Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Firefox and Other System Utilities Hijacked

Started by Midnight364 , Nov 28 2005 12:15 AM

Please log in to reply

#16
Midnight364

Posted 03 December 2005 - 09:51 AM

Member

Topic Starter
Member
63 posts

And a fresh HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 7:48:05 AM, on 12/3/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
C:\WINDOWS\System32\gearsec.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\mysql\bin\mysqld-nt.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Java\jre1.5.0_04\bin\jucheck.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\ATWTUSB.EXE
C:\Documents and Settings\Midnight\Desktop\Shortcuts\KeyCount\KeyCount.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\TBLMOUSE.EXE
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
C:\Program Files\Nikon\NkView5\NkvMon.exe
C:\Program Files\Red Chair Software\Notmad Explorer\notmgr.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Documents and Settings\Midnight\Desktop\Shortcuts\Anti-Spyware\hijackthis\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O1 - Hosts: 68.3.107.49 l2authd.lineage2.com
O3 - Toolbar: Systran40premi.IEPlugIn - {CFB25594-4D5F-11D6-AB7B-00B0D094B576} - C:\Program Files\Systran\4_0\Premium\IEPlugIn.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 -noicon
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Atwtusb] RUNDLL32 FuncKey.DLL,ExtFuncCall AA
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATI DeviceDetect] C:\Program Files\ATI Multimedia\\Program Files\ATI Multimedia\main\ATIDtct.EXE
O4 - HKLM\..\Run: [wtadd_KeyCount.exe] C:\Documents and Settings\Midnight\Desktop\Shortcuts\KeyCount\KeyCount.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [LDM] \Program\
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Notmad Manager.lnk = C:\Program Files\Red Chair Software\Notmad Explorer\notmgr.exe
O4 - Startup: Registration Prince of Persia Warrior Within.LNK = C:\Program Files\UBISOFT\Prince of Persia Warrior Within\Support\Register\RegistrationReminder.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: ImageFox.lnk.disabled
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microtek Scanner Finder.lnk = C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView5\NkvMon.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Free Surfer - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - C:\Program Files\Free Surfer\FS20.exe
O9 - Extra 'Tools' menuitem: Free Surfer - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - C:\Program Files\Free Surfer\FS20.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Chess - http://download.game...nts/y/ct0_x.cab
O16 - DPF: Yahoo! Literati - http://download.game...nts/y/tt0_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.game...ts/y/potc_x.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...ry/msgrchkr.cab
O16 - DPF: {05717986-A8C7-11D7-A03D-00104BCD089B} (W3IP Control) - http://www.w3ip.com/W3ip.cab
O16 - DPF: {12F7F128-B36C-4843-8AA4-A5F71A969331} (Launcher Control) - https://horizons.ist...ls/launcher.ocx
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...MineSweeper.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v43/yacscom.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...meInstaller.exe
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...StatsClient.cab
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://echat.us.del...t/TLIEFlash.CAB
O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn...eUC/MsnUpld.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/z...s/heartbeat.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/...ro.cab27513.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {BD5FBD60-8AA3-4060-92B9-A868B9FF2FCC} (Reversi Control) - http://mirror.worldw...rsi/reversi.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn...UC/MsnPUpld.cab
O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} (Live Collaboration) - http://liveca04.righ...l/java/RntX.cab
O18 - Protocol: bw+0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - Winlogon Notify: AppPaths - C:\WINDOWS\system32\m0ju0a19ed.dll (file missing)
O20 - Winlogon Notify: WB - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: CWShredder Service - Unknown owner - C:\Documents and Settings\Midnight\Desktop\cwshredder.exe (file missing)
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MySQL - Unknown owner - C:\mysql\bin\mysqld-nt.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)

#17
Midnight364

Posted 03 December 2005 - 09:54 AM

Member

Topic Starter
Member
63 posts

One other thing that should be noted:

Every time I reboot, one of my spyware catchers notifies me that something keeps trying to change Internet Exploerer's homepage. This hasn't gone away yet...

#18
lovethepirk

Posted 03 December 2005 - 07:09 PM

Visiting Staff

Member
528 posts

Scan with HijackThis again and place a check next to these items:

O20 - Winlogon Notify: AppPaths - C:\WINDOWS\system32\m0ju0a19ed.dll (file missing)

Close all other windows except HijackThis, and hit Fix Checked

Then I would like you to try and run the new l2mfix. It was updated today.

Delete the l2mfix folder on your desktop and then install the new version from one of these two locations:
http://www.atribune....oads/l2mfix.exe
http://www.downloads....org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and and select option #2 for Run Fix by typing 2 and then pressing enter. It will process then start. Your desktop and icons will disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, it will be ready for a reboot. Press any key to reboot. After the reboot notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so! Do Not run in safe mode!!
If after the reboot the log does not open double click on it in the l2mfix folder.

Please include the l2mfix log in your next post along with another HJT log.

Edited by lovethepirk, 03 December 2005 - 10:19 PM.

#19
Midnight364

Posted 05 December 2005 - 03:51 AM

Member

Topic Starter
Member
63 posts

I did all that, but when I ran the new L2MFix it still gave the same messages in both windows as last time. This might have something to do with the fact that I re-enabled everything in Norton Antivirus since I thought we wouldn't be needing to disable it again.

Should I disable Norton and try running L2MFix again?

#20
lovethepirk

Posted 05 December 2005 - 09:44 AM

Visiting Staff

Member
528 posts

Let's just clean you up manually. I tried running L2mfix on a system with Norton 2005 myself and it ran fine so I am not so sure that is the problem.

First thing I would like you to do is go to this website and then submit this file that is lurking in your system32 directory. The file name will be very close to what I have listed but after the "~" there will be more letters.

Please go to http://virusscan.jotti.org , click on Browse, and upload the following file(s) for analysis:

C:\WINDOWS\SYSTEM32\deskcp~1.tmp

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.
If the above file is checked and is infected delete it.

Please navigate to this file and delete it:
C:\WINDOWS\System32\9D525C4804.dll

Instructions: Copy and paste the quoted text into a text editor such as Notepad.
Save this text as Fixme.reg. Make sure the "Save as type:" is "All Files (*.*)" and save it to your desktop.
Double-click on Fixme.reg. When it asks you to merge the information to the registry click Yes.

REGEDIT4

[-HKEY_CLASSES_ROOT\CLSID\{7C61BF57-E921-41FC-96BD-7550B5681D7D}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{C35F8ACB-D7B1-616F-23AC-7777544758DD}"=-

Then reboot.

Run option #1 in l2mfix and post that log for us and another HJT log.
Also tell me about that file that you uploaded.

Thanks,

LTP

#21
Midnight364

Posted 05 December 2005 - 05:01 PM

Member

Topic Starter
Member
63 posts

The results on virusscan.jotti.org for that file all turned up as "Found Nothing."
I couldn't find "9D525C4804.dll" in the System32 folder. I even tried deleting it via command prompt and it said it doesn't exist.

