[D_mcpasterfield]

[EDIT] I have good reason to believe this is some sort of rundll32 infection, please help![/EDIT/]
Ok, my computer is freaking out!
This thing is renaming my drives, popping pop ups everywhere... VERY bad....
The HJT log is very normal looking, but i know that isnt everything, so i have included my l2mfix.bat log also. My Trojan hunter log can also be included if need be (i had no idea anyone could have this many trojans) I have tried all the normal stuff, services.msc, adaware, HJT, spybot... this is driving me nuts

Logfile of HijackThis v1.99.1
Scan saved at 9:36:53 PM, on 11/15/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\System32\CTSvcCDA.EXE
E:\Program Files\Alias\Maya 6.0 Personal Learning Edition\docs\wrapper.exe
C:\WINDOWS\System32\nvsvc32.exe
E:\Program Files\Alias\Maya 6.0 Personal Learning Edition\docs\jre\bin\java.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
C:\windows\system32\mdms.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
F:\Program Files\Xfire\Xfire.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\TrojanHunter 4.2\TrojanHunter.exe
C:\Program Files\TrojanHunter 4.2\THGuard.exe
C:\Program Files\Winamp\winamp.exe
C:\PROGRA~1\Grisoft\AVG7\avgw.exe
E:\HSA KILL\hijackthis.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Anti-Blaxx Manager] C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 -lock
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SysMemory manager] c:\windows\system32\mdms.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Startup: Xfire.lnk = F:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O20 - Winlogon Notify: Telephony - C:\WINDOWS\system32\irlml5311.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE
O23 - Service: Maya 6 PLE Documentation Server (mple6docserver) - Unknown owner - E:\Program Files\Alias\Maya 6.0 Personal Learning Edition\docs\wrapper.exe" -s "E:\Program Files\Alias\Maya 6.0 Personal Learning Edition\docs\Wrapper.conf (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

L2MFIX.bat!

L2MFIX find log 1.04a
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Telephony]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\irlml5311.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER


**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{AE339E3B-C971-5026-2654-DBD52FFE0EA2}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{568804CA-CBD7-11d0-9816-00C04FD91972}"="Menu Shell Folder"
"{5b4dae26-b807-11d0-9815-00c04fd91972}"="Menu Band"
"{8278F931-2A3E-11d2-838F-00C04FD918D0}"="Tracking Shell Menu"
"{E13EF4E4-D2F2-11d0-9816-00C04FD91972}"="Menu Site"
"{ECD4FC4F-521C-11D0-B792-00A0C90312E1}"="Menu Desk Bar"
"{D82BE2B0-5764-11D0-A96E-00C04FD705A2}"="IShellFolderBand"
"{0E5CBF21-D15F-11d0-8301-00AA005B4383}"="&Links"
"{7487cd30-f71a-11d0-9ea7-00805f714772}"="Thumbnail Image"
"{450D8FBA-AD25-11D0-98A8-0800361B1103}"="MyDocs Folder"
"{1A9BA3A0-143A-11CF-8350-444553540000}"="Shell Favorite Folder"
"{20D04FE0-3AEA-1069-A2D8-08002B30309D}"="My Computer"
"{86747AC0-42A0-1069-A2E6-08002B30309D}"="Briefcase Folder"
"{0AFACED1-E828-11D1-9187-B532F1E9575D}"="Folder Shortcut"
"{12518493-00B2-11d2-9FA5-9E3420524153}"="Mounted Volume"
"{21B22460-3AEA-1069-A2DC-08002B30309D}"="File Property Page Extension"
"{B091E540-83E3-11CF-A713-0020AFD79762}"="File Types Page"
"{FBF23B41-E3F0-101B-8488-00AA003E56F8}"="MIME File Types Hook"
"{C2FBB630-2971-11d1-A18C-00C04FD75D13}"="Microsoft CopyTo Service"
"{C2FBB631-2971-11d1-A18C-00C04FD75D13}"="Microsoft MoveTo Service"
"{13709620-C279-11CE-A49E-444553540000}"="Shell Automation Service"
"{62112AA1-EBE4-11cf-A5FB-0020AFE7292D}"="Shell Automation Folder View"
"{4622AD11-FF23-11d0-8D34-00A0C90F2719}"="Start Menu"
"{7BA4C740-9E81-11CF-99D3-00AA004AE837}"="Microsoft SendTo Service"
"{D969A300-E7FF-11d0-A93B-00A0C90F2719}"="Microsoft New Object Service"
"{09799AFB-AD67-11d1-ABCD-00C04FC30936}"="Open With Context Menu Handler"
"{3FC0B520-68A9-11D0-8D77-00C04FD70822}"="Display Control Panel HTML Extensions"
"{75048700-EF1F-11D0-9888-006097DEACF9}"="ActiveDesktop"
"{6D5313C0-8C62-11D1-B2CD-006097DF8C11}"="Folder Options Property Page Extension"
"{57651662-CE3E-11D0-8D77-00C04FC99D61}"="CmdFileIcon"
"{4657278A-411B-11d2-839A-00C04FD918D0}"="Shell Drag and Drop helper"
"{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer"
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
"{BB7DF450-F119-11CD-8465-00AA00425D90}"="Microsoft Access Custom Icon Handler"
"{59850401-6664-101B-B21C-00AA004BA90B}"="Microsoft Office Binder Explode"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class"
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}"="nView Desktop Context Menu"
"{32020A01-506E-484D-A2A8-BE3CF17601C3}"="AlcoholShellEx"
"{A68865DD-EE3C-4442-9BE9-1BAB2576E3FA}"="NOMAD Explorer"
"{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"="AVG7 Shell Extension"
"{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}"="AVG7 Find Extension"
"{5464D816-CF16-4784-B9F3-75C0DB52B499}"="Yahoo! Mail"
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}"="Play on my TV helper"
"{6DEA92E9-8682-4b6a-97DE-354772FE5727}"="Autodesk DWF Preview"
"{36A21736-36C2-4C11-8ACB-D4136F2B57BD}"="AutoCAD Digital Signatures Icon Overlay Handler"
"{AC1DB655-4F9A-4c39-8AD2-A65324A4C446}"="Autodesk Drawing Preview"
"{5E2121EE-0300-11D4-8D3B-444553540000}"="st"
"{A3AA4C1C-F5E7-41FA-8E0A-693BDC6ED326}"=""
"{EBDF1F20-C829-11D1-8233-FF20AF3E97A9}"="TrojanHunter Menu Shell Extension"

