D | C] -- C:\WINDOWS\VirtualEar
[2009/01/25 22:11:26 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\DLA
[2009/01/25 22:11:26 | 00,000,000 | ---D | C] -- C:\Program Files\Analog Devices
[2009/01/25 17:58:50 | 00,271,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSCOREE.DLL

========== Files - Modified Within 30 Days ==========

[2 C:\WINDOWS\System32\*.tmp files]
[4 C:\WINDOWS\*.tmp files]
[2009/02/24 04:35:10 | 00,000,638 | ---- | M] () -- C:\WINDOWS\win.ini
[2009/02/24 04:35:10 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2009/02/24 04:35:10 | 00,000,211 | RHS- | M] () -- C:\boot.ini
[2009/02/24 00:45:10 | 00,034,512 | -H-- | M] () -- C:\WINDOWS\System32\mlfcache.dat
[2009/02/23 23:20:06 | 00,000,104 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Internet.lnk
[2009/02/23 23:06:26 | 00,001,507 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Safari.lnk
[2009/02/23 23:05:00 | 20,655,472 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\SafariSetup(2).exe
[2009/02/23 22:11:54 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/02/23 22:11:52 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/02/23 22:07:56 | 00,004,802 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2009/02/23 22:05:12 | 15,700,133 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\SafariSetup.exe.part
[2009/02/23 22:01:40 | 00,001,649 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\HijackThis.lnk
[2009/02/23 22:01:30 | 00,812,344 | ---- | M] (Trend Micro Inc.) -- C:\Documents and Settings\Owner\Desktop\HJTInstall.exe
[2009/02/23 21:36:36 | 00,000,848 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Spybot - Search & Destroy.lnk
[2009/02/23 21:35:30 | 16,409,960 | ---- | M] (Safer Networking Limited ) -- C:\Documents and Settings\Owner\Desktop\spybotsd162.exe
[2009/02/23 17:45:38 | 04,319,218 | -H-- | M] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\IconCache.db
[2009/02/23 17:44:12 | 00,012,598 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/02/23 15:06:42 | 00,494,080 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTListIt2.exe
[2009/02/23 14:09:20 | 00,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2009/02/23 00:32:48 | 00,071,061 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\index.cfm
[2009/02/22 20:42:08 | 00,029,792 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\l_dc3c727249554cbabadd826ec04c4043.jpg
[2009/02/22 20:42:02 | 00,037,600 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\l_9f9af0b122ec4e579f567bbb3cf60f28.jpg
[2009/02/22 20:41:52 | 00,033,923 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\l_912510f96fc44c918354d79f65c7ab07.jpg
[2009/02/22 20:41:44 | 00,041,214 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\l_38235506485148e2b0e966f0bfb6058f.jpg
[2009/02/22 20:41:40 | 00,025,705 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\l_b49ced49ec0543e1ab0d196a99f5225c.jpg
[2009/02/22 20:41:32 | 00,031,848 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\l_e20d8c01af19464899a088f605251ad5.jpg
[2009/02/22 20:41:20 | 00,023,040 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\lol.jpg
[2009/02/21 22:43:26 | 00,001,517 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2009/02/21 22:41:14 | 00,000,026 | ---- | M] () -- C:\WINDOWS\ulead32.ini
[2009/02/19 12:43:06 | 00,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2009/02/18 16:36:52 | 00,000,674 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Picasa 3.lnk
[2009/02/16 20:54:48 | 00,048,266 | ---- | M] () -- C:\WINDOWS\System32\msryiydwkldbkfl.exe
[2009/02/16 20:53:32 | 00,000,460 | ---- | M] () -- C:\WINDOWS\xccwinsys.ini
[2009/02/16 07:16:30 | 00,298,496 | ---- | M] () -- C:\WINDOWS\System32\hhnqaxugtanell.dll
[2009/02/14 06:57:56 | 00,131,072 | ---- | M] () -- C:\WINDOWS\System32\drivers\77cda61.sys
[2009/02/13 23:59:58 | 00,005,189 | ---- | M] () -- C:\WINDOWS\System32\uacinit.dll
[2009/02/13 12:24:38 | 00,065,536 | ---- | M] () -- C:\WINDOWS\System32\drivers\UACpxgxtfor.sys
[2009/02/13 12:24:36 | 00,000,127 | ---- | M] () -- C:\WINDOWS\System32\UACelhykxlx.dat
[2009/02/13 12:24:28 | 00,019,214 | ---- | M] () -- C:\WINDOWS\System32\sf.ico
[2009/02/13 12:24:28 | 00,013,942 | ---- | M] () -- C:\WINDOWS\System32\m3.ico
[2009/02/13 12:24:28 | 00,004,286 | ---- | M] () -- C:\WINDOWS\System32\s.ico
[2009/02/13 12:24:26 | 00,003,182 | ---- | M] () -- C:\WINDOWS\ios.dat
[2009/02/13 12:24:22 | 00,106,496 | ---- | M] () -- C:\WINDOWS\System32\fejokt.dll
[2009/02/13 12:24:20 | 00,090,119 | ---- | M] () -- C:\xyephkl.exe
[2009/02/13 12:24:16 | 00,082,432 | ---- | M] () -- C:\dykhyp.exe
[2009/02/13 12:24:02 | 00,000,002 | ---- | M] () -- C:\372317438
[2009/02/13 12:23:58 | 00,155,156 | ---- | M] () -- C:\WINDOWS\System\xccef090131.exe
[2009/02/13 12:20:50 | 00,129,024 | ---- | M] () -- C:\WINDOWS\System32\shmkuqya.dll
[2009/02/13 12:20:50 | 00,129,024 | ---- | M] () -- C:\WINDOWS\System32\pttilh.dll
[2009/02/11 12:23:48 | 00,129,024 | ---- | M] () -- C:\WINDOWS\System32\wodoli.dll
[2009/02/11 12:23:48 | 00,129,024 | ---- | M] () -- C:\WINDOWS\System32\kfphhtkm.dll
[2009/02/11 12:20:48 | 00,032,768 | ---- | M] () -- C:\WINDOWS\System32\xmswhdih.dll
[2009/02/09 21:56:08 | 00,085,637 | ---- | M] () -- C:\WINDOWS\System32\a88a5f6e-9a6e-4484-17df-7210623ed19c.exe
[2009/02/09 21:55:42 | 00,129,024 | ---- | M] () -- C:\WINDOWS\System32\totxistn.dll
[2009/02/09 21:55:42 | 00,129,024 | ---- | M] () -- C:\WINDOWS\System32\mjqhgq.dll
[2009/02/05 12:56:14 | 00,674,304 | ---- | M] () -- C:\WINDOWS\System32\nsd175.dll
[2009/01/27 20:12:10 | 00,001,495 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\LimeWire 4.18.8.lnk
[2009/01/25 22:18:48 | 00,000,120 | -HS- | M] () -- C:\WINDOWS\System32\getbicjt.ini
[2009/01/25 17:59:00 | 00,311,604 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2009/01/25 17:59:00 | 00,039,992 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