Here's the L2mfix log:

L2MFIX find log 120305
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WB]
"Asynchronous"=dword:00000000
"DllName"="C:\\PROGRA~1\\Stardock\\OBJECT~1\\WINDOW~1\\fastload.dll"
"Startup"="StartSys"
"Logon"="StartWB"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
"Asynchronous"=dword:00000000
"DllName"="WRLogonNTF.dll"
"Impersonate"=dword:00000001
"Lock"="WRLock"
"StartScreenSaver"="WRStartScreenSaver"
"StartShell"="WRStartShell"
"Startup"="WRStartup"
"StopScreenSaver"="WRStopScreenSaver"
"Unlock"="WRUnlock"
"Shutdown"="WRShutdown"
"Logoff"="WRLogoff"
"Logon"="WRLogon"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{2C49B5D0-ACE7-4D17-9DF0-A254A6C5A0C5}"="dBpowerAMP Music Converter"
"{8f7261d0-d2b9-11d2-9909-00605205b24c}"="CuteFTP Shell Extension"
"{68f32140-2ca3-11d0-acc1-444553540000}"="PicaView"
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
"{C81DCBCA-8AE2-41FC-9C39-78B160393210}"="RhinoShExt"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class"
"{5464D816-CF16-4784-B9F3-75C0DB52B499}"="Yahoo! Mail"
"{32020A01-506E-484D-A2A8-BE3CF17601C3}"="AlcoholShellEx"
"{BB7DF450-F119-11CD-8465-00AA00425D90}"="Microsoft Access Custom Icon Handler"
"{8D1636FD-CA49-4B4E-90E4-0A20E03A15E8}"="jetAudio"
"{3FCEF010-09A4-11D4-8D3B-D12F9D3D8B02}"="TIShelEx Shell Extension"
"{2F5AC606-70CF-461C-BFE1-734234536262}"="WindowBlinds CPL Extension"
"{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"="Adobe.Acrobat.ContextMenu"
"{73B24247-042E-4EF5-ADC2-42F62E6FD654}"="ICQ Lite Shell Extension"
"{BBA7EB3F-97AB-4EBD-BCA2-C3C8DBED444F}"="Notmad Explorer Zen"
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
"{5E2121EE-0300-11D4-8D3B-444553540000}"="Catalyst Context Menu extension"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{ACDFDEFC-5FD7-487D-91DC-365235188666}]
@="TIGroupExplorer.Group"

**********************************************************************************
HKEY ROOT CLASSIDS:
**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
ati2cqag.dll Fri Oct 28 2005 6:16:02p A.... 237,568 232.00 K
ati2dvag.dll Fri Oct 28 2005 7:12:48p A.... 247,296 241.50 K
ati2edxx.dll Fri Oct 28 2005 7:07:36p A.... 40,960 40.00 K
ati2evxx.dll Fri Oct 28 2005 7:07:28p A.... 47,616 46.50 K
ati3duag.dll Fri Oct 28 2005 6:58:48p A.... 2,491,808 2.38 M
atiddc.dll Fri Oct 28 2005 7:06:00p A.... 53,248 52.00 K
atidemgr.dll Fri Oct 28 2005 9:13:40p A.... 258,048 252.00 K
atiiiexx.dll Fri Oct 28 2005 9:52:18p A.... 307,200 300.00 K
atikvmag.dll Fri Oct 28 2005 6:40:32p A.... 151,552 148.00 K
atioglx1.dll Fri Oct 28 2005 8:32:26p A.... 6,684,672 6.38 M
atioglxx.dll Fri Oct 28 2005 7:27:22p A.... 4,866,048 4.64 M
atipdlxx.dll Fri Oct 28 2005 7:08:00p A.... 110,592 108.00 K
atitvo32.dll Fri Oct 28 2005 6:21:16p A.... 17,408 17.00 K
ativvaxx.dll Fri Oct 28 2005 6:52:58p A.... 603,040 588.91 K
cdosys.dll Fri Sep 9 2005 5:53:42p A.... 2,067,968 1.97 M
cmdlin~1.dll Mon Sep 12 2005 1:17:34p A.... 98,304 96.00 K
gdi32.dll Wed Oct 5 2005 7:09:36p A.... 280,064 273.50 K
mshtml.dll Tue Oct 4 2005 4:26:00p A.... 3,015,168 2.88 M
oemdspif.dll Fri Oct 28 2005 7:07:50p A.... 77,824 76.00 K
shell32.dll Thu Sep 22 2005 7:05:30p A.... 8,450,560 8.06 M

20 items found: 20 files, 0 directories.
Total of file sizes: 30,106,944 bytes 28.71 M
Locate .tmp files:

C:\WINDOWS\SYSTEM32\
deskcp~1.tmp Sun Nov 27 2005 10:37:54p A.... 221,280 216.09 K

1 item found: 1 file, 0 directories.
Total of file sizes: 221,280 bytes 216.09 K
**********************************************************************************
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is 34E5-D50A

Directory of C:\WINDOWS\System32

12/03/2005 02:26 PM <DIR> DLLCACHE
08/21/2005 07:56 PM 80 9D525C4804.dll
10/28/2004 07:54 PM 1,890 KGyGaAvL.sys
04/24/2002 10:14 PM <DIR> Microsoft
2 File(s) 1,970 bytes
2 Dir(s) 5,773,037,568 bytes free

#22
Midnight364

Posted 05 December 2005 - 05:02 PM

Member

Topic Starter
Member
63 posts

and another HJT Log:

Logfile of HijackThis v1.99.1
Scan saved at 3:02:15 PM, on 12/5/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
C:\WINDOWS\System32\gearsec.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\mysql\bin\mysqld-nt.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Documents and Settings\Midnight\Desktop\Shortcuts\KeyCount\KeyCount.exe
C:\WINDOWS\system32\ATWTUSB.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\TBLMOUSE.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
C:\Program Files\Red Chair Software\Notmad Explorer\notmgr.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Norton AntiVirus\OPScan.exe
C:\Documents and Settings\Midnight\Desktop\Shortcuts\Anti-Spyware\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O1 - Hosts: 68.3.107.49 l2authd.lineage2.com
O3 - Toolbar: Systran40premi.IEPlugIn - {CFB25594-4D5F-11D6-AB7B-00B0D094B576} - C:\Program Files\Systran\4_0\Premium\IEPlugIn.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 -noicon
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Atwtusb] RUNDLL32 FuncKey.DLL,ExtFuncCall AA
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATI DeviceDetect] C:\Program Files\ATI Multimedia\\Program Files\ATI Multimedia\main\ATIDtct.EXE
O4 - HKLM\..\Run: [wtadd_KeyCount.exe] C:\Documents and Settings\Midnight\Desktop\Shortcuts\KeyCount\KeyCount.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [LDM] \Program\
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Notmad Manager.lnk = C:\Program Files\Red Chair Software\Notmad Explorer\notmgr.exe
O4 - Startup: Registration Prince of Persia Warrior Within.LNK = C:\Program Files\UBISOFT\Prince of Persia Warrior Within\Support\Register\RegistrationReminder.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: ImageFox.lnk.disabled
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microtek Scanner Finder.lnk = C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView5\NkvMon.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Free Surfer - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - C:\Program Files\Free Surfer\FS20.exe
O9 - Extra 'Tools' menuitem: Free Surfer - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - C:\Program Files\Free Surfer\FS20.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Chess - http://download.game...nts/y/ct0_x.cab
O16 - DPF: Yahoo! Literati - http://download.game...nts/y/tt0_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.game...ts/y/potc_x.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...ry/msgrchkr.cab
O16 - DPF: {05717986-A8C7-11D7-A03D-00104BCD089B} (W3IP Control) - http://www.w3ip.com/W3ip.cab
O16 - DPF: {12F7F128-B36C-4843-8AA4-A5F71A969331} (Launcher Control) - https://horizons.ist...ls/launcher.ocx
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...MineSweeper.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v43/yacscom.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...meInstaller.exe
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...StatsClient.cab
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://echat.us.del...t/TLIEFlash.CAB
O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn...eUC/MsnUpld.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/z...s/heartbeat.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/...ro.cab27513.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {BD5FBD60-8AA3-4060-92B9-A868B9FF2FCC} (Reversi Control) - http://mirror.worldw...rsi/reversi.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn...UC/MsnPUpld.cab
O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} (Live Collaboration) - http://liveca04.righ...l/java/RntX.cab
O18 - Protocol: bw+0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - Winlogon Notify: WB - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: CWShredder Service - Unknown owner - C:\Documents and Settings\Midnight\Desktop\cwshredder.exe (file missing)
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MySQL - Unknown owner - C:\mysql\bin\mysqld-nt.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)