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{A3AA4C1C-F5E7-41FA-8E0A-693BDC6ED326}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{A3AA4C1C-F5E7-41FA-8E0A-693BDC6ED326}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{A3AA4C1C-F5E7-41FA-8E0A-693BDC6ED326}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{A3AA4C1C-F5E7-41FA-8E0A-693BDC6ED326}\InprocServer32]
@="C:\\WINDOWS\\system32\\qqv.dll"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
qqv.dll Tue Nov 15 2005 8:45:00p ..S.R 235,407 229.89 K
winacpi.dll Tue Nov 15 2005 9:11:40p A.... 55,833 54.52 K
winnb57.dll Sat Nov 12 2005 10:30:42a A.... 303,104 296.00 K
abic32gt.dll Sat Nov 12 2005 3:53:40p A.... 45,056 44.00 K
lgmejkeo.dll Sat Nov 12 2005 10:31:52a A.... 36,864 36.00 K
lv8u09~1.dll Sat Nov 12 2005 10:55:30a ..S.R 235,261 229.75 K
atmtd.dll Sat Nov 12 2005 10:58:16a A.... 687,592 671.48 K
wfxhel~1.dll Sun Nov 13 2005 10:00:58p A.... 10 0.01 K
en42l1~1.dll Sun Nov 13 2005 10:16:48p ..S.R 234,272 228.78 K
irlml5~1.dll Sun Nov 13 2005 10:15:48p ..... 235,407 229.89 K

10 items found: 10 files (3 H/S), 0 directories.
Total of file sizes: 2,068,806 bytes 1.97 M
Locate .tmp files:

C:\WINDOWS\SYSTEM32\
guard.tmp Tue Nov 15 2005 8:47:00p ..S.R 235,407 229.89 K

1 item found: 1 file (1 H/S), 0 directories.
Total of file sizes: 235,407 bytes 229.89 K
**********************************************************************************
Directory Listing of system files:
Volume in drive C is C-DISK
Volume Serial Number is 336D-18FA

Directory of C:\WINDOWS\System32

11/15/2005 08:47 PM 235,407 guard.tmp
11/15/2005 08:45 PM 235,407 qqv.dll
11/13/2005 10:16 PM 234,272 en42l1ho1.dll
11/12/2005 10:55 AM 235,261 lv8u09l9e.dll
02/20/2005 04:20 PM 7,471 yyfxy.log
02/20/2005 03:58 PM 3,567 qzyct.dat
08/29/2004 04:52 PM 0 crxn32.exe
07/09/2004 04:22 PM 0 vddpn.dll
07/07/2004 07:18 AM 0 hfwtu.dll
06/28/2004 12:13 PM 0 lzegp.dat
06/28/2004 03:49 AM 0 soawg.dat
06/28/2004 02:48 AM 0 mfcac.dll
06/27/2004 12:10 AM 0 jdeyb.dat
06/26/2004 03:57 PM 0 mcxcc.dll
06/21/2004 02:08 PM 0 apitt32.dll
06/17/2004 05:41 PM 0 sdkwt.dll
06/08/2004 07:24 PM 0 tbaed.dat
05/31/2004 10:01 AM 0 ipgz32.dll
05/29/2004 07:36 AM 0 lgngk.dat
05/29/2004 03:47 AM 0 ntvk32.dll
10/25/2003 03:36 PM <DIR> Microsoft
10/25/2003 03:12 PM <DIR> dllcache
20 File(s) 951,385 bytes
2 Dir(s) 2,176,253,952 bytes free

please help!! I'm going nuts with this thing!!!!!