========== LOP Check ==========

[2006/01/11 15:15:08 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\All Users\Application Data
[2008/12/25 10:00:54 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[2009/01/25 22:13:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Adobe
[2008/05/25 23:58:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Apple
[2008/05/25 23:58:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Apple Computer
[2007/09/07 23:00:42 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg7
[2008/10/14 12:20:56 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Blizzard
[2009/01/25 22:12:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BVRP Software
[2007/09/08 07:40:42 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Google
[2007/09/07 23:00:42 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Grisoft
[2008/01/05 12:38:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\HP
[2006/01/11 21:40:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Kodak
[2006/01/11 15:14:54 | 00,000,000 | --SD | M] -- C:\Documents and Settings\All Users\Application Data\Microsoft
[2006/01/14 16:38:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MSN6
[2009/01/02 18:49:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MumboJumbo
[2006/01/11 21:21:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nova Development
[2006/01/11 14:59:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\QuickTime
[2008/01/05 12:37:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sonic
[2007/09/07 22:59:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2009/01/02 18:47:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2006/01/11 21:25:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ulead Systems
[2007/09/12 15:48:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Yahoo!
[2007/09/12 15:51:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
[2006/01/11 15:15:08 | 00,000,000 | -H-D | M] -- C:\Documents and Settings\Owner\Application Data
[2006/01/11 15:25:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Adobe
[2006/01/11 15:27:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\AdobeUM
[2008/05/26 00:01:30 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Apple Computer
[2007/09/07 23:01:06 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\AVG7
[2007/09/07 23:55:54 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Google
[2008/01/13 13:23:52 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Help
[2008/01/05 12:40:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\HP
[2006/01/11 14:35:04 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Identities
[2006/01/11 15:25:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Lavasoft
[2006/01/11 15:27:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Leadertech
[2008/05/26 00:01:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\LimeWire
[2007/09/07 23:42:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Macromedia
[2006/01/11 15:14:54 | 00,000,000 | --SD | M] -- C:\Documents and Settings\Owner\Application Data\Microsoft
[2007/09/12 17:31:16 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Mozilla
[2006/01/14 16:38:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\MSN6
[2008/06/10 03:54:42 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\MySpace
[2008/10/28 13:48:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Nexon
[2006/01/11 14:50:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Sonic
[2007/09/07 23:55:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Sun
[2007/09/07 22:33:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\U3
[2009/02/21 22:41:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Ulead Systems
[2008/12/27 05:58:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Uniblue
[2008/12/27 06:13:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\WinRAR
[2007/09/12 15:51:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Yahoo!
[2003/07/16 15:36:48 | 00,000,065 | RH-- | M] () -- C:\WINDOWS\Tasks\desktop.ini
[2009/02/23 22:11:54 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\Tasks\SA.DAT

========== Purity Check ==========

< End of report >

[JonRosell]

Well, the link rootkit gave me fails to load on my browser.

[kahdah]

Ok no problem please submit these files before running Combofix.


Download this program:

submit files packer

Highlight the files listed below in bold and right-click and selecting copy.

C:\xyephkl.exe
C:\dykhyp.exe
C:\WINDOWS\System\xccef090131.exe
C:\WINDOWS\System32\a88a5f6e-9a6e-4484-17df-7210623ed19c.exe
C:\WINDOWS\System32\msryiydwkldbkfl.exe
C:\WINDOWS\System32\nwinpldt.exe



Then start the file packer program and right click in the white box and select paste to paste the copied file names in the field.

Then press the Continue button.

I will create an archive with these files and a small log on your Desktop that starts with a name like requested-file[date].cab.

Rename this file to samples.

Click Here to upload the files please.
=================
Next:

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3


* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:




Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

[JonRosell]

Here it is.


ComboFix 09-02-21.01 - Owner 2009-02-24 5:50:01.1 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.510.237 [GMT -8:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
AV: AVG 7.5.552 *On-access scanning enabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\INSTALL.LOG
c:\program files\Mozilla Firefox\components\e964e7d9-d0c4-d824-4eab-090008a21ad2.dll
c:\temp\fse
c:\windows\IE4 Error Log.txt
c:\windows\ios.dat
c:\windows\system32\awtrQGvw.dll.vir
c:\windows\system32\bavrpmal.dll
c:\windows\system32\Drivers\UACpxgxtfor.sys
c:\windows\system32\f02WtR
c:\windows\system32\fejokt.dll
c:\windows\system32\getbicjt.ini
c:\windows\system32\hhnqaxugtanell.dll
c:\windows\system32\hxedurom.ini
c:\windows\system32\inf\rundll33.exe
c:\windows\system32\inf\xccdfb16_090131.dll
c:\windows\system32\inf\xccefb090131.scr
c:\windows\system32\kfphhtkm.dll
c:\windows\system32\m3.ico
c:\windows\system32\mjqhgq.dll
c:\windows\system32\olsjev.dll
c:\windows\system32\pttilh.dll
c:\windows\system32\pyaisexn.ini
c:\windows\system32\s.ico
c:\windows\system32\sf.ico
c:\windows\system32\shmkuqya.dll
c:\windows\system32\totxistn.dll
c:\windows\system32\UACelhykxlx.dat
c:\windows\system32\UACinit.dll
c:\windows\system32\UACjaorrdvg.log
c:\windows\system32\vuFMVvut.ini
c:\windows\system32\wodoli.dll
c:\windows\system32\wpv771231602518.cpx
c:\windows\wiaserviv.log
c:\windows\xccwinsys.ini

.
((((((((((((((((((((((((( Files Created from 2009-01-24 to 2009-02-24 )))))))))))))))))))))))))))))))
.