#23
lovethepirk

Posted 05 December 2005 - 08:06 PM

Visiting Staff

Member
528 posts

Midnight,

Looks like we got that look2me infection...we need to delete that file you couldn't find though.

1) Open up killbox

2) Select "Delete on Reboot".

3) Copy the file names below to the clipboard by highlighting them and pressing Control-C:

C:\WINDOWS\System32\9D525C4804.dll

4) Return to Killbox, go to the File menu, and choose "Paste from Clipboard".

5) Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "Yes" to reboot next.

After the reboot please do this.

Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make sure that the following are selected:
- Scan using the following Anti-Virus database:
Extended (if available otherwise Standard)
- Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan:Select My Computer
This program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
- Now click on the Save as Text button:
Save the file to your desktop.
Copy and paste that information in your next post with another HJT log

#24
Midnight364

Posted 06 December 2005 - 11:50 PM

Member

Topic Starter
Member
63 posts

I'll have the scan results and new logs up sometime tomorrow....since it's taking multiple hours to complete the scan of my computer.

#25
lovethepirk

Posted 07 December 2005 - 12:01 AM

Visiting Staff

Member
528 posts

No problem :tazz:

I look forward to giving you a clean bill of health.

Edited by lovethepirk, 07 December 2005 - 12:01 AM.

#26
Midnight364

Posted 07 December 2005 - 01:52 AM

Member

Topic Starter
Member
63 posts

Okay, so the scan finished quicker than I anticipated. Here are the results:

-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Tuesday, December 06, 2005 23:48:00
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 7/12/2005
Kaspersky Anti-Virus database records: 153820
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - Folders:
C:\

Scan Statistics:
Total number of scanned objects: 210245
Number of viruses found: 55
Number of infected objects: 1023
Number of suspicious objects: 10
Duration of the scan process: 12473 sec