Edited by D_mcpasterfield, 15 November 2005 - 10:43 PM.

[Advertisements]

Hi D_macpasterfield and welcome to the Geeks to Go Forums.

My name is Trevuren and I will be helping you with your log.

Close any programs you have open since this step requires a reboot.

• From the l2mfix folder on your desktop, double click l2mfix.bat.
• Select option #2 for Run Fix by typing 2 and then pressing enter.
• Press any key to reboot your computer.
• After a reboot, your desktop and icons will appear, then disappear (this is normal).
• L2mfix will continue to scan your computer and when it's finished, notepad will open with a log.
• Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!

Note: If after the reboot the desktop icons dont dissappear or the log does not pop up then in the l2mfix folder double click the second.bat file to continue with the fix

Regards,

Trevuren

[Trevuren]

Hi D_macpasterfield and welcome to the Geeks to Go Forums.

My name is Trevuren and I will be helping you with your log.

Close any programs you have open since this step requires a reboot.

• From the l2mfix folder on your desktop, double click l2mfix.bat.
• Select option #2 for Run Fix by typing 2 and then pressing enter.
• Press any key to reboot your computer.
• After a reboot, your desktop and icons will appear, then disappear (this is normal).
• L2mfix will continue to scan your computer and when it's finished, notepad will open with a log.
• Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!

Note: If after the reboot the desktop icons dont dissappear or the log does not pop up then in the l2mfix folder double click the second.bat file to continue with the fix

Regards,

Trevuren

[D_mcpasterfield]

Thanks for the quick reply,
l2mfix.bat when i run the fix (#2) and it reboots, directly following it's dialogue box closing, my computer is just stuck there... nothing happens, no log opens, and i end up having to reboot. <EDIT> oh, and the same happens when i attempt to run second.bat
sorry for taking so long to get back, attempted many times to just leave comp booting while im at class,
Steve

Edited by D_mcpasterfield, 17 November 2005 - 06:39 PM.

[Trevuren]

Please STOP the procedure and post a fresh HJT log.

Regards,

Trevuren

[D_mcpasterfield]

NEW HJT LOG, though i believe you misunderstood what i was saying, when it boots after running the l2mfix, and i click my name to log-in, it starts up with that familiar turqoise box, it quickly finishes, closes and i am left with no log, a cursor, but no icons or start menu....

here the new log is: (NOTE: i got rid of the wildtangent thing using spy sweeper, and HJT yesterday i believe)

Logfile of HijackThis v1.99.1
Scan saved at 8:17:49 PM, on 11/17/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\System32\CTSvcCDA.EXE
E:\Program Files\Alias\Maya 6.0 Personal Learning Edition\docs\wrapper.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
E:\Program Files\Alias\Maya 6.0 Personal Learning Edition\docs\jre\bin\java.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\System32\MsPMSPSv.exe
F:\Program Files\Xfire\Xfire.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Winamp\winamp.exe
E:\Program Files\BearShare\BearShare.exe
E:\Program Files\BearShare\BearShare.exe
E:\HSA KILL\hijackthis.exe

O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Anti-Blaxx Manager] C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 -lock
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Startup: Xfire.lnk = F:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE
O23 - Service: Maya 6 PLE Documentation Server (mple6docserver) - Unknown owner - E:\Program Files\Alias\Maya 6.0 Personal Learning Edition\docs\wrapper.exe" -s "E:\Program Files\Alias\Maya 6.0 Personal Learning Edition\docs\Wrapper.conf (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

Thanks,
Steve

Edited by D_mcpasterfield, 17 November 2005 - 08:20 PM.

[Trevuren]

1. BearShare: Please read this: http://www.spywarein...m/articles/p2p/

2. O4 - HKLM\..\Run: [Anti-Blaxx Manager] C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe If this is a "crack" facilitator, I must advise you that it is illegal .

3. Please think about both of the above, take any action that you think appropriate, and repost a fresh HJT log.

Regards,

Trevuren

[D_mcpasterfield]

I have done as you asked, gotten rid of bear share, and switched on over to share-aza while at the same time removing anti-blaxx. I understand that this is illegal if you DO NOT OWN the programs you run with it, but I assure you i do, i use this so i never have to put cd's in my drives (very handy). I use this in association with daemon tools, both are now removed.
NEW HJT!


