# Solved: Need help please, hjt and combofix log incl.



## dragnstyl33 (Nov 18, 2006)

I think I have the virus bursters and malware virus/trojan. Comp is really slow and constant alert about critical system errors.

Logfile of HijackThis v1.99.1
Scan saved at 1:38:38 PM, on 11/19/2006
Platform: Windows XP SP2, v.2149 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2149)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Batty2\Batty2.exe
C:\Documents and Settings\Noom\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
F3 - REG:win.ini: run=C:\WINDOWS\inet20004\services.exe
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O3 - Toolbar: Protection Bar - {74a49269-9779-48b4-a0e6-3a5af2a3ade6} - C:\Program Files\Super Codec\iesplugin.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\dllcache\tintsetp.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\dllcache\tintsetp.exe /IMEName
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [iRiver Updater] \Updater.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [tgcmd] "c:\Program Files\Adelphia HSAgent\bin\tgcmd.exe" /server /startmonitor /deaf 
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1162186374\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [UpdateService] C:\WINDOWS\system32\wservice.exe
O4 - HKLM\..\Run: [ms] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\8394\gm.exe
O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inet20004\services.exe
O4 - HKLM\..\Run: [tea0f3dc] RUNDLL32.EXE w3dad4f6.dll,n 0070f3d5000000053dad4f6
O4 - HKLM\..\Run: [lqkpmisA] C:\WINDOWS\lqkpmisA.exe
O4 - HKLM\..\Run: [TheMonitor] C:\WINDOWS\Sloopy7.exe
O4 - HKLM\..\Run: [Microsoft WWW] C:\WINDOWS\inet20004\free.exe 
O4 - HKLM\..\Run: [System] C:\WINDOWS\system32\kernels88.exe
O4 - HKLM\..\Run: [ms0571997-7364] C:\WINDOWS\ms0571997-7364.exe
O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\system32\kernels88.exe
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [UpdateService] C:\WINDOWS\system32\wservice.exe
O4 - HKCU\..\Run: [taskdir] C:\WINDOWS\system32\taskdir.exe
O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inet20004\services.exe
O4 - HKCU\..\Run: [PSCastor] "C:\Program Files\PSCastor\PSCastor.exe"
O4 - HKCU\..\Run: [WinMedia] C:\WINDOWS\jqx64712451.exe
O4 - HKCU\..\Run: [CMIntex] "C:\Program Files\CMIntex\CMIntex.exe"
O4 - HKCU\..\Run: [Key] C:\DOCUME~1\Noom\LOCALS~1\Temp\35.tmp
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Run Google Web Accelerator.lnk = C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
O4 - Global Startup: wupdmgr.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.adelphia.net/sdccommon/download/tgctlins.cab
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish.com/SnapfishActivia.cab
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} - http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://www.vzwpix.com/activex/VerizonWirelessUploadControl.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {C915801D-6F00-49CD-8A9A-8DE5C11ADDC1} (Pixami Drag/Drop Upload UI Control) - http://www.photoworks.com/pixami/DragDropUploader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{952A9AC8-A5CF-4D22-99EB-FC83496CA1F2}: NameServer = 152.158.2.48
O17 - HKLM\System\CCS\Services\Tcpip\..\{FAAD30F5-4BD7-442F-94AB-A65BDC73BBF8}: NameServer = 152.158.2.48
O18 - Filter: text/html - {994D478A-45D0-4DB4-AE27-738B1E346F99} - C:\Program Files\Batty2\Batty2.dll
O20 - AppInit_DLLs: c:\windows\system32\ldcore.dll,BattyRun2.dll
O21 - SSODL: cussers - {ff170564-36c8-43f7-9100-559e166405cf} - C:\WINDOWS\system32\cfltygd.dll
O21 - SSODL: DCOM Server 3339 - {2C1CD3D7-86AC-4068-93BC-A02304BB3339} - C:\WINDOWS\system32\qbhtpcz.dll
O21 - SSODL: DCOM Server 2236 - {2C1CD3D7-86AC-4068-93BC-A02304BB2236} - C:\WINDOWS\system32\oivyba.dll
O23 - Service: Microsoft ASPI Manager (aspi113210) - Unknown owner - C:\WINDOWS\system32\aspi1879611.exe (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\lqkpmis.exe


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

Welcome to TSG.


Please download *Combofix* to your desktop from *Here* or *Here*: 
Double click *combofix.exe * and follow the prompts.
When finished, it shall produce a log for you. Post that log and a *HiJackthis* log in your next reply
*Note: Do not mouseclick combofix's window while its running. That may cause it to stall*


----------



## dragnstyl33 (Nov 18, 2006)

okay, so I downloaded combo fix and this is the log that it provided. Along with this I also included the Hijackthis log.

ComboFix Log

Noom - 06-11-20 13:17:44.61 Service Pack 2, v.2149
ComboFix 06.11.9 - Running from: "C:\Documents and Settings\Noom\Desktop"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\Documents and Settings\Noom\Application Data\Install.dat
C:\WINDOWS\offun.exe
C:\WINDOWS\system32\tpuninstall.exe
C:\Program Files\Common Files\download
C:\Program Files\Common Files\inetget
C:\Program Files\Common Files\inetget2
C:\Program Files\Common Files\windows
C:\Program Files\cmfibula
C:\Program Files\Common Files\inetget 
C:\Program Files\batty2

((((((((((((((((((((((((((((((( Files Created from 2006-10-19 to 2006-11-19 ))))))))))))))))))))))))))))))))))