2009-02-24 00:45 . 2009-02-24 00:45 34,512 --ah----- c:\windows\SYSTEM32\mlfcache.dat
2009-02-23 23:06 . 2009-02-23 23:06 <DIR> d-------- c:\program files\Safari
2009-02-23 22:01 . 2009-02-23 22:01 <DIR> d-------- c:\program files\Trend Micro
2009-02-23 21:33 . 2009-02-23 21:33 <DIR> d-------- c:\program files\SDHelper (Spybot - Search & Destroy)
2009-02-23 21:33 . 2009-02-23 21:33 <DIR> d-------- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2009-02-23 21:33 . 2009-02-23 21:33 <DIR> d-------- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2009-02-23 17:43 . 2009-02-23 17:43 <DIR> d--hs---- C:\FOUND.001
2009-02-21 22:41 . 2009-02-21 22:41 <DIR> d-------- c:\documents and settings\Owner\Application Data\Ulead Systems
2009-02-21 22:41 . 2009-02-21 22:41 26 --a------ c:\windows\ulead32.ini
2009-02-21 06:23 . 2009-02-21 06:23 <DIR> d--hs---- C:\FOUND.000
2009-02-18 16:37 . 2008-07-31 14:17 9,200 --------- c:\windows\SYSTEM32\DRIVERS\cdralw2k.sys
2009-02-18 16:37 . 2008-07-31 14:17 9,072 --------- c:\windows\SYSTEM32\DRIVERS\cdr4_xp.sys
2009-02-18 16:28 . 2009-02-18 16:28 <DIR> d-------- c:\windows\SYSTEM32\IOSUBSYS
2009-02-16 20:38 . 2009-02-16 20:38 <DIR> d--hs---- C:\FOUND.031
2009-02-13 12:36 . 2009-02-13 12:36 134,144 --a------ c:\windows\ibihewatebicogic.dll
2009-02-13 12:24 . 2009-02-13 12:23 155,156 --a------ c:\windows\SYSTEM\xccef090131.exe
2009-02-13 12:24 . 2009-02-14 06:57 131,072 --a------ c:\windows\SYSTEM32\DRIVERS\77cda61.sys
2009-02-13 12:24 . 2009-02-13 12:24 90,119 --a------ C:\xyephkl.exe
2009-02-13 12:24 . 2009-02-13 12:24 82,432 --a------ C:\dykhyp.exe
2009-02-13 12:24 . 2009-02-13 12:24 2 --a------ C:\372317438
2009-02-13 12:23 . 2009-02-13 12:24 <DIR> d-------- c:\windows\SYSTEM32\inf
2009-02-12 00:17 . 2009-02-12 00:17 410,984 --a------ c:\windows\SYSTEM32\deploytk.dll
2009-02-11 12:20 . 2009-02-11 12:20 32,768 --------- c:\windows\SYSTEM32\xmswhdih.dll
2009-02-09 21:56 . 2009-02-09 21:56 85,637 --a------ c:\windows\SYSTEM32\a88a5f6e-9a6e-4484-17df-7210623ed19c.exe
2009-02-09 21:55 . 2009-02-16 20:54 48,266 --a------ c:\windows\SYSTEM32\msryiydwkldbkfl.exe
2009-02-05 12:56 . 2009-02-05 12:56 674,304 --a------ c:\windows\SYSTEM32\nsd175.dll
2009-01-27 09:45 . 2007-09-08 09:51 192,588 --a------ c:\windows\SYSTEM32\nwinpldt.exe
2009-01-25 22:16 . 2009-01-25 22:16 <DIR> d--hs---- C:\FOUND.030
2009-01-25 22:13 . 2009-01-25 22:13 <DIR> d-------- c:\program files\Lavasoft
2009-01-25 22:13 . 2009-01-25 22:13 <DIR> d-------- c:\program files\Common Files\Adobe
2009-01-25 22:12 . 2009-01-25 22:12 <DIR> d-------- c:\program files\FaxTools
2009-01-25 22:12 . 2009-01-25 22:12 <DIR> d-------- c:\program files\Common Files\Java
2009-01-25 22:12 . 2009-01-25 22:12 <DIR> d-------- c:\program files\Broadcom
2009-01-25 22:12 . 2009-01-25 22:12 <DIR> d-------- c:\program files\Bonjour
2009-01-25 22:12 . 2009-01-25 22:12 <DIR> d-------- c:\program files\Apple Software Update
2009-01-25 22:12 . 2009-01-25 22:12 <DIR> d-------- c:\documents and settings\All Users\Application Data\BVRP Software
2009-01-25 22:12 . 2009-01-25 22:12 <DIR> d-------- C:\desktop
2009-01-25 22:11 . 2009-01-25 22:11 <DIR> d-------- c:\windows\VirtualEar
2009-01-25 22:11 . 2009-01-25 22:11 <DIR> d-------- c:\windows\SYSTEM32\DLA
2009-01-25 22:11 . 2009-01-25 22:11 <DIR> d-------- c:\program files\Sun
2009-01-25 22:11 . 2009-01-25 22:11 <DIR> d-------- c:\program files\Pivot Stickfigure Animator
2009-01-25 22:11 . 2009-01-25 22:11 <DIR> d-------- c:\program files\On2 Technologies
2009-01-25 22:11 . 2009-01-25 22:12 <DIR> d-------- c:\program files\MSXML 4.0
2009-01-25 22:11 . 2009-01-25 22:11 <DIR> d-------- c:\program files\Common Files\Sonic
2009-01-25 22:11 . 2009-01-25 22:11 <DIR> d-------- c:\program files\Common Files\Ahead
2009-01-25 22:11 . 2009-01-25 22:11 <DIR> d-------- c:\program files\Ascentive
2009-01-25 22:11 . 2009-01-25 22:11 <DIR> d-------- c:\program files\Analog Devices
2009-01-25 17:58 . 2006-12-22 12:28 271,360 --a------ c:\windows\SYSTEM32\MSCOREE.DLL