Infected Object Name - Virus Name
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ISearchTechISTsvc.zip/istsvc.exe Suspicious: Password-protected-EXE
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ISearchTechISTsvc.zip Suspicious: Password-protected-EXE
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ISearchTechSlotch1.zip/istsvc.exe Suspicious: Password-protected-EXE
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ISearchTechSlotch1.zip Suspicious: Password-protected-EXE
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ISTbarSlotch1.zip/istsvc.exe Suspicious: Password-protected-EXE
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ISTbarSlotch1.zip Suspicious: Password-protected-EXE
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ISTbarSlotch4.zip/istsvc.exe Suspicious: Password-protected-EXE
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ISTbarSlotch4.zip Suspicious: Password-protected-EXE
C:\Documents and Settings\All Users\Documents\Misc\orange_ripper.exe/WISE0018.BIN/data0005 Infected: Trojan-Downloader.Win32.Agent.ac
C:\Documents and Settings\All Users\Documents\Misc\orange_ripper.exe/WISE0018.BIN/data0006 Infected: Trojan-Downloader.Win32.Turown.i
C:\Documents and Settings\All Users\Documents\Misc\orange_ripper.exe/WISE0018.BIN/data0008 Infected: Trojan-Downloader.Win32.Turown.g
C:\Documents and Settings\All Users\Documents\Misc\orange_ripper.exe/WISE0018.BIN/data0011 Infected: Trojan-Downloader.Win32.Turown.i
C:\Documents and Settings\All Users\Documents\Misc\orange_ripper.exe/WISE0018.BIN/data0013 Infected: Trojan-Downloader.Win32.VB.cw
C:\Documents and Settings\All Users\Documents\Misc\orange_ripper.exe/WISE0018.BIN Infected: Trojan-Downloader.Win32.VB.cw
C:\Documents and Settings\All Users\Documents\Misc\orange_ripper.exe Infected: Trojan-Downloader.Win32.VB.cw
C:\Documents and Settings\Midnight\Desktop\Shortcuts\WestwoodSalons\SWiSHmax_Pre-Release_v2004.09.10_www.crack.cd_\cif.exe Infected: Trojan-Downloader.Win32.INService.gen
C:\Documents and Settings\Midnight\Desktop\Shortcuts\WestwoodSalons\SWiSHmax_Pre-Release_v2004.09.10_www.crack.cd_.zip/cif.exe Infected: Trojan-Downloader.Win32.INService.gen
C:\Documents and Settings\Midnight\Desktop\Shortcuts\WestwoodSalons\SWiSHmax_Pre-Release_v2004.09.10_www.crack.cd_.zip Infected: Trojan-Downloader.Win32.INService.gen
C:\Documents and Settings\Midnight\Desktop\Shortcuts\WestwoodSalons\SWiSHmax_v1.0_build_2003.09.03_www.crack.cd_\efo.exe Infected: Trojan-Downloader.Win32.INService.gen
C:\Documents and Settings\Midnight\Desktop\Shortcuts\WestwoodSalons\SWiSHmax_v1.0_build_2003.09.03_www.crack.cd_.zip/efo.exe Infected: Trojan-Downloader.Win32.INService.gen
C:\Documents and Settings\Midnight\Desktop\Shortcuts\WestwoodSalons\SWiSHmax_v1.0_build_2003.09.03_www.crack.cd_.zip Infected: Trojan-Downloader.Win32.INService.gen
C:\Documents and Settings\Midnight\Local Settings\Application Data\Identities\{EB187F76-71F6-4642-90B5-A8593A810903}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Sun, 8 Feb 2004 23:51:28 -0800]/UNNAMED/text.zip/text.scr Infected: Email-Worm.Win32.Mydoom.a
C:\Documents and Settings\Midnight\Local Settings\Application Data\Identities\{EB187F76-71F6-4642-90B5-A8593A810903}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Sun, 8 Feb 2004 23:51:28 -0800]/UNNAMED/text.zip Infected: Email-Worm.Win32.Mydoom.a
C:\Documents and Settings\Midnight\Local Settings\Application Data\Identities\{EB187F76-71F6-4642-90B5-A8593A810903}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Sun, 8 Feb 2004 23:51:28 -0800]/UNNAMED Infected: Email-Worm.Win32.Mydoom.a
C:\Documents and Settings\Midnight\Local Settings\Application Data\Identities\{EB187F76-71F6-4642-90B5-A8593A810903}\Microsoft\Outlook Express\Deleted Items.dbx Infected: Email-Worm.Win32.Mydoom.a
C:\Documents and Settings\Midnight\Local Settings\Application Data\Identities\{EB187F76-71F6-4642-90B5-A8593A810903}\Microsoft\Outlook Express\Sent Items.dbx/[From "Midnight" <[email protected]>][Date Sat, 21 May 2005 13:12:05 -0700]/UNNAMED/Adobe_Photoshop_CS_KeyGen_Activation.zip/oxv.exe Infected: Trojan-Downloader.Win32.INService.et
C:\Documents and Settings\Midnight\Local Settings\Application Data\Identities\{EB187F76-71F6-4642-90B5-A8593A810903}\Microsoft\Outlook Express\Sent Items.dbx/[From "Midnight" <[email protected]>][Date Sat, 21 May 2005 13:12:05 -0700]/UNNAMED/Adobe_Photoshop_CS_KeyGen_Activation.zip Infected: Trojan-Downloader.Win32.INService.et
C:\Documents and Settings\Midnight\Local Settings\Application Data\Identities\{EB187F76-71F6-4642-90B5-A8593A810903}\Microsoft\Outlook Express\Sent Items.dbx/[From "Midnight" <[email protected]>][Date Sat, 21 May 2005 13:12:05 -0700]/UNNAMED Infected: Trojan-Downloader.Win32.INService.et
C:\Documents and Settings\Midnight\Local Settings\Application Data\Identities\{EB187F76-71F6-4642-90B5-A8593A810903}\Microsoft\Outlook Express\Sent Items.dbx Infected: Trojan-Downloader.Win32.INService.et
C:\Documents and Settings\Midnight\Local Settings\Application Data\Identities\{F2795121-B2EE-4D7D-9AD5-FBCFD3ED9516}\Microsoft\Outlook Express\Inbox.dbx/[From Elizabeth Pyjov <[email protected]>][Date Thu, 11 Aug 2005 11:41:05 -0700 (PDT)]/UNNAMED/UNNAMED/[From [email protected]][Date Thu, 11 Aug 2005 09:38:33 -0400]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload
C:\Documents and Settings\Midnight\Local Settings\Application Data\Identities\{F2795121-B2EE-4D7D-9AD5-FBCFD3ED9516}\Microsoft\Outlook Express\Inbox.dbx/[From Elizabeth Pyjov <[email protected]>][Date Thu, 11 Aug 2005 11:41:05 -0700 (PDT)]/UNNAMED/UNNAMED/[From [email protected]][Date Thu, 11 Aug 2005 09:38:33 -0400]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload
C:\Documents and Settings\Midnight\Local Settings\Application Data\Identities\{F2795121-B2EE-4D7D-9AD5-FBCFD3ED9516}\Microsoft\Outlook Express\Inbox.dbx/[From Elizabeth Pyjov <[email protected]>][Date Thu, 11 Aug 2005 11:41:05 -0700 (PDT)]/UNNAMED/UNNAMED/[From [email protected]][Date Thu, 11 Aug 2005 09:38:33 -0400]/message.scr Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\Midnight\Local Settings\Application Data\Identities\{F2795121-B2EE-4D7D-9AD5-FBCFD3ED9516}\Microsoft\Outlook Express\Inbox.dbx/[From Elizabeth Pyjov <[email protected]>][Date Thu, 11 Aug 2005 11:41:05 -0700 (PDT)]/UNNAMED/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\Midnight\Local Settings\Application Data\Identities\{F2795121-B2EE-4D7D-9AD5-FBCFD3ED9516}\Microsoft\Outlook Express\Inbox.dbx/[From Elizabeth Pyjov <[email protected]>][Date Thu, 11 Aug 2005 11:41:05 -0700 (PDT)]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\Midnight\Local Settings\Application Data\Identities\{F2795121-B2EE-4D7D-9AD5-FBCFD3ED9516}\Microsoft\Outlook Express\Inbox.dbx/[From "Board" <[email protected]>][Date Fri, 12 Aug 2005 00:55:40 -0400]/html/Work/Taxes.exe Infected: Email-Worm.Win32.Bagle.cf
C:\Documents and Settings\Midnight\Local Settings\Application Data\Identities\{F2795121-B2EE-4D7D-9AD5-FBCFD3ED9516}\Microsoft\Outlook Express\Inbox.dbx/[From "Board" <[email protected]>][Date Fri, 12 Aug 2005 00:55:40 -0400]/html/Work Infected: Email-Worm.Win32.Bagle.cf
C:\Documents and Settings\Midnight\Local Settings\Application Data\Identities\{F2795121-B2EE-4D7D-9AD5-FBCFD3ED9516}\Microsoft\Outlook Express\Inbox.dbx/[From "Board" <[email protected]>][Date Fri, 12 Aug 2005 00:55:40 -0400]/html Infected: Email-Worm.Win32.Bagle.cf
C:\Documents and Settings\Midnight\Local Settings\Application Data\Identities\{F2795121-B2EE-4D7D-9AD5-FBCFD3ED9516}\Microsoft\Outlook Express\Inbox.dbx/[From "Boardandski" <[email protected]>][Date Fri, 12 Aug 2005 00:57:56 -0300]/html/Taxes.rar/Taxes.exe Infected: Email-Worm.Win32.Bagle.ch
C:\Documents and Settings\Midnight\Local Settings\Application Data\Identities\{F2795121-B2EE-4D7D-9AD5-FBCFD3ED9516}\Microsoft\Outlook Express\Inbox.dbx/[From "Boardandski" <[email protected]>][Date Fri, 12 Aug 2005 00:57:56 -0300]/html/Taxes.rar Infected: Email-Worm.Win32.Bagle.ch
C:\Documents and Settings\Midnight\Local Settings\Application Data\Identities\{F2795121-B2EE-4D7D-9AD5-FBCFD3ED9516}\Microsoft\Outlook Express\Inbox.dbx/[From "Boardandski" <[email protected]>][Date Fri, 12 Aug 2005 00:57:56 -0300]/html Infected: Email-Worm.Win32.Bagle.ch
C:\Documents and Settings\Midnight\Local Settings\Application Data\Identities\{F2795121-B2EE-4D7D-9AD5-FBCFD3ED9516}\Microsoft\Outlook Express\Inbox.dbx/[From eBay <[email protected]>][Date Tue, 30 Aug 2005 02:29:33 -0300]/UNNAMED/html Infected: Trojan-Spy.HTML.Bayfraud.hl
C:\Documents and Settings\Midnight\Local Settings\Application Data\Identities\{F2795121-B2EE-4D7D-9AD5-FBCFD3ED9516}\Microsoft\Outlook Express\Inbox.dbx/[From eBay <[email protected]>][Date Tue, 30 Aug 2005 02:29:33 -0300]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hl
C:\Documents and Settings\Midnight\Local Settings\Application Data\Identities\{F2795121-B2EE-4D7D-9AD5-FBCFD3ED9516}\Microsoft\Outlook Express\Inbox.dbx Infected: Trojan-Spy.HTML.Bayfraud.hl
C:\Program Files\Daily Weather Forecast\weather.exe Infected: Trojan-Downloader.Win32.Centim.an
C:\Program Files\Norton AntiVirus\Quarantine\009A4C9C.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\00F13F7D.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\00F530F0.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\013A73F3.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\01644827.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\02334EFA.exe Infected: Trojan-Dropper.Win32.Pincher.a
C:\Program Files\Norton AntiVirus\Quarantine\02A7474F.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\03087811.exe Infected: Trojan-Dropper.Win32.Pincher.a
C:\Program Files\Norton AntiVirus\Quarantine\032045FF.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\03B76F4B.dll Infected: Backdoor.Win32.SubSeven.22.plugin
C:\Program Files\Norton AntiVirus\Quarantine\03B76F4B.exe Infected: Backdoor.Win32.SubSeven.22.a
C:\Program Files\Norton AntiVirus\Quarantine\043E51E7.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\049B28EB.tmp Infected: HackTool.Win32.AOLHack.b
C:\Program Files\Norton AntiVirus\Quarantine\04C031C2.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\05481F58.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\05607720.exe Infected: Trojan-Downloader.Win32.IstBar.gen
C:\Program Files\Norton AntiVirus\Quarantine\058E793D.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\05F56229.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\064F7153.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\06821106.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\06966771.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\06E8070E.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\075269E8.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\077D79D6.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\078023D2.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\07834DCE.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\078677CB.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\078A21C7.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\078D4BC4.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\079075C0.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\07931FBD.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\079749B9.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\079A73B5.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\079D1DB2.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\079E5CB9.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\07A147AE.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\07AF13F7.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\07B44399.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\07B76D95.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\07BB1791.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\08570628.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\092B04BF.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\09342388.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\0A5060C3.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\0A6812F6.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\0AC903CD.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\0ADD5178.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\0AF71711.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\0B0566B6.dll Infected: Trojan.Win32.Dialer.ks
C:\Program Files\Norton AntiVirus\Quarantine\0B0910B3.exe Infected: Trojan-Downloader.Win32.Dyfuca.ei
C:\Program Files\Norton AntiVirus\Quarantine\0B130EA8.exe Infected: Trojan-Dropper.Win32.Small.fl