Logfile of HijackThis v1.99.1
Scan saved at 7:27:06 AM, on 11/18/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\System32\CTSvcCDA.EXE
E:\Program Files\Alias\Maya 6.0 Personal Learning Edition\docs\wrapper.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
E:\Program Files\Alias\Maya 6.0 Personal Learning Edition\docs\jre\bin\java.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\System32\MsPMSPSv.exe
F:\Program Files\Xfire\Xfire.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
E:\HSA KILL\hijackthis.exe
C:\Program Files\Microsoft Office\Office\Winword.exe
C:\Program Files\Winamp\winamp.exe

O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 -lock
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Startup: Xfire.lnk = F:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE
O23 - Service: Maya 6 PLE Documentation Server (mple6docserver) - Unknown owner - E:\Program Files\Alias\Maya 6.0 Personal Learning Edition\docs\wrapper.exe" -s "E:\Program Files\Alias\Maya 6.0 Personal Learning Edition\docs\Wrapper.conf (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
thanks,
Steve

[Trevuren]

We must disable Spy Sweeper for it may interfere with our fix

To disable SpySweeper:

• Open SpySweeper, click >Options over to the left then >program options >Uncheck "load at windows startup".
• Over to the left, click "shields" and uncheck all there.
• Uncheck "home page shield".
• Uncheck 'automaticly restore default without notifiction

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order in which they are mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

• First we need to make all files and folders VISIBLE:
  
  • Go to start>control panel>folder options>view (tab)
  • Choose to "show hidden files and folders,"
  • Uncheck the "hide protected operating system files" and the "hide extensions for know file types" boxes.
  • Close the window with ok
• Please RUN HijackThis.
  . Click the SCAN button to produce a log.
  
  
• Place a check mark beside each one of the following items:
  
  O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
  
  
  
• Now with all the items selected, and all windows closed except for HJT, delete them by clicking the FIX checked button. Close the HijackThis window.
  
  
• Reboot Your System in Safe Mode
  
  How to use the F8 method to Start Your Computer in Safe Mode
  
  
  • Restart the computer.
  • As soon as BIOS is loaded begin tapping the F8 key until the Advanced Options menu appears.
  • Use the arrow keys to select the Safe mode menu item
  • Press Enter.
• Using Windows Explorer, locate the following files/folders, and DELETE them (if they are present):
  
  C:\Program Files\Winamp\winampa.exe<==Only the file in red
  
  
• Exit Explorer, and REBOOT BACK INTO NORMAL MODE
  
  
• Finally, RUN Hijackthis again and produce a new HJT log. Post it in the forum so we can check how everything looks now.

In addition, just to make sure because L2M usually brings a lot of bad stuff with it,

Please follow the instructions provided, you may want to print out these instructions and use them as a reference.

• Please download ewido security suite it is a trial version of the program.
  
  • Install ewido security suite
  • When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
  • Launch ewido, there should be an icon on your desktop double-click it.
  • The program will prompt you to update click the OK button
  • The program will now go to the main screen
• You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update
  • Click on Start
  • The update will start and a progress bar will show the updates being installed.
• Once the updates are installed do the following:
  • REBOOT into Safe Mode
  • Run EWIDO
  • Click on scanner
  • Click on Start Scan
  • Let the program scan the machine
  • While the scan is in progress you will be prompted to clean files, click OK
• Once the scan has completed, there will be a button located on the bottom of the screen named Save report
  • Click Save report
  • Save the report to your desktop
• Reboot your machine and post back a new HJT log and the ewido .txt log file you saved by using Add Reply

Regards,

Trevuren

[D_mcpasterfield]

EWIDO LOG!

-----------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 4:42:56 PM, 11/19/2005
+ Report-Checksum: B536836