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-20 02:30 --------- d-----w c:\program files\SmartPopupBlocker
2009-01-20 02:18 --------- d-----w c:\program files\Common Files\Scanner
2009-01-20 02:18 --------- d-----w c:\program files\CA Yahoo! Anti-Spy
2009-01-05 22:33 3,751,995 ----a-w c:\windows\SYSTEM32\GPhotos.scr
2009-01-03 02:49 --------- d-----w c:\documents and settings\All Users\Application Data\MumboJumbo
2009-01-03 02:47 --------- d-----w c:\documents and settings\All Users\Application Data\TEMP
2008-12-27 13:58 --------- d-----w c:\documents and settings\Owner\Application Data\Uniblue
2008-12-25 18:01 --------- d-----w c:\program files\iPod
2008-12-25 18:00 --------- d-----w c:\program files\iTunes
2008-12-25 18:00 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-25 17:58 --------- d-----w c:\program files\QuickTime
2008-12-21 01:25 31 ----a-w c:\documents and settings\Owner\jagex_runescape_preferences.dat
2008-12-13 06:40 3,593,216 ------w c:\windows\SYSTEM32\dllcache\mshtml.dll
2007-10-23 20:45 882,000 ----a-w c:\program files\HyCam2.exe
2007-10-23 20:45 87,400 ----a-w c:\program files\UnHyCam2.exe
2007-10-22 23:09 106,496 ----a-w c:\program files\CamRes2.dll
2007-09-27 22:31 5,272 ----a-w c:\program files\HyCam2.tlb
2007-08-12 02:15 57,344 ----a-w c:\program files\MClick2.dll
2006-12-14 21:13 113,628 ----a-w c:\program files\HyCam2.chm
2006-12-14 18:18 3,274 ----a-w c:\program files\agreement.txt
2006-07-09 13:13 82 ----a-w c:\program files\HomePage.url
2006-01-11 22:51 266 --sh--w c:\program files\desktop.ini
2006-01-11 22:51 11,079 ---h--w c:\program files\folder.htt
2004-05-05 20:57 2,018 ----a-w c:\program files\readme.txt
2004-04-16 22:07 675 ----a-w c:\program files\HyCam2.cnt
1999-06-24 19:49 587 ----a-w c:\program files\8-44100d.wav
1999-06-24 19:49 421 ----a-w c:\program files\8-44100u.wav
1999-06-24 19:47 317 ----a-w c:\program files\8-22050d.wav
1999-06-24 19:47 225 ----a-w c:\program files\8-22050u.wav
1999-06-24 19:46 183 ----a-w c:\program files\8-11025d.wav
1999-06-24 19:46 135 ----a-w c:\program files\8-11025u.wav
1999-06-24 19:44 127 ----a-w c:\program files\8-8000u.wav
1999-06-24 19:43 151 ----a-w c:\program files\8-8000d.wav
1999-06-24 19:41 220 ----a-w c:\program files\16-8000u.wav
1999-06-24 19:40 260 ----a-w c:\program files\16-8000d.wav
1999-06-24 19:38 956 ----a-w c:\program files\16-44100u.wav
1999-06-24 19:37 1,186 ----a-w c:\program files\16-44100d.wav
1999-06-24 19:34 652 ----a-w c:\program files\16-22050d.wav
1999-06-24 19:34 442 ----a-w c:\program files\16-22050u.wav
1999-06-24 18:54 340 ----a-w c:\program files\16-11025d.wav
1999-06-24 18:50 326 ----a-w c:\program files\16-11025u.wav
2004-06-08 23:51 278,528 ----a-w c:\program files\internet explorer\plugins\PanoViewer.dll
2004-06-08 23:51 143,360 ----a-w c:\program files\internet explorer\plugins\UPjpeg.dll
2008-12-19 06:00 67,688 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2008-12-19 06:00 54,368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2008-12-19 06:00 34,944 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2008-12-19 06:00 46,712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2008-12-19 06:00 172,136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 158208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [2007-10-23 219136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=pttilh.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.VP31"= vp31vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Event Planner Reminders.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Event Planner Reminders.lnk
backup=c:\windows\pss\Event Planner Reminders.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=c:\windows\pss\HP Image Zone Fast Start.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak software updater.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk
backup=c:\windows\pss\Kodak software updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^GameSpot Download Manager.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\GameSpot Download Manager.lnk
backup=c:\windows\pss\GameSpot Download Manager.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^TA_Start.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\TA_Start.lnk
backup=c:\windows\pss\TA_Start.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
--a------ 2008-10-16 09:47 590848 c:\progra~1\Grisoft\AVG7\avgcc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-04 00:56 15360 c:\windows\SYSTEM32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell AIO Printer A940]
--a------ 2003-06-25 07:29 294998 c:\program files\Dell AIO Printer A940\dlbabmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
--a------ 2003-08-06 01:04 114741 c:\windows\SYSTEM32\DLA\TFSWCTRL.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
--a------ 2005-06-21 23:44 126976 c:\windows\SYSTEM32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2005-05-11 23:12 49152 c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
--a------ 2005-06-21 23:48 155648 c:\windows\SYSTEM32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-11-20 13:20 290088 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 c:\windows\SYSTEM32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nkodojewujoxuce]
--a------ 2009-02-13 12:36 134144 c:\windows\ibihewatebicogic.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Performance Center]
--a------ 2008-08-13 14:14 3244032 c:\program files\Ascentive\Performance Center\ApcMain.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-11-04 10:30 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Search Protection]
--a------ 2008-10-07 08:23 111856 c:\program files\Yahoo!\Search Protection\SearchProtection.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
--a------ 2004-10-14 14:42 1404928 c:\program files\Analog Devices\Core\smax4pnp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StorageGuard]
--a------ 2003-02-13 01:01 155648 c:\program files\Common Files\Sonic\Update Manager\sgtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2009-02-12 00:17 148888 c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YSearchProtection]
--a------ 2008-10-07 08:23 111856 c:\program files\Yahoo!\Search Protection\SearchProtection.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCMSMMSG]
--a------ 2003-08-29 04:59 122880 c:\windows\BCMSMMSG.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=
"c:\\WINDOWS\\System32\\LEXPPS.EXE"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