C:\Program Files\Norton AntiVirus\Quarantine\0B28108C.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\0B44255B.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\0B4B7B75.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\0C5D18EA.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\0C8F5D8C.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\0D063FC9.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\0D29373C.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\0DD90AEE.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\0DDD56A2.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\0E1B0C30.dll Infected: Backdoor.Win32.SubSeven.22.plugin
C:\Program Files\Norton AntiVirus\Quarantine\0E8600F3.tmp Infected: Trojan-Dropper.Win32.Pincher.a
C:\Program Files\Norton AntiVirus\Quarantine\0EB85C79.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\0EBE2EB4.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\0F2063A7.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\0FB9297E.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\0FC832E6.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\0FCD2678.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\10313398.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\10B31D75.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\10B901C2.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\112948A3.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\11AC56FD.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\11B57426.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\11BF5546.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\12124D05.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\1278430C.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\129D105F.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\12E06D02.tmp Infected: Trojan-Downloader.Win32.Bagle.g
C:\Program Files\Norton AntiVirus\Quarantine\1303490E.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\130A658D.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\130B67D7.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\13442C58.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\14247B16.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\149709CC.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\14AB0D88.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\150054DB.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\15A67B01.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\15DE00B0.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\16281C01.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\16355D39.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\166F6B52.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\168264EF.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\16D56159.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\16E12E15.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\177C4A74.dll Infected: Backdoor.Win32.SubSeven.22.plugin
C:\Program Files\Norton AntiVirus\Quarantine\17983A2D.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\189A1EBD.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\18FB51F3.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\19934F44.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\199A6BC3.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\1B34784E.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\1BD81C56.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\1CE44DFC.dll Infected: Backdoor.Win32.SubSeven.22.plugin
C:\Program Files\Norton AntiVirus\Quarantine\1CE75623.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\1CFF52AC.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\1D303567.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\1D3C12FC.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\1D522CE2.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\1DDE625F.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\1E097F0B.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\1E2F055F.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\1EDE6D23.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\1F2E5557.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\1F81694D.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\1FA61DDF.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\1FFA0C58.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\20104B85.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\202E254F.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\205D7009.dll Infected: Trojan.Win32.Delf.pu
C:\Program Files\Norton AntiVirus\Quarantine\20601A05.dll Infected: Trojan.Win32.Delf.pu
C:\Program Files\Norton AntiVirus\Quarantine\20955421.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\212D7547.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\21660087.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\21A84818.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\221A14AF.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\22651D58.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\22D82DC3.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\23723012.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\237A051B.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\24327384.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\249745DB.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\250C0414.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\250F669A.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\26BE1A73.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\272A7132.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\276F1A09.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\2770706F.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\28594F07.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\28CD4EFB.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\29334502.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\29D250A7.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\29E81D89.tmp Infected: Email-Worm.Win32.Bagle.ei
C:\Program Files\Norton AntiVirus\Quarantine\2A0756EF.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\2A6A6E74.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\2AB40E8E.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\2B596B1E.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\2BBB1CEF.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\2BC91117.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\2BCE0B26.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\2CB35CBB.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\2D492BDB.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\2D4A7462.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\2DF65957.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\2E6E07E0.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\2E8C0E0C.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\2EE300ED.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\2EE44864.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\2F5A3393.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\30724948.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\30800FBC.exe Infected: Backdoor.Win32.Bifrose.d
C:\Program Files\Norton AntiVirus\Quarantine\309A08BE.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\31475E59.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\31AA2052.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\32D96B06.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\333B60C8.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\33504ED0.exe Infected: Backdoor.Win32.Delf.ez
C:\Program Files\Norton AntiVirus\Quarantine\33E14FA0.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\34077E07.exe Infected: Trojan-Downloader.Win32.INService.bl
C:\Program Files\Norton AntiVirus\Quarantine\34455CC0.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\345D0AF9.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\348928E1.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\35297708.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\35A15567.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\3660701F.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\36651B86.dll Infected: Backdoor.Win32.SubSeven.22.plugin
C:\Program Files\Norton AntiVirus\Quarantine\37093E0B.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\37241A27.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\372562AE.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\37D352BC.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\38422233.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\3861285F.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\38BF36B0.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\391B51FC.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\39C17822.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\39EC0B5D.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\3A4C305D.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\3A9743FF.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\3B0014F0.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\3B1C78AC.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\3B4414A3.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\3BB2374E.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\3C1F7D8D.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\3C9B3DD9.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\3CAA1DE9.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\3CE21922.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\3D132517.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\3DAF14EB.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\3DB17661.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\3DC311E5.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\3DEF114C.dll Infected: Backdoor.Win32.SubSeven.22.plugin
C:\Program Files\Norton AntiVirus\Quarantine\3E204B0B.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\3E291007.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\3E41419B.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\3F384043.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\3F7245BD.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\3F84262D.dll Infected: Backdoor.Win32.SubSeven.22.plugin
C:\Program Files\Norton AntiVirus\Quarantine\3F84262D.exe Infected: Backdoor.Win32.SubSeven.22.a
C:\Program Files\Norton AntiVirus\Quarantine\3F875029.dll Infected: Backdoor.Win32.SubSeven.22.plugin
C:\Program Files\Norton AntiVirus\Quarantine\3F8B7A25.dll Infected: Backdoor.Win32.SubSeven.22.plugin
C:\Program Files\Norton AntiVirus\Quarantine\3F8B7A25.exe Infected: Backdoor.Win32.SubSeven.22
C:\Program Files\Norton AntiVirus\Quarantine\3F8E2422.exe Infected: Backdoor.Win32.SubSeven.22.a
C:\Program Files\Norton AntiVirus\Quarantine\3FA83596.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\3FED46F8.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\3FF228BB.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\40543CFF.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\408D27D3.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\40BA3307.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\40F50A7E.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\40FA7D01.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\40FE2947.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\413019CF.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\4146322E.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\418D7129.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\42173C86.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\42915A4D.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\42F3164B.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\43961275.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\44183375.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\44281EA9.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\447F2454.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\44AA71DF.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\44D04588.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\45496203.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\457C475B.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\458751A1.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\459A420D.exe Infected: Trojan-Downloader.Win32.Small.bp
C:\Program Files\Norton AntiVirus\Quarantine\46893631.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\47893AB0.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\478A0336.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\4794023B.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\48C3326A.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\49061C3F.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\492639BE.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\49D131BF.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\49F2576F.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\4AD91793.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\4B053422.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\4B384661.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\4B7E02F6.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\4B876D2D.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\4BE478FE.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\4BEB56D9.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\4CB0650D.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\4CD12E93.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\4D61158C.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\4D7745A0.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\4E7E179B.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\4E7F0C32.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\4F5517FB.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\4FBE343D.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\50092C23.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\50F2189A.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\510D035A.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\516428FC.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\51657182.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\51691C8E.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\53026F80.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\537530B3.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\54B405DF.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\54EC26FA.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\55273097.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\55625B79.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\55A24626.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\567258B6.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\567B4CA9.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\56FC6278.dll Infected: Backdoor.Win32.SubSeven.22.b2
C:\Program Files\Norton AntiVirus\Quarantine\57565DE8.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\57DA2B04.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\57E60606.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\580E0CC9.tmp Infected: Trojan-Dropper.Win32.Pincher.a
C:\Program Files\Norton AntiVirus\Quarantine\5840210C.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\585D2FE4.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\587F63BD.exe Infected: Trojan-Downloader.Win32.IstBar.ll
C:\Program Files\Norton AntiVirus\Quarantine\58A74FFE.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\594B2C8E.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\5966300B.exe Infected: Trojan-Clicker.Win32.VB.al
C:\Program Files\Norton AntiVirus\Quarantine\59C22680.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\59C7208F.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\5B38434F.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\5B416218.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\5B4633C7.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\5C374951.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\5C5D1F53.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\5C7F4F7C.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\5C9D3F59.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\5CB04D6B.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\5CB223EA.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\5CD6425D.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\5CD709D3.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\5D364F1C.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\5DB01D63.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\5DDF1F3E.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\5E672D7E.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\5E9D1C1C.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\5EAF6D5B.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\5F137E59.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\5F3675CC.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\5F534D62.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\5FAE3D53.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\60202ACA.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\60C94505.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\61141B8B.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\6158121A.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\61D2477A.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\61D73B0C.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\61E929AD.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\623B482C.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\630570FB.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\639416D6.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\63C332B7.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\64C95401.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\6510079E.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\65157A21.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\65264E59.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\655D0552.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\65990699.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\659B5F1E.exe Infected: Trojan-Spy.Win32.Small.dg
C:\Program Files\Norton AntiVirus\Quarantine\65A91D22.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\65E37ACF.exe Infected: Trojan-Downloader.Win32.Small.bnt
C:\Program Files\Norton AntiVirus\Quarantine\65E37ACF.txt Infected: Trojan-Downloader.Win32.Small.bnt
C:\Program Files\Norton AntiVirus\Quarantine\65E624CC.txt Infected: Trojan-Downloader.Win32.Small.bnt
C:\Program Files\Norton AntiVirus\Quarantine\65F34CBD.exe Infected: Trojan-Downloader.Win32.Small.bnt
C:\Program Files\Norton AntiVirus\Quarantine\65F34CBD.txt Infected: Trojan-Downloader.Win32.Small.bnt
C:\Program Files\Norton AntiVirus\Quarantine\65F776BA.exe Infected: Trojan-Downloader.Win32.Small.bnt
C:\Program Files\Norton AntiVirus\Quarantine\65F776BA.txt Infected: Trojan-Downloader.Win32.Small.bnt
C:\Program Files\Norton AntiVirus\Quarantine\65FA20B6.exe Infected: Trojan-Downloader.Win32.Small.bnt
C:\Program Files\Norton AntiVirus\Quarantine\65FA20B6.txt Infected: Trojan-Downloader.Win32.Small.bnt
C:\Program Files\Norton AntiVirus\Quarantine\66366FEF.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\66741F5E.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\66B2781F.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\670D136B.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\67924062.exe Infected: Trojan-Downloader.Win32.VB.ri
C:\Program Files\Norton AntiVirus\Quarantine\679C3E58.exe Infected: Trojan-Downloader.Win32.TSUpdate.o
C:\Program Files\Norton AntiVirus\Quarantine\679F6854.exe Infected: not-virus:Hoax.Win32.Renos.ac
C:\Program Files\Norton AntiVirus\Quarantine\67A21250.exe Infected: Trojan-Downloader.Win32.Adload.j
C:\Program Files\Norton AntiVirus\Quarantine\67A21250.txt Infected: not-virus:Hoax.Win32.Renos.ac
C:\Program Files\Norton AntiVirus\Quarantine\67A53C4D.txt Infected: Trojan-Downloader.Win32.Adload.j
C:\Program Files\Norton AntiVirus\Quarantine\67B00F95.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\682D7B57.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\68421BCA.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\684427C8.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\687C0BC8.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\68967778.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\68D8279C.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\68DA70D1.dll Infected: Backdoor.Win32.SubSeven.22.plugin
C:\Program Files\Norton AntiVirus\Quarantine\68EB42A8.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\696C2770.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\699E24C5.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\6A942718.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\6B066687.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\6B2826EC.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\6BA40057.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\6BAF7F5C.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\6BBC26C0.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\6C6B739F.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6C6E1D9C.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6C724798.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6C757195.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6C781B91.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6C821986.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6C854383.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6C886D7F.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6C8C177B.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6C8F4178.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6C961571.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6C993F6D.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6C9C6969.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6C9F1366.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6CA33D62.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6CA6675F.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6CA9115B.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6CAC3B57.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6CB06554.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6CB30F50.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6CB6394D.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6CB77936.tmp Infected: Trojan-Downloader.Java.OpenStream.w
C:\Program Files\Norton AntiVirus\Quarantine\6CB96349.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6CBA2332.tmp Infected: Trojan-Downloader.Java.OpenStream.w
C:\Program Files\Norton AntiVirus\Quarantine\6CBD0D45.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6CC03742.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6CC3613E.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6CC60B3B.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6CCD5F34.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6CD00930.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6CD4332C.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6CD75D29.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6CDA0725.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\6CE03C06.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\6D3D101C.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\6D4136DE.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\6D687D2B.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\6D94715A.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\6EF0686D.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\6EF16AB7.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\6F235B3F.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\6F3C1D9A.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\6F611909.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\70097DF6.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\70E801B7.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\70FC2D38.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\718B7DE1.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\720A74E4.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\721D0A15.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\729D334F.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\73BE3756.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\74242D5E.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\747279AB.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\74B44355.exe Infected: Trojan.Win32.Dialer.mi
C:\Program Files\Norton AntiVirus\Quarantine\75026561.dll Infected: Backdoor.Win32.SubSeven.22.plugin
C:\Program Files\Norton AntiVirus\Quarantine\757C44A6.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\75825019.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\758419AF.dll Infected: Trojan-Downloader.Win32.Delf.wp
C:\Program Files\Norton AntiVirus\Quarantine\7690086D.exe Infected: Trojan-Downloader.Win32.Small.bnt
C:\Program Files\Norton AntiVirus\Quarantine\77197B2E.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\7720169D.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\77C926AC.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\78074467.dll Infected: Trojan-Downloader.Win32.Delf.pa
C:\Program Files\Norton AntiVirus\Quarantine\78CF02FF.dll Infected: Trojan-Downloader.Win32.Delf.h
C:\Program Files\Norton AntiVirus\Quarantine\78FE498B.dll Infected: Trojan-Downloader.Win32.Delf.wp

#27
Midnight364

Posted 07 December 2005 - 01:53 AM

Midnight364

Member

Topic Starter

Member

63 posts

And here is a new HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 11:52:49 PM, on 12/6/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
C:\WINDOWS\System32\gearsec.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\mysql\bin\mysqld-nt.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\system32\ATWTUSB.EXE
C:\Documents and Settings\Midnight\Desktop\Shortcuts\KeyCount\KeyCount.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\TBLMOUSE.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
C:\Program Files\Nikon\NkView5\NkvMon.exe
C:\Program Files\Red Chair Software\Notmad Explorer\notmgr.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Systran\4_0\Premium\SYSTRA~1.EXE
C:\Program Files\Adobe\Acrobat 6.0\Distillr\AcroDist.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Midnight\Desktop\Shortcuts\Anti-Spyware\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O1 - Hosts: 68.3.107.49 l2authd.lineage2.com
O3 - Toolbar: Systran40premi.IEPlugIn - {CFB25594-4D5F-11D6-AB7B-00B0D094B576} - C:\Program Files\Systran\4_0\Premium\IEPlugIn.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 -noicon
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Atwtusb] RUNDLL32 FuncKey.DLL,ExtFuncCall AA
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATI DeviceDetect] C:\Program Files\ATI Multimedia\\Program Files\ATI Multimedia\main\ATIDtct.EXE
O4 - HKLM\..\Run: [wtadd_KeyCount.exe] C:\Documents and Settings\Midnight\Desktop\Shortcuts\KeyCount\KeyCount.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [LDM] \Program\
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Notmad Manager.lnk = C:\Program Files\Red Chair Software\Notmad Explorer\notmgr.exe
O4 - Startup: Registration Prince of Persia Warrior Within.LNK = C:\Program Files\UBISOFT\Prince of Persia Warrior Within\Support\Register\RegistrationReminder.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: ImageFox.lnk.disabled
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microtek Scanner Finder.lnk = C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView5\NkvMon.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Free Surfer - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - C:\Program Files\Free Surfer\FS20.exe
O9 - Extra 'Tools' menuitem: Free Surfer - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - C:\Program Files\Free Surfer\FS20.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Chess - http://download.game...nts/y/ct0_x.cab
O16 - DPF: Yahoo! Literati - http://download.game...nts/y/tt0_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.game...ts/y/potc_x.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...ry/msgrchkr.cab
O16 - DPF: {05717986-A8C7-11D7-A03D-00104BCD089B} (W3IP Control) - http://www.w3ip.com/W3ip.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {12F7F128-B36C-4843-8AA4-A5F71A969331} (Launcher Control) - https://horizons.ist...ls/launcher.ocx
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...MineSweeper.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v43/yacscom.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...meInstaller.exe
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...StatsClient.cab
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://echat.us.del...t/TLIEFlash.CAB
O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn...eUC/MsnUpld.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/z...s/heartbeat.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/...ro.cab27513.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {BD5FBD60-8AA3-4060-92B9-A868B9FF2FCC} (Reversi Control) - http://mirror.worldw...rsi/reversi.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn...UC/MsnPUpld.cab
O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} (Live Collaboration) - http://liveca04.righ...l/java/RntX.cab
O18 - Protocol: bw+0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - Winlogon Notify: WB - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: CWShredder Service - Unknown owner - C:\Documents and Settings\Midnight\Desktop\cwshredder.exe (file missing)
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MySQL - Unknown owner - C:\mysql\bin\mysqld-nt.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)

0

#28
lovethepirk

Posted 07 December 2005 - 09:48 PM

lovethepirk

Visiting Staff

Member

528 posts

Let's flush out some of those bad files that are quarantined....

1) Open Norton
2) Click "Reports"
3) Click "View Quarantined Items"
4) Select all the items in the quarantine area and click "delete item"

1) Open up Spybot so we can delete the infected backups it has made.
2) Click Recovery
3) Check mark every item in the bottom box.
4) Click "Purge Selected Items"

To make sure you can see all hidden files, please follow the directions here

Then navigate to these files and delete them:
C:\Documents and Settings\All Users\Documents\Misc\orange_ripper.exe
C:\Documents and Settings\Midnight\Desktop\Shortcuts\WestwoodSalons\SWiSHmax_Pre-Release_v2004.09.10_www.crack.cd_.zip

Now you have several infected objects in your Outlook Express folder...you need to navigate to and delete the infected objects that Kaspersky warned about above.

After you have done all that please reboot and post anothe HJT log and let me know how things are.

BTW...be careful what you download from on now...for instance that orange ripper program is riddled with spyware.

0

#29
Midnight364

Posted 13 December 2005 - 01:43 AM

Midnight364

Member

Topic Starter

Member

63 posts

Great, everything seems to be running nice and cleanly now. No more spyware or hijacks.
The only thing that is still bothering me is that initial problem i mentioned in the beginning, about my "Desktop Properties" window being locked up so I can't change the background in that particular window.

I don't even remember what that orange ripper thing was for. I think it was a MP3 encoder or something. Either way, I deleted that and the Spybot/Norton backups. The only thing I couldn't delete were the e-mails because they're part of massive Outlook e-mail package files.

Thanks for your help, here's a final HJT log:
(let me know if you can help me figure out the desktop change thing..)

Logfile of HijackThis v1.99.1
Scan saved at 11:40:31 PM, on 12/12/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
C:\WINDOWS\System32\gearsec.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\mysql\bin\mysqld-nt.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Documents and Settings\Midnight\Desktop\Shortcuts\KeyCount\KeyCount.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\ATWTUSB.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\TBLMOUSE.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
C:\Program Files\Nikon\NkView5\NkvMon.exe
C:\Program Files\Red Chair Software\Notmad Explorer\notmgr.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Norton AntiVirus\OPScan.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Midnight\Desktop\Shortcuts\Anti-Spyware\hijackthis\HijackThis.exe
C:\Program Files\Trillian\trillian.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O1 - Hosts: 68.3.107.49 l2authd.lineage2.com
O3 - Toolbar: Systran40premi.IEPlugIn - {CFB25594-4D5F-11D6-AB7B-00B0D094B576} - C:\Program Files\Systran\4_0\Premium\IEPlugIn.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 -noicon
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Atwtusb] RUNDLL32 FuncKey.DLL,ExtFuncCall AA
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATI DeviceDetect] C:\Program Files\ATI Multimedia\\Program Files\ATI Multimedia\main\ATIDtct.EXE
O4 - HKLM\..\Run: [wtadd_KeyCount.exe] C:\Documents and Settings\Midnight\Desktop\Shortcuts\KeyCount\KeyCount.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [LDM] \Program\
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Notmad Manager.lnk = C:\Program Files\Red Chair Software\Notmad Explorer\notmgr.exe
O4 - Startup: Registration Prince of Persia Warrior Within.LNK = C:\Program Files\UBISOFT\Prince of Persia Warrior Within\Support\Register\RegistrationReminder.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: ImageFox.lnk.disabled
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microtek Scanner Finder.lnk = C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView5\NkvMon.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Free Surfer - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - C:\Program Files\Free Surfer\FS20.exe
O9 - Extra 'Tools' menuitem: Free Surfer - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - C:\Program Files\Free Surfer\FS20.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Chess - http://download.game...nts/y/ct0_x.cab
O16 - DPF: Yahoo! Literati - http://download.game...nts/y/tt0_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.game...ts/y/potc_x.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...ry/msgrchkr.cab
O16 - DPF: {05717986-A8C7-11D7-A03D-00104BCD089B} (W3IP Control) - http://www.w3ip.com/W3ip.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {12F7F128-B36C-4843-8AA4-A5F71A969331} (Launcher Control) - https://horizons.ist...ls/launcher.ocx
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...MineSweeper.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v43/yacscom.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...meInstaller.exe
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...StatsClient.cab
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://echat.us.del...t/TLIEFlash.CAB
O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn...eUC/MsnUpld.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/z...s/heartbeat.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/...ro.cab27513.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {BD5FBD60-8AA3-4060-92B9-A868B9FF2FCC} (Reversi Control) - http://mirror.worldw...rsi/reversi.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn...UC/MsnPUpld.cab
O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} (Live Collaboration) - http://liveca04.righ...l/java/RntX.cab
O18 - Protocol: bw+0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {04ABCCDD-203A-40B2-9737-695F13122640} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - Winlogon Notify: WB - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: CWShredder Service - Unknown owner - C:\Documents and Settings\Midnight\Desktop\cwshredder.exe (file missing)
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MySQL - Unknown owner - C:\mysql\bin\mysqld-nt.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)

0

#30
lovethepirk

Posted 13 December 2005 - 09:09 AM

lovethepirk

Visiting Staff

Member

528 posts

Midnight,

Good to hear things are better. If you can try to open your inbox of Outlook Express and remove the emails from users in the kaspersky report.
For example : "[From "Midnight" <[email protected]>][Date Sat, 21 May 2005 13:12:05 -0700]/UNNAMED"

Then let's try to get your desktop properties back

Download smitRem.exe and save the file to your desktop.
Double click on the file to extract it to it's own folder on the desktop.

Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen. Your desktop and icons will disappear and then reappear again --- this is normal.
Wait for the tool to complete and Disk Cleanup to finish --- this may take a while; please be patient.

Next go to Start -> Control Panel, click Display -> Desktop -> Customize Desktop -> Web -> Uncheck "Security Info" if present.

Reboot your computer now.

How is it now?

Thanks,

LTP

0

Prev

Page 2 of 2

1

2

Back to Virus, Spyware, Malware Removal · Next Unread Topic →

Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Reply to quoted posts Clear

Geeks to Go Community

→ Security

→ Virus, Spyware, Malware Removal

As Featured On:

Geeks to Go Blog

Community

Sign In

Create Account

Geeks to Go Forum 343,324 topics
Quick Links FAQ Malware Cleaning Guide How it Works

Downloads 2+ million
-->

Search Advanced

Search section:

Google
This topic

Forums

Members

Help Files

Downloads

View New Content

Firefox and Other System Utilities Hijacked

#16
Midnight364

Posted 03 December 2005 - 09:51 AM

Advertisements

#17
Midnight364

Posted 03 December 2005 - 09:54 AM

#18
lovethepirk

Posted 03 December 2005 - 07:09 PM

#19
Midnight364

Posted 05 December 2005 - 03:51 AM

#20
lovethepirk

Posted 05 December 2005 - 09:44 AM

#21
Midnight364

Posted 05 December 2005 - 05:01 PM

#22
Midnight364

Posted 05 December 2005 - 05:02 PM

#23
lovethepirk

Posted 05 December 2005 - 08:06 PM

#24
Midnight364

Posted 06 December 2005 - 11:50 PM

#25
lovethepirk

Posted 07 December 2005 - 12:01 AM

Advertisements

#26
Midnight364

Posted 07 December 2005 - 01:52 AM

#27
Midnight364

Posted 07 December 2005 - 01:53 AM

#28
lovethepirk

Posted 07 December 2005 - 09:48 PM

#29
Midnight364

Posted 13 December 2005 - 01:43 AM

#30
lovethepirk

Posted 13 December 2005 - 09:09 AM

Similar Topics

0 user(s) are reading this topic

As Featured On:

Forums

Downloads

Members

Connect With Us

Firefox and Other System Utilities Hijacked

#16 Midnight364 Posted 03 December 2005 - 09:51 AM

Advertisements

#17 Midnight364 Posted 03 December 2005 - 09:54 AM

#18 lovethepirk Posted 03 December 2005 - 07:09 PM

#19 Midnight364 Posted 05 December 2005 - 03:51 AM

#20 lovethepirk Posted 05 December 2005 - 09:44 AM

#21 Midnight364 Posted 05 December 2005 - 05:01 PM

#22 Midnight364 Posted 05 December 2005 - 05:02 PM

#23 lovethepirk Posted 05 December 2005 - 08:06 PM

#24 Midnight364 Posted 06 December 2005 - 11:50 PM

#25 lovethepirk Posted 07 December 2005 - 12:01 AM

Advertisements

#26 Midnight364 Posted 07 December 2005 - 01:52 AM

#27 Midnight364 Posted 07 December 2005 - 01:53 AM

#28 lovethepirk Posted 07 December 2005 - 09:48 PM

#29 Midnight364 Posted 13 December 2005 - 01:43 AM

#30 lovethepirk Posted 13 December 2005 - 09:09 AM

Similar Topics

0 user(s) are reading this topic

As Featured On:

Forums

Downloads

Members

Connect With Us

Sign In

#16
Midnight364

Posted 03 December 2005 - 09:51 AM

#17
Midnight364

Posted 03 December 2005 - 09:54 AM

#18
lovethepirk

Posted 03 December 2005 - 07:09 PM

#19
Midnight364

Posted 05 December 2005 - 03:51 AM

#20
lovethepirk

Posted 05 December 2005 - 09:44 AM

#21
Midnight364

Posted 05 December 2005 - 05:01 PM

#22
Midnight364

Posted 05 December 2005 - 05:02 PM

#23
lovethepirk

Posted 05 December 2005 - 08:06 PM

#24
Midnight364

Posted 06 December 2005 - 11:50 PM

#25
lovethepirk

Posted 07 December 2005 - 12:01 AM

#26
Midnight364

Posted 07 December 2005 - 01:52 AM

#27
Midnight364

Posted 07 December 2005 - 01:53 AM

#28
lovethepirk

Posted 07 December 2005 - 09:48 PM

#29
Midnight364

Posted 13 December 2005 - 01:43 AM

#30
lovethepirk

Posted 13 December 2005 - 09:09 AM