[globalfx]

Logfile of HijackThis v1.99.1
Scan saved at 2:32:41 PM, on 10/2/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\brss01a.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\dXNlcgAA\command.exe
c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\00THotkey.exe
C:\WINDOWS\system32\TFNF5.exe
C:\WINDOWS\system32\TPWRTRAY.EXE
C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\WINDOWS\system32\TDispVol.exe
C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE
C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
C:\toshiba\ivp\ism\pinger.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Synaptics\SynTP\CPad\cPadFstR.Exe
C:\Program Files\Synaptics\SynTP\cPad\AlarmWatcher.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Norton Password Manager\AcctMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SPYWAR~1\swdoctor.exe
C:\Program Files\D-Link AirPlus Xtreme G\AirPlus.exe
C:\Program Files\TrojanHunter 4.2\THGuard.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\GeeksToGo\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshiba.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://69.28.210.175/media/1
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe
O2 - BHO: (no name) - {30201634-41C8-F0FF-C6C7-EA47A5FBE127} - C:\WINDOWS\qjyxbujl.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: AdCom - {D7950AB4-67F5-458e-A37D-9F2DE7F250AC} - C:\WINDOWS\system32\AdCom.dll
O3 - Toolbar: Search - {82DFB8BE-F895-9FE5-9398-AE31E365D3C0} - C:\WINDOWS\qjyxbujl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY.EXE
O4 - HKLM\..\Run: [TosHKCW.exe] "C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe"
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe /Type 03
O4 - HKLM\..\Run: [TDispVol] TDispVol.exe
O4 - HKLM\..\Run: [TMESBS.EXE] C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE /Client
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [cPadFstR] C:\Program Files\Synaptics\SynTP\CPad\cPadFstR.Exe
O4 - HKLM\..\Run: [cPadAlarm] C:\Program Files\Synaptics\SynTP\cPad\AlarmWatcher.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DLPSP] "c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE"
O4 - HKLM\..\Run: [Sysnet] C:\DOCUME~1\user\LOCALS~1\Temp\sysnet.exe
O4 - HKLM\..\Run: [tgyidll] C:\WINDOWS\tgyidll.EXE
O4 - HKLM\..\Run: [asubenc] C:\WINDOWS\asubenc.EXE
O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [ttupt] C:\WINDOWS\ttupt.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [hgybdll] C:\WINDOWS\hgybdll.exe
O4 - HKLM\..\Run: [hgybenc] C:\WINDOWS\hgybenc.exe
O4 - HKLM\..\Run: [wvgjdll] C:\WINDOWS\wvgjdll.exe
O4 - HKLM\..\Run: [zfipenc] C:\WINDOWS\zfipenc.exe
O4 - HKLM\..\Run: [frcedll] C:\WINDOWS\frcedll.exe
O4 - HKLM\..\Run: [frceenc] C:\WINDOWS\frceenc.exe
O4 - HKLM\..\Run: [fnmddll] C:\WINDOWS\fnmddll.exe
O4 - HKLM\..\Run: [fnmdenc] C:\WINDOWS\fnmdenc.exe
O4 - HKLM\..\Run: [zdpvdll] C:\WINDOWS\zdpvdll.exe
O4 - HKLM\..\Run: [gqlgenc] C:\WINDOWS\gqlgenc.exe
O4 - HKLM\..\Run: [ymrhdll] C:\WINDOWS\ymrhdll.exe
O4 - HKLM\..\Run: [ymrhenc] C:\WINDOWS\ymrhenc.exe
O4 - HKLM\..\Run: [trxadll] C:\WINDOWS\trxadll.exe
O4 - HKLM\..\Run: [trxaenc] C:\WINDOWS\trxaenc.exe
O4 - HKLM\..\Run: [xsnddll] C:\WINDOWS\xsnddll.exe
O4 - HKLM\..\Run: [xsndenc] C:\WINDOWS\xsndenc.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [uftcdll] C:\WINDOWS\uftcdll.exe
O4 - HKLM\..\Run: [uftcenc] C:\WINDOWS\uftcenc.exe
O4 - HKLM\..\Run: [moemdll] C:\WINDOWS\moemdll.exe
O4 - HKLM\..\Run: [moemenc] C:\WINDOWS\moemenc.exe
O4 - HKLM\..\Run: [iurgdll] C:\WINDOWS\iurgdll.exe
O4 - HKLM\..\Run: [iurgenc] C:\WINDOWS\iurgenc.exe
O4 - HKLM\..\Run: [rsaqdll] C:\WINDOWS\rsaqdll.exe
O4 - HKLM\..\Run: [rsaqenc] C:\WINDOWS\rsaqenc.exe
O4 - HKLM\..\Run: [maxldll] C:\WINDOWS\maxldll.exe
O4 - HKLM\..\Run: [maxlenc] C:\WINDOWS\maxlenc.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [Spyware Doctor] C:\PROGRA~1\SPYWAR~1\swdoctor.exe /Q
O4 - Global Startup: D-Link AirPlus Xtreme G Configuration Utility.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar3.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar3.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar3.dll/cmtrans.html
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra 'Tools' menuitem: Launch Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zone.../ICSScanner.cab
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - http://a248.e.akamai...ol/SymDlBrg.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://upload.smugmu...vex/XUpload.ocx
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\dXNlcgAA\command.exe
O23 - Service: Dell Printer Status Watcher (DLPWD) - Dell Inc. - c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE
O23 - Service: Dell Printer Status Database (DLSDB) - Dell Inc. - c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Tmesbs32 (Tmesbs) - Unknown owner - C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe" /Service (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

[Advertisements]

Hi and welcome to GeeksToGo! My name is Sam and I will be helping you.

I apologize for the delay getting to your log, the helpers here are very busy.
If you still need help, please post a fresh Hijack log, in this thread, so I can help you with your Malware Problems.

If you have resolved this issue please let us know.

[Buckeye_Sam]

Hi and welcome to GeeksToGo! My name is Sam and I will be helping you.

I apologize for the delay getting to your log, the helpers here are very busy.
If you still need help, please post a fresh Hijack log, in this thread, so I can help you with your Malware Problems.

If you have resolved this issue please let us know.

[globalfx]

Thanks...here's the latest.

Bill

Logfile of HijackThis v1.99.1
Scan saved at 10:32:38 AM, on 10/5/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\System32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\00THotkey.exe
C:\WINDOWS\system32\TFNF5.exe
C:\WINDOWS\system32\TPWRTRAY.EXE
C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\WINDOWS\system32\TDispVol.exe
C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE
C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
C:\toshiba\ivp\ism\pinger.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Synaptics\SynTP\CPad\cPadFstR.Exe
C:\Program Files\Synaptics\SynTP\cPad\AlarmWatcher.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Norton Password Manager\AcctMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\TrojanHunter 4.2\THGuard.exe
C:\PROGRA~1\SPYWAR~1\swdoctor.exe
C:\Program Files\D-Link AirPlus Xtreme G\AirPlus.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\GeeksToGo\Hijackthis\HijackThis.exe
C:\WINDOWS\bdmkl1001.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshiba.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://69.28.210.175/media/1
F2 - REG:system.ini: Shell=Explorer.exe
O2 - BHO: (no name) - {30201634-41C8-F0FF-C6C7-EA47A5FBE127} - C:\WINDOWS\qjyxbujl.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Related Page - {9A9C9B69-F908-4AAB-8D0C-10EA8997F37E} - C:\WINDOWS\system32\WinNB57.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: AdCom - {D7950AB4-67F5-458e-A37D-9F2DE7F250AC} - C:\WINDOWS\system32\AdCom.dll
O3 - Toolbar: Search - {82DFB8BE-F895-9FE5-9398-AE31E365D3C0} - C:\WINDOWS\qjyxbujl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Related Page - {9A9C9B68-F908-4AAB-8D0C-10EA8997F37E} - C:\WINDOWS\system32\WinNB57.dll
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY.EXE
O4 - HKLM\..\Run: [TosHKCW.exe] "C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe"
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe /Type 03
O4 - HKLM\..\Run: [TDispVol] TDispVol.exe
O4 - HKLM\..\Run: [TMESBS.EXE] C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE /Client
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [cPadFstR] C:\Program Files\Synaptics\SynTP\CPad\cPadFstR.Exe
O4 - HKLM\..\Run: [cPadAlarm] C:\Program Files\Synaptics\SynTP\cPad\AlarmWatcher.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DLPSP] "c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE"
O4 - HKLM\..\Run: [Sysnet] C:\DOCUME~1\user\LOCALS~1\Temp\sysnet.exe
O4 - HKLM\..\Run: [tgyidll] C:\WINDOWS\tgyidll.EXE
O4 - HKLM\..\Run: [asubenc] C:\WINDOWS\asubenc.EXE
O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [ttupt] C:\WINDOWS\ttupt.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [hgybdll] C:\WINDOWS\hgybdll.exe
O4 - HKLM\..\Run: [hgybenc] C:\WINDOWS\hgybenc.exe
O4 - HKLM\..\Run: [wvgjdll] C:\WINDOWS\wvgjdll.exe
O4 - HKLM\..\Run: [zfipenc] C:\WINDOWS\zfipenc.exe
O4 - HKLM\..\Run: [frcedll] C:\WINDOWS\frcedll.exe
O4 - HKLM\..\Run: [frceenc] C:\WINDOWS\frceenc.exe
O4 - HKLM\..\Run: [fnmddll] C:\WINDOWS\fnmddll.exe
O4 - HKLM\..\Run: [fnmdenc] C:\WINDOWS\fnmdenc.exe
O4 - HKLM\..\Run: [zdpvdll] C:\WINDOWS\zdpvdll.exe
O4 - HKLM\..\Run: [gqlgenc] C:\WINDOWS\gqlgenc.exe
O4 - HKLM\..\Run: [ymrhdll] C:\WINDOWS\ymrhdll.exe
O4 - HKLM\..\Run: [ymrhenc] C:\WINDOWS\ymrhenc.exe
O4 - HKLM\..\Run: [trxadll] C:\WINDOWS\trxadll.exe
O4 - HKLM\..\Run: [trxaenc] C:\WINDOWS\trxaenc.exe
O4 - HKLM\..\Run: [xsnddll] C:\WINDOWS\xsnddll.exe
O4 - HKLM\..\Run: [xsndenc] C:\WINDOWS\xsndenc.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [uftcdll] C:\WINDOWS\uftcdll.exe
O4 - HKLM\..\Run: [uftcenc] C:\WINDOWS\uftcenc.exe
O4 - HKLM\..\Run: [moemdll] C:\WINDOWS\moemdll.exe
O4 - HKLM\..\Run: [moemenc] C:\WINDOWS\moemenc.exe
O4 - HKLM\..\Run: [iurgdll] C:\WINDOWS\iurgdll.exe
O4 - HKLM\..\Run: [iurgenc] C:\WINDOWS\iurgenc.exe
O4 - HKLM\..\Run: [rsaqdll] C:\WINDOWS\rsaqdll.exe
O4 - HKLM\..\Run: [rsaqenc] C:\WINDOWS\rsaqenc.exe
O4 - HKLM\..\Run: [maxldll] C:\WINDOWS\maxldll.exe
O4 - HKLM\..\Run: [maxlenc] C:\WINDOWS\maxlenc.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [Spyware Doctor] C:\PROGRA~1\SPYWAR~1\swdoctor.exe /Q
O4 - Global Startup: D-Link AirPlus Xtreme G Configuration Utility.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar3.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar3.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar3.dll/cmtrans.html
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra 'Tools' menuitem: Launch Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zone.../ICSScanner.cab
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - http://a248.e.akamai...ol/SymDlBrg.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://upload.smugmu...vex/XUpload.ocx
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Dell Printer Status Watcher (DLPWD) - Dell Inc. - c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE
O23 - Service: Dell Printer Status Database (DLSDB) - Dell Inc. - c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Tmesbs32 (Tmesbs) - Unknown owner - C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe" /Service (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Edited by globalfx, 05 October 2005 - 11:54 AM.