.
- - - - ORPHANS REMOVED - - - -

BHO-{93748B91-FCC2-F4FB-31DD-EF86E49F3D7D} - c:\windows\system32\hhnqaxugtanell.dll
HKLM-Explorer_Run-xccinit - c:\windows\system32\inf\rundll33.exe
MSConfigStartUp-16311c51 - c:\windows\system32\tpgatpht.dll
MSConfigStartUp-GetModule35 - c:\program files\GetModule\GetModule35.exe
MSConfigStartUp-GetPack27 - c:\program files\GetPack\GetPack27.exe
MSConfigStartUp-jpzpntfbahzxwphw - c:\windows\system32\hhnqaxugtanell.dll
MSConfigStartUp-jsf8uiw3jnjgffght - c:\docume~1\Owner\LOCALS~1\Temp\winlognn.exe
MSConfigStartUp-Smax4 - c:\documents and settings\Owner\Application Data\Google\kjzna1562565.exe
MSConfigStartUp-Sroga - c:\windows\Mgeris.dll
MSConfigStartUp-tezrtsjhfr84iusjfo84f - c:\docume~1\Owner\LOCALS~1\Temp\csrssc.exe
MSConfigStartUp-Uniblue RegistryBooster 2009 - c:\program files\Uniblue\RegistryBooster\RegistryBooster.exe
MSConfigStartUp-{11-1C-CF-FE-ZN} - c:\windows\SYSTEM32\kodsrngk.exe


.
------- Supplementary Scan -------
.
uStart Page = hxxp://MY.YAHOO.COM
uSearchMigratedDefaultUrl = hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZU&fl=0&ptb=L1Gnwc9DodCGl5CL4vpXsg&url=http://edits.mywebsearch.com/toolbaredits/barsearch.jhtml&st=sb&searchfor={searchTerms}
uDefault_Search_URL = hxxp://www.google.com/ie
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Search - ?p=ZU
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\th4d2iwq.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www13.yoog.com/search.php?q=
FF - prefs.js: browser.search.selectedEngine - Yoog Search
FF - prefs.js: keyword.URL - hxxp://www13.yoog.com/search.php?q=
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll

---- FIREFOX POLICIES ----
FF - user.js: google.toolbar.linkdoctor.enabled - false
FF - user.js: browser.search.defaultenginename - Yoog Search
FF - user.js: browser.search.defaulturl - hxxp://www13.yoog.com/search.php?q=
FF - user.js: browser.search.selectedEngine - Yoog Search
FF - user.js: keyword.URL - hxxp://www13.yoog.com/search.php?q=
FF - user.js: keyword.enabled - true
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-24 05:53:36
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\SYSTEM32\LEXBCES.EXE
c:\windows\SYSTEM32\LEXPPS.EXE
c:\program files\COMMON FILES\APPLE\MOBILE DEVICE SUPPORT\BIN\APPLEMOBILEDEVICESERVICE.EXE
c:\program files\GRISOFT\AVG7\AVGAMSVR.EXE
c:\program files\GRISOFT\AVG7\AVGUPSVC.EXE
c:\program files\GRISOFT\AVG7\AVGEMC.EXE
c:\program files\BONJOUR\MDNSRESPONDER.EXE
c:\windows\SYSTEM32\DRIVERS\KODAKCCS.EXE
c:\windows\system32\OSK.exe
c:\windows\SYSTEM32\HPZIPM12.EXE
c:\windows\system32\MSSWCHX.EXE
.
**************************************************************************
.
Completion time: 2009-02-24 5:57:14 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-24 13:57:12

Pre-Run: 24,596,905,984 bytes free
Post-Run: 24,532,844,544 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

317 --- E O F --- 2008-12-18 11:00:43

[kahdah]

1. Please open Notepad

• Click Start , then Run
• type in notepad in the Run Box then hit ok.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
c:\windows\SYSTEM\xccef090131.exe
c:\windows\SYSTEM32\DRIVERS\77cda61.sys
C:\xyephkl.exe
C:\dykhyp.exe
C:\372317438
c:\windows\SYSTEM32\a88a5f6e-9a6e-4484-17df-7210623ed19c.exe
c:\windows\SYSTEM32\msryiydwkldbkfl.exe
c:\windows\SYSTEM32\nsd175.dll
c:\windows\SYSTEM32\nwinpldt.exe

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=""
uSearchMigratedDefaultUrl = hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZU&fl=0&ptb=L1Gnwc9DodCGl5CL4vpXsg&url=http://edits.mywebsearch.com/toolbaredits/barsearch.jhtml&st=sb&searchfor={searchTerms}
IE: &Search - ?p=ZU

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.




5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

• Combofix.txt
• A new HijackThis log.