2006-11-19	15:59	106,496	--a------	C:\WINDOWS\Sloopy7.exe
2006-11-19	15:56	38,912	--a------	C:\WINDOWS\system32\aspi194211.exe
2006-11-19	15:55	40,973	---hs----	C:\WINDOWS\system32\byxvsqp.dll
2006-11-19	15:55	19,240	--a------	C:\WINDOWS\mq2.exe
2006-11-19	15:54	3,584	-r-hs----	C:\WINDOWS\c1e268626.exe
2006-11-19	15:54	106,712	--a------	C:\WINDOWS\vkr.exe
2006-11-19	15:53	9,767	--a------	C:\WINDOWS\4jh.exe
2006-11-19	15:53	8,058	--a------	C:\WINDOWS\pvt.exe
2006-11-19	15:53	6,010	--a------	C:\Documents and Settings\Noom\JFcW463.exe
2006-11-19	15:53	167,936	--a------	C:\WINDOWS\ms061997-73647.exe
2006-11-19	14:40	8,006	--a------	C:\WINDOWS\comdlj32.dll
2006-11-19	14:22	6,010	--a------	C:\Documents and Settings\Noom\H6Ws7cS.exe
2006-11-18	13:49	6,010	--a------	C:\Documents and Settings\Noom\dV.exe
2006-11-18	13:03	6,010	--a------	C:\Documents and Settings\Noom\UF82H6F.exe
2006-11-18	12:48	6,010	--a------	C:\Documents and Settings\Noom\viqogPE.exe
2006-11-18	12:28	126,996	--a------	C:\WINDOWS\system32\nbxoffih.dll
2006-11-18	12:18	6,010	--a------	C:\Documents and Settings\Noom\v7kQ031.exe
2006-11-18	12:13	40,973	---hs----	C:\WINDOWS\system32\wvuspml.dll
2006-11-18	12:13	19,240	--a------	C:\WINDOWS\pns.exe
2006-11-18	12:12	2,560	--a------	C:\WINDOWS\uu.exe
2006-11-18	12:12	106,712	--a------	C:\WINDOWS\raq.exe
2006-11-18	12:10	8,058	--a------	C:\WINDOWS\bsf.exe
2006-11-18	12:06	110,612	--a------	C:\WINDOWS\system32\wpwswapt.exe
2006-11-18	12:05	733,016	---hs----	C:\WINDOWS\system32\ybcdd.bak2
2006-11-18	12:02	732,227	---hs----	C:\WINDOWS\system32\ybcdd.bak1
2006-11-18	11:47	40,973	---hs----	C:\WINDOWS\system32\wvutstu.dll
2006-11-18	11:47	19,240	--a------	C:\WINDOWS\fym.exe
2006-11-18	11:46	2,560	--a------	C:\WINDOWS\ebx.exe
2006-11-18	11:45	8,058	--a------	C:\WINDOWS\1.exe
2006-11-18	11:45	106,712	--a------	C:\WINDOWS\2pd.exe
2006-11-18	11:42	6,010	--a------	C:\Documents and Settings\Noom\vLT7QJ5.exe
2006-11-18	10:17	6,010	--a------	C:\Documents and Settings\Noom\Ft0Bi5u.exe
2006-11-18	09:48	692,276	---hs----	C:\WINDOWS\system32\ddcby.dll
2006-11-18	09:44	167,936	--a------	C:\WINDOWS\sys01736471997-2006.exe
2006-11-18	09:43	6,010	--a------	C:\Documents and Settings\Noom\xDmB554.exe
2006-11-18	09:19	40,973	---hs----	C:\WINDOWS\system32\urqqpmm.dll
2006-11-18	09:19	19,240	--a------	C:\WINDOWS\kgz.exe
2006-11-18	09:18	71,384	--a------	C:\WINDOWS\system32\ipv6monk.dll
2006-11-18	09:18	2,560	--a------	C:\WINDOWS\tpd.exe
2006-11-18	09:18	106,712	--a------	C:\WINDOWS\u5p.exe
2006-11-18	09:17	9,767	--a------	C:\WINDOWS\owq.exe
2006-11-18	09:17	8,058	--a------	C:\WINDOWS\.exe
2006-11-18	06:22	692,276	---hs----	C:\WINDOWS\system32\mllmk.dll
2006-11-18	06:22	4,169	--a------	C:\WINDOWS\system32\vxg6ame4.exe
2006-11-18	06:22	1,632	--a------	C:\WINDOWS\system32\vxga8me6.exe
2006-11-18	06:21	33,792	--a------	C:\WINDOWS\system32\vxga4me1.exe
2006-11-18	06:20	40,973	---hs----	C:\WINDOWS\system32\awtsstr.dll
2006-11-18	06:19	9,094	--a------	C:\WINDOWS\system32\dlh9jkd1q5.exe
2006-11-18	06:19	7,408	--a------	C:\WINDOWS\system32\dlh9jkd1q7.exe
2006-11-18	06:19	37,344	--a------	C:\WINDOWS\system32\dlh9jkd1q2.exe
2006-11-18	06:19	2,518	--a------	C:\WINDOWS\system32\dlh9jkd1q1.exe
2006-11-18	06:19	16	--a------	C:\WINDOWS\system32\dlh9jkd1q8.exe
2006-11-18	06:18	8,058	--a------	C:\WINDOWS\system32\kernels88.exe
2006-11-18	06:18	2,560	--a------	C:\WINDOWS\ezf.exe
2006-11-18	06:18	106,712	--a------	C:\WINDOWS\jkp.exe
2006-11-18	06:17	9,767	--a------	C:\WINDOWS\zfj.exe
2006-11-18	06:17	8,058	--a------	C:\WINDOWS\oew.exe
2006-11-18	05:24	692,276	---hs----	C:\WINDOWS\system32\xxwts.dll
2006-11-18	04:25	692,276	---hs----	C:\WINDOWS\system32\cbayv.dll
2006-11-18	04:15 d--------	C:\Documents and Settings\Noom\www.google.com
2006-11-18	04:10	183,296	--a-s----	C:\WINDOWS\NDNuninstall7_22.exe
2006-11-18	04:08	40,973	---hs----	C:\WINDOWS\system32\gebxvut.dll
2006-11-18	04:08	19,240	--a------	C:\WINDOWS\tfp.exe
2006-11-18	04:07	96,256	--a------	C:\WINDOWS\system32\durvilx.exe
2006-11-18	04:07	71,384	--a------	C:\WINDOWS\system32\ipv6monl.dll
2006-11-18	04:07	62,976	--a------	C:\WINDOWS\system32\tea0f3dc.dll
2006-11-18	04:07	53,120	--a------	C:\WINDOWS\srvszvvmfe.exe
2006-11-18	04:07	53,120	--a------	C:\WINDOWS\srvrdgapkd.exe
2006-11-18	04:07	477,824	-r-hs----	C:\WINDOWS\lqkpmisA.exe
2006-11-18	04:07	45,312	--a------	C:\WINDOWS\tct101.dll
2006-11-18	04:07	418,784	-r-hs----	C:\WINDOWS\lqkpmis.exe
2006-11-18	04:07	36,608	--a------	C:\WINDOWS\nem220.dll
2006-11-18	04:07	3,584	-r-hs----	C:\WINDOWS\jqx64712451.exe
2006-11-18	04:07	29,696	--a------	C:\WINDOWS\system32\w3dad4f6.dll
2006-11-18	04:07	183,476	--a------	C:\WINDOWS\srvymrgqhp.exe
2006-11-18	04:07	183,476	--a------	C:\WINDOWS\srvivtrofr.exe
2006-11-18	04:07	151,552	--a------	C:\WINDOWS\system32\durvilx.dll
2006-11-18	04:07	106,712	--a------	C:\WINDOWS\k.exe
2006-11-18	04:07	106,496	--a------	C:\WINDOWS\system32\DomainHelper.dll
2006-11-18	04:07	1,329	--a------	C:\WINDOWS\system32\tea0f3dc.sys
2006-11-18	04:06	9,767	--a------	C:\WINDOWS\kvh.exe
2006-11-18	04:06	8,749	--a------	C:\WINDOWS\system32\z2199.exe
2006-11-18	04:06	8,464	--a------	C:\WINDOWS\system32\sporder.dll
2006-11-18	04:06	8,058	--a------	C:\WINDOWS\ids.exe
2006-11-18	04:06	7,680	--a------	C:\WINDOWS\vmmlog32.dll
2006-11-18	04:06	6,687	--a------	C:\WINDOWS\system32\ldcore.dll
2006-11-18	04:06	57,064	--a------	C:\WINDOWS\system32\z2570.exe
2006-11-18	04:06	50,688	--a-s----	C:\WINDOWS\NDNuninstall6_38.exe
2006-11-18	04:06	5,120	--a------	C:\WINDOWS\system32\z2600.exe
2006-11-18	04:06	37,557	--a------	C:\WINDOWS\system32\z2885.exe
2006-11-18	04:06	34,485	--a------	C:\WINDOWS\system32\sghvn32.dll
2006-11-18	04:06	3,648	--a------	C:\WINDOWS\system32\z2319.exe
2006-11-18	04:06	2,560	--a------	C:\WINDOWS\system32\z2397.exe
2006-11-18	04:05	29,184	--a------	C:\WINDOWS\system32\z2612.exe
2006-11-18	04:05	23,552	--a------	C:\WINDOWS\system32\z2292.exe
2006-11-18	04:05	13,312	--a------	C:\WINDOWS\system32\z2999.exe
2006-11-18	04:02	161,280	--a------	C:\WINDOWS\system32\qbhtpcz.dll
2006-11-18	04:01	46,592	--a------	C:\WINDOWS\system32\zlbw.dll
2006-11-18	04:01	15,226	--a------	C:\WINDOWS\system32\w.exe
2006-11-18	04:00	9,804	--a------	C:\WINDOWS\system32\z1940.exe
2006-11-18	04:00	6,010	--a------	C:\WINDOWS\system32\se.exe.exe
2006-11-18	04:00	6,010	--a------	C:\WINDOWS\system32\CrtCD47.exe
2006-11-18	04:00	54,138	--a------	C:\WINDOWS\system32\taskdir.exe
2006-11-18	04:00	54,138	--a------	C:\WINDOWS\system32\google.png.exe
2006-11-18	04:00	5,705	--a------	C:\WINDOWS\system32\z2963.exe
2006-11-18	04:00	4,608	--a------	C:\WINDOWS\system32\adir.dll
2006-11-18	04:00	23,552	--a------	C:\WINDOWS\system32\z2774.exe
2006-11-18	04:00	20,480	--a------	C:\WINDOWS\system32\z3250.dll
2006-11-18	04:00	192,512	--a------	C:\WINDOWS\system32\z2750.exe
2006-11-18	04:00	161,280	--a------	C:\WINDOWS\system32\oivyba.dll
2006-11-18	04:00	157,696	--a------	C:\WINDOWS\system32\3339_32.dll
2006-11-18	04:00	15,226	--a------	C:\WINDOWS\system32\w.exe.exe
2006-11-18	04:00	15,226	---h-----	C:\WINDOWS\system32\wservice.exe
2006-11-18	04:00	128,378	--a------	C:\WINDOWS\system32\ss.exe.exe
2006-11-18	03:58	77,824	--a------	C:\WINDOWS\system32\cfltygd.dll
2006-11-15	16:49	49,152	--a------	C:\npbittorrent.dll

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

*Rootkit driver pe386 is present. A rootkit scan is required*

2006-11-20 13:46	--------	d--------	C:\Program Files\Common Files
2006-11-18 13:55	2371	--a------	C:\Documents and Settings\Noom\Application Data\.googlewebacchosts
2006-11-18 12:08	--------	d--------	C:\Documents and Settings\Noom\Application Data\SearchToolbarCorp
2006-11-18 12:06	--------	d--------	C:\Program Files\VSAdd-in
2006-11-18 12:04	--------	d--------	C:\Program Files\Super Codec
2006-11-18 12:03	--------	d--------	C:\Program Files\VirusBursters
2006-11-18 09:17	8058	--a------	C:\WINDOWS\.exe
2006-11-18 04:16	--------	d--------	C:\Program Files\SpySheriff
2006-11-18 04:08	--------	d--------	C:\Program Files\CMIntex
2006-11-18 04:07	--------	d--------	C:\Program Files\PSDream
2006-11-18 04:07	--------	d--------	C:\Program Files\PSCastor
2006-11-18 04:00	--------	d---s----	C:\Documents and Settings\Noom\Application Data\Microsoft
2006-11-17 10:29	--------	d--------	C:\Program Files\BitTorrent
2006-11-17 10:18	--------	d--------	C:\Program Files\Common Files\Symantec Shared
2006-11-12 17:03	--------	d--------	C:\Program Files\viewsonic
2006-11-12 17:02	--------	d--h-----	C:\Program Files\InstallShield Installation Information
2006-11-11 18:34	--------	d--------	C:\Program Files\IrfanView
2006-11-05 13:37	--------	d--------	C:\Program Files\iTunes
2006-11-05 13:37	--------	d--------	C:\Program Files\iPod
2006-11-05 13:36	--------	d--------	C:\Program Files\QuickTime
2006-11-03 19:43	--------	d--------	C:\Documents and Settings\Noom\Application Data\BitTorrent
2006-11-03 19:39	--------	d--------	C:\Documents and Settings\Noom\Application Data\Skype
2006-10-29 21:33	--------	d--------	C:\Program Files\Common Files\Nullsoft
2006-10-29 21:33	--------	d--------	C:\Program Files\Common Files\AOL
2006-10-29 21:33	--------	d--------	C:\Program Files\AOL
2006-10-29 21:33	--------	d--------	C:\Program Files\AOD
2006-10-29 21:33	--------	d--------	C:\Documents and Settings\Noom\Application Data\acccore
2006-10-29 21:32	--------	d--------	C:\Program Files\Common Files\aolshare
2006-10-29 21:30	--------	d--------	C:\Program Files\AIM
2006-10-29 21:29	--------	d--------	C:\Documents and Settings\Noom\Application Data\Aim
2006-10-18 13:38	--------	d--------	C:\Documents and Settings\Noom\Application Data\AdobeUM
2006-10-17 17:04	--------	d--------	C:\Program Files\Lexmark X74-X75
2006-10-16 21:58	--------	d--------	C:\Program Files\Apple Software Update
2006-10-15 00:32	--------	d--------	C:\Program Files\Audacity
2006-09-28 11:40	--------	d--------	C:\Program Files\adelphia hsagent
2006-09-28 11:34	--------	d--------	C:\Program Files\Support.com
2006-09-24 11:23	39816	--a------	C:\Documents and Settings\Noom\Application Data\GDIPFONTCACHEV1.DAT
2006-09-24 10:26	--------	d--------	C:\Documents and Settings\Noom\Application Data\MySpace
2006-09-24 10:24	--------	d--------	C:\Program Files\MySpace
2006-09-22 06:36	53248	--a------	C:\WINDOWS\uni_7eh.exe
2006-09-19 15:44	15664	--a------	C:\WINDOWS\system32\drivers\GEARAspiWDM.sys
2006-09-19 15:43	109360	--a------	C:\WINDOWS\system32\GEARAspi.dll
2006-08-07 22:06	1218	--a------	C:\Documents and Settings\Noom\Application Data\AdobeDLM.log
2006-08-07 22:06	0	--a------	C:\Documents and Settings\Noom\Application Data\dm.ini