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Cleaned with backup
HKLM\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX\CLSID\\ -> Spyware.MiniBug : Cleaned with backup
HKLM\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX.1\CLSID\\ -> Spyware.MiniBug : Cleaned with backup
HKLM\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\res -> Spyware.WebSearch : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{120E090D-9136-4b78-8258-F0B44B4BD2AC} -> Spyware.Maxspeed : Cleaned with backup
C:\WINDOWS\SYSTEM32\2.exe -> TrojanDownloader.Agent.xq : Cleaned with backup
C:\WINDOWS\SYSTEM32\3.exe -> TrojanDownloader.VB.qr : Cleaned with backup
C:\WINDOWS\SYSTEM32\bH.dll.tcf -> Spyware.BargainBuddy : Cleaned with backup
C:\WINDOWS\SYSTEM32\BO2802040113.dll -> Spyware.BargainBuddy : Cleaned with backup
C:\WINDOWS\SYSTEM32\atiupdate5.exe.tcf -> Spyware.Adtomi : Cleaned with backup
C:\WINDOWS\SYSTEM32\axuninstall.exe -> Spyware.BlazeFind : Cleaned with backup
C:\WINDOWS\SYSTEM32\paytime.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\SYSTEM32\in10b6.dll -> Adware.eZula : Cleaned with backup
C:\WINDOWS\SYSTEM32\apiok.exe.tcf -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\SYSTEM32\winfe.exe.tcf -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\SYSTEM32\crbi32.exe.tcf -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\moppxe.dat -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\wt\wtvh.dll -> Spyware.WildTangent : Cleaned with backup
C:\WINDOWS\msxmidi.exe -> TrojanDownloader.WinShow.af : Cleaned with backup
C:\WINDOWS\kl.exe -> TrojanSpy.Small.dg : Cleaned with backup
C:\WINDOWS\tool2.exe -> Not-A-Virus.Hoax.Win32.Renos.w : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\HDPlugin1019.dll -> Adware.Gator : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\HDPlugin1019.dll -> Adware.Gator : Cleaned with backup
C:\WINDOWS\tool3.exe -> TrojanDownloader.VB.qr : Cleaned with backup
C:\WINDOWS\apixb32.exe.tcf -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\timessquare.exe -> Spyware.Hijacker.StartPage.aw : Cleaned with backup
C:\WINDOWS\adtech2005.exe -> Trojan.VB.afn : Cleaned with backup
C:\WINDOWS\webhdll.dll_tobedeleted -> Spyware.WebHancer : Cleaned with backup
C:\WINDOWS\buareo.log -> Trojan.Agent.bi : Cleaned with backup
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe -> TrojanSpy.Small.dg : Cleaned with backup
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.dll -> TrojanSpy.Small.dg : Cleaned with backup
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00002.dll -> TrojanSpy.Small.dg : Cleaned with backup
C:\Program Files\Common Files\mzoq\mzoqa.exe -> TrojanDownloader.TSUpdate.l : Cleaned with backup
C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll.tcf -> Spyware.Wheaterbug : Cleaned with backup
C:\xz.bat -> Trojan.KillProc.a : Cleaned with backup
C:\Documents and Settings\Steven Sullivan\Cookies\steven sullivan@revenue[1].txt -> Spyware.Cookie.Revenue : Cleaned with backup
C:\Documents and Settings\Steven Sullivan\Cookies\steven sullivan@valuead[2].txt -> Spyware.Cookie.Valuead : Cleaned with backup
C:\Documents and Settings\Steven Sullivan\Cookies\steven sullivan@trafficmp[2].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
C:\Documents and Settings\Steven Sullivan\Cookies\steven sullivan@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
C:\Documents and Settings\Steven Sullivan\Cookies\steven sullivan@fastclick[2].txt -> Spyware.Cookie.Fastclick : Cleaned with backup
C:\Documents and Settings\Steven Sullivan\Cookies\steven sullivan@247realmedia[1].txt -> Spyware.Cookie.247realmedia : Cleaned with backup
C:\Documents and Settings\Steven Sullivan\Cookies\steven [email protected][2].txt -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\Documents and Settings\Steven Sullivan\Cookies\steven [email protected][2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Steven Sullivan\Cookies\steven [email protected][1].txt -> Spyware.Cookie.Specificclick : Cleaned with backup
:mozilla.28:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.29:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.32:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Casinotropez : Cleaned with backup
:mozilla.33:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Weborama : Cleaned with backup
:mozilla.34:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Weborama : Cleaned with backup
:mozilla.35:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Weborama : Cleaned with backup
:mozilla.40:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.41:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
:mozilla.42:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
:mozilla.43:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.44:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.45:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.46:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.47:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.48:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.49:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.54:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.56:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.57:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.70:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.71:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.72:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.73:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.74:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.75:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.76:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.77:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.78:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.79:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.80:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.81:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.82:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.83:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.84:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.85:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.86:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.87:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.88:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.89:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.90:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.91:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.92:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.93:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.94:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.95:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.96:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.97:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.98:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.99:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.100:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.101:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.102:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.103:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.104:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.105:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.106:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.107:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.108:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.109:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.110:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.111:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.112:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.113:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.114:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.119:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.124:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.125:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.126:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.127:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.128:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.129:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.132:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.133:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.134:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.135:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.139:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.140:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.141:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.149:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.150:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.152:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.154:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.155:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.156:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.157:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.160:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
:mozilla.161:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
:mozilla.169:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup
:mozilla.170:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup
:mozilla.171:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup
:mozilla.172:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup
:mozilla.173:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup
:mozilla.174:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup
:mozilla.175:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup
:mozilla.176:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup
:mozilla.177:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup
:mozilla.178:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.179:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.189:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Findwhat : Cleaned with backup
:mozilla.191:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
:mozilla.192:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
:mozilla.207:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.208:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.209:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.210:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.211:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.212:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.213:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.214:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.215:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup
:mozilla.216:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup
:mozilla.217:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup
:mozilla.218:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup
:mozilla.219:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup
:mozilla.228:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.229:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.230:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.231:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.234:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.239:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.240:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.241:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Targetnet : Cleaned with backup
:mozilla.242:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Targetnet : Cleaned with backup
:mozilla.245:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.246:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.248:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.Burstbeacon : Cleaned with backup
:mozilla.263:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Firefox\Profiles\default.wur\cookies.txt -> Spyware.Cookie.247realmedia : Cleaned with backup
:mozilla.7:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Profiles\default\isftepny.slt\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.14:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Profiles\default\isftepny.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.15:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Profiles\default\isftepny.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.16:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Profiles\default\isftepny.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.17:C:\Documents and Settings\Steven Sullivan\Application Data\Mozilla\Profiles\default\isftepny.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Steven Sullivan\Application Data\Wildtangent\Cdacache\00\00\0F.dat/files\wtvh.dll -> Spyware.WildTangent : Cleaned with backup
C:\Documents and Settings\Steven Sullivan\Application Data\Wildtangent\Cdacache\00\00\1C.dat/files\wtvh.dll -> Spyware.WildTangent : Cleaned with backup
C:\QUARANTINE\mfcxa32.xxx -> Trojan.Agent.bi : Cleaned with backup
C:\backup.zip/lv8u09l9e.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/guard.tmp -> Spyware.Look2Me : Cleaned with backup
D:\Diablo II\showcdkey.exe -> TrojanSpy.Lucyfer : Cleaned with backup
E:\MFdownloads\D2elvesSetup-dm.exe -> Spyware.Trymedia : Cleaned with backup
E:\MFdownloads\D2galleanSetup-dm.exe -> Spyware.Trymedia : Cleaned with backup
E:\MFdownloads\D2galleanSetup-dm-1.exe -> Spyware.Trymedia : Cleaned with backup
E:\MFdownloads\OnlyerPack.zip/showcdkey.zip/showcdkey.exe -> TrojanSpy.Lucyfer : Cleaned with backup
E:\MFdownloads\MGBSetup-dm.exe -> Spyware.Trymedia : Cleaned with backup
E:\MFdownloads\Rainbow_Six_3_Athena_Sword-1.zip/crack.exe -> TrojanDownloader.IstBar.er : Cleaned with backup
E:\MFdownloads\pacificpoker.exe -> Spyware.Casino : Cleaned with backup
F:\crack\run.exe -> TrojanDropper.Agent.hl : Cleaned with backup
F:\MFDOWNLOADS\rld-cod2kg.exe/run.exe -> TrojanDropper.Agent.hl : Cleaned with backup


::Report End

NEW HJT!

Logfile of HijackThis v1.99.1
Scan saved at 4:47:34 PM, on 11/19/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\AIM\aim.exe
F:\Program Files\Shareaza\Shareaza.exe
F:\Program Files\Xfire\Xfire.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\System32\CTSvcCDA.EXE
f:\Program Files\ewido\security suite\ewidoctrl.exe
E:\Program Files\Alias\Maya 6.0 Personal Learning Edition\docs\wrapper.exe
C:\WINDOWS\System32\nvsvc32.exe
E:\Program Files\Alias\Maya 6.0 Personal Learning Edition\docs\jre\bin\java.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
E:\HSA KILL\hijackthis.exe

O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Shareaza] "f:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - Startup: Xfire.lnk = F:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE
O23 - Service: ewido security suite control - ewido networks - f:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Maya 6 PLE Documentation Server (mple6docserver) - Unknown owner - E:\Program Files\Alias\Maya 6.0 Personal Learning Edition\docs\wrapper.exe" -s "E:\Program Files\Alias\Maya 6.0 Personal Learning Edition\docs\Wrapper.conf (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

Thanks a lot, I can already see improvement!,
Steve

[Trevuren]

I need you to download MWav to a convenient location.

This scan might take around 3+ hours to finish when set to scan everything.
I need you to run MWav by double-clicking on mwav.exe. This scan only produces a report, it doesn't clean your system. I will analyze the report and recommend a course of action depending on the results.

Put a check next to the below items before scanning:

• Memory
• Startup Folders
• Drive - All Local Drives
• Folder - then click "browse" to change the directory to C: (default is C:\Windows)
• Registry
• System Folders
• Services
• Include Sub-Directory
• Scan All Files

Please make sure ALL of these are checked, then press the Scan button. This typically will take hours to complete.

**NOTE*** Sometimes MWav will pause and it appears to be finished, but it isn't done. Just let it run until it says it's complete.

On the bottom portion of the window, you will see the lower panel where MWav is listing "infected items", please highlight everything in that lower panel and copy them by holding CTRL + C then paste it here. The whole log will be extremely BIG so there is no way to post the log. I just need the infected items list.

Regards,

Trevuren

[D_mcpasterfield]

-------NEVERMIND THIS POST!, SILLY ERROR----------

Edited by D_mcpasterfield, 19 November 2005 - 11:22 PM.

[Trevuren]

Please run this one instead

Please do an online scan with Kaspersky WebScanner

Next Click on Launch Kaspersky Anti-Virus Web Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  Standard
  
  • Scan Options:
  Scan Archives
  Scan Mail Bases
• Click OK
• Now under select a target to scan:Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information into your next post.

Regards

Trevuren

[D_mcpasterfield]

here it is!


File C:\WINDOWS\System32\abic32gt.dll infected by "Trojan.Win32.Crypt.t" Virus! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "troj/witna-a Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "cws.homesearch Browser Hijacker" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "cws.loadadv.400 Browser Hijacker" found in File System! Action Taken: No Action Taken.
Object "network1.popups Adware" found in File System! Action Taken: No Action Taken.
Object "network1.popups Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "search assistant Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "kazaa Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "kazaa Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "search assistant Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "win32.passma Virus" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "abetterinternet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "180solutions Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "hotbar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "sahagent Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "windupdate Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "target saver Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "casinoclient Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "mediamotor Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "istbar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "clipgenie Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "smartfinder Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "istbar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "clipgenie Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "gain.gator Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "gain.gator Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "casinoclient Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "zipitpro Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "target saver Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "cws.smartsearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\gta-vc.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Mss32.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\mss\Mp3dec.asi". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\mss\Mssa3d.m3d". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\mss\Mssa3d2.m3d". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\mss\Mssds3dh.m3d". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\mss\Mssds3ds.m3d". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\mss\Msseax.m3d". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\mss\msseax3.m3d". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\mss\Mssfast.m3d". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\mss\Mssrsx.m3d". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\mss\Reverb3.flt". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\sfx.RAW". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\sfx.SDT". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\ass_10.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\AirHornR.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\ass_1.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\AirHornL.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\ass_11.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\ass_12.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\ass_13.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\ass_14.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\ass_2.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\ass_3.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\ass_4.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\ass_5.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\ass_6.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\ass_7.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\ass_8.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\ass_9.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\band_01.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\band_02.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\band_03.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\band_04.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\band_05.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\band_06.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\band_07.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\band_08.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\BAR_1.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\BAR_2.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\BAR_3.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\BAR_4.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\BAR_5.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\BAR_6.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\BAR_7.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\BAR_8.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bike1_1.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bike1_2.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bike1_3.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\BikeRev.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bjm1_20.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bjm1_4.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bjm1_5.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bk4_12a.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bk4_12b.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bk4_12c.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bk4_14a.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bk4_14b.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bk4_19a.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bk4_19b.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bk4_20a.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bk4_20b.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bk4_23a.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bk4_23b.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bk4_23c.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bk4_23d.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bk4_24a.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bk4_24b.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bk4_31a.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bk4_31b.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bk4_34a.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bk4_34b.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\BK4_35a.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\BK4_35b.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\BK4_40a.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bk4_40b.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\BlowRoof.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk1_1.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk1_10.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk1_11.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk1_12.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk1_13.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk1_14.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk1_2.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk1_3.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk1_4.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk1_5.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk1_6.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk1_7.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk1_8.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk2_1.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk2_2.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk2_3.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk2_4.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk2_5.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk2_6.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk2_7.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk2_8.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk2_9.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk3_1.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk3_2.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk3_3a.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk3_3b.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk3_3c.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk3_4a.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk3_4b.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk3_4c.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_1.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_10.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_11.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_13.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_15.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_16.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_17.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_18.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_2.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_21.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_25.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_26.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_27.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_28.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_29.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_30.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_32.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_36.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_37.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_38.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_39.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_3a.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_3b.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_3c.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_3d.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_3e.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_3f.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_3g.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_3h.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_3i.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_3j.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_3k.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_3m.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_3o.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_3p.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_3q.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_3r.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_3s.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_3t.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_3u.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_3v.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_41.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_42.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_43.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_44.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_45.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_46.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_47.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_48.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_49.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_4a.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_4b.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_5.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_51.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_6.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_7.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_8.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_9.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_94.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_95.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_96.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_97.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_98.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk4_99.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk422a.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk422b.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk450a.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bnk450b.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud1_1.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud1_10.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud1_2.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud1_3.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud1_4.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud1_5.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud1_9.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud2_1.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud2_2.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud2_3.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud2_4.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud2_5.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud2_6.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud2_7.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud3_1.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud3_1a.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud3_1b.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud3_1c.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud3_2.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud3_3.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud3_4.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud3_5.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud3_6.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud3_7.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud3_8a.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud3_8b.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud3_8c.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud3_9a.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud3_9b.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bud3_9c.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\burg_01.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\burg_02.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\burg_03.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\burg_04.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\burg_05.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\burg_06.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\burg_07.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\burg_08.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\burg_09.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\burg_10.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\burg_11.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\burg_12.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bust_01.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bust_02.wav". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\Audio\bust_03.wav"

[Trevuren]

That is quite a list you have there.!!! Another big clean up to do.


1. Update your Ewido definitions and run Ewido in Safe Mode. Keep the log and REBOOT back into Normal Mode. Copy/Paste the log into your next reply.