=============

[JonRosell]

combofix log.



ComboFix 09-02-24.02 - Owner 2009-02-24 15:59:32.2 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.510.289 [GMT -8:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: AVG 7.5.552 *On-access scanning enabled* (Updated)
* Created a new restore point

FILE ::
C:\372317438
C:\dykhyp.exe
c:\windows\SYSTEM\xccef090131.exe
c:\windows\SYSTEM32\a88a5f6e-9a6e-4484-17df-7210623ed19c.exe
c:\windows\SYSTEM32\DRIVERS\77cda61.sys
c:\windows\SYSTEM32\msryiydwkldbkfl.exe
c:\windows\SYSTEM32\nsd175.dll
c:\windows\SYSTEM32\nwinpldt.exe
C:\xyephkl.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\372317438
C:\dykhyp.exe
c:\windows\SYSTEM\xccef090131.exe
c:\windows\SYSTEM32\a88a5f6e-9a6e-4484-17df-7210623ed19c.exe
c:\windows\SYSTEM32\DRIVERS\77cda61.sys
c:\windows\SYSTEM32\msryiydwkldbkfl.exe
c:\windows\SYSTEM32\nsd175.dll
c:\windows\SYSTEM32\nwinpldt.exe
C:\xyephkl.exe

.
((((((((((((((((((((((((( Files Created from 2009-01-24 to 2009-02-24 )))))))))))))))))))))))))))))))
.

2009-02-24 00:45 . 2009-02-24 00:45 34,512 --ah----- c:\windows\SYSTEM32\mlfcache.dat
2009-02-23 23:06 . 2009-02-23 23:06 <DIR> d-------- c:\program files\Safari
2009-02-23 22:01 . 2009-02-23 22:01 <DIR> d-------- c:\program files\Trend Micro
2009-02-23 21:33 . 2009-02-23 21:33 <DIR> d-------- c:\program files\SDHelper (Spybot - Search & Destroy)
2009-02-23 21:33 . 2009-02-23 21:33 <DIR> d-------- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2009-02-23 21:33 . 2009-02-23 21:33 <DIR> d-------- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2009-02-23 17:43 . 2009-02-23 17:43 <DIR> d--hs---- C:\FOUND.001
2009-02-21 22:41 . 2009-02-21 22:41 <DIR> d-------- c:\documents and settings\Owner\Application Data\Ulead Systems
2009-02-21 22:41 . 2009-02-21 22:41 26 --a------ c:\windows\ulead32.ini
2009-02-21 06:23 . 2009-02-21 06:23 <DIR> d--hs---- C:\FOUND.000
2009-02-18 16:37 . 2008-07-31 14:17 9,200 --------- c:\windows\SYSTEM32\DRIVERS\cdralw2k.sys
2009-02-18 16:37 . 2008-07-31 14:17 9,072 --------- c:\windows\SYSTEM32\DRIVERS\cdr4_xp.sys
2009-02-18 16:28 . 2009-02-18 16:28 <DIR> d-------- c:\windows\SYSTEM32\IOSUBSYS
2009-02-16 20:38 . 2009-02-16 20:38 <DIR> d--hs---- C:\FOUND.031
2009-02-13 12:36 . 2009-02-13 12:36 134,144 --a------ c:\windows\ibihewatebicogic.dll
2009-02-13 12:23 . 2009-02-13 12:24 <DIR> d-------- c:\windows\SYSTEM32\inf
2009-02-12 00:17 . 2009-02-12 00:17 410,984 --a------ c:\windows\SYSTEM32\deploytk.dll
2009-02-11 12:20 . 2009-02-11 12:20 32,768 --------- c:\windows\SYSTEM32\xmswhdih.dll
2009-01-25 22:16 . 2009-01-25 22:16 <DIR> d--hs---- C:\FOUND.030
2009-01-25 22:13 . 2009-01-25 22:13 <DIR> d-------- c:\program files\Lavasoft
2009-01-25 22:13 . 2009-01-25 22:13 <DIR> d-------- c:\program files\Common Files\Adobe
2009-01-25 22:12 . 2009-01-25 22:12 <DIR> d-------- c:\program files\FaxTools
2009-01-25 22:12 . 2009-01-25 22:12 <DIR> d-------- c:\program files\Common Files\Java
2009-01-25 22:12 . 2009-01-25 22:12 <DIR> d-------- c:\program files\Broadcom
2009-01-25 22:12 . 2009-01-25 22:12 <DIR> d-------- c:\program files\Bonjour
2009-01-25 22:12 . 2009-01-25 22:12 <DIR> d-------- c:\program files\Apple Software Update
2009-01-25 22:12 . 2009-01-25 22:12 <DIR> d-------- c:\documents and settings\All Users\Application Data\BVRP Software
2009-01-25 22:12 . 2009-01-25 22:12 <DIR> d-------- C:\desktop
2009-01-25 22:11 . 2009-01-25 22:11 <DIR> d-------- c:\windows\VirtualEar
2009-01-25 22:11 . 2009-01-25 22:11 <DIR> d-------- c:\windows\SYSTEM32\DLA
2009-01-25 22:11 . 2009-01-25 22:11 <DIR> d-------- c:\program files\Sun
2009-01-25 22:11 . 2009-01-25 22:11 <DIR> d-------- c:\program files\Pivot Stickfigure Animator
2009-01-25 22:11 . 2009-01-25 22:11 <DIR> d-------- c:\program files\On2 Technologies
2009-01-25 22:11 . 2009-01-25 22:12 <DIR> d-------- c:\program files\MSXML 4.0
2009-01-25 22:11 . 2009-01-25 22:11 <DIR> d-------- c:\program files\Common Files\Sonic
2009-01-25 22:11 . 2009-01-25 22:11 <DIR> d-------- c:\program files\Common Files\Ahead
2009-01-25 22:11 . 2009-01-25 22:11 <DIR> d-------- c:\program files\Ascentive
2009-01-25 22:11 . 2009-01-25 22:11 <DIR> d-------- c:\program files\Analog Devices
2009-01-25 17:58 . 2006-12-22 12:28 271,360 --a------ c:\windows\SYSTEM32\MSCOREE.DLL

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-20 02:30 --------- d-----w c:\program files\SmartPopupBlocker
2009-01-20 02:18 --------- d-----w c:\program files\Common Files\Scanner
2009-01-20 02:18 --------- d-----w c:\program files\CA Yahoo! Anti-Spy
2009-01-05 22:33 3,751,995 ----a-w c:\windows\SYSTEM32\GPhotos.scr
2009-01-03 02:49 --------- d-----w c:\documents and settings\All Users\Application Data\MumboJumbo
2009-01-03 02:47 --------- d-----w c:\documents and settings\All Users\Application Data\TEMP
2008-12-27 13:58 --------- d-----w c:\documents and settings\Owner\Application Data\Uniblue
2008-12-25 18:01 --------- d-----w c:\program files\iPod
2008-12-25 18:00 --------- d-----w c:\program files\iTunes
2008-12-25 18:00 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-25 17:58 --------- d-----w c:\program files\QuickTime
2008-12-21 01:25 31 ----a-w c:\documents and settings\Owner\jagex_runescape_preferences.dat
2008-12-13 06:40 3,593,216 ------w c:\windows\SYSTEM32\dllcache\mshtml.dll
2007-10-23 20:45 882,000 ----a-w c:\program files\HyCam2.exe
2007-10-23 20:45 87,400 ----a-w c:\program files\UnHyCam2.exe
2007-10-22 23:09 106,496 ----a-w c:\program files\CamRes2.dll
2007-09-27 22:31 5,272 ----a-w c:\program files\HyCam2.tlb
2007-08-12 02:15 57,344 ----a-w c:\program files\MClick2.dll
2006-12-14 21:13 113,628 ----a-w c:\program files\HyCam2.chm
2006-12-14 18:18 3,274 ----a-w c:\program files\agreement.txt
2006-07-09 13:13 82 ----a-w c:\program files\HomePage.url
2006-01-11 22:51 266 --sh--w c:\program files\desktop.ini
2006-01-11 22:51 11,079 ---h--w c:\program files\folder.htt
2004-05-05 20:57 2,018 ----a-w c:\program files\readme.txt
2004-04-16 22:07 675 ----a-w c:\program files\HyCam2.cnt
1999-06-24 19:49 587 ----a-w c:\program files\8-44100d.wav
1999-06-24 19:49 421 ----a-w c:\program files\8-44100u.wav
1999-06-24 19:47 317 ----a-w c:\program files\8-22050d.wav
1999-06-24 19:47 225 ----a-w c:\program files\8-22050u.wav
1999-06-24 19:46 183 ----a-w c:\program files\8-11025d.wav
1999-06-24 19:46 135 ----a-w c:\program files\8-11025u.wav
1999-06-24 19:44 127 ----a-w c:\program files\8-8000u.wav
1999-06-24 19:43 151 ----a-w c:\program files\8-8000d.wav
1999-06-24 19:41 220 ----a-w c:\program files\16-8000u.wav
1999-06-24 19:40 260 ----a-w c:\program files\16-8000d.wav
1999-06-24 19:38 956 ----a-w c:\program files\16-44100u.wav
1999-06-24 19:37 1,186 ----a-w c:\program files\16-44100d.wav
1999-06-24 19:34 652 ----a-w c:\program files\16-22050d.wav
1999-06-24 19:34 442 ----a-w c:\program files\16-22050u.wav
1999-06-24 18:54 340 ----a-w c:\program files\16-11025d.wav
1999-06-24 18:50 326 ----a-w c:\program files\16-11025u.wav
2004-06-08 23:51 278,528 ----a-w c:\program files\internet explorer\plugins\PanoViewer.dll
2004-06-08 23:51 143,360 ----a-w c:\program files\internet explorer\plugins\UPjpeg.dll
2008-12-19 06:00 67,688 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2008-12-19 06:00 54,368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2008-12-19 06:00 34,944 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2008-12-19 06:00 46,712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2008-12-19 06:00 172,136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-02-24_ 5.56.12.90 )))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 158208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [2007-10-23 219136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.VP31"= vp31vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Event Planner Reminders.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Event Planner Reminders.lnk
backup=c:\windows\pss\Event Planner Reminders.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=c:\windows\pss\HP Image Zone Fast Start.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak software updater.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk
backup=c:\windows\pss\Kodak software updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^GameSpot Download Manager.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\GameSpot Download Manager.lnk
backup=c:\windows\pss\GameSpot Download Manager.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^TA_Start.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\TA_Start.lnk
backup=c:\windows\pss\TA_Start.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
--a------ 2008-10-16 09:47 590848 c:\progra~1\Grisoft\AVG7\avgcc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-04 00:56 15360 c:\windows\SYSTEM32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell AIO Printer A940]
--a------ 2003-06-25 07:29 294998 c:\program files\Dell AIO Printer A940\dlbabmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
--a------ 2003-08-06 01:04 114741 c:\windows\SYSTEM32\DLA\TFSWCTRL.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
--a------ 2005-06-21 23:44 126976 c:\windows\SYSTEM32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2005-05-11 23:12 49152 c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
--a------ 2005-06-21 23:48 155648 c:\windows\SYSTEM32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-11-20 13:20 290088 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 c:\windows\SYSTEM32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nkodojewujoxuce]
--a------ 2009-02-13 12:36 134144 c:\windows\ibihewatebicogic.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Performance Center]
--a------ 2008-08-13 14:14 3244032 c:\program files\Ascentive\Performance Center\ApcMain.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-11-04 10:30 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Search Protection]
--a------ 2008-10-07 08:23 111856 c:\program files\Yahoo!\Search Protection\SearchProtection.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
--a------ 2004-10-14 14:42 1404928 c:\program files\Analog Devices\Core\smax4pnp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StorageGuard]
--a------ 2003-02-13 01:01 155648 c:\program files\Common Files\Sonic\Update Manager\sgtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2009-02-12 00:17 148888 c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YSearchProtection]
--a------ 2008-10-07 08:23 111856 c:\program files\Yahoo!\Search Protection\SearchProtection.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCMSMMSG]
--a------ 2003-08-29 04:59 122880 c:\windows\BCMSMMSG.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=
"c:\\WINDOWS\\System32\\LEXPPS.EXE"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://MY.YAHOO.COM
uSearchMigratedDefaultUrl = hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZU&fl=0&ptb=L1Gnwc9DodCGl5CL4vpXsg&url=http://edits.mywebsearch.com/toolbaredits/barsearch.jhtml&st=sb&searchfor={searchTerms}
uDefault_Search_URL = hxxp://www.google.com/ie
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Search - ?p=ZU
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\th4d2iwq.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www13.yoog.com/search.php?q=
FF - prefs.js: browser.search.selectedEngine - Yoog Search
FF - prefs.js: keyword.URL - hxxp://www13.yoog.com/search.php?q=

---- FIREFOX POLICIES ----
FF - user.js: google.toolbar.linkdoctor.enabled - false
FF - user.js: browser.search.defaultenginename - Yoog Search
FF - user.js: browser.search.defaulturl - hxxp://www13.yoog.com/search.php?q=
FF - user.js: browser.search.selectedEngine - Yoog Search
FF - user.js: keyword.URL - hxxp://www13.yoog.com/search.php?q=
FF - user.js: keyword.enabled - true
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-24 16:03:12
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-02-24 16:04:24
ComboFix-quarantined-files.txt 2009-02-25 00:04:24
ComboFix2.txt 2009-02-24 13:57:24

Pre-Run: 24,400,560,128 bytes free
Post-Run: 24,377,458,688 bytes free

259 --- E O F --- 2008-12-18 11:00:43

[JonRosell]

hijack this log.



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:06:32 PM, on 2/24/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Safari\Safari.exe
C:\WINDOWS\SYSTEM32\osk.exe
C:\WINDOWS\SYSTEM32\MSSWCHX.EXE
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: &Search - ?p=ZU
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 5041 bytes

[kahdah]

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Full Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatley.

[JonRosell]

Malwarebytes' Anti-Malware 1.34
Database version: 1801
Windows 5.1.2600 Service Pack 2

2/24/2009 9:49:24 PM
mbam-log-2009-02-24 (21-49-24).txt

Scan type: Full Scan (C:\|)
Objects scanned: 126726
Time elapsed: 33 minute(s), 8 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 6
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 106

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\lmaspois (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\lmaspois.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{7a85cdf5-284b-4496-a9a7-dd82fee9dcec} (Rogue.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{fcd4b2f5-8793-4e1f-8774-6e520cf6cd79} (Rogue.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{a6573479-9075-4a65-98a6-19fd29cf7374} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Program Files\Mozilla Firefox\plugins\NPMyWebS.dll_tobedeleted_old (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\dykhyp.exe.vir (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\xyephkl.exe.vir (Trojan.BHO) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\fejokt.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\wpv771231602518.cpx.vir (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\awtrQGvw.dll.vir.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\bavrpmal.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\kfphhtkm.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\olsjev.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\pttilh.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\shmkuqya.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\wodoli.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\inf\xccdfb16_090131.dll.vir (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\inf\xccefb090131.scr.vir (Trojan.Buzus) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\DRIVERS\UACpxgxtfor.sys.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM\xccef090131.exe.vir (Trojan.Buzus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Desktop\PDInstall2009.exe (Rogue.PerfectDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Desktop\SpeedScan_setup.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117308.scr (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117309.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117310.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117311.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117312.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117313.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117314.exe (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117315.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117316.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117317.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117318.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117319.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117320.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117321.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117322.SCR (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117323.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117324.DLL (Adware.MyWeb.FunWeb) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117325.EXE (Adware.MyWeb.FunWeb) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117326.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117327.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117328.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117330.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117331.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117332.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117333.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117335.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117336.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117337.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117338.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117339.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117340.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117341.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP493\A0117342.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP494\A0117374.exe (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP494\A0117376.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117394.scr (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117395.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117396.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117397.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117398.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117399.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117400.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117401.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117402.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117403.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117404.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117405.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117406.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117407.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117408.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117409.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117410.SCR (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117411.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117412.DLL (Adware.MyWeb.FunWeb) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117413.EXE (Adware.MyWeb.FunWeb) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117414.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117415.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117416.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117418.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117419.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117420.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117421.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117423.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117424.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117425.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117426.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117427.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117428.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117429.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP496\A0117430.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP509\A0120865.exe (Rogue.PerfectDefender) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP530\A0148999.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP530\A0149998.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP532\A0155000.exe (Trojan.Peed) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP557\A0159071.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP557\A0159072.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP557\A0159073.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP562\A0163095.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP566\A0166202.dll (Adware.BHO) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP573\A0171395.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP573\A0171405.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP573\A0171409.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP573\A0171411.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP573\A0171412.DLL (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP573\A0171414.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP573\A0171417.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP574\A0171573.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B9CC841-5BEC-470C-BCF6-95E11FAE3955}\RP574\A0171580.exe (Trojan.BHO) -> Quarantined and deleted successfully.

[kahdah]

Please download ATF Cleaner by Atribune.
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.
==============================================
Please do a scan with Kaspersky Online Scanner

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

Click on the Accept button and install any components it needs.

• The program will install and then begin downloading the latest definition files.
• After the files have been downloaded on the left side of the page in the Scan section select My Computer
• This will start the program and scan your system.
• The scan will take a while, so be patient and let it run.
• Once the scan is complete, click on View scan report
• Now, click on the Save Report as button.
• Save the file to your desktop.
• Copy and paste that information in your next post.