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Norton SystemWorks"="\"C:\\Program Files\\Norton SystemWorks\\cfgwiz.exe\" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz"
"LogitechSoftwareUpdate"="\"C:\\Program Files\\Logitech\\Video\\ManifestEngine.exe\" boot"
"NBJ"="\"C:\\Program Files\\Ahead\\Nero BackItUp\\nbj.exe\""
"Yahoo! Pager"="C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe -quiet"
"Aim6"=""
"UpdateService"="C:\\WINDOWS\\system32\\wservice.exe"
"taskdir"="C:\\WINDOWS\\system32\\taskdir.exe"
"PSCastor"="\"C:\\Program Files\\PSCastor\\PSCastor.exe\""
"CMIntex"="\"C:\\Program Files\\CMIntex\\CMIntex.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32"
"PHIME2002ASync"="C:\\WINDOWS\\system32\\dllcache\\tintsetp.exe /SYNC"
"PHIME2002A"="C:\\WINDOWS\\system32\\dllcache\\tintsetp.exe /IMEName"
"SiSUSBRG"="C:\\WINDOWS\\SiSUSBrg.exe"
"SoundMan"="SOUNDMAN.EXE"
"Lexmark X74-X75"="\"C:\\Program Files\\Lexmark X74-X75\\lxbbbmgr.exe\""
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"LogitechVideoRepair"="C:\\Program Files\\Logitech\\Video\\ISStart.exe "
"LogitechVideoTray"="C:\\Program Files\\Logitech\\Video\\LogiTray.exe"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer"
"Logitech Utility"="Logi_MwX.Exe"
"zBrowser Launcher"="C:\\Program Files\\Logitech\\iTouch\\iTouch.exe"
"iRiver Updater"="\\Updater.exe"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\
65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"Adobe Photo Downloader"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\""
"tgcmd"="\"c:\\Program Files\\Adelphia HSAgent\\bin\\tgcmd.exe\" /server /startmonitor /deaf "
"HostManager"="C:\\Program Files\\Common Files\\AOL\\1162186374\\ee\\AOLSoftware.exe"
"IPHSend"="C:\\Program Files\\Common Files\\AOL\\IPHSend\\IPHSend.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"UpdateService"="C:\\WINDOWS\\system32\\wservice.exe"
"ms"="C:\\DOCUME~1\\ADMINI~1\\LOCALS~1\\Temp\\8394\\gm.exe"
"tea0f3dc"="RUNDLL32.EXE w3dad4f6.dll,n 0070f3d5000000053dad4f6"
"lqkpmisA"="C:\\WINDOWS\\lqkpmisA.exe"
"Microsoft WWW"="C:\\WINDOWS\\inet20004\\free.exe "
"ms0571997-7364"="C:\\WINDOWS\\ms0571997-7364.exe"
"ms061997-73647"="C:\\WINDOWS\\ms061997-73647.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000005

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,80,00,00,00,00,00,00,00,00,02,00,00,c2,01,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,f2,01,00,00,b9,00,00,00,7c,00,00,00,72,00,\
00,00,01,00,00,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
"{ff170564-36c8-43f7-9100-559e166405cf}"="cussers"
"{2C1CD3D7-86AC-4068-93BC-A02304BB3339}"="DCOM Server 3339"
"{2C1CD3D7-86AC-4068-93BC-A02304BB2236}"="DCOM Server 2236"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{0E55CC01-8113-487B-92F2-98C24D98A57F}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"UseDesktopIniCache"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"isamonitor.exe"="C:\\Program Files\\Super Codec\\isamonitor.exe"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=dword:00000001

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"cussers"="{ff170564-36c8-43f7-9100-559e166405cf}"
"DCOM Server 3339"="{2C1CD3D7-86AC-4068-93BC-A02304BB3339}"
"DCOM Server 2236"="{2C1CD3D7-86AC-4068-93BC-A02304BB2236}"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcby
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winsys2freg
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wvutstu

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]	
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - Nat.job
C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - Noom.job
C:\WINDOWS\tasks\Norton SystemWorks One Button Checkup.job
C:\WINDOWS\tasks\Symantec Drmc.job

Completion time: 06-11-20 13:48:58.77 
C:\ComboFix.txt ... 06-11-20 13:48
C:\ComboFix2.txt ... 06-11-19 21:21
C:\ComboFix3.txt ... 06-11-19 19:01

Hijackthis Log

Logfile of HijackThis v1.99.1
Scan saved at 1:38:38 PM, on 11/19/2006
Platform: Windows XP SP2, v.2149 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2149)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Batty2\Batty2.exe
C:\Documents and Settings\Noom\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
F3 - REG:win.ini: run=C:\WINDOWS\inet20004\services.exe
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O3 - Toolbar: Protection Bar - {74a49269-9779-48b4-a0e6-3a5af2a3ade6} - C:\Program Files\Super Codec\iesplugin.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\dllcache\tintsetp.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\dllcache\tintsetp.exe /IMEName
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [iRiver Updater] \Updater.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [tgcmd] "c:\Program Files\Adelphia HSAgent\bin\tgcmd.exe" /server /startmonitor /deaf 
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1162186374\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [UpdateService] C:\WINDOWS\system32\wservice.exe
O4 - HKLM\..\Run: [ms] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\8394\gm.exe
O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inet20004\services.exe
O4 - HKLM\..\Run: [tea0f3dc] RUNDLL32.EXE w3dad4f6.dll,n 0070f3d5000000053dad4f6
O4 - HKLM\..\Run: [lqkpmisA] C:\WINDOWS\lqkpmisA.exe
O4 - HKLM\..\Run: [TheMonitor] C:\WINDOWS\Sloopy7.exe
O4 - HKLM\..\Run: [Microsoft WWW] C:\WINDOWS\inet20004\free.exe 
O4 - HKLM\..\Run: [System] C:\WINDOWS\system32\kernels88.exe
O4 - HKLM\..\Run: [ms0571997-7364] C:\WINDOWS\ms0571997-7364.exe
O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\system32\kernels88.exe
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [UpdateService] C:\WINDOWS\system32\wservice.exe
O4 - HKCU\..\Run: [taskdir] C:\WINDOWS\system32\taskdir.exe
O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inet20004\services.exe
O4 - HKCU\..\Run: [PSCastor] "C:\Program Files\PSCastor\PSCastor.exe"
O4 - HKCU\..\Run: [WinMedia] C:\WINDOWS\jqx64712451.exe
O4 - HKCU\..\Run: [CMIntex] "C:\Program Files\CMIntex\CMIntex.exe"
O4 - HKCU\..\Run: [Key] C:\DOCUME~1\Noom\LOCALS~1\Temp\35.tmp
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Run Google Web Accelerator.lnk = C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
O4 - Global Startup: wupdmgr.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.adelphia.net/sdccommon/download/tgctlins.cab
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish.com/SnapfishActivia.cab
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} - http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://www.vzwpix.com/activex/VerizonWirelessUploadControl.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {C915801D-6F00-49CD-8A9A-8DE5C11ADDC1} (Pixami Drag/Drop Upload UI Control) - http://www.photoworks.com/pixami/DragDropUploader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{952A9AC8-A5CF-4D22-99EB-FC83496CA1F2}: NameServer = 152.158.2.48
O17 - HKLM\System\CCS\Services\Tcpip\..\{FAAD30F5-4BD7-442F-94AB-A65BDC73BBF8}: NameServer = 152.158.2.48
O18 - Filter: text/html - {994D478A-45D0-4DB4-AE27-738B1E346F99} - C:\Program Files\Batty2\Batty2.dll
O20 - AppInit_DLLs: c:\windows\system32\ldcore.dll,BattyRun2.dll
O21 - SSODL: cussers - {ff170564-36c8-43f7-9100-559e166405cf} - C:\WINDOWS\system32\cfltygd.dll
O21 - SSODL: DCOM Server 3339 - {2C1CD3D7-86AC-4068-93BC-A02304BB3339} - C:\WINDOWS\system32\qbhtpcz.dll
O21 - SSODL: DCOM Server 2236 - {2C1CD3D7-86AC-4068-93BC-A02304BB2236} - C:\WINDOWS\system32\oivyba.dll
O23 - Service: Microsoft ASPI Manager (aspi113210) - Unknown owner - C:\WINDOWS\system32\aspi1879611.exe (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\lqkpmis.exe


----------



## dragnstyl33 (Nov 18, 2006)

Noom - 06-11-20 13:17:44.61 Service Pack 2, v.2149
ComboFix 06.11.9 - Running from: "C:\Documents and Settings\Noom\Desktop"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\Documents and Settings\Noom\Application Data\Install.dat
C:\WINDOWS\offun.exe
C:\WINDOWS\system32\tpuninstall.exe
C:\Program Files\Common Files\download
C:\Program Files\Common Files\inetget
C:\Program Files\Common Files\inetget2
C:\Program Files\Common Files\windows
C:\Program Files\cmfibula
C:\Program Files\Common Files\inetget 
C:\Program Files\batty2

((((((((((((((((((((((((((((((( Files Created from 2006-10-19 to 2006-11-19 ))))))))))))))))))))))))))))))))))