2. Please download WebRoot SpySweeper from HERE (It's a 2 week trial):

• Click the Free Trial link under to "SpySweeper" to download the program.
• Install it. Once the program is installed, it will open.
• It will prompt you to update to the latest definitions, click Yes.
• Once the definitions are installed, click Options on the left side.
• Click the Sweep Options tab.
• Under What to Sweep please put a check next to the following:
  • Sweep Memory
  • Sweep Registry
  • Sweep Cookies
  • Sweep All User Accounts
  • Enable Direct Disk Sweeping
  • Sweep Contents of Compressed Files
  • Sweep for Rootkits
  • Please UNCHECK Do not Sweep System Restore Folder.
• Click Sweep Now on the left side.
• Click the Start button.
• When it's done scanning, click the Next button.
• Make sure everything has a check next to it, then click the Next button.
• It will remove all of the items found.
• Click Session Log in the upper right corner, copy everything in that window.
• Click the Summary tab and click Finish.
• Paste the contents of the session log you copied into your next reply.

3. Reboot your system.

4. Post both logs as well as a fresh HJT log


Regards,

Trevuren

[D_mcpasterfield]

------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Sunday, November 20, 2005 14:17:50
Operating System: Microsoft Windows XP Professional, Service Pack 1 (Build 2600)
Kaspersky On-line Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 20/11/2005
Kaspersky Anti-Virus database records: 150996
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\

Scan Statistics:
Total number of scanned objects: 312640
Number of viruses found: 11
Number of infected objects: 21
Number of suspicious objects: 0
Duration of the scan process: 8564 sec

Infected Object Name - Virus Name
C:\WINDOWS\SYSTEM32\abic32gt.dll Infected: Trojan.Win32.Crypt.t
C:\Program Files\Common Files\mzoq\mzoqm.exe Infected: Trojan-Downloader.Win32.TSUpdate.n
C:\Program Files\Common Files\mzoq\mzoqp.exe Infected: Trojan-Downloader.Win32.TSUpdate.f
C:\Documents and Settings\Steven Sullivan\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-3cc46f89-16bef6e5.zip/javainstaller/InstallerApplet.class Infected: Trojan-Downloader.Java.OpenStream.t
C:\Documents and Settings\Steven Sullivan\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-3cc46f89-16bef6e5.zip Infected: Trojan-Downloader.Java.OpenStream.t
C:\Documents and Settings\Steven Sullivan\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-5ad1bcbe-5c6512e1.zip/javainstaller/InstallerApplet.class Infected: Trojan-Downloader.Java.OpenStream.w
C:\Documents and Settings\Steven Sullivan\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-5ad1bcbe-5c6512e1.zip Infected: Trojan-Downloader.Java.OpenStream.w
C:\Documents and Settings\Steven Sullivan\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-2898a363-51d051ab.zip/GetAccess.class Infected: Trojan-Downloader.Java.OpenConnection.aj
C:\Documents and Settings\Steven Sullivan\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-2898a363-51d051ab.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.aj
C:\Documents and Settings\Steven Sullivan\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-2898a363-51d051ab.zip Infected: Trojan-Downloader.Java.OpenConnection.aj
C:\Documents and Settings\Steven Sullivan\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv698.jar-2b037dd6-661bd175.zip/Matrix.class Infected: Trojan-Downloader.Java.OpenStream.c
C:\Documents and Settings\Steven Sullivan\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv698.jar-2b037dd6-661bd175.zip/Counter.class Infected: Trojan.Java.ClassLoader.h
C:\Documents and Settings\Steven Sullivan\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv698.jar-2b037dd6-661bd175.zip/Parser.class Infected: Trojan.Java.ClassLoader.d
C:\Documents and Settings\Steven Sullivan\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv698.jar-2b037dd6-661bd175.zip Infected: Trojan.Java.ClassLoader.d
C:\Documents and Settings\Steven Sullivan\.jpi_cache\jar\1.0\javainstaller.jar-4514e5ea-1fb00cd5.zip/javainstaller/InstallerApplet.class Infected: Trojan-Downloader.Java.OpenStream.w
C:\Documents and Settings\Steven Sullivan\.jpi_cache\jar\1.0\javainstaller.jar-4514e5ea-1fb00cd5.zip Infected: Trojan-Downloader.Java.OpenStream.w
E:\MFdownloads\Magic%20the%20Gathering%20Battlegrounds.zip/crack.exe Infected: Trojan-Spy.Win32.Briss.j
E:\MFdownloads\Magic%20the%20Gathering%20Battlegrounds.zip Infected: Trojan-Spy.Win32.Briss.j
E:\MFdownloads\Magic%20Battlegrounds.zip/crack.exe Infected: Trojan-Spy.Win32.Briss.j
E:\MFdownloads\Magic%20Battlegrounds.zip Infected: Trojan-Spy.Win32.Briss.j
E:\MFdownloads\pic0023-1.com Infected: Backdoor.Win32.IRCBot.gw

Scan process completed.

ok, currently working on the 2nd EWIDO, and spy sweeper stuff