[TonyKlein]

My apologies for gatecrashing this topic, but could I ask you to please send a copy of the C:\WINDOWS\system32\AdCom.dll file to submit_stuffATxs4all.nl for analysis? (replace 'AT' by @)

We're pretty sure it doesn't belong on your computer, and we'd like to have a closer look at it! We'd also want to send a sample to developers in the security field, if necessary.

Much appreciated

The file could possibly have the "Hidden" attribute. Here's how to show hidden and operating system files

After that I'll be leaving you in Buckeye_Sam's capable hands!

[Buckeye_Sam]

You certainly have a lot going on in that log. And it appears you have something new and exciting.

Please follow the request by TonyKlein. He is a top expert in this area and without the time and diligence that he puts into this area, we would have a much more difficult time helping people such as yourself.

Please let me know once you have submitted that file and we will get started tackling your problem.

[globalfx]

OK Sam, I sent 4 files to Tony...all Adcom.

Bill

[TonyKlein]

Thanks for sending those files, Bill.

As I expected, it's adware, hailing from netrevenuestream.com

Best regards,

[Buckeye_Sam]

Thanks for helping out. Now let's get you fixed up.

Run Hijackthis again, click scan, and Put a checkmark next to each of these. Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix Checked button.

O4 - HKLM\..\Run: [ttupt] C:\WINDOWS\ttupt.exe
O4 - HKLM\..\Run: [hgybdll] C:\WINDOWS\hgybdll.exe
O4 - HKLM\..\Run: [hgybenc] C:\WINDOWS\hgybenc.exe
O4 - HKLM\..\Run: [wvgjdll] C:\WINDOWS\wvgjdll.exe
O4 - HKLM\..\Run: [zfipenc] C:\WINDOWS\zfipenc.exe
O4 - HKLM\..\Run: [frcedll] C:\WINDOWS\frcedll.exe
O4 - HKLM\..\Run: [frceenc] C:\WINDOWS\frceenc.exe
O4 - HKLM\..\Run: [fnmddll] C:\WINDOWS\fnmddll.exe
O4 - HKLM\..\Run: [fnmdenc] C:\WINDOWS\fnmdenc.exe
O4 - HKLM\..\Run: [zdpvdll] C:\WINDOWS\zdpvdll.exe
O4 - HKLM\..\Run: [gqlgenc] C:\WINDOWS\gqlgenc.exe
O4 - HKLM\..\Run: [ymrhdll] C:\WINDOWS\ymrhdll.exe
O4 - HKLM\..\Run: [ymrhenc] C:\WINDOWS\ymrhenc.exe
O4 - HKLM\..\Run: [trxadll] C:\WINDOWS\trxadll.exe
O4 - HKLM\..\Run: [trxaenc] C:\WINDOWS\trxaenc.exe
O4 - HKLM\..\Run: [xsnddll] C:\WINDOWS\xsnddll.exe
O4 - HKLM\..\Run: [xsndenc] C:\WINDOWS\xsndenc.exe
O4 - HKLM\..\Run: [uftcdll] C:\WINDOWS\uftcdll.exe
O4 - HKLM\..\Run: [uftcenc] C:\WINDOWS\uftcenc.exe
O4 - HKLM\..\Run: [moemdll] C:\WINDOWS\moemdll.exe
O4 - HKLM\..\Run: [moemenc] C:\WINDOWS\moemenc.exe
O4 - HKLM\..\Run: [iurgdll] C:\WINDOWS\iurgdll.exe
O4 - HKLM\..\Run: [iurgenc] C:\WINDOWS\iurgenc.exe
O4 - HKLM\..\Run: [rsaqdll] C:\WINDOWS\rsaqdll.exe
O4 - HKLM\..\Run: [rsaqenc] C:\WINDOWS\rsaqenc.exe
O4 - HKLM\..\Run: [maxldll] C:\WINDOWS\maxldll.exe
O4 - HKLM\..\Run: [maxlenc] C:\WINDOWS\maxlenc.exe


Please download Ewido Security Suite it is a trial version of the program.

• Install ewido security suite
• When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
• Launch ewido, there should be an icon on your desktop double-click it.
• The program will now go to the main screen

You will need to update ewido to the latest definition files.

• On the left hand side of the main screen click update
• Then click on Start Update

The update will start and a progress bar will show the updates being installed.
If you are having problems with the updater, you can use this link to manually update ewido.
http://www.ewido.net...wnload/updates/

Once the updates are installed do the following:

• Click on scanner
• Click on Complete System Scan and the scan will begin.
• While the scan is in progress you will be prompted to clean files, click OK
• When it asks if you want to clean the first file, put a check in the lower left corner of the box that says "Perform action on all infections" then choose clean and click OK.
• Once the scan has completed, there will be a button located on the bottom of the screen named Save report
• Click Save report.
• Save the report .txt file to your desktop.

Now close ewido security suite.


Reboot your computer and post a new hijackthis log and the log from Ewido.

[globalfx]

Sorry...I ran ewido, but I lost the log. It said that it removed 65 threats!

Logfile of HijackThis v1.99.1
Scan saved at 8:44:24 PM, on 10/9/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\brss01a.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\WINDOWS\System32\00THotkey.exe
C:\WINDOWS\system32\TFNF5.exe
C:\WINDOWS\system32\TPWRTRAY.EXE
C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\WINDOWS\system32\TDispVol.exe
C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE
C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
C:\toshiba\ivp\ism\pinger.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Synaptics\SynTP\CPad\cPadFstR.Exe
C:\Program Files\Synaptics\SynTP\cPad\AlarmWatcher.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Norton Password Manager\AcctMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\TrojanHunter 4.2\THGuard.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\SPYWAR~1\swdoctor.exe
C:\Program Files\D-Link AirPlus Xtreme G\AirPlus.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\GeeksToGo\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshiba.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://69.28.210.175/media/1
F2 - REG:system.ini: Shell=Explorer.exe
O2 - BHO: (no name) - {30201634-41C8-F0FF-C6C7-EA47A5FBE127} - C:\WINDOWS\qjyxbujl.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: AdCom - {D7950AB4-67F5-458e-A37D-9F2DE7F250AC} - C:\WINDOWS\system32\AdCom.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY.EXE
O4 - HKLM\..\Run: [TosHKCW.exe] "C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe"
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe /Type 03
O4 - HKLM\..\Run: [TDispVol] TDispVol.exe
O4 - HKLM\..\Run: [TMESBS.EXE] C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE /Client
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [cPadFstR] C:\Program Files\Synaptics\SynTP\CPad\cPadFstR.Exe
O4 - HKLM\..\Run: [cPadAlarm] C:\Program Files\Synaptics\SynTP\cPad\AlarmWatcher.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [DLPSP] "c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE"
O4 - HKLM\..\Run: [Sysnet] C:\DOCUME~1\user\LOCALS~1\Temp\sysnet.exe
O4 - HKLM\..\Run: [tgyidll] C:\WINDOWS\tgyidll.EXE
O4 - HKLM\..\Run: [asubenc] C:\WINDOWS\asubenc.EXE
O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\system32\uaiunu.exe reg_run
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Spyware Doctor] C:\PROGRA~1\SPYWAR~1\swdoctor.exe /Q
O4 - Global Startup: D-Link AirPlus Xtreme G Configuration Utility.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar3.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar3.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar3.dll/cmtrans.html
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra 'Tools' menuitem: Launch Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: (no name) - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra 'Tools' menuitem: Java - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zone.../ICSScanner.cab
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - http://a248.e.akamai...ol/SymDlBrg.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://upload.smugmu...vex/XUpload.ocx
O16 - DPF: {FFFFFFFF-CAFE-BABE-BABE-00AA0055595A} - http://www.networkso...rueSwitchEC.exe
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Dell Printer Status Watcher (DLPWD) - Dell Inc. - c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE
O23 - Service: Dell Printer Status Database (DLSDB) - Dell Inc. - c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Tmesbs32 (Tmesbs) - Unknown owner - C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe" /Service (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

[Buckeye_Sam]

Please follow these steps:

• Please make sure that you can View Hidden Files
  • Click Start -> My Computer
  • Select Tools -> Folder options
  • Select the View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled.
  • Also make sure that 'Display the contents of system folders' is checked.
  • For more info on how to show hidden files click here.
  
  
  
• Run Hijackthis again, click scan, and Put a checkmark next to each of these. Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix Checked button.
  
  
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://69.28.210.175/media/1
  O2 - BHO: (no name) - {30201634-41C8-F0FF-C6C7-EA47A5FBE127} - C:\WINDOWS\qjyxbujl.dll
  O2 - BHO: AdCom - {D7950AB4-67F5-458e-A37D-9F2DE7F250AC} - C:\WINDOWS\system32\AdCom.dll
  O4 - HKLM\..\Run: [Sysnet] C:\DOCUME~1\user\LOCALS~1\Temp\sysnet.exe
  O4 - HKLM\..\Run: [tgyidll] C:\WINDOWS\tgyidll.EXE
  O4 - HKLM\..\Run: [asubenc] C:\WINDOWS\asubenc.EXE
  O4 - HKLM\..\Run: [winsync] C:\WINDOWS\system32\uaiunu.exe reg_run
  O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
  
  
  
  
• Please reboot your computer in SafeMode by doing the following:
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
  • Instead of Windows loading as normal, a menu should appear
  • Select the first option, to run Windows in Safe Mode.
  • If you have trouble getting into Safe mode go here for more info.
  
  
  
  
• Once in Safe mode, delete these files or directories (Do not be concerned if they do not exist):
  
  
  C:\WINDOWS\qjyxbujl.dll
  C:\WINDOWS\system32\AdCom.dll
  C:\WINDOWS\tgyidll.EXE
  C:\WINDOWS\asubenc.EXE
  C:\WINDOWS\system32\uaiunu.exe
  
  
  
• Delete your temp files
  • Navigate to the C:\Windows\Temp folder.
  • Open the Temp folder
  • Select Edit -> Select All
  • Select Edit -> Delete(or press the delete button on your keyboard) to delete the entire contents of the Temp folder.
• Navigate to the C:\Windows\Prefetch folder.
  • Open the Prefetch folder
  • Select Edit -> Select All
  • Select Edit -> Delete(or press the delete button on your keyboard) to delete the entire contents of the Temp folder.
• Click Start -> Run and type %temp% in the Run box.
  
  • Select Edit -> Select All
  • Select Edit -> Delete(or press the delete button on your keyboard) to delete the entire contents of the Temp folder.
• Click Start -> Control Panel -> Internet Options.
  • Select the General tab
  • Under "Temporary Internet Files" Click "Delete Files".
  • Put a check by "Delete Offline Content" and click OK.
  • Click on the Programs tab then click the "Reset Web Settings" button.
  • Click Apply then OK.
• Empty the Recycle Bin.

Reboot your computer to go back to normal mode.


Please download WebRoot SpySweeper from HERE (It's a 2 week trial):

• Click the Free Trial link on the right - next to "SpySweeper for Home Computers" to download the program.
• Double-click the file to install it as follows:
  • Click "Next", read the agreement, Click "Next"
  • Choose "Custom" click "Next".
  • Leave the default installation directoy as it is, then click "Next".
  • UNcheck "Run SpySweeper at Windows Startup" and "Add Sweep for Spyware to Windows Explorer Context Menu". Click "Next".
  • On the following screen you can leave the e-mail address field blank, if you wish. Click "Next".
  • Finally, click "Install"
• Once the program is installed, it will open.
• It will prompt you to update to the latest definitions, click Yes.
  Disable SpySweeper Shields
  • Click Shields on the left.
  • Click Internet Explorer and uncheck all items.
  • Click Windows System and uncheck all items.
  • Click Startup Programs and uncheck all items.
• Once the definitions are installed and shields disabled, click Sweep Now on the left side.
• Click the Start button.
• When it's done scanning, click the Next button.
• Make sure everything has a check next to it, then click the Next button.
• It will remove all of the items found.
• Click Session Log in the upper right corner, copy everything in that window.
• Click the Summary tab and click Finish.
• Paste the contents of the session log you copied into your next reply.

Also post a new hijackthis log.

[globalfx]

********
9:45 PM: |··· Start of Session, Monday, October 10, 2005 ···|
9:45 PM: Spy Sweeper started
9:45 PM: Sweep initiated using definitions version 552
9:45 PM: Starting Memory Sweep
9:47 PM: Found Adware: clkoptimizer
9:47 PM: Detected running threat: C:\WINDOWS\system32\oiookon.dll (ID = 146387)
9:55 PM: Detected running threat: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\tnit.exe (ID = 146391)
9:55 PM: Memory Sweep Complete, Elapsed Time: 00:10:08
9:55 PM: Starting Registry Sweep
9:56 PM: Found Adware: mirar webband
9:56 PM: HKCR\interface\{6e4c7afc-9915-4036-b7f9-8b3f1710788f}\ (8 subtraces) (ID = 135069)
9:56 PM: HKCR\interface\{54b287f9-fd90-4457-b65e-cb91560c021d}\ (8 subtraces) (ID = 135070)
9:56 PM: HKCR\interface\{1037b06c-84b7-4240-8d80-485810a0497d}\ (8 subtraces) (ID = 135071)
9:56 PM: HKCR\interface\{224302b0-94e9-45c2-9e5b-ba989ee556e1}\ (8 subtraces) (ID = 135072)
9:56 PM: HKLM\software\classes\interface\{6e4c7afc-9915-4036-b7f9-8b3f1710788f}\ (8 subtraces) (ID = 135082)
9:56 PM: HKLM\software\classes\interface\{54b287f9-fd90-4457-b65e-cb91560c021d}\ (8 subtraces) (ID = 135083)
9:56 PM: HKLM\software\classes\interface\{1037b06c-84b7-4240-8d80-485810a0497d}\ (8 subtraces) (ID = 135084)
9:56 PM: HKLM\software\classes\interface\{224302b0-94e9-45c2-9e5b-ba989ee556e1}\ (8 subtraces) (ID = 135085)
9:56 PM: HKLM\software\classes\typelib\{566dede9-9ed8-45da-9be6-9b2eeab17f49}\ (9 subtraces) (ID = 135092)
9:56 PM: HKLM\software\classes\typelib\{f8310e7d-4c4d-46a4-a068-b5bb99411cc7}\ (9 subtraces) (ID = 135093)
9:56 PM: HKCR\typelib\{566dede9-9ed8-45da-9be6-9b2eeab17f49}\ (9 subtraces) (ID = 135121)
9:56 PM: HKCR\typelib\{f8310e7d-4c4d-46a4-a068-b5bb99411cc7}\ (9 subtraces) (ID = 135122)
9:56 PM: Found Adware: abetterinternet
9:56 PM: HKU\WRSS_Profile_S-1-5-21-3973020173-473866232-3689853989-500\software\aurora\ (18 subtraces) (ID = 360174)
9:56 PM: Found Trojan Horse: sysnet
9:56 PM: HKLM\software\microsoft\windows\currentversion\uninstall\sysnet\ (2 subtraces) (ID = 381857)
9:56 PM: HKLM\software\microsoft\windows\currentversion\run\ || winsync (ID = 601545)
9:56 PM: Registry Sweep Complete, Elapsed Time:00:00:43
9:56 PM: Starting Cookie Sweep
9:56 PM: Found Spy Cookie: atlas dmt cookie
9:56 PM: user@atdmt[2].txt (ID = 2253)
9:56 PM: Found Spy Cookie: webtrendslive cookie
9:56 PM: user@dcslt9a2911e5h27gz9cy9xcg_5f1j[1].txt (ID = 3677)
9:56 PM: Found Spy Cookie: did-it cookie
9:56 PM: user@did-it[1].txt (ID = 2523)
9:56 PM: Found Spy Cookie: maxserving cookie
9:56 PM: user@maxserving[2].txt (ID = 2966)
9:56 PM: Found Spy Cookie: realmedia cookie
9:56 PM: user@realmedia[1].txt (ID = 3235)
9:56 PM: Cookie Sweep Complete, Elapsed Time: 00:00:01
9:56 PM: Starting File Sweep
9:56 PM: c:\program files\asys (ID = -2147477847)
9:56 PM: c:\program files\epicenter (1 subtraces) (ID = -2147477846)
9:57 PM: Found Adware: enbrowser
9:57 PM: linun.exe (ID = 60121)
9:57 PM: snuninst.exe (ID = 110129)
9:57 PM: Found Adware: cws_ns3
9:57 PM: estyw.log (ID = 56601)
9:58 PM: zapotec.bmp:tgdyqg (ID = 56601)
9:58 PM: oiookon.dll (ID = 146387)
9:59 PM: vpkvq.dat (ID = 146391)
10:00 PM: tnit.exe (ID = 146391)
10:01 PM: lfwlg.dll (ID = 146381)
10:01 PM: obmocoq.exe (ID = 146385)
10:01 PM: uaiunu.exe (ID = 146391)
10:01 PM: Found Adware: bookedspace
10:01 PM: iltgqcuzo.bus (ID = 158998)
10:01 PM: lifvbjgsv.uvb (ID = 159013)
10:01 PM: zsyswsvd.psz (ID = 159017)
10:01 PM: qlwfqzgo.lje (ID = 159027)
10:01 PM: zrcmokja.eru (ID = 158991)
10:01 PM: oeymknmirf.hxn (ID = 159005)
10:01 PM: iwwnyercz.dei (ID = 159030)
10:01 PM: udckakcff.oex (ID = 159004)
10:01 PM: oqtudrr.hyg (ID = 159003)
10:01 PM: vwqzkoc.vxl (ID = 158995)
10:01 PM: brfgqzitbew.dct (ID = 159037)
10:01 PM: iauprgarnlp.ntf (ID = 159016)
10:01 PM: xtnfmsqda.yzg (ID = 158988)
10:01 PM: kzwqffamj.urs (ID = 159047)
10:01 PM: kvcufhdo.gwj (ID = 159045)
10:01 PM: tforobonaz.usw (ID = 159060)
10:01 PM: wxxofubyktu.ths (ID = 158986)
10:01 PM: hplpwjaiz.xxy (ID = 159024)
10:01 PM: hbgedobxyy.bji (ID = 159019)
10:01 PM: magsspbuvh.nhc (ID = 159056)
10:01 PM: lsibhxywyfv.xkr (ID = 159014)
10:01 PM: ujplsvqtkg.tps (ID = 159058)
10:01 PM: jsblhzvufg.lsf (ID = 159053)
10:01 PM: ignktgkm.ksd (ID = 159028)
10:01 PM: lwdueiy.ktt (ID = 159061)
10:01 PM: hpyhwbwj.haw (ID = 159025)
10:01 PM: yfvsfcg.vus (ID = 159026)
10:01 PM: sdvjxrsg.bez (ID = 159018)
10:01 PM: gdsauvsfwe.lnl (ID = 158994)
10:01 PM: owcoqitt.blt (ID = 159031)
10:01 PM: wcwzkjhmux.cgh (ID = 159035)
10:01 PM: mgqlcwwfp.jml (ID = 158987)
10:01 PM: glfupben.eby (ID = 159052)
10:01 PM: eoeqkewepoe.ukj (ID = 159038)
10:01 PM: tvrdafqth.jcj (ID = 159001)
10:01 PM: ypgzfagbfa.pud (ID = 159051)
10:01 PM: qztpugebul.gkd (ID = 158990)
10:01 PM: mvfcspijkz.anm (ID = 159029)
10:01 PM: osyjyjmsfbw.dnp (ID = 159010)
10:01 PM: tkqemceay.irz (ID = 159015)
10:01 PM: llsxdtqb.ury (ID = 159046)
10:01 PM: erfmfbvmegs.ioo (ID = 159059)
10:01 PM: scnagzhods.gzj (ID = 159023)
10:01 PM: bbytgqapvzh.lbn (ID = 158997)
10:01 PM: slhoilj.qqt (ID = 159020)
10:01 PM: rdqicwhstot.xyv (ID = 159037)
10:01 PM: otulcikbpmw.pzu (ID = 159016)
10:01 PM: pcmtkut.lmb (ID = 159021)
10:01 PM: rkgmobtmlb.fwp (ID = 158999)
10:01 PM: mejgotug.say (ID = 159054)
10:01 PM: mvkweaxrgzo.hsk (ID = 158988)
10:01 PM: abkomgmh.tsv (ID = 158996)
10:01 PM: cbzheemkbv.pqk (ID = 159047)
10:01 PM: kyqqdmi.gkt (ID = 159045)
10:01 PM: knafslcatl.kfe (ID = 159060)
10:01 PM: ugzealbuplr.lxr (ID = 158986)
10:01 PM: umeyncgv.hsv (ID = 159006)
10:01 PM: aklkabvnpzp.wrt (ID = 159024)
10:01 PM: updgdwpn.zyu (ID = 159019)
10:01 PM: ctzwamv.xdi (ID = 159007)
10:01 PM: yajcrcqv.ajc (ID = 159056)
10:01 PM: mqdmnwkr.mar (ID = 159014)
10:01 PM: kqnbejeodd.knp (ID = 159058)
10:01 PM: oqjoptiht.ddd (ID = 159053)
10:01 PM: wnhmhclxd.tee (ID = 158993)
10:01 PM: ywruohfyqlo.lgf (ID = 159022)
10:01 PM: hmowiwwbx.nuy (ID = 159050)
10:01 PM: ywnjcbp.abz (ID = 159028)
10:01 PM: nkslevcg.ocd (ID = 159061)
10:01 PM: omkjjfa.hhi (ID = 158985)
10:01 PM: adizefvcf.rkc (ID = 159012)
10:01 PM: ceacbdnwaq.jfm (ID = 159025)
10:01 PM: sycykcwes.bso (ID = 159039)
10:01 PM: zxrnjkh.ylh (ID = 159026)
10:01 PM: qrzshopo.jiv (ID = 159018)
10:01 PM: govqgfjpx.tks (ID = 158994)
10:01 PM: uvfyfetua.lpi (ID = 159009)
10:01 PM: zezsikze.nhf (ID = 159031)
10:01 PM: lbbyocoe.fky (ID = 159035)
10:01 PM: ijnlarmylsm.haj (ID = 158987)
10:01 PM: feivuxeq.zwr (ID = 159052)
10:01 PM: jbtnycpbwcq.dzr (ID = 159038)
10:01 PM: jntnqjx.gzl (ID = 159001)
10:01 PM: ezynsfcrq.cdm (ID = 159051)
10:01 PM: pdmjehsue.udg (ID = 159011)
10:01 PM: bogaheuu.jva (ID = 158990)
10:01 PM: sedsersyf.qql (ID = 159029)
10:01 PM: qbvgxcpky.sow (ID = 159010)
10:01 PM: nvsxphxdtr.ekt (ID = 159015)
10:01 PM: nmsjxhvebx.omq (ID = 159046)
10:01 PM: ojcznljkpb.yxx (ID = 159059)
10:01 PM: dmuwrcvyy.quq (ID = 159023)
10:01 PM: khqdlmk.xwr (ID = 159033)
10:01 PM: cxrgixm.lpj (ID = 158997)
10:01 PM: winnb57.dll.tcf (ID = 159067)
10:01 PM: 876056.exe (ID = 158984)
10:01 PM: xjcxssvq.ldd (ID = 158998)
10:01 PM: amdwrobraw.fny (ID = 159040)
10:01 PM: kgpwnvc.lva (ID = 159013)
10:01 PM: vvkpkwby.epx (ID = 159017)
10:01 PM: jokudnizt.lgn (ID = 159027)
10:01 PM: oldmrxegj.rry (ID = 158991)
10:01 PM: uxgfrkulvxu.gqs (ID = 159005)
10:01 PM: rzrgvvy.hur (ID = 159030)
10:01 PM: dspacfxlhpv.uuv (ID = 159004)
10:01 PM: ddechtrh.xvq (ID = 159003)
10:01 PM: gvivhejgd.hna (ID = 158995)
10:01 PM: hhxchcwgdza.cvy (ID = 159020)
10:01 PM: pifaevnfdke.nkl (ID = 159037)
10:01 PM: zcbxpqu.inq (ID = 159016)
10:01 PM: vvbjinw.ssh (ID = 158988)
10:01 PM: coqgwkcabio.cgq (ID = 159047)
10:01 PM: zcmazeclglk.smh (ID = 159045)
10:01 PM: ineqtexuhy.ahx (ID = 159060)
10:01 PM: lvushhhs.wad (ID = 158986)
10:01 PM: sdtkwleiwp.ebf (ID = 159024)
10:01 PM: acojltnehx.bsb (ID = 159019)
10:01 PM: pjpwpdh.jen (ID = 159056)
10:01 PM: elvjasduuy.pjd (ID = 159014)
10:01 PM: sfcwuyggr.iow (ID = 159058)
10:01 PM: bzxrioei.coj (ID = 159053)
10:01 PM: ymajntazc.rwu (ID = 159028)
10:01 PM: exgzlgzeb.amq (ID = 159061)
10:01 PM: jpbdotddtb.wsf (ID = 159012)
10:01 PM: cnboxotj.xjc (ID = 159025)
10:01 PM: aobrlcuvgr.znc (ID = 159026)
10:01 PM: roilfmmpvd.rkc (ID = 159018)
10:01 PM: munlfgmx.fef (ID = 158994)
10:01 PM: xiymyorj.pbe (ID = 159031)
10:01 PM: bdzokvg.jue (ID = 159035)
10:01 PM: dnhpqaes.bav (ID = 158987)
10:01 PM: biddvts.jlt (ID = 159052)
10:01 PM: vrmokzlo.jld (ID = 159038)
10:01 PM: sgyldwoy.umh (ID = 159001)
10:01 PM: xaxruwficx.esb (ID = 159051)
10:01 PM: sgsdlso.vxf (ID = 158990)
10:01 PM: bmuufzua.lkv (ID = 159029)
10:01 PM: foxrqjufsrt.yiy (ID = 159010)
10:01 PM: pzbtqal.ovl (ID = 159015)
10:01 PM: pkqcyil.bar (ID = 159046)
10:01 PM: zngtvdvz.zmw (ID = 159059)
10:01 PM: vcgfnhuxnb.hoj (ID = 159023)
10:01 PM: hufdxypr.ztq (ID = 158997)
10:01 PM: cmehdeopfo.lul (ID = 158998)
10:01 PM: bbbjiqmt.qxf (ID = 159002)
10:01 PM: npcctzie.tzx (ID = 159040)
10:01 PM: venbdqrhc.lfz (ID = 158992)
10:01 PM: gbkvxfpyygw.xdb (ID = 159013)
10:01 PM: mryogxta.kpb (ID = 159017)
10:01 PM: exdhgcuocjw.wkx (ID = 159027)
10:01 PM: mtorhppk.zqy (ID = 158991)
10:01 PM: dugbufc.yoi (ID = 159055)
10:01 PM: kiysnxoknae.irt (ID = 159005)
10:01 PM: fnapeisofil.rdn (ID = 159030)
10:01 PM: xkdtlsagxlh.ohx (ID = 159004)
10:01 PM: aakfyhmgd.uvi (ID = 159003)
10:01 PM: ydgpoom.mbo (ID = 158995)
10:02 PM: Found Adware: surfsidekick
10:02 PM: sskcwrd.dll (ID = 77712)
10:02 PM: vckapkirx.yoj (ID = 159040)
10:02 PM: vhdbdlqmn.lsq (ID = 159012)
10:02 PM: vkcsbkjkmt.dih (ID = 159020)
10:02 PM: uninstall_wh.exe (ID = 60133)
10:02 PM: Found Adware: mindset interactive - favoriteman
10:02 PM: bundle_101.inf (ID = 69821)
10:02 PM: File Sweep Complete, Elapsed Time: 00:05:45
10:02 PM: Full Sweep has completed. Elapsed time 00:16:48
10:02 PM: Traces Found: 318
12:04 AM: Removal process initiated
12:04 AM: Quarantining All Traces: clkoptimizer
12:04 AM: clkoptimizer is in use. It will be removed on reboot.
12:04 AM: oiookon.dll is in use. It will be removed on reboot.
12:04 AM: C:\WINDOWS\system32\oiookon.dll is in use. It will be removed on reboot.
12:04 AM: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\tnit.exe is in use. It will be removed on reboot.
12:04 AM: Quarantining All Traces: mirar webband
12:04 AM: Quarantining All Traces: abetterinternet
12:04 AM: Quarantining All Traces: sysnet
12:04 AM: Quarantining All Traces: atlas dmt cookie
12:04 AM: Quarantining All Traces: webtrendslive cookie
12:04 AM: Quarantining All Traces: did-it cookie
12:04 AM: Quarantining All Traces: maxserving cookie
12:04 AM: Quarantining All Traces: realmedia cookie
12:04 AM: Quarantining All Traces: enbrowser
12:04 AM: Quarantining All Traces: cws_ns3
12:04 AM: Quarantining All Traces: bookedspace
12:05 AM: Quarantining All Traces: surfsidekick
12:05 AM: Quarantining All Traces: mindset interactive - favoriteman
12:06 AM: Preparing to restart your computer. Please wait...
12:06 AM: Removal process completed. Elapsed time 00:02:44
12:13 AM: Deletion from quarantine initiated
12:13 AM: Processing: realmedia cookie
12:13 AM: Processing: sysnet
12:13 AM: Processing: clkoptimizer
12:13 AM: Processing: abetterinternet
12:13 AM: Processing: cws_ns3
12:13 AM: Processing: did-it cookie
12:13 AM: Processing: enbrowser
12:13 AM: Processing: bookedspace
12:13 AM: Processing: maxserving cookie
12:13 AM: Processing: mindset interactive - favoriteman
12:13 AM: Processing: mirar webband
12:13 AM: Processing: webtrendslive cookie
12:13 AM: Processing: surfsidekick
12:13 AM: Processing: atlas dmt cookie
12:13 AM: Deletion from quarantine completed. Elapsed time 00:00:02
********
9:31 PM: |··· Start of Session, Monday, October 10, 2005 ···|
9:31 PM: Spy Sweeper started
9:31 PM: Sweep initiated using definitions version 552
9:31 PM: Starting Memory Sweep
********
9:30 PM: |··· Start of Session, Monday, October 10, 2005 ···|
9:30 PM: Spy Sweeper started
9:31 PM: |··· End of Session, Monday, October 10, 2005 ···|


Logfile of HijackThis v1.99.1
Scan saved at 12:20:08 AM, on 10/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\brss01a.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\System32\00THotkey.exe
C:\WINDOWS\system32\TFNF5.exe
C:\WINDOWS\system32\TPWRTRAY.EXE
C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\WINDOWS\system32\TDispVol.exe
C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE
C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
C:\toshiba\ivp\ism\pinger.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Synaptics\SynTP\CPad\cPadFstR.Exe
C:\Program Files\Synaptics\SynTP\cPad\AlarmWatcher.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Norton Password Manager\AcctMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\SPYWAR~1\swdoctor.exe
C:\Program Files\D-Link AirPlus Xtreme G\AirPlus.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\GeeksToGo\Hijackthis\HijackThis.exe

F2 - REG:system.ini: Shell=Explorer.exe
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY.EXE
O4 - HKLM\..\Run: [TosHKCW.exe] "C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe"
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe /Type 03
O4 - HKLM\..\Run: [TDispVol] TDispVol.exe
O4 - HKLM\..\Run: [TMESBS.EXE] C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE /Client
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [cPadFstR] C:\Program Files\Synaptics\SynTP\CPad\cPadFstR.Exe
O4 - HKLM\..\Run: [cPadAlarm] C:\Program Files\Synaptics\SynTP\cPad\AlarmWatcher.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [DLPSP] "c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE"
O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Spyware Doctor] C:\PROGRA~1\SPYWAR~1\swdoctor.exe /Q
O4 - Global Startup: D-Link AirPlus Xtreme G Configuration Utility.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar3.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar3.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar3.dll/cmtrans.html
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra 'Tools' menuitem: Launch Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: (no name) - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra 'Tools' menuitem: Java - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zone.../ICSScanner.cab
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - http://a248.e.akamai...ol/SymDlBrg.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://upload.smugmu...vex/XUpload.ocx
O16 - DPF: {FFFFFFFF-CAFE-BABE-BABE-00AA0055595A} - http://www.networkso...rueSwitchEC.exe
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Dell Printer Status Watcher (DLPWD) - Dell Inc. - c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE
O23 - Service: Dell Printer Status Database (DLSDB) - Dell Inc. - c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Tmesbs32 (Tmesbs) - Unknown owner - C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe" /Service (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Logfile of HijackThis v1.99.1
Scan saved at 12:20:08 AM, on 10/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\brss01a.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\System32\00THotkey.exe
C:\WINDOWS\system32\TFNF5.exe
C:\WINDOWS\system32\TPWRTRAY.EXE
C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\WINDOWS\system32\TDispVol.exe
C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE
C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
C:\toshiba\ivp\ism\pinger.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Synaptics\SynTP\CPad\cPadFstR.Exe
C:\Program Files\Synaptics\SynTP\cPad\AlarmWatcher.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Norton Password Manager\AcctMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\SPYWAR~1\swdoctor.exe
C:\Program Files\D-Link AirPlus Xtreme G\AirPlus.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\GeeksToGo\Hijackthis\HijackThis.exe

F2 - REG:system.ini: Shell=Explorer.exe
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY.EXE
O4 - HKLM\..\Run: [TosHKCW.exe] "C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe"
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe /Type 03
O4 - HKLM\..\Run: [TDispVol] TDispVol.exe
O4 - HKLM\..\Run: [TMESBS.EXE] C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE /Client
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [cPadFstR] C:\Program Files\Synaptics\SynTP\CPad\cPadFstR.Exe
O4 - HKLM\..\Run: [cPadAlarm] C:\Program Files\Synaptics\SynTP\cPad\AlarmWatcher.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [DLPSP] "c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE"
O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Spyware Doctor] C:\PROGRA~1\SPYWAR~1\swdoctor.exe /Q
O4 - Global Startup: D-Link AirPlus Xtreme G Configuration Utility.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar3.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar3.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar3.dll/cmtrans.html
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra 'Tools' menuitem: Launch Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: (no name) - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra 'Tools' menuitem: Java - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zone.../ICSScanner.cab
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - http://a248.e.akamai...ol/SymDlBrg.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://upload.smugmu...vex/XUpload.ocx
O16 - DPF: {FFFFFFFF-CAFE-BABE-BABE-00AA0055595A} - http://www.networkso...rueSwitchEC.exe
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Dell Printer Status Watcher (DLPWD) - Dell Inc. - c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE
O23 - Service: Dell Printer Status Database (DLSDB) - Dell Inc. - c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Tmesbs32 (Tmesbs) - Unknown owner - C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe" /Service (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

[Buckeye_Sam]

Download WindPFind

Extract WinPFind.zip to your c:\ folder.

Reboot your computer into Safe Mode

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
• Instead of Windows loading as normal, a menu should appear
• Select the first option, to run Windows in Safe Mode.

* if you have trouble getting into Safe mode go here for more info.


Then open c:\WinPFind and double-click on WinPFind.exe.
When the program is open, click on the Start Scan button to start scanning your computer. Be patient as this scan may take a while.
When it is done, it will show a log and tell you the scan is completed. Reboot your computer back to normal mode and and post the contents of c:\WinPFind\WinPFind.txt as a reply to this topic.

[globalfx]

WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding.

If you see a message in the titlebar saying "Not responding..." you can ignore it. Windows somethimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly.

»»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Product Name: Microsoft Windows XP Current Build: Service Pack 2 Current Build Number: 2600
Internet Explorer Version: 6.0.2900.2180

»»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»»

Checking %SystemDrive% folder...

Checking %ProgramFilesDir% folder...

Checking %WinDir% folder...
web-nex 8/4/2005 8:19:50 PM 4117 C:\WINDOWS\kjzka.dll
abetterinternet.com 8/4/2005 10:09:16 AM 3639 C:\WINDOWS\lu.dat

Checking %System% folder...
PEC2 8/18/2001 5:00:00 AM 41397 C:\WINDOWS\SYSTEM32\dfrg.msc
UPX! 1/13/2005 9:41:48 PM 11254 C:\WINDOWS\SYSTEM32\locate.com
PECompact2 9/8/2005 8:08:28 PM 1997664 C:\WINDOWS\SYSTEM32\MRT.exe
aspack 9/8/2005 8:08:28 PM 1997664 C:\WINDOWS\SYSTEM32\MRT.exe
aspack 8/4/2004 12:56:36 AM 708096 C:\WINDOWS\SYSTEM32\ntdll.dll
Umonitor 8/4/2004 12:56:44 AM 657920 C:\WINDOWS\SYSTEM32\rasdlg.dll
UPX! 1/20/2005 1:47:50 PM 175616 C:\WINDOWS\SYSTEM32\strings.exe
winsync 8/18/2001 5:00:00 AM 1309184 C:\WINDOWS\SYSTEM32\wbdbase.deu

Checking %System%\Drivers folder and sub-folders...
PTech 8/3/2004 10:41:38 PM 1309184 C:\WINDOWS\SYSTEM32\drivers\mtlstrm.sys

Items found in C:\WINDOWS\SYSTEM32\drivers\etc\hosts


Checking the Windows folder and sub-folders for system and hidden files within the last 60 days...
10/11/2005 10:36:08 AM S 2048 C:\WINDOWS\bootstat.dat
10/10/2005 8:23:34 PM H 54156 C:\WINDOWS\QTFont.qfn
10/7/2005 12:32:10 PM HS 8192 C:\WINDOWS\Thumbs.db
10/11/2005 10:16:02 AM H 31762 C:\WINDOWS\system32\vsconfig.xml
8/26/2005 8:53:04 AM H 4212 C:\WINDOWS\system32\zllictbl.dat
10/11/2005 10:35:56 AM H 8192 C:\WINDOWS\system32\config\default.LOG
10/11/2005 10:36:40 AM H 1024 C:\WINDOWS\system32\config\SAM.LOG
10/11/2005 10:36:10 AM H 16384 C:\WINDOWS\system32\config\SECURITY.LOG
10/11/2005 10:36:42 AM H 69632 C:\WINDOWS\system32\config\software.LOG
10/11/2005 10:36:42 AM H 28672 C:\WINDOWS\system32\config\system.LOG
9/23/2005 5:46:06 PM H 1024 C:\WINDOWS\system32\config\systemprofile\NTUSER.DAT.LOG
9/2/2005 4:23:58 PM HS 388 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\User\f13e9be8-c2a7-4a39-b41a-ddb606ad600c
9/2/2005 4:23:58 PM HS 24 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\User\Preferred
10/11/2005 10:34:56 AM H 6 C:\WINDOWS\Tasks\SA.DAT
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS0DE2FD5F-8470-47C0-A913-1F575DE30825.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS0DE90E39-A602-4F1E-BF9A-CC08296048C8.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS0E60F8CA-5F24-48DB-B00A-7D5F251915BD.tmp
10/10/2005 9:31:50 PM H 0 C:\WINDOWS\Temp\CS1103C488-154C-4069-98B0-3D667C635F16.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS135C4E22-FE6A-4B73-A411-93BCF8645566.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS151EF10A-8072-4D90-8C4C-A1E0BC84DCBE.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS16440135-6841-47DD-B9CE-EA550F8EBF11.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS1B94E80E-F403-47D4-B1CC-0D930A1B2C0F.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS1C0A6BA8-501B-4995-AA72-4132184E6754.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS1C85B38F-ABEF-41A1-B7F1-6F986F44A48C.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS1CE6F269-615B-46BB-91AD-EA1533D55DAC.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS1DB9157A-CCC3-484C-B6E2-13E2511F7B4D.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS24B7A62F-5B57-4216-ABB4-5B675C94FA7C.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS2811E3BB-CB33-4AAC-857F-3EE4F7EC6C1B.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS288A89B8-DA04-4F13-8855-1B740E17F210.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS29D15914-49F8-44F2-AB67-D11D03B5A1F6.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS2A302499-5F70-4FDE-A914-F46E225B282F.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS2B5D3E40-9017-4457-8D83-BADE8959077D.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS2C5E682E-ABF1-4D56-9B5F-E5ED43AA8669.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS2DB9E396-94B1-4F5D-B9E4-C756C365835D.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS2E12E3E7-F55B-4C71-BEED-2830E2D0F7BD.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS2E686AC6-FABE-4BD3-9553-7B27A4435FCC.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS31B6EF62-62D6-4D5E-A3B7-205CB503CEC3.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS333EFEAE-F01C-468A-9AC9-064B4311975B.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS34EEAAC6-46E8-4DB8-A7DF-FB2B6716C3F6.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS3D0A6BFC-EA0D-4503-8125-F3BD1C1DDCF2.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS3EE929DB-88FA-40DF-A991-1D22FE1D5321.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS3F595716-7A50-459A-A88A-97478DA6D5A4.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS40E06A6E-CE4E-4A7F-9BDB-00F3FEEC1B92.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS410C77E9-ACBC-460E-AD9C-11EAF2EC8632.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS4250A4C3-973C-4255-9304-AAAD6731DF11.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS45267A17-F5AF-4A1A-9E09-4D0B18B04F37.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS47E9C388-A7A0-4439-88FF-64CDCA927CD0.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS4A08E8D4-DE1F-4721-B0B9-8E97797DE584.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS4B33B4C5-F2B8-44FA-9199-595A631030E9.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS516D0A10-AFDE-43DF-B08D-FDFE6C044065.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS55B621DA-CECE-46FB-8E91-CAB01E7C9355.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS56DC0C66-F670-4E62-834B-4C802A57A497.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS594B1EFF-7DED-4CE2-8B57-4568B1C7DA3D.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS5AEF2634-8F40-4F0F-94FD-A4EC0E6FC0B6.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS5C407B36-4D77-4704-BAE0-EB9DC505F5FB.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS60ACD741-7CE8-4937-8254-25CE8DBCB378.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS6157729D-739B-45BC-B0BD-8F23857FD2C7.tmp
10/10/2005 9:31:52 PM H 0 C:\WINDOWS\Temp\CS62D4105A-81F0-41D1-B3B8-265A6B0611C1.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS63286D32-C8F2-4CC0-B3A8-287BCB915FFC.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS63E29D61-E69A-4234-B966-29177FAE579E.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS668EB725-E247-4B15-AA61-75C3A98035BF.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS6E499D8C-C661-4250-B691-4C5B2C3F5BE9.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS6FDFEF2A-DEBB-4012-B5D7-91C03E63AB77.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS7216D819-FF4D-423C-BEE5-DDC7087F0725.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS738E25D8-D267-487C-81A1-3D6C3A0DAE20.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS73C22FB5-DD5A-4D5B-BAD9-FC59151DE1BD.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS7FAA03C6-0AE2-4627-94F6-856C7E3F2A0E.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS7FC1DFEC-FB00-4D1A-9897-62E0EECE1925.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS8BA2218C-6B26-484D-8147-8418DD7AFF4F.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS8CDA56C3-CD2A-4895-9F35-AF3B3950F0CE.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS8D1EFC96-08BC-4B09-8F10-735B5AA3FC7F.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS8DFEAD09-FC30-4D16-9BE4-6687C38214FF.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS95CE9408-3068-4A5B-BBEE-9BFF611FA7AA.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS97A3DE9E-47D0-4E78-9D8F-6F4DFE23D28B.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS9DE3A578-8023-4DA9-B25C-7BAB233097BA.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CSA4579932-4D35-40E6-BD52-D9EF4C0ECE43.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSA68BB761-E27D-4E9A-90A0-8AFC2A83A3E7.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSAA2FD060-B26E-46E9-B991-5E9AA1ABD270.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CSAD7A3541-1CF8-449E-B3A6-CB6D97DDC3D0.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CSB22AF5C3-3BD1-4D2B-AF49-7219E1EEF0CE.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSB5349555-C3A4-43FB-88CF-F8DF6C8676E8.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSB86457AE-3056-4604-8DC9-F16AC3AAF00A.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSB9F952BE-ADB5-49B4-855C-DF6CE77EE3EF.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CSBD89B8C7-6C78-4EE0-8BFA-0B0D63D34261.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSC105EBC6-894D-4510-A8B8-F1DF613AAE6B.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CSC178003A-E437-4C2E-B57C-72BE15647F42.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSC50CB547-71CD-463F-BEDA-4E3689EF5647.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSC68C7FB9-A0B3-4180-B22D-0B5E2C8D2C5B.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSC81E169B-7840-410D-9678-415AB444EBEB.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSC9214889-CA89-44BB-AD32-D1F8D6B72C53.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSD2B83BE5-D6A7-486B-B45B-9D5982F16D3E.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSD3730E34-EBBC-4DAD-9D9E-016C5713C7E2.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CSD6E5B6E6-9E33-4172-A792-B88BF7CF2A48.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSD8F53EA0-0FFD-4FF1-81C9-4A0AE32425EF.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSDB9CC2E9-1557-45B8-A3CA-B34EB2FCC671.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSDF3C3681-F55C-4E1C-A53D-056C9C3A31B8.tmp
10/10/2005 9:31:36 PM H 0 C:\WINDOWS\Temp\CSE0F5B364-6276-46C0-853C-CE612F85D56C.tmp
10/10/2005 9:31:38 PM H 532 C:\WINDOWS\Temp\CSE26C88D4-3F6B-40FF-BE3C-CE549ED9D2EB.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSE433DB18-D8AA-4547-963D-50A947D0AE95.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSE50AE194-048C-4DEA-832A-11A3620BA802.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSE5F8C9CA-423C-4CEF-9450-29C41A83A096.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSE8196CB5-1005-48C2-9EEF-8BBB60D42EA6.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CSE9015EC3-38DE-4D66-BCC6-6976BBC115D0.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSE915B5D5-5A94-404E-8E54-814E9F35C396.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CSEBA774CE-EE75-435B-8702-9687C7034736.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSEFF76EB7-A7A5-48AC-B70B-918D3B361B6C.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSF0B8DB9E-E600-469B-A47E-65D8AC9AA1AB.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CSF2EE607B-3E11-46C9-AB77-25FD720F2537.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CSF4C4EB31-FBB3-45EF-AC9F-CF69C7B7F9AB.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CSF562BB12-2EEC-456E-AB04-4926F96F1751.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSF6B13BAE-A97B-4FA3-B00F-8FA7E3D68306.tmp
10/10/2005 9:31:48 PM H 0 C:\WINDOWS\Temp\CSF96C987F-7157-4C36-B966-ACE27469E9F0.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSFAC0921A-9857-4D5E-AF15-48113F412421.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSFECE0FA2-EDAE-47AF-9C01-8FEACF38267D.tmp
10/10/2005 9:31:52 PM H 0 C:\WINDOWS\Temp\CSFF296528-C704-4EC9-A9DB-98E141DDF53B.tmp

Checking for CPL files...
Microsoft Corporation 8/4/2004 12:56:58 AM 68608 C:\WINDOWS\SYSTEM32\access.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 549888 C:\WINDOWS\SYSTEM32\appwiz.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 110592 C:\WINDOWS\SYSTEM32\bthprops.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 135168 C:\WINDOWS\SYSTEM32\desk.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 80384 C:\WINDOWS\SYSTEM32\firewall.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 155136 C:\WINDOWS\SYSTEM32\hdwwiz.cpl
TOSHIBA Corp. 8/1/2002 2:49:42 PM 438272 C:\WINDOWS\SYSTEM32\HWSETUP.CPL
Microsoft Corporation 8/4/2004 12:56:58 AM 358400 C:\WINDOWS\SYSTEM32\inetcpl.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 129536 C:\WINDOWS\SYSTEM32\intl.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 380416 C:\WINDOWS\SYSTEM32\irprops.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 68608 C:\WINDOWS\SYSTEM32\joy.cpl
TOSHIBA CORPORATION 6/12/2002 10:48:06 PM 57344 C:\WINDOWS\SYSTEM32\LocalCOM.cpl
Microsoft Corporation 8/18/2001 5:00:00 AM 187904 C:\WINDOWS\SYSTEM32\main.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 618496 C:\WINDOWS\SYSTEM32\mmsys.cpl
Microsoft Corporation 8/18/2001 5:00:00 AM 35840 C:\WINDOWS\SYSTEM32\ncpa.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 25600 C:\WINDOWS\SYSTEM32\netsetup.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 257024 C:\WINDOWS\SYSTEM32\nusrmgr.cpl
NVIDIA Corporation 8/15/2002 1:14:00 PM 180224 C:\WINDOWS\SYSTEM32\nvtuicpl.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 32768 C:\WINDOWS\SYSTEM32\odbccp32.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 114688 C:\WINDOWS\SYSTEM32\powercfg.cpl
RealNetworks, Inc. 7/25/2002 1:10:02 PM 24576 C:\WINDOWS\SYSTEM32\prefscpl.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 298496 C:\WINDOWS\SYSTEM32\sysdm.cpl
Microsoft Corporation 8/18/2001 5:00:00 AM 28160 C:\WINDOWS\SYSTEM32\telephon.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 94208 C:\WINDOWS\SYSTEM32\timedate.cpl
TOSHIBA Corp. 7/30/2002 4:33:52 PM 167936 C:\WINDOWS\SYSTEM32\tmeprop.cpl
TOSHIBA Corporation 6/10/2002 2:11:24 PM 876544 C:\WINDOWS\SYSTEM32\TPWRSAVE.CPL
Microsoft Corporation 8/4/2004 12:56:58 AM 148480 C:\WINDOWS\SYSTEM32\wscui.cpl
Microsoft Corporation 5/26/2005 4:16:30 AM 174360 C:\WINDOWS\SYSTEM32\wuaucpl.cpl
YAMAHA CORPORATION 7/24/2002 4:42:34 PM 249856 C:\WINDOWS\SYSTEM32\yacxgc.cpl

»»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»»

Checking files in %ALLUSERSPROFILE%\Startup folder...
7/23/2002 4:47:08 PM HS 84 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini
1/31/2000 10:16:18 PM 533 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\D-Link AirPlus Xtreme G Configuration Utility.lnk
1/30/2000 2:32:28 PM 1730 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk

Checking files in %ALLUSERSPROFILE%\Application Data folder...
7/23/2002 9:37:58 AM HS 62 C:\Documents and Settings\All Users\Application Data\desktop.ini

Checking files in %USERPROFILE%\Startup folder...
7/23/2002 4:47:08 PM HS 84 C:\Documents and Settings\user\Start Menu\Programs\Startup\desktop.ini

Checking files in %USERPROFILE%\Application Data folder...
7/23/2002 9:37:58 AM HS 62 C:\Documents and Settings\user\Application Data\desktop.ini
12/25/2004 11:50:20 PM 65536 C:\Documents and Settings\user\Application Data\GDIPFONTCACHEV1.DAT

»»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»»

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
=

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
{9F967EE1-E89A-4093-8961-18992F41E4AA} = C:\WINDOWS\system32\rhpwsx.dll
{367FE58C-225C-4258-A95E-60DAC7E73014} = C:\WINDOWS\system32\situpdll.dll
{D1519FB5-A094-4842-98A2-BEDDB9B8C215} = C:\WINDOWS\system32\dycdll.dll
{72B88834-1477-4D00-923C-6EF15FAEBFF4} = C:\WINDOWS\system32\dhskcopy.dll
{391A0BBB-9C48-49BB-85B0-CE4929DD0B4E} = C:\WINDOWS\system32\lecdll.dll
{8F0C9419-365B-4B3F-87D4-927A0CFB8C9A} = C:\WINDOWS\system32\srlgntfy.dll

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

[HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers]
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\ewido
{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E} = C:\Program Files\ewido\security suite\context.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files
{750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With
{09799AFB-AD67-11d1-ABCD-00C04FC30936} = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu
{A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\qfxqgqkg
{87a46993-982e-4dcc-bba7-a09cc469a809} = C:\WINDOWS\system32\lfwlg.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu
{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} = C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\TrojanHunter
{EBDF1F20-C829-11D1-8233-FF20AF3E97A9} = C:\PROGRA~1\TROJAN~1.2\contmenu.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}
Start Menu Pin = %SystemRoot%\system32\SHELL32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu
{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} = C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\TrojanHunter
{EBDF1F20-C829-11D1-8233-FF20AF3E97A9} = C:\PROGRA~1\TROJAN~1.2\contmenu.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EncryptionMenu
{A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ewido
{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E} = C:\Program Files\ewido\security suite\context.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Offline Files
{750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Sharing
{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = ntshrui.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\TrojanHunter
{EBDF1F20-C829-11D1-8233-FF20AF3E97A9} = C:\PROGRA~1\TROJAN~1.2\contmenu.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE}
= %SystemRoot%\system32\SHELL32.dll

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB}
PCTools Site Guard = C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}
Google Toolbar Helper = c:\program files\google\googletoolbar3.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B56A7D7D-6927-48C8-A975-17DF180C71AC}
PCTools Browser Monitor = C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}
&Tip of the Day = %SystemRoot%\System32\shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{6F480F82-C3A6-4D35-96F7-B297AD49FBE8}
Copernic Agent Results = C:\Program Files\Copernic Agent\CopernicAgentExt.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{F2E259E8-0FC8-438C-A6E0-342DD80FA53E}
Copernic Agent = C:\Program Files\Copernic Agent\CopernicAgentExt.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{FE54FA40-D68C-11d2-98FA-00C0F0318AFE}
Real.com = C:\WINDOWS\System32\Shdocvw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} = &Google : c:\program files\google\googletoolbar3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{193B17B0-7C9F-4D5B-AEAB-8D3605EFC084}
MenuText = Launch Copernic Agent :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2D663D1A-8670-49D9-A1A5-4C56B4E14E84}
ButtonText = Spyware Doctor :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{688DC797-DC11-46A7-9F1B-445F4F58CE6E}
ButtonText = Copernic Agent : C:\PROGRA~1\COPERN~1\COPERN~1.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{9E248641-0E24-4DDB-9A1F-705087832AD6}
MenuText = Java :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
ButtonText = Real.com :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}
ButtonText = Messenger : C:\Program Files\Messenger\msmsgs.exe

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}
File Search Explorer Band = %SystemRoot%\system32\SHELL32.dll

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
{01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address : %SystemRoot%\System32\browseui.dll
{0E5CBF21-D15F-11D0-8301-00AA005B4383} = &Links : %SystemRoot%\system32\SHELL32.dll
{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} = Norton Internet Security : C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
{2318C2B1-4965-11D4-9B18-009027A5CD4F} = &Google : c:\program files\google\googletoolbar3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
00THotkey C:\WINDOWS\System32\00THotkey.exe
000StTHK 000StTHK.exe
TFNF5 TFNF5.exe
Tpwrtray TPWRTRAY.EXE
TosHKCW.exe "C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe"
LtMoh C:\Program Files\ltmoh\Ltmoh.exe
TFncKy TFncKy.exe /Type 03
TcmTray
TDispVol TDispVol.exe
TMESBS.EXE C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE /Client
NvCplDaemon RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
nwiz nwiz.exe /installquiet
TouchED C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
Pinger c:\toshiba\ivp\ism\pinger.exe /run
SynTPLpr C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
SynTPEnh C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
cPadFstR C:\Program Files\Synaptics\SynTP\CPad\cPadFstR.Exe
cPadAlarm C:\Program Files\Synaptics\SynTP\cPad\AlarmWatcher.exe
Microsoft Works Update Detection C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
DLPSP "c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE"
AcctMgr C:\Program Files\Norton Password Manager\AcctMgr.exe /startup
ccApp "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
URLLSTCK.exe C:\Program Files\Norton Internet Security\UrlLstCk.exe
Zone Labs Client C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
iTunesHelper "C:\Program Files\iTunes\iTunesHelper.exe"
QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
IMAIL Installed = 1
MAPI Installed = 1
MSFS Installed = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Spyware Doctor C:\PROGRA~1\SPYWAR~1\swdoctor.exe /Q

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} =
{0DF44EAA-FF21-4412-828E-260A8728E7F1} =


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
dontdisplaylastusername 0
legalnoticecaption
legalnoticetext
shutdownwithoutlogon 1
undockwithoutlogon 1


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
NoDriveTypeAutoRun 145


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
PostBootReminder {7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll
CDBurn {fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll
WebCheck {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\System32\webcheck.dll
SysTray {35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\System32\stobject.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
Shell = Explorer.exe
System =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain
= crypt32.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet
= cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll
= cscdll.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\PCANotify
= PCANotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp
= wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule
= wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy
= sclgntfy.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn
= WlNotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv
= wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon
= wlnotify.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path
Debugger = ntsd -d

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLs


»»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
WinPFind v1.4.1 - Log file written to "WinPFind.Txt" in the WinPFind folder.
Scan completed on 10/11/2005 10:45:07 AM

[globalfx]

WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding.

If you see a message in the titlebar saying "Not responding..." you can ignore it. Windows somethimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly.

»»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Product Name: Microsoft Windows XP Current Build: Service Pack 2 Current Build Number: 2600
Internet Explorer Version: 6.0.2900.2180

»»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»»

Checking %SystemDrive% folder...

Checking %ProgramFilesDir% folder...

Checking %WinDir% folder...
web-nex 8/4/2005 8:19:50 PM 4117 C:\WINDOWS\kjzka.dll
abetterinternet.com 8/4/2005 10:09:16 AM 3639 C:\WINDOWS\lu.dat

Checking %System% folder...
PEC2 8/18/2001 5:00:00 AM 41397 C:\WINDOWS\SYSTEM32\dfrg.msc
UPX! 1/13/2005 9:41:48 PM 11254 C:\WINDOWS\SYSTEM32\locate.com
PECompact2 9/8/2005 8:08:28 PM 1997664 C:\WINDOWS\SYSTEM32\MRT.exe
aspack 9/8/2005 8:08:28 PM 1997664 C:\WINDOWS\SYSTEM32\MRT.exe
aspack 8/4/2004 12:56:36 AM 708096 C:\WINDOWS\SYSTEM32\ntdll.dll
Umonitor 8/4/2004 12:56:44 AM 657920 C:\WINDOWS\SYSTEM32\rasdlg.dll
UPX! 1/20/2005 1:47:50 PM 175616 C:\WINDOWS\SYSTEM32\strings.exe
winsync 8/18/2001 5:00:00 AM 1309184 C:\WINDOWS\SYSTEM32\wbdbase.deu

Checking %System%\Drivers folder and sub-folders...
PTech 8/3/2004 10:41:38 PM 1309184 C:\WINDOWS\SYSTEM32\drivers\mtlstrm.sys

Items found in C:\WINDOWS\SYSTEM32\drivers\etc\hosts


Checking the Windows folder and sub-folders for system and hidden files within the last 60 days...
10/11/2005 10:36:08 AM S 2048 C:\WINDOWS\bootstat.dat
10/10/2005 8:23:34 PM H 54156 C:\WINDOWS\QTFont.qfn
10/7/2005 12:32:10 PM HS 8192 C:\WINDOWS\Thumbs.db
10/11/2005 10:16:02 AM H 31762 C:\WINDOWS\system32\vsconfig.xml
8/26/2005 8:53:04 AM H 4212 C:\WINDOWS\system32\zllictbl.dat
10/11/2005 10:35:56 AM H 8192 C:\WINDOWS\system32\config\default.LOG
10/11/2005 10:36:40 AM H 1024 C:\WINDOWS\system32\config\SAM.LOG
10/11/2005 10:36:10 AM H 16384 C:\WINDOWS\system32\config\SECURITY.LOG
10/11/2005 10:36:42 AM H 69632 C:\WINDOWS\system32\config\software.LOG
10/11/2005 10:36:42 AM H 28672 C:\WINDOWS\system32\config\system.LOG
9/23/2005 5:46:06 PM H 1024 C:\WINDOWS\system32\config\systemprofile\NTUSER.DAT.LOG
9/2/2005 4:23:58 PM HS 388 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\User\f13e9be8-c2a7-4a39-b41a-ddb606ad600c
9/2/2005 4:23:58 PM HS 24 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\User\Preferred
10/11/2005 10:34:56 AM H 6 C:\WINDOWS\Tasks\SA.DAT
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS0DE2FD5F-8470-47C0-A913-1F575DE30825.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS0DE90E39-A602-4F1E-BF9A-CC08296048C8.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS0E60F8CA-5F24-48DB-B00A-7D5F251915BD.tmp
10/10/2005 9:31:50 PM H 0 C:\WINDOWS\Temp\CS1103C488-154C-4069-98B0-3D667C635F16.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS135C4E22-FE6A-4B73-A411-93BCF8645566.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS151EF10A-8072-4D90-8C4C-A1E0BC84DCBE.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS16440135-6841-47DD-B9CE-EA550F8EBF11.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS1B94E80E-F403-47D4-B1CC-0D930A1B2C0F.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS1C0A6BA8-501B-4995-AA72-4132184E6754.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS1C85B38F-ABEF-41A1-B7F1-6F986F44A48C.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS1CE6F269-615B-46BB-91AD-EA1533D55DAC.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS1DB9157A-CCC3-484C-B6E2-13E2511F7B4D.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS24B7A62F-5B57-4216-ABB4-5B675C94FA7C.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS2811E3BB-CB33-4AAC-857F-3EE4F7EC6C1B.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS288A89B8-DA04-4F13-8855-1B740E17F210.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS29D15914-49F8-44F2-AB67-D11D03B5A1F6.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS2A302499-5F70-4FDE-A914-F46E225B282F.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS2B5D3E40-9017-4457-8D83-BADE8959077D.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS2C5E682E-ABF1-4D56-9B5F-E5ED43AA8669.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS2DB9E396-94B1-4F5D-B9E4-C756C365835D.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS2E12E3E7-F55B-4C71-BEED-2830E2D0F7BD.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS2E686AC6-FABE-4BD3-9553-7B27A4435FCC.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS31B6EF62-62D6-4D5E-A3B7-205CB503CEC3.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS333EFEAE-F01C-468A-9AC9-064B4311975B.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS34EEAAC6-46E8-4DB8-A7DF-FB2B6716C3F6.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS3D0A6BFC-EA0D-4503-8125-F3BD1C1DDCF2.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS3EE929DB-88FA-40DF-A991-1D22FE1D5321.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS3F595716-7A50-459A-A88A-97478DA6D5A4.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS40E06A6E-CE4E-4A7F-9BDB-00F3FEEC1B92.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS410C77E9-ACBC-460E-AD9C-11EAF2EC8632.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS4250A4C3-973C-4255-9304-AAAD6731DF11.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS45267A17-F5AF-4A1A-9E09-4D0B18B04F37.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS47E9C388-A7A0-4439-88FF-64CDCA927CD0.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS4A08E8D4-DE1F-4721-B0B9-8E97797DE584.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS4B33B4C5-F2B8-44FA-9199-595A631030E9.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS516D0A10-AFDE-43DF-B08D-FDFE6C044065.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS55B621DA-CECE-46FB-8E91-CAB01E7C9355.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS56DC0C66-F670-4E62-834B-4C802A57A497.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS594B1EFF-7DED-4CE2-8B57-4568B1C7DA3D.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS5AEF2634-8F40-4F0F-94FD-A4EC0E6FC0B6.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS5C407B36-4D77-4704-BAE0-EB9DC505F5FB.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS60ACD741-7CE8-4937-8254-25CE8DBCB378.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS6157729D-739B-45BC-B0BD-8F23857FD2C7.tmp
10/10/2005 9:31:52 PM H 0 C:\WINDOWS\Temp\CS62D4105A-81F0-41D1-B3B8-265A6B0611C1.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS63286D32-C8F2-4CC0-B3A8-287BCB915FFC.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS63E29D61-E69A-4234-B966-29177FAE579E.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS668EB725-E247-4B15-AA61-75C3A98035BF.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS6E499D8C-C661-4250-B691-4C5B2C3F5BE9.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS6FDFEF2A-DEBB-4012-B5D7-91C03E63AB77.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS7216D819-FF4D-423C-BEE5-DDC7087F0725.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS738E25D8-D267-487C-81A1-3D6C3A0DAE20.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS73C22FB5-DD5A-4D5B-BAD9-FC59151DE1BD.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS7FAA03C6-0AE2-4627-94F6-856C7E3F2A0E.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS7FC1DFEC-FB00-4D1A-9897-62E0EECE1925.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS8BA2218C-6B26-484D-8147-8418DD7AFF4F.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS8CDA56C3-CD2A-4895-9F35-AF3B3950F0CE.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS8D1EFC96-08BC-4B09-8F10-735B5AA3FC7F.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CS8DFEAD09-FC30-4D16-9BE4-6687C38214FF.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS95CE9408-3068-4A5B-BBEE-9BFF611FA7AA.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS97A3DE9E-47D0-4E78-9D8F-6F4DFE23D28B.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CS9DE3A578-8023-4DA9-B25C-7BAB233097BA.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CSA4579932-4D35-40E6-BD52-D9EF4C0ECE43.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSA68BB761-E27D-4E9A-90A0-8AFC2A83A3E7.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSAA2FD060-B26E-46E9-B991-5E9AA1ABD270.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CSAD7A3541-1CF8-449E-B3A6-CB6D97DDC3D0.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CSB22AF5C3-3BD1-4D2B-AF49-7219E1EEF0CE.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSB5349555-C3A4-43FB-88CF-F8DF6C8676E8.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSB86457AE-3056-4604-8DC9-F16AC3AAF00A.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSB9F952BE-ADB5-49B4-855C-DF6CE77EE3EF.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CSBD89B8C7-6C78-4EE0-8BFA-0B0D63D34261.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSC105EBC6-894D-4510-A8B8-F1DF613AAE6B.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CSC178003A-E437-4C2E-B57C-72BE15647F42.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSC50CB547-71CD-463F-BEDA-4E3689EF5647.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSC68C7FB9-A0B3-4180-B22D-0B5E2C8D2C5B.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSC81E169B-7840-410D-9678-415AB444EBEB.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSC9214889-CA89-44BB-AD32-D1F8D6B72C53.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSD2B83BE5-D6A7-486B-B45B-9D5982F16D3E.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSD3730E34-EBBC-4DAD-9D9E-016C5713C7E2.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CSD6E5B6E6-9E33-4172-A792-B88BF7CF2A48.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSD8F53EA0-0FFD-4FF1-81C9-4A0AE32425EF.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSDB9CC2E9-1557-45B8-A3CA-B34EB2FCC671.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSDF3C3681-F55C-4E1C-A53D-056C9C3A31B8.tmp
10/10/2005 9:31:36 PM H 0 C:\WINDOWS\Temp\CSE0F5B364-6276-46C0-853C-CE612F85D56C.tmp
10/10/2005 9:31:38 PM H 532 C:\WINDOWS\Temp\CSE26C88D4-3F6B-40FF-BE3C-CE549ED9D2EB.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSE433DB18-D8AA-4547-963D-50A947D0AE95.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSE50AE194-048C-4DEA-832A-11A3620BA802.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSE5F8C9CA-423C-4CEF-9450-29C41A83A096.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSE8196CB5-1005-48C2-9EEF-8BBB60D42EA6.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CSE9015EC3-38DE-4D66-BCC6-6976BBC115D0.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSE915B5D5-5A94-404E-8E54-814E9F35C396.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CSEBA774CE-EE75-435B-8702-9687C7034736.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSEFF76EB7-A7A5-48AC-B70B-918D3B361B6C.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSF0B8DB9E-E600-469B-A47E-65D8AC9AA1AB.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CSF2EE607B-3E11-46C9-AB77-25FD720F2537.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CSF4C4EB31-FBB3-45EF-AC9F-CF69C7B7F9AB.tmp
10/10/2005 9:31:02 PM H 0 C:\WINDOWS\Temp\CSF562BB12-2EEC-456E-AB04-4926F96F1751.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSF6B13BAE-A97B-4FA3-B00F-8FA7E3D68306.tmp
10/10/2005 9:31:48 PM H 0 C:\WINDOWS\Temp\CSF96C987F-7157-4C36-B966-ACE27469E9F0.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSFAC0921A-9857-4D5E-AF15-48113F412421.tmp
10/10/2005 9:31:38 PM H 0 C:\WINDOWS\Temp\CSFECE0FA2-EDAE-47AF-9C01-8FEACF38267D.tmp
10/10/2005 9:31:52 PM H 0 C:\WINDOWS\Temp\CSFF296528-C704-4EC9-A9DB-98E141DDF53B.tmp

Checking for CPL files...
Microsoft Corporation 8/4/2004 12:56:58 AM 68608 C:\WINDOWS\SYSTEM32\access.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 549888 C:\WINDOWS\SYSTEM32\appwiz.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 110592 C:\WINDOWS\SYSTEM32\bthprops.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 135168 C:\WINDOWS\SYSTEM32\desk.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 80384 C:\WINDOWS\SYSTEM32\firewall.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 155136 C:\WINDOWS\SYSTEM32\hdwwiz.cpl
TOSHIBA Corp. 8/1/2002 2:49:42 PM 438272 C:\WINDOWS\SYSTEM32\HWSETUP.CPL
Microsoft Corporation 8/4/2004 12:56:58 AM 358400 C:\WINDOWS\SYSTEM32\inetcpl.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 129536 C:\WINDOWS\SYSTEM32\intl.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 380416 C:\WINDOWS\SYSTEM32\irprops.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 68608 C:\WINDOWS\SYSTEM32\joy.cpl
TOSHIBA CORPORATION 6/12/2002 10:48:06 PM 57344 C:\WINDOWS\SYSTEM32\LocalCOM.cpl
Microsoft Corporation 8/18/2001 5:00:00 AM 187904 C:\WINDOWS\SYSTEM32\main.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 618496 C:\WINDOWS\SYSTEM32\mmsys.cpl
Microsoft Corporation 8/18/2001 5:00:00 AM 35840 C:\WINDOWS\SYSTEM32\ncpa.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 25600 C:\WINDOWS\SYSTEM32\netsetup.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 257024 C:\WINDOWS\SYSTEM32\nusrmgr.cpl
NVIDIA Corporation 8/15/2002 1:14:00 PM 180224 C:\WINDOWS\SYSTEM32\nvtuicpl.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 32768 C:\WINDOWS\SYSTEM32\odbccp32.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 114688 C:\WINDOWS\SYSTEM32\powercfg.cpl
RealNetworks, Inc. 7/25/2002 1:10:02 PM 24576 C:\WINDOWS\SYSTEM32\prefscpl.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 298496 C:\WINDOWS\SYSTEM32\sysdm.cpl
Microsoft Corporation 8/18/2001 5:00:00 AM 28160 C:\WINDOWS\SYSTEM32\telephon.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 94208 C:\WINDOWS\SYSTEM32\timedate.cpl
TOSHIBA Corp. 7/30/2002 4:33:52 PM 167936 C:\WINDOWS\SYSTEM32\tmeprop.cpl
TOSHIBA Corporation 6/10/2002 2:11:24 PM 876544 C:\WINDOWS\SYSTEM32\TPWRSAVE.CPL
Microsoft Corporation 8/4/2004 12:56:58 AM 148480 C:\WINDOWS\SYSTEM32\wscui.cpl
Microsoft Corporation 5/26/2005 4:16:30 AM 174360 C:\WINDOWS\SYSTEM32\wuaucpl.cpl
YAMAHA CORPORATION 7/24/2002 4:42:34 PM 249856 C:\WINDOWS\SYSTEM32\yacxgc.cpl

»»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»»

Checking files in %ALLUSERSPROFILE%\Startup folder...
7/23/2002 4:47:08 PM HS 84 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini
1/31/2000 10:16:18 PM 533 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\D-Link AirPlus Xtreme G Configuration Utility.lnk
1/30/2000 2:32:28 PM 1730 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk

Checking files in %ALLUSERSPROFILE%\Application Data folder...
7/23/2002 9:37:58 AM HS 62 C:\Documents and Settings\All Users\Application Data\desktop.ini

Checking files in %USERPROFILE%\Startup folder...
7/23/2002 4:47:08 PM HS 84 C:\Documents and Settings\user\Start Menu\Programs\Startup\desktop.ini

Checking files in %USERPROFILE%\Application Data folder...
7/23/2002 9:37:58 AM HS 62 C:\Documents and Settings\user\Application Data\desktop.ini
12/25/2004 11:50:20 PM 65536 C:\Documents and Settings\user\Application Data\GDIPFONTCACHEV1.DAT

»»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»»

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
=

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
{9F967EE1-E89A-4093-8961-18992F41E4AA} = C:\WINDOWS\system32\rhpwsx.dll
{367FE58C-225C-4258-A95E-60DAC7E73014} = C:\WINDOWS\system32\situpdll.dll
{D1519FB5-A094-4842-98A2-BEDDB9B8C215} = C:\WINDOWS\system32\dycdll.dll
{72B88834-1477-4D00-923C-6EF15FAEBFF4} = C:\WINDOWS\system32\dhskcopy.dll
{391A0BBB-9C48-49BB-85B0-CE4929DD0B4E} = C:\WINDOWS\system32\lecdll.dll
{8F0C9419-365B-4B3F-87D4-927A0CFB8C9A} = C:\WINDOWS\system32\srlgntfy.dll

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

[HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers]
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\ewido
{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E} = C:\Program Files\ewido\security suite\context.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files
{750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With
{09799AFB-AD67-11d1-ABCD-00C04FC30936} = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu
{A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\qfxqgqkg
{87a46993-982e-4dcc-bba7-a09cc469a809} = C:\WINDOWS\system32\lfwlg.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu
{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} = C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\TrojanHunter
{EBDF1F20-C829-11D1-8233-FF20AF3E97A9} = C:\PROGRA~1\TROJAN~1.2\contmenu.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}
Start Menu Pin = %SystemRoot%\system32\SHELL32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu
{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} = C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\TrojanHunter
{EBDF1F20-C829-11D1-8233-FF20AF3E97A9} = C:\PROGRA~1\TROJAN~1.2\contmenu.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EncryptionMenu
{A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ewido
{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E} = C:\Program Files\ewido\security suite\context.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Offline Files
{750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Sharing
{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = ntshrui.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\TrojanHunter
{EBDF1F20-C829-11D1-8233-FF20AF3E97A9} = C:\PROGRA~1\TROJAN~1.2\contmenu.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE}
= %SystemRoot%\system32\SHELL32.dll

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB}
PCTools Site Guard = C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}
Google Toolbar Helper = c:\program files\google\googletoolbar3.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B56A7D7D-6927-48C8-A975-17DF180C71AC}
PCTools Browser Monitor = C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}
&Tip of the Day = %SystemRoot%\System32\shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{6F480F82-C3A6-4D35-96F7-B297AD49FBE8}
Copernic Agent Results = C:\Program Files\Copernic Agent\CopernicAgentExt.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{F2E259E8-0FC8-438C-A6E0-342DD80FA53E}
Copernic Agent = C:\Program Files\Copernic Agent\CopernicAgentExt.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{FE54FA40-D68C-11d2-98FA-00C0F0318AFE}
Real.com = C:\WINDOWS\System32\Shdocvw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} = &Google : c:\program files\google\googletoolbar3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{193B17B0-7C9F-4D5B-AEAB-8D3605EFC084}
MenuText = Launch Copernic Agent :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2D663D1A-8670-49D9-A1A5-4C56B4E14E84}
ButtonText = Spyware Doctor :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{688DC797-DC11-46A7-9F1B-445F4F58CE6E}
ButtonText = Copernic Agent : C:\PROGRA~1\COPERN~1\COPERN~1.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{9E248641-0E24-4DDB-9A1F-705087832AD6}
MenuText = Java :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
ButtonText = Real.com :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}
ButtonText = Messenger : C:\Program Files\Messenger\msmsgs.exe

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}
File Search Explorer Band = %SystemRoot%\system32\SHELL32.dll

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
{01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address : %SystemRoot%\System32\browseui.dll
{0E5CBF21-D15F-11D0-8301-00AA005B4383} = &Links : %SystemRoot%\system32\SHELL32.dll
{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} = Norton Internet Security : C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
{2318C2B1-4965-11D4-9B18-009027A5CD4F} = &Google : c:\program files\google\googletoolbar3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
00THotkey C:\WINDOWS\System32\00THotkey.exe
000StTHK 000StTHK.exe
TFNF5 TFNF5.exe
Tpwrtray TPWRTRAY.EXE
TosHKCW.exe "C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe"
LtMoh C:\Program Files\ltmoh\Ltmoh.exe
TFncKy TFncKy.exe /Type 03
TcmTray
TDispVol TDispVol.exe
TMESBS.EXE C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE /Client
NvCplDaemon RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
nwiz nwiz.exe /installquiet
TouchED C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
Pinger c:\toshiba\ivp\ism\pinger.exe /run
SynTPLpr C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
SynTPEnh C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
cPadFstR C:\Program Files\Synaptics\SynTP\CPad\cPadFstR.Exe
cPadAlarm C:\Program Files\Synaptics\SynTP\cPad\AlarmWatcher.exe
Microsoft Works Update Detection C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
DLPSP "c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE"
AcctMgr C:\Program Files\Norton Password Manager\AcctMgr.exe /startup
ccApp "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
URLLSTCK.exe C:\Program Files\Norton Internet Security\UrlLstCk.exe
Zone Labs Client C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
iTunesHelper "C:\Program Files\iTunes\iTunesHelper.exe"
QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
IMAIL Installed = 1
MAPI Installed = 1
MSFS Installed = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Spyware Doctor C:\PROGRA~1\SPYWAR~1\swdoctor.exe /Q

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} =
{0DF44EAA-FF21-4412-828E-260A8728E7F1} =


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
dontdisplaylastusername 0
legalnoticecaption
legalnoticetext
shutdownwithoutlogon 1
undockwithoutlogon 1


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
NoDriveTypeAutoRun 145


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
PostBootReminder {7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll
CDBurn {fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll
WebCheck {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\System32\webcheck.dll
SysTray {35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\System32\stobject.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
Shell = Explorer.exe
System =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain
= crypt32.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet
= cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll
= cscdll.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\PCANotify
= PCANotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp
= wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule
= wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy
= sclgntfy.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn
= WlNotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv
= wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon
= wlnotify.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path
Debugger = ntsd -d

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLs


»»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
WinPFind v1.4.1 - Log file written to "WinPFind.Txt" in the WinPFind folder.
Scan completed on 10/11/2005 10:45:07 AM

[Buckeye_Sam]

You've still got a very infected computer on your hands. Lot's of instructions here. Let me know if you have any problems.


Please download and install Cleanup 4.0

Now run CleanUp
IMPORTANT!
CleanUp deletes EVERYTHING out of your temp/temporary folders, it does not make backups.
If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these before running CleanUp

Running CleanUp

• Start CleanUp by double-clicking the icon on your desktop (or from the Start > All Programs menu).
• When CleanUp starts go to the Options button (right side of CleanUp screen)
• Move the arrow down to "Custom CleanUp!"
• Now place a checkmark next to the following (Make sure nothing else is checked!):
  • Delete Cookies
    This is optional, if you leave the box checked it will remove all of your cookies, at this point removing cookies is a good idea
  • Empty Recycle Bins
  • Delete Prefetch files
  • Cleanup! All Users
• Click OK
• Then click on the CleanUp button. This will take a short while, let it do its thing.
• When asked to reboot system select No
• Close CleanUp

============



Please open Notepad, and copy/paste the code in the box below into a new text file. Save it as KillQoo.reg (set Filetype to "All Files") and save it on your Desktop.

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\qfxqgqkg]

[-HKEY_CLASSES_ROOT\CLSID\{87a46993-982e-4dcc-bba7-a09cc469a809}]

Now Locate and DoubleClick KillQoo.reg-> Allow it to merge into the Registry!



==========


Download the Pocket Killbox.

Unzip the contents of KillBox.zip to a convenient location and then double-click on KillBox.exe to launch the program.

• Highlight the lines below and press the Ctrl key and the C key at the same time to copy them to the clipboard:
  • 
    C:\WINDOWS\kjzka.dll
    C:\WINDOWS\lu.dat
    C:\WINDOWS\system32\rhpwsx.dll
    C:\WINDOWS\system32\situpdll.dll
    C:\WINDOWS\system32\dycdll.dll
    C:\WINDOWS\system32\dhskcopy.dll
    C:\WINDOWS\system32\lecdll.dll
    C:\WINDOWS\system32\srlgntfy.dll
    C:\WINDOWS\system32\lfwlg.dll
    
    
• Now go to the Killbox application and click on the File menu and then the Paste from Clipboard menu item. In the Full Path of File to Delete box you should see the first file. If you dropdown that box you should see the rest of them. Make sure that they are all there.
• Click on the Delete on Reboot option and then click on the red circle with a white 'X' in to to delete the files. Killbox will tell you that all listed files will be deleted on next reboot, click YES. When it asks if you would like to Reboot now, click YES. If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just restart manually.

Your system will reboot now.



============


Download L2mfix from one of these two locations:

http://www.atribune....oads/l2mfix.exe
http://www.downloads....org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!