2006-11-19	15:59	106,496	--a------	C:\WINDOWS\Sloopy7.exe
2006-11-19	15:56	38,912	--a------	C:\WINDOWS\system32\aspi194211.exe
2006-11-19	15:55	40,973	---hs----	C:\WINDOWS\system32\byxvsqp.dll
2006-11-19	15:55	19,240	--a------	C:\WINDOWS\mq2.exe
2006-11-19	15:54	3,584	-r-hs----	C:\WINDOWS\c1e268626.exe
2006-11-19	15:54	106,712	--a------	C:\WINDOWS\vkr.exe
2006-11-19	15:53	9,767	--a------	C:\WINDOWS\4jh.exe
2006-11-19	15:53	8,058	--a------	C:\WINDOWS\pvt.exe
2006-11-19	15:53	6,010	--a------	C:\Documents and Settings\Noom\JFcW463.exe
2006-11-19	15:53	167,936	--a------	C:\WINDOWS\ms061997-73647.exe
2006-11-19	14:40	8,006	--a------	C:\WINDOWS\comdlj32.dll
2006-11-19	14:22	6,010	--a------	C:\Documents and Settings\Noom\H6Ws7cS.exe
2006-11-18	13:49	6,010	--a------	C:\Documents and Settings\Noom\dV.exe
2006-11-18	13:03	6,010	--a------	C:\Documents and Settings\Noom\UF82H6F.exe
2006-11-18	12:48	6,010	--a------	C:\Documents and Settings\Noom\viqogPE.exe
2006-11-18	12:28	126,996	--a------	C:\WINDOWS\system32\nbxoffih.dll
2006-11-18	12:18	6,010	--a------	C:\Documents and Settings\Noom\v7kQ031.exe
2006-11-18	12:13	40,973	---hs----	C:\WINDOWS\system32\wvuspml.dll
2006-11-18	12:13	19,240	--a------	C:\WINDOWS\pns.exe
2006-11-18	12:12	2,560	--a------	C:\WINDOWS\uu.exe
2006-11-18	12:12	106,712	--a------	C:\WINDOWS\raq.exe
2006-11-18	12:10	8,058	--a------	C:\WINDOWS\bsf.exe
2006-11-18	12:06	110,612	--a------	C:\WINDOWS\system32\wpwswapt.exe
2006-11-18	12:05	733,016	---hs----	C:\WINDOWS\system32\ybcdd.bak2
2006-11-18	12:02	732,227	---hs----	C:\WINDOWS\system32\ybcdd.bak1
2006-11-18	11:47	40,973	---hs----	C:\WINDOWS\system32\wvutstu.dll
2006-11-18	11:47	19,240	--a------	C:\WINDOWS\fym.exe
2006-11-18	11:46	2,560	--a------	C:\WINDOWS\ebx.exe
2006-11-18	11:45	8,058	--a------	C:\WINDOWS\1.exe
2006-11-18	11:45	106,712	--a------	C:\WINDOWS\2pd.exe
2006-11-18	11:42	6,010	--a------	C:\Documents and Settings\Noom\vLT7QJ5.exe
2006-11-18	10:17	6,010	--a------	C:\Documents and Settings\Noom\Ft0Bi5u.exe
2006-11-18	09:48	692,276	---hs----	C:\WINDOWS\system32\ddcby.dll
2006-11-18	09:44	167,936	--a------	C:\WINDOWS\sys01736471997-2006.exe
2006-11-18	09:43	6,010	--a------	C:\Documents and Settings\Noom\xDmB554.exe
2006-11-18	09:19	40,973	---hs----	C:\WINDOWS\system32\urqqpmm.dll
2006-11-18	09:19	19,240	--a------	C:\WINDOWS\kgz.exe
2006-11-18	09:18	71,384	--a------	C:\WINDOWS\system32\ipv6monk.dll
2006-11-18	09:18	2,560	--a------	C:\WINDOWS\tpd.exe
2006-11-18	09:18	106,712	--a------	C:\WINDOWS\u5p.exe
2006-11-18	09:17	9,767	--a------	C:\WINDOWS\owq.exe
2006-11-18	09:17	8,058	--a------	C:\WINDOWS\.exe
2006-11-18	06:22	692,276	---hs----	C:\WINDOWS\system32\mllmk.dll
2006-11-18	06:22	4,169	--a------	C:\WINDOWS\system32\vxg6ame4.exe
2006-11-18	06:22	1,632	--a------	C:\WINDOWS\system32\vxga8me6.exe
2006-11-18	06:21	33,792	--a------	C:\WINDOWS\system32\vxga4me1.exe
2006-11-18	06:20	40,973	---hs----	C:\WINDOWS\system32\awtsstr.dll
2006-11-18	06:19	9,094	--a------	C:\WINDOWS\system32\dlh9jkd1q5.exe
2006-11-18	06:19	7,408	--a------	C:\WINDOWS\system32\dlh9jkd1q7.exe
2006-11-18	06:19	37,344	--a------	C:\WINDOWS\system32\dlh9jkd1q2.exe
2006-11-18	06:19	2,518	--a------	C:\WINDOWS\system32\dlh9jkd1q1.exe
2006-11-18	06:19	16	--a------	C:\WINDOWS\system32\dlh9jkd1q8.exe
2006-11-18	06:18	8,058	--a------	C:\WINDOWS\system32\kernels88.exe
2006-11-18	06:18	2,560	--a------	C:\WINDOWS\ezf.exe
2006-11-18	06:18	106,712	--a------	C:\WINDOWS\jkp.exe
2006-11-18	06:17	9,767	--a------	C:\WINDOWS\zfj.exe
2006-11-18	06:17	8,058	--a------	C:\WINDOWS\oew.exe
2006-11-18	05:24	692,276	---hs----	C:\WINDOWS\system32\xxwts.dll
2006-11-18	04:25	692,276	---hs----	C:\WINDOWS\system32\cbayv.dll
2006-11-18	04:15 d--------	C:\Documents and Settings\Noom\www.google.com
2006-11-18	04:10	183,296	--a-s----	C:\WINDOWS\NDNuninstall7_22.exe
2006-11-18	04:08	40,973	---hs----	C:\WINDOWS\system32\gebxvut.dll
2006-11-18	04:08	19,240	--a------	C:\WINDOWS\tfp.exe
2006-11-18	04:07	96,256	--a------	C:\WINDOWS\system32\durvilx.exe
2006-11-18	04:07	71,384	--a------	C:\WINDOWS\system32\ipv6monl.dll
2006-11-18	04:07	62,976	--a------	C:\WINDOWS\system32\tea0f3dc.dll
2006-11-18	04:07	53,120	--a------	C:\WINDOWS\srvszvvmfe.exe
2006-11-18	04:07	53,120	--a------	C:\WINDOWS\srvrdgapkd.exe
2006-11-18	04:07	477,824	-r-hs----	C:\WINDOWS\lqkpmisA.exe
2006-11-18	04:07	45,312	--a------	C:\WINDOWS\tct101.dll
2006-11-18	04:07	418,784	-r-hs----	C:\WINDOWS\lqkpmis.exe
2006-11-18	04:07	36,608	--a------	C:\WINDOWS\nem220.dll
2006-11-18	04:07	3,584	-r-hs----	C:\WINDOWS\jqx64712451.exe
2006-11-18	04:07	29,696	--a------	C:\WINDOWS\system32\w3dad4f6.dll
2006-11-18	04:07	183,476	--a------	C:\WINDOWS\srvymrgqhp.exe
2006-11-18	04:07	183,476	--a------	C:\WINDOWS\srvivtrofr.exe
2006-11-18	04:07	151,552	--a------	C:\WINDOWS\system32\durvilx.dll
2006-11-18	04:07	106,712	--a------	C:\WINDOWS\k.exe
2006-11-18	04:07	106,496	--a------	C:\WINDOWS\system32\DomainHelper.dll
2006-11-18	04:07	1,329	--a------	C:\WINDOWS\system32\tea0f3dc.sys
2006-11-18	04:06	9,767	--a------	C:\WINDOWS\kvh.exe
2006-11-18	04:06	8,749	--a------	C:\WINDOWS\system32\z2199.exe
2006-11-18	04:06	8,464	--a------	C:\WINDOWS\system32\sporder.dll
2006-11-18	04:06	8,058	--a------	C:\WINDOWS\ids.exe
2006-11-18	04:06	7,680	--a------	C:\WINDOWS\vmmlog32.dll
2006-11-18	04:06	6,687	--a------	C:\WINDOWS\system32\ldcore.dll
2006-11-18	04:06	57,064	--a------	C:\WINDOWS\system32\z2570.exe
2006-11-18	04:06	50,688	--a-s----	C:\WINDOWS\NDNuninstall6_38.exe
2006-11-18	04:06	5,120	--a------	C:\WINDOWS\system32\z2600.exe
2006-11-18	04:06	37,557	--a------	C:\WINDOWS\system32\z2885.exe
2006-11-18	04:06	34,485	--a------	C:\WINDOWS\system32\sghvn32.dll
2006-11-18	04:06	3,648	--a------	C:\WINDOWS\system32\z2319.exe
2006-11-18	04:06	2,560	--a------	C:\WINDOWS\system32\z2397.exe
2006-11-18	04:05	29,184	--a------	C:\WINDOWS\system32\z2612.exe
2006-11-18	04:05	23,552	--a------	C:\WINDOWS\system32\z2292.exe
2006-11-18	04:05	13,312	--a------	C:\WINDOWS\system32\z2999.exe
2006-11-18	04:02	161,280	--a------	C:\WINDOWS\system32\qbhtpcz.dll
2006-11-18	04:01	46,592	--a------	C:\WINDOWS\system32\zlbw.dll
2006-11-18	04:01	15,226	--a------	C:\WINDOWS\system32\w.exe
2006-11-18	04:00 9,804	--a------	C:\WINDOWS\system32\z1940.exe
2006-11-18	04:00	6,010	--a------	C:\WINDOWS\system32\se.exe.exe
2006-11-18	04:00	6,010	--a------	C:\WINDOWS\system32\CrtCD47.exe
2006-11-18	04:00	54,138	--a------	C:\WINDOWS\system32\taskdir.exe
2006-11-18	04:00	54,138	--a------	C:\WINDOWS\system32\google.png.exe
2006-11-18	04:00	5,705	--a------	C:\WINDOWS\system32\z2963.exe
2006-11-18	04:00	4,608	--a------	C:\WINDOWS\system32\adir.dll
2006-11-18	04:00	23,552	--a------	C:\WINDOWS\system32\z2774.exe
2006-11-18	04:00	20,480	--a------	C:\WINDOWS\system32\z3250.dll
2006-11-18	04:00	192,512	--a------	C:\WINDOWS\system32\z2750.exe
2006-11-18	04:00	161,280	--a------	C:\WINDOWS\system32\oivyba.dll
2006-11-18	04:00	157,696	--a------	C:\WINDOWS\system32\3339_32.dll
2006-11-18	04:00	15,226	--a------	C:\WINDOWS\system32\w.exe.exe
2006-11-18	04:00	15,226	---h-----	C:\WINDOWS\system32\wservice.exe
2006-11-18	04:00	128,378	--a------	C:\WINDOWS\system32\ss.exe.exe
2006-11-18	03:58	77,824	--a------	C:\WINDOWS\system32\cfltygd.dll
2006-11-15	16:49	49,152	--a------	C:\npbittorrent.dll

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

*Rootkit driver pe386 is present. A rootkit scan is required*

2006-11-20 13:46	--------	d--------	C:\Program Files\Common Files
2006-11-18 13:55	2371	--a------	C:\Documents and Settings\Noom\Application Data\.googlewebacchosts
2006-11-18 12:08	--------	d--------	C:\Documents and Settings\Noom\Application Data\SearchToolbarCorp
2006-11-18 12:06	--------	d--------	C:\Program Files\VSAdd-in
2006-11-18 12:04	--------	d--------	C:\Program Files\Super Codec
2006-11-18 12:03	--------	d--------	C:\Program Files\VirusBursters
2006-11-18 09:17	8058	--a------	C:\WINDOWS\.exe
2006-11-18 04:16	--------	d--------	C:\Program Files\SpySheriff
2006-11-18 04:08	--------	d--------	C:\Program Files\CMIntex
2006-11-18 04:07	--------	d--------	C:\Program Files\PSDream
2006-11-18 04:07	--------	d--------	C:\Program Files\PSCastor
2006-11-18 04:00	--------	d---s----	C:\Documents and Settings\Noom\Application Data\Microsoft
2006-11-17 10:29	--------	d--------	C:\Program Files\BitTorrent
2006-11-17 10:18	--------	d--------	C:\Program Files\Common Files\Symantec Shared
2006-11-12 17:03	--------	d--------	C:\Program Files\viewsonic
2006-11-12 17:02	--------	d--h-----	C:\Program Files\InstallShield Installation Information
2006-11-11 18:34	--------	d--------	C:\Program Files\IrfanView
2006-11-05 13:37	--------	d--------	C:\Program Files\iTunes
2006-11-05 13:37	--------	d--------	C:\Program Files\iPod
2006-11-05 13:36	--------	d--------	C:\Program Files\QuickTime
2006-11-03 19:43	--------	d--------	C:\Documents and Settings\Noom\Application Data\BitTorrent
2006-11-03 19:39	--------	d--------	C:\Documents and Settings\Noom\Application Data\Skype
2006-10-29 21:33	--------	d--------	C:\Program Files\Common Files\Nullsoft
2006-10-29 21:33	--------	d--------	C:\Program Files\Common Files\AOL
2006-10-29 21:33	--------	d--------	C:\Program Files\AOL
2006-10-29 21:33	--------	d--------	C:\Program Files\AOD
2006-10-29 21:33	--------	d--------	C:\Documents and Settings\Noom\Application Data\acccore
2006-10-29 21:32	--------	d--------	C:\Program Files\Common Files\aolshare
2006-10-29 21:30	--------	d--------	C:\Program Files\AIM
2006-10-29 21:29	--------	d--------	C:\Documents and Settings\Noom\Application Data\Aim
2006-10-18 13:38	--------	d--------	C:\Documents and Settings\Noom\Application Data\AdobeUM
2006-10-17 17:04	--------	d--------	C:\Program Files\Lexmark X74-X75
2006-10-16 21:58	--------	d--------	C:\Program Files\Apple Software Update
2006-10-15 00:32	--------	d--------	C:\Program Files\Audacity
2006-09-28 11:40	--------	d--------	C:\Program Files\adelphia hsagent
2006-09-28 11:34	--------	d--------	C:\Program Files\Support.com
2006-09-24 11:23	39816	--a------	C:\Documents and Settings\Noom\Application Data\GDIPFONTCACHEV1.DAT
2006-09-24 10:26	--------	d--------	C:\Documents and Settings\Noom\Application Data\MySpace
2006-09-24 10:24	--------	d--------	C:\Program Files\MySpace
2006-09-22 06:36	53248	--a------	C:\WINDOWS\uni_7eh.exe
2006-09-19 15:44	15664	--a------	C:\WINDOWS\system32\drivers\GEARAspiWDM.sys
2006-09-19 15:43	109360	--a------	C:\WINDOWS\system32\GEARAspi.dll
2006-08-07 22:06	1218	--a------	C:\Documents and Settings\Noom\Application Data\AdobeDLM.log
2006-08-07 22:06	0	--a------	C:\Documents and Settings\Noom\Application Data\dm.ini

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Norton SystemWorks"="\"C:\\Program Files\\Norton SystemWorks\\cfgwiz.exe\" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz"
"LogitechSoftwareUpdate"="\"C:\\Program Files\\Logitech\\Video\\ManifestEngine.exe\" boot"
"NBJ"="\"C:\\Program Files\\Ahead\\Nero BackItUp\\nbj.exe\""
"Yahoo! Pager"="C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe -quiet"
"Aim6"=""
"UpdateService"="C:\\WINDOWS\\system32\\wservice.exe"
"taskdir"="C:\\WINDOWS\\system32\\taskdir.exe"
"PSCastor"="\"C:\\Program Files\\PSCastor\\PSCastor.exe\""
"CMIntex"="\"C:\\Program Files\\CMIntex\\CMIntex.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32"
"PHIME2002ASync"="C:\\WINDOWS\\system32\\dllcache\\tintsetp.exe /SYNC"
"PHIME2002A"="C:\\WINDOWS\\system32\\dllcache\\tintsetp.exe /IMEName"
"SiSUSBRG"="C:\\WINDOWS\\SiSUSBrg.exe"
"SoundMan"="SOUNDMAN.EXE"
"Lexmark X74-X75"="\"C:\\Program Files\\Lexmark X74-X75\\lxbbbmgr.exe\""
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"LogitechVideoRepair"="C:\\Program Files\\Logitech\\Video\\ISStart.exe "
"LogitechVideoTray"="C:\\Program Files\\Logitech\\Video\\LogiTray.exe"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer"
"Logitech Utility"="Logi_MwX.Exe"
"zBrowser Launcher"="C:\\Program Files\\Logitech\\iTouch\\iTouch.exe"
"iRiver Updater"="\\Updater.exe"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\
65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"Adobe Photo Downloader"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\""
"tgcmd"="\"c:\\Program Files\\Adelphia HSAgent\\bin\\tgcmd.exe\" /server /startmonitor /deaf "
"HostManager"="C:\\Program Files\\Common Files\\AOL\\1162186374\\ee\\AOLSoftware.exe"
"IPHSend"="C:\\Program Files\\Common Files\\AOL\\IPHSend\\IPHSend.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"UpdateService"="C:\\WINDOWS\\system32\\wservice.exe"
"ms"="C:\\DOCUME~1\\ADMINI~1\\LOCALS~1\\Temp\\8394\\gm.exe"
"tea0f3dc"="RUNDLL32.EXE w3dad4f6.dll,n 0070f3d5000000053dad4f6"
"lqkpmisA"="C:\\WINDOWS\\lqkpmisA.exe"
"Microsoft WWW"="C:\\WINDOWS\\inet20004\\free.exe "
"ms0571997-7364"="C:\\WINDOWS\\ms0571997-7364.exe"
"ms061997-73647"="C:\\WINDOWS\\ms061997-73647.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000005

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,80,00,00,00,00,00,00,00,00,02,00,00,c2,01,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,f2,01,00,00,b9,00,00,00,7c,00,00,00,72,00,\
 00,00,01,00,00,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
"{ff170564-36c8-43f7-9100-559e166405cf}"="cussers"
"{2C1CD3D7-86AC-4068-93BC-A02304BB3339}"="DCOM Server 3339"
"{2C1CD3D7-86AC-4068-93BC-A02304BB2236}"="DCOM Server 2236"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{0E55CC01-8113-487B-92F2-98C24D98A57F}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"UseDesktopIniCache"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"isamonitor.exe"="C:\\Program Files\\Super Codec\\isamonitor.exe"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=dword:00000001

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"cussers"="{ff170564-36c8-43f7-9100-559e166405cf}"
"DCOM Server 3339"="{2C1CD3D7-86AC-4068-93BC-A02304BB3339}"
"DCOM Server 2236"="{2C1CD3D7-86AC-4068-93BC-A02304BB2236}"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcby
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winsys2freg
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wvutstu

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]	
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - Nat.job
C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - Noom.job
C:\WINDOWS\tasks\Norton SystemWorks One Button Checkup.job
C:\WINDOWS\tasks\Symantec Drmc.job

Completion time: 06-11-20 13:48:58.77 
C:\ComboFix.txt ... 06-11-20 13:48
C:\ComboFix2.txt ... 06-11-19 21:21
C:\ComboFix3.txt ... 06-11-19 19:01

Logfile of HijackThis v1.99.1
Scan saved at 1:38:38 PM, on 11/19/2006
Platform: Windows XP SP2, v.2149 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2149)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Batty2\Batty2.exe
C:\Documents and Settings\Noom\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
F3 - REG:win.ini: run=C:\WINDOWS\inet20004\services.exe
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O3 - Toolbar: Protection Bar - {74a49269-9779-48b4-a0e6-3a5af2a3ade6} - C:\Program Files\Super Codec\iesplugin.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\dllcache\tintsetp.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\dllcache\tintsetp.exe /IMEName
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [iRiver Updater] \Updater.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [tgcmd] "c:\Program Files\Adelphia HSAgent\bin\tgcmd.exe" /server /startmonitor /deaf 
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1162186374\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [UpdateService] C:\WINDOWS\system32\wservice.exe
O4 - HKLM\..\Run: [ms] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\8394\gm.exe
O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inet20004\services.exe
O4 - HKLM\..\Run: [tea0f3dc] RUNDLL32.EXE w3dad4f6.dll,n 0070f3d5000000053dad4f6
O4 - HKLM\..\Run: [lqkpmisA] C:\WINDOWS\lqkpmisA.exe
O4 - HKLM\..\Run: [TheMonitor] C:\WINDOWS\Sloopy7.exe
O4 - HKLM\..\Run: [Microsoft WWW] C:\WINDOWS\inet20004\free.exe 
O4 - HKLM\..\Run: [System] C:\WINDOWS\system32\kernels88.exe
O4 - HKLM\..\Run: [ms0571997-7364] C:\WINDOWS\ms0571997-7364.exe
O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\system32\kernels88.exe
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [UpdateService] C:\WINDOWS\system32\wservice.exe
O4 - HKCU\..\Run: [taskdir] C:\WINDOWS\system32\taskdir.exe
O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inet20004\services.exe
O4 - HKCU\..\Run: [PSCastor] "C:\Program Files\PSCastor\PSCastor.exe"
O4 - HKCU\..\Run: [WinMedia] C:\WINDOWS\jqx64712451.exe
O4 - HKCU\..\Run: [CMIntex] "C:\Program Files\CMIntex\CMIntex.exe"
O4 - HKCU\..\Run: [Key] C:\DOCUME~1\Noom\LOCALS~1\Temp\35.tmp
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Run Google Web Accelerator.lnk = C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
O4 - Global Startup: wupdmgr.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.adelphia.net/sdccommon/download/tgctlins.cab
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish.com/SnapfishActivia.cab
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} - http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://www.vzwpix.com/activex/VerizonWirelessUploadControl.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {C915801D-6F00-49CD-8A9A-8DE5C11ADDC1} (Pixami Drag/Drop Upload UI Control) - http://www.photoworks.com/pixami/DragDropUploader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{952A9AC8-A5CF-4D22-99EB-FC83496CA1F2}: NameServer = 152.158.2.48
O17 - HKLM\System\CCS\Services\Tcpip\..\{FAAD30F5-4BD7-442F-94AB-A65BDC73BBF8}: NameServer = 152.158.2.48
O18 - Filter: text/html - {994D478A-45D0-4DB4-AE27-738B1E346F99} - C:\Program Files\Batty2\Batty2.dll
O20 - AppInit_DLLs: c:\windows\system32\ldcore.dll,BattyRun2.dll
O21 - SSODL: cussers - {ff170564-36c8-43f7-9100-559e166405cf} - C:\WINDOWS\system32\cfltygd.dll
O21 - SSODL: DCOM Server 3339 - {2C1CD3D7-86AC-4068-93BC-A02304BB3339} - C:\WINDOWS\system32\qbhtpcz.dll
O21 - SSODL: DCOM Server 2236 - {2C1CD3D7-86AC-4068-93BC-A02304BB2236} - C:\WINDOWS\system32\oivyba.dll
O23 - Service: Microsoft ASPI Manager (aspi113210) - Unknown owner - C:\WINDOWS\system32\aspi1879611.exe (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\lqkpmis.exe


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below. *

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
F3 - REG:win.ini: run=C:\WINDOWS\inet20004\services.exe
O3 - Toolbar: Protection Bar - {74a49269-9779-48b4-a0e6-3a5af2a3ade6} - C:\Program Files\Super Codec\iesplugin.dll
O4 - HKLM\..\Run: [UpdateService] C:\WINDOWS\system32\wservice.exe
O4 - HKLM\..\Run: [ms] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\8394\gm.exe
O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inet20004\services.exe
O4 - HKLM\..\Run: [tea0f3dc] RUNDLL32.EXE w3dad4f6.dll,n 0070f3d5000000053dad4f6
O4 - HKLM\..\Run: [lqkpmisA] C:\WINDOWS\lqkpmisA.exe
O4 - HKLM\..\Run: [TheMonitor] C:\WINDOWS\Sloopy7.exe
O4 - HKLM\..\Run: [Microsoft WWW] C:\WINDOWS\inet20004\free.exe 
O4 - HKLM\..\Run: [System] C:\WINDOWS\system32\kernels88.exe
O4 - HKLM\..\Run: [ms0571997-7364] C:\WINDOWS\ms0571997-7364.exe
O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\system32\kernels88.exe
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [UpdateService] C:\WINDOWS\system32\wservice.exe
O4 - HKCU\..\Run: [taskdir] C:\WINDOWS\system32\taskdir.exe
O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inet20004\services.exe
O4 - HKCU\..\Run: [PSCastor] "C:\Program Files\PSCastor\PSCastor.exe"
O4 - HKCU\..\Run: [WinMedia] C:\WINDOWS\jqx64712451.exe
O4 - HKCU\..\Run: [CMIntex] "C:\Program Files\CMIntex\CMIntex.exe"
O4 - HKCU\..\Run: [Key] C:\DOCUME~1\Noom\LOCALS~1\Temp\35.tmp
O4 - Startup: PowerReg Scheduler.exe
O18 - Filter: text/html - {994D478A-45D0-4DB4-AE27-738B1E346F99} - C:\Program Files\Batty2\Batty2.dll
O20 - AppInit_DLLs: c:\windows\system32\ldcore.dll,BattyRun2.dll
O21 - SSODL: cussers - {ff170564-36c8-43f7-9100-559e166405cf} - C:\WINDOWS\system32\cfltygd.dll
O21 - SSODL: DCOM Server 3339 - {2C1CD3D7-86AC-4068-93BC-A02304BB3339} - C:\WINDOWS\system32\qbhtpcz.dll
O21 - SSODL: DCOM Server 2236 - {2C1CD3D7-86AC-4068-93BC-A02304BB2236} - C:\WINDOWS\system32\oivyba.dll

*Now *close all windows and browsers, other than HiJackThis*, then click Fix Checked.

Close Hijackthis.

Please go to Start > Control Panel > *Add/Remove Programs* and remove the following (if present):

*VSAdd-in
Super Codec
VirusBursters
SpySheriff
CMIntex
PSDream
PSCastor
Batty2
*


Download the attached file, unzip it and save it to your *C:\ drive.*
When having saved it, the file path should be *C:\remove.txt*
Download and unzip *Avenger* to your desktop.
Open the *Avenger*.
Check *Load Script from File *and then click the folder Icon on the right side of that section.
Then browse to *C:\remove.txt* and click *open* to load it.








Then click the *green light* icon.
This will begin the execution of the script currently in memory.
After you have clicked on the green light to begin execution of a script, the Avenger will set itself up to run the next time you reboot your computer, and then will prompt you to restart immediately.
After your system restarts, a log file should open with the results of Avengers actions. This log file is located at *C:\avenger.txt.* The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to *C:\avenger\backups.zip.*
Please download gmer rootkit detector from *Here*


Unzip it & double click the gmer.exe file
Select rootkit tab and press scan 
When it has finished press save & post back the log it makes 
Repeat the proces with the Autostarts tab and do the same there
Also post the contents of the *C:\avenger.txt* file and a fresh *Hijackthis log*.


----------



## Flrman1 (Jul 26, 2002)

Hi dragnstyl33 

Welcome to TSG! 

I have merged your new thread with the original thread that you were working with JSntgRvr in. Please make all posts regarding this matter in this thread. If you are having trouble remembering where your thread is, I suggest that you bookmark this page. This is the second time that this has been brought to your attention. Do not start another new thread for this problem. Any more new threads you start regarding this same problem will be closed without further explanation.

Thank you for your cooperation,

Mark


----------



## dragnstyl33 (Nov 18, 2006)

Logfile of HijackThis v1.99.1
Scan saved at 18:30, on 06-11-20
Platform: Windows XP SP2, v.2149 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2149)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Lexmark X74-X75\lxbbbmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Updater.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Adelphia HSAgent\bin\tgcmd.exe
C:\WINDOWS\system32\LVComsX.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Common Files\AOL\1162186374\ee\aolsoftware.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\sys0236471997-7.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
C:\Program Files\Google\Web Accelerator\googlewebaccclient.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Noom\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://localhost:9100/proxy.pac
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - C:\Program Files\DeluxeCommunications\DxcBho.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\dllcache\tintsetp.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\dllcache\tintsetp.exe /IMEName
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [iRiver Updater] \Updater.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [tgcmd] "c:\Program Files\Adelphia HSAgent\bin\tgcmd.exe" /server /startmonitor /deaf 
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1162186374\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [sys0236471997-7] C:\WINDOWS\sys0236471997-7.exe
O4 - HKLM\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Run Google Web Accelerator.lnk = C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.adelphia.net/sdccommon/download/tgctlins.cab
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish.com/SnapfishActivia.cab
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} - http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://www.vzwpix.com/activex/VerizonWirelessUploadControl.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {C915801D-6F00-49CD-8A9A-8DE5C11ADDC1} (Pixami Drag/Drop Upload UI Control) - http://www.photoworks.com/pixami/DragDropUploader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{952A9AC8-A5CF-4D22-99EB-FC83496CA1F2}: NameServer = 152.158.2.48
O17 - HKLM\System\CCS\Services\Tcpip\..\{FAAD30F5-4BD7-442F-94AB-A65BDC73BBF8}: NameServer = 152.158.2.48
O20 - AppInit_DLLs: dxclib303562752.dll
O23 - Service: Microsoft ASPI Manager (aspi113210) - Unknown owner - C:\WINDOWS\system32\aspi194211.exe (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\lqkpmis.exe (file missing)


----------



## dragnstyl33 (Nov 18, 2006)

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\mjnncmgb

*******************

Script file located at: \??\C:\WINDOWS\system32\bsvedxie.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\Sloopy7.exe deleted successfully.


File C:\WINDOWS\system32\aspi194211.exe not found!
Deletion of file C:\WINDOWS\system32\aspi194211.exe failed!

Could not process line:
C:\WINDOWS\system32\aspi194211.exe
Status: 0xc0000034



File C:\WINDOWS\system32\byxvsqp.dll not found!
Deletion of file C:\WINDOWS\system32\byxvsqp.dll failed!

Could not process line:
C:\WINDOWS\system32\byxvsqp.dll
Status: 0xc0000034



File C:\WINDOWS\mq2.exe not found!
Deletion of file C:\WINDOWS\mq2.exe failed!

Could not process line:
C:\WINDOWS\mq2.exe
Status: 0xc0000034



File C:\WINDOWS\c1e268626.exe not found!
Deletion of file C:\WINDOWS\c1e268626.exe failed!

Could not process line:
C:\WINDOWS\c1e268626.exe
Status: 0xc0000034



File C:\WINDOWS\vkr.exe not found!
Deletion of file C:\WINDOWS\vkr.exe failed!

Could not process line:
C:\WINDOWS\vkr.exe
Status: 0xc0000034



File C:\WINDOWS\4jh.exe not found!
Deletion of file C:\WINDOWS\4jh.exe failed!

Could not process line:
C:\WINDOWS\4jh.exe
Status: 0xc0000034



File C:\WINDOWS\pvt.exe not found!
Deletion of file C:\WINDOWS\pvt.exe failed!

Could not process line:
C:\WINDOWS\pvt.exe
Status: 0xc0000034



File C:\Documents and Settings\Noom\JFcW463.exe not found!
Deletion of file C:\Documents and Settings\Noom\JFcW463.exe failed!

Could not process line:
C:\Documents and Settings\Noom\JFcW463.exe
Status: 0xc0000034



File C:\WINDOWS\ms061997-73647.exe not found!
Deletion of file C:\WINDOWS\ms061997-73647.exe failed!

Could not process line:
C:\WINDOWS\ms061997-73647.exe
Status: 0xc0000034



File C:\WINDOWS\comdlj32.dll not found!
Deletion of file C:\WINDOWS\comdlj32.dll failed!

Could not process line:
C:\WINDOWS\comdlj32.dll
Status: 0xc0000034



File C:\Documents and Settings\Noom\H6Ws7cS.exe not found!
Deletion of file C:\Documents and Settings\Noom\H6Ws7cS.exe failed!

Could not process line:
C:\Documents and Settings\Noom\H6Ws7cS.exe
Status: 0xc0000034



File C:\Documents and Settings\Noom\dV.exe not found!
Deletion of file C:\Documents and Settings\Noom\dV.exe failed!

Could not process line:
C:\Documents and Settings\Noom\dV.exe
Status: 0xc0000034



File C:\Documents and Settings\Noom\UF82H6F.exe not found!
Deletion of file C:\Documents and Settings\Noom\UF82H6F.exe failed!

Could not process line:
C:\Documents and Settings\Noom\UF82H6F.exe
Status: 0xc0000034



File C:\Documents and Settings\Noom\viqogPE.exe not found!
Deletion of file C:\Documents and Settings\Noom\viqogPE.exe failed!

Could not process line:
C:\Documents and Settings\Noom\viqogPE.exe
Status: 0xc0000034



File C:\WINDOWS\system32\nbxoffih.dll not found!
Deletion of file C:\WINDOWS\system32\nbxoffih.dll failed!

Could not process line:
C:\WINDOWS\system32\nbxoffih.dll
Status: 0xc0000034



File C:\Documents and Settings\Noom\v7kQ031.exe not found!
Deletion of file C:\Documents and Settings\Noom\v7kQ031.exe failed!

Could not process line:
C:\Documents and Settings\Noom\v7kQ031.exe
Status: 0xc0000034



File C:\WINDOWS\system32\wvuspml.dll not found!
Deletion of file C:\WINDOWS\system32\wvuspml.dll failed!

Could not process line:
C:\WINDOWS\system32\wvuspml.dll
Status: 0xc0000034



File C:\WINDOWS\pns.exe not found!
Deletion of file C:\WINDOWS\pns.exe failed!

Could not process line:
C:\WINDOWS\pns.exe
Status: 0xc0000034



File C:\WINDOWS\uu.exe not found!
Deletion of file C:\WINDOWS\uu.exe failed!

Could not process line:
C:\WINDOWS\uu.exe
Status: 0xc0000034



File C:\WINDOWS\raq.exe not found!
Deletion of file C:\WINDOWS\raq.exe failed!

Could not process line:
C:\WINDOWS\raq.exe
Status: 0xc0000034



File C:\WINDOWS\bsf.exe not found!
Deletion of file C:\WINDOWS\bsf.exe failed!

Could not process line:
C:\WINDOWS\bsf.exe
Status: 0xc0000034



File C:\WINDOWS\system32\wpwswapt.exe not found!
Deletion of file C:\WINDOWS\system32\wpwswapt.exe failed!

Could not process line:
C:\WINDOWS\system32\wpwswapt.exe
Status: 0xc0000034



File C:\WINDOWS\system32\ybcdd.bak2 not found!
Deletion of file C:\WINDOWS\system32\ybcdd.bak2 failed!

Could not process line:
C:\WINDOWS\system32\ybcdd.bak2
Status: 0xc0000034



File C:\WINDOWS\system32\ybcdd.bak1 not found!
Deletion of file C:\WINDOWS\system32\ybcdd.bak1 failed!

Could not process line:
C:\WINDOWS\system32\ybcdd.bak1
Status: 0xc0000034



File C:\WINDOWS\system32\wvutstu.dll not found!
Deletion of file C:\WINDOWS\system32\wvutstu.dll failed!

Could not process line:
C:\WINDOWS\system32\wvutstu.dll
Status: 0xc0000034



File C:\WINDOWS\fym.exe not found!
Deletion of file C:\WINDOWS\fym.exe failed!

Could not process line:
C:\WINDOWS\fym.exe
Status: 0xc0000034



File C:\WINDOWS\ebx.exe not found!
Deletion of file C:\WINDOWS\ebx.exe failed!

Could not process line:
C:\WINDOWS\ebx.exe
Status: 0xc0000034



File C:\WINDOWS\1.exe not found!
Deletion of file C:\WINDOWS\1.exe failed!

Could not process line:
C:\WINDOWS\1.exe
Status: 0xc0000034



File C:\WINDOWS\2pd.exe not found!
Deletion of file C:\WINDOWS\2pd.exe failed!

Could not process line:
C:\WINDOWS\2pd.exe
Status: 0xc0000034



File C:\Documents and Settings\Noom\vLT7QJ5.exe not found!
Deletion of file C:\Documents and Settings\Noom\vLT7QJ5.exe failed!

Could not process line:
C:\Documents and Settings\Noom\vLT7QJ5.exe
Status: 0xc0000034



File C:\Documents and Settings\Noom\Ft0Bi5u.exe not found!
Deletion of file C:\Documents and Settings\Noom\Ft0Bi5u.exe failed!

Could not process line:
C:\Documents and Settings\Noom\Ft0Bi5u.exe
Status: 0xc0000034



File C:\WINDOWS\system32\ddcby.dll not found!
Deletion of file C:\WINDOWS\system32\ddcby.dll failed!

Could not process line:
C:\WINDOWS\system32\ddcby.dll
Status: 0xc0000034



File C:\WINDOWS\sys01736471997-2006.exe not found!
Deletion of file C:\WINDOWS\sys01736471997-2006.exe failed!

Could not process line:
C:\WINDOWS\sys01736471997-2006.exe
Status: 0xc0000034



File C:\Documents and Settings\Noom\xDmB554.exe not found!
Deletion of file C:\Documents and Settings\Noom\xDmB554.exe failed!

Could not process line:
C:\Documents and Settings\Noom\xDmB554.exe
Status: 0xc0000034



File C:\WINDOWS\system32\urqqpmm.dll not found!
Deletion of file C:\WINDOWS\system32\urqqpmm.dll failed!

Could not process line:
C:\WINDOWS\system32\urqqpmm.dll
Status: 0xc0000034



File C:\WINDOWS\kgz.exe not found!
Deletion of file C:\WINDOWS\kgz.exe failed!

Could not process line:
C:\WINDOWS\kgz.exe
Status: 0xc0000034



File C:\WINDOWS\system32\ipv6monk.dll not found!
Deletion of file C:\WINDOWS\system32\ipv6monk.dll failed!

Could not process line:
C:\WINDOWS\system32\ipv6monk.dll
Status: 0xc0000034



File C:\WINDOWS\tpd.exe not found!
Deletion of file C:\WINDOWS\tpd.exe failed!

Could not process line:
C:\WINDOWS\tpd.exe
Status: 0xc0000034



File C:\WINDOWS\u5p.exe not found!
Deletion of file C:\WINDOWS\u5p.exe failed!

Could not process line:
C:\WINDOWS\u5p.exe
Status: 0xc0000034



File C:\WINDOWS\owq.exe not found!
Deletion of file C:\WINDOWS\owq.exe failed!

Could not process line:
C:\WINDOWS\owq.exe
Status: 0xc0000034



File C:\WINDOWS\.exe not found!
Deletion of file C:\WINDOWS\.exe failed!

Could not process line:
C:\WINDOWS\.exe
Status: 0xc0000034



File C:\WINDOWS\system32\mllmk.dll not found!
Deletion of file C:\WINDOWS\system32\mllmk.dll failed!

Could not process line:
C:\WINDOWS\system32\mllmk.dll
Status: 0xc0000034



File C:\WINDOWS\system32\vxg6ame4.exe not found!
Deletion of file C:\WINDOWS\system32\vxg6ame4.exe failed!

Could not process line:
C:\WINDOWS\system32\vxg6ame4.exe
Status: 0xc0000034



File C:\WINDOWS\system32\vxga8me6.exe not found!
Deletion of file C:\WINDOWS\system32\vxga8me6.exe failed!

Could not process line:
C:\WINDOWS\system32\vxga8me6.exe
Status: 0xc0000034



File C:\WINDOWS\system32\vxga4me1.exe not found!
Deletion of file C:\WINDOWS\system32\vxga4me1.exe failed!

Could not process line:
C:\WINDOWS\system32\vxga4me1.exe
Status: 0xc0000034



File C:\WINDOWS\system32\awtsstr.dll not found!
Deletion of file C:\WINDOWS\system32\awtsstr.dll failed!

Could not process line:
C:\WINDOWS\system32\awtsstr.dll
Status: 0xc0000034



File C:\WINDOWS\system32\dlh9jkd1q5.exe not found!
Deletion of file C:\WINDOWS\system32\dlh9jkd1q5.exe failed!

Could not process line:
C:\WINDOWS\system32\dlh9jkd1q5.exe
Status: 0xc0000034



File C:\WINDOWS\system32\dlh9jkd1q7.exe not found!
Deletion of file C:\WINDOWS\system32\dlh9jkd1q7.exe failed!

Could not process line:
C:\WINDOWS\system32\dlh9jkd1q7.exe
Status: 0xc0000034



File C:\WINDOWS\system32\dlh9jkd1q2.exe not found!
Deletion of file C:\WINDOWS\system32\dlh9jkd1q2.exe failed!

Could not process line:
C:\WINDOWS\system32\dlh9jkd1q2.exe
Status: 0xc0000034



File C:\WINDOWS\system32\dlh9jkd1q1.exe not found!
Deletion of file C:\WINDOWS\system32\dlh9jkd1q1.exe failed!

Could not process line:
C:\WINDOWS\system32\dlh9jkd1q1.exe
Status: 0xc0000034



File C:\WINDOWS\system32\dlh9jkd1q8.exe not found!
Deletion of file C:\WINDOWS\system32\dlh9jkd1q8.exe failed!

Could not process line:
C:\WINDOWS\system32\dlh9jkd1q8.exe
Status: 0xc0000034



File C:\WINDOWS\system32\kernels88.exe not found!
Deletion of file C:\WINDOWS\system32\kernels88.exe failed!

Could not process line:
C:\WINDOWS\system32\kernels88.exe
Status: 0xc0000034



File C:\WINDOWS\ezf.exe not found!
Deletion of file C:\WINDOWS\ezf.exe failed!

Could not process line:
C:\WINDOWS\ezf.exe
Status: 0xc0000034



File C:\WINDOWS\jkp.exe not found!
Deletion of file C:\WINDOWS\jkp.exe failed!

Could not process line:
C:\WINDOWS\jkp.exe
Status: 0xc0000034



File C:\WINDOWS\zfj.exe not found!
Deletion of file C:\WINDOWS\zfj.exe failed!

Could not process line:
C:\WINDOWS\zfj.exe
Status: 0xc0000034



File C:\WINDOWS\oew.exe not found!
Deletion of file C:\WINDOWS\oew.exe failed!

Could not process line:
C:\WINDOWS\oew.exe
Status: 0xc0000034



File C:\WINDOWS\system32\xxwts.dll not found!
Deletion of file C:\WINDOWS\system32\xxwts.dll failed!

Could not process line:
C:\WINDOWS\system32\xxwts.dll
Status: 0xc0000034



File C:\WINDOWS\system32\cbayv.dll not found!
Deletion of file C:\WINDOWS\system32\cbayv.dll failed!

Could not process line:
C:\WINDOWS\system32\cbayv.dll
Status: 0xc0000034



File C:\WINDOWS\NDNuninstall7_22.exe not found!
Deletion of file C:\WINDOWS\NDNuninstall7_22.exe failed!

Could not process line:
C:\WINDOWS\NDNuninstall7_22.exe
Status: 0xc0000034



File C:\WINDOWS\system32\gebxvut.dll not found!
Deletion of file C:\WINDOWS\system32\gebxvut.dll failed!

Could not process line:
C:\WINDOWS\system32\gebxvut.dll
Status: 0xc0000034



File C:\WINDOWS\tfp.exe not found!
Deletion of file C:\WINDOWS\tfp.exe failed!

Could not process line:
C:\WINDOWS\tfp.exe
Status: 0xc0000034



File C:\WINDOWS\system32\durvilx.exe not found!
Deletion of file C:\WINDOWS\system32\durvilx.exe failed!

Could not process line:
C:\WINDOWS\system32\durvilx.exe
Status: 0xc0000034



File C:\WINDOWS\system32\ipv6monl.dll not found!
Deletion of file C:\WINDOWS\system32\ipv6monl.dll failed!

Could not process line:
C:\WINDOWS\system32\ipv6monl.dll
Status: 0xc0000034



File C:\WINDOWS\system32\tea0f3dc.dll not found!
Deletion of file C:\WINDOWS\system32\tea0f3dc.dll failed!

Could not process line:
C:\WINDOWS\system32\tea0f3dc.dll
Status: 0xc0000034



File C:\WINDOWS\srvszvvmfe.exe not found!
Deletion of file C:\WINDOWS\srvszvvmfe.exe failed!

Could not process line:
C:\WINDOWS\srvszvvmfe.exe
Status: 0xc0000034



File C:\WINDOWS\srvrdgapkd.exe not found!
Deletion of file C:\WINDOWS\srvrdgapkd.exe failed!

Could not process line:
C:\WINDOWS\srvrdgapkd.exe
Status: 0xc0000034



File C:\WINDOWS\lqkpmisA.exe not found!
Deletion of file C:\WINDOWS\lqkpmisA.exe failed!

Could not process line:
C:\WINDOWS\lqkpmisA.exe
Status: 0xc0000034



File C:\WINDOWS\tct101.dll not found!
Deletion of file C:\WINDOWS\tct101.dll failed!

Could not process line:
C:\WINDOWS\tct101.dll
Status: 0xc0000034



File C:\WINDOWS\lqkpmis.exe not found!
Deletion of file C:\WINDOWS\lqkpmis.exe failed!

Could not process line:
C:\WINDOWS\lqkpmis.exe
Status: 0xc0000034



File C:\WINDOWS\nem220.dll not found!
Deletion of file C:\WINDOWS\nem220.dll failed!

Could not process line:
C:\WINDOWS\nem220.dll
Status: 0xc0000034



File C:\WINDOWS\jqx64712451.exe not found!
Deletion of file C:\WINDOWS\jqx64712451.exe failed!

Could not process line:
C:\WINDOWS\jqx64712451.exe
Status: 0xc0000034



File C:\WINDOWS\system32\w3dad4f6.dll not found!
Deletion of file C:\WINDOWS\system32\w3dad4f6.dll failed!

Could not process line:
C:\WINDOWS\system32\w3dad4f6.dll
Status: 0xc0000034



File C:\WINDOWS\srvymrgqhp.exe not found!
Deletion of file C:\WINDOWS\srvymrgqhp.exe failed!

Could not process line:
C:\WINDOWS\srvymrgqhp.exe
Status: 0xc0000034



File C:\WINDOWS\srvivtrofr.exe not found!
Deletion of file C:\WINDOWS\srvivtrofr.exe failed!

Could not process line:
C:\WINDOWS\srvivtrofr.exe
Status: 0xc0000034



File C:\WINDOWS\system32\durvilx.dll not found!
Deletion of file C:\WINDOWS\system32\durvilx.dll failed!

Could not process line:
C:\WINDOWS\system32\durvilx.dll
Status: 0xc0000034



File C:\WINDOWS\k.exe not found!
Deletion of file C:\WINDOWS\k.exe failed!

Could not process line:
C:\WINDOWS\k.exe
Status: 0xc0000034



File C:\WINDOWS\system32\DomainHelper.dll not found!
Deletion of file C:\WINDOWS\system32\DomainHelper.dll failed!

Could not process line:
C:\WINDOWS\system32\DomainHelper.dll
Status: 0xc0000034



File C:\WINDOWS\system32\tea0f3dc.sys not found!
Deletion of file C:\WINDOWS\system32\tea0f3dc.sys failed!

Could not process line:
C:\WINDOWS\system32\tea0f3dc.sys
Status: 0xc0000034



File C:\WINDOWS\kvh.exe not found!
Deletion of file C:\WINDOWS\kvh.exe failed!

Could not process line:
C:\WINDOWS\kvh.exe
Status: 0xc0000034



File C:\WINDOWS\system32\z2199.exe not found!
Deletion of file C:\WINDOWS\system32\z2199.exe failed!

Could not process line:
C:\WINDOWS\system32\z2199.exe
Status: 0xc0000034



File C:\WINDOWS\system32\sporder.dll not found!
Deletion of file C:\WINDOWS\system32\sporder.dll failed!

Could not process line:
C:\WINDOWS\system32\sporder.dll
Status: 0xc0000034



File C:\WINDOWS\ids.exe not found!
Deletion of file C:\WINDOWS\ids.exe failed!

Could not process line:
C:\WINDOWS\ids.exe
Status: 0xc0000034

File C:\WINDOWS\vmmlog32.dll deleted successfully.


File C:\WINDOWS\system32\ldcore.dll not found!
Deletion of file C:\WINDOWS\system32\ldcore.dll failed!

Could not process line:
C:\WINDOWS\system32\ldcore.dll
Status: 0xc0000034



File C:\WINDOWS\system32\z2570.exe not found!
Deletion of file C:\WINDOWS\system32\z2570.exe failed!

Could not process line:
C:\WINDOWS\system32\z2570.exe
Status: 0xc0000034



File C:\WINDOWS\NDNuninstall6_38.exe not found!
Deletion of file C:\WINDOWS\NDNuninstall6_38.exe failed!

Could not process line:
C:\WINDOWS\NDNuninstall6_38.exe
Status: 0xc0000034



File C:\WINDOWS\system32\z2600.exe not found!
Deletion of file C:\WINDOWS\system32\z2600.exe failed!

Could not process line:
C:\WINDOWS\system32\z2600.exe
Status: 0xc0000034



File C:\WINDOWS\system32\z2885.exe not found!
Deletion of file C:\WINDOWS\system32\z2885.exe failed!

Could not process line:
C:\WINDOWS\system32\z2885.exe
Status: 0xc0000034



File C:\WINDOWS\system32\sghvn32.dll not found!
Deletion of file C:\WINDOWS\system32\sghvn32.dll failed!

Could not process line:
C:\WINDOWS\system32\sghvn32.dll
Status: 0xc0000034



File C:\WINDOWS\system32\z2319.exe not found!
Deletion of file C:\WINDOWS\system32\z2319.exe failed!

Could not process line:
C:\WINDOWS\system32\z2319.exe
Status: 0xc0000034



File C:\WINDOWS\system32\z2397.exe not found!
Deletion of file C:\WINDOWS\system32\z2397.exe failed!

Could not process line:
C:\WINDOWS\system32\z2397.exe
Status: 0xc0000034



File C:\WINDOWS\system32\z2612.exe not found!
Deletion of file C:\WINDOWS\system32\z2612.exe failed!

Could not process line:
C:\WINDOWS\system32\z2612.exe
Status: 0xc0000034



File C:\WINDOWS\system32\z2292.exe not found!
Deletion of file C:\WINDOWS\system32\z2292.exe failed!

Could not process line:
C:\WINDOWS\system32\z2292.exe
Status: 0xc0000034



File C:\WINDOWS\system32\z2999.exe not found!
Deletion of file C:\WINDOWS\system32\z2999.exe failed!

Could not process line:
C:\WINDOWS\system32\z2999.exe
Status: 0xc0000034



File C:\WINDOWS\system32\qbhtpcz.dll not found!
Deletion of file C:\WINDOWS\system32\qbhtpcz.dll failed!

Could not process line:
C:\WINDOWS\system32\qbhtpcz.dll
Status: 0xc0000034



File C:\WINDOWS\system32\zlbw.dll not found!
Deletion of file C:\WINDOWS\system32\zlbw.dll failed!

Could not process line:
C:\WINDOWS\system32\zlbw.dll
Status: 0xc0000034



File C:\WINDOWS\system32\w.exe not found!
Deletion of file C:\WINDOWS\system32\w.exe failed!

Could not process line:
C:\WINDOWS\system32\w.exe
Status: 0xc0000034



File C:\WINDOWS\system32\z1940.exe not found!
Deletion of file C:\WINDOWS\system32\z1940.exe failed!

Could not process line:
C:\WINDOWS\system32\z1940.exe
Status: 0xc0000034



File C:\WINDOWS\system32\se.exe.exe not found!
Deletion of file C:\WINDOWS\system32\se.exe.exe failed!

Could not process line:
C:\WINDOWS\system32\se.exe.exe
Status: 0xc0000034



File C:\WINDOWS\system32\CrtCD47.exe not found!
Deletion of file C:\WINDOWS\system32\CrtCD47.exe failed!

Could not process line:
C:\WINDOWS\system32\CrtCD47.exe
Status: 0xc0000034



File C:\WINDOWS\system32\taskdir.exe not found!
Deletion of file C:\WINDOWS\system32\taskdir.exe failed!

Could not process line:
C:\WINDOWS\system32\taskdir.exe
Status: 0xc0000034



File C:\WINDOWS\system32\google.png.exe not found!
Deletion of file C:\WINDOWS\system32\google.png.exe failed!

Could not process line:
C:\WINDOWS\system32\google.png.exe
Status: 0xc0000034



File C:\WINDOWS\system32\z2963.exe not found!
Deletion of file C:\WINDOWS\system32\z2963.exe failed!

Could not process line:
C:\WINDOWS\system32\z2963.exe
Status: 0xc0000034



File C:\WINDOWS\system32\adir.dll not found!
Deletion of file C:\WINDOWS\system32\adir.dll failed!

Could not process line:
C:\WINDOWS\system32\adir.dll
Status: 0xc0000034



File C:\WINDOWS\system32\z2774.exe not found!
Deletion of file C:\WINDOWS\system32\z2774.exe failed!

Could not process line:
C:\WINDOWS\system32\z2774.exe
Status: 0xc0000034



File C:\WINDOWS\system32\z3250.dll not found!
Deletion of file C:\WINDOWS\system32\z3250.dll failed!

Could not process line:
C:\WINDOWS\system32\z3250.dll
Status: 0xc0000034



File C:\WINDOWS\system32\z2750.exe not found!
Deletion of file C:\WINDOWS\system32\z2750.exe failed!

Could not process line:
C:\WINDOWS\system32\z2750.exe
Status: 0xc0000034



File C:\WINDOWS\system32\oivyba.dll not found!
Deletion of file C:\WINDOWS\system32\oivyba.dll failed!

Could not process line:
C:\WINDOWS\system32\oivyba.dll
Status: 0xc0000034



File C:\WINDOWS\system32\3339_32.dll not found!
Deletion of file C:\WINDOWS\system32\3339_32.dll failed!

Could not process line:
C:\WINDOWS\system32\3339_32.dll
Status: 0xc0000034



File C:\WINDOWS\system32\w.exe.exe not found!
Deletion of file C:\WINDOWS\system32\w.exe.exe failed!

Could not process line:
C:\WINDOWS\system32\w.exe.exe
Status: 0xc0000034



File C:\WINDOWS\system32\wservice.exe not found!
Deletion of file C:\WINDOWS\system32\wservice.exe failed!

Could not process line:
C:\WINDOWS\system32\wservice.exe
Status: 0xc0000034



File C:\WINDOWS\system32\ss.exe.exe not found!
Deletion of file C:\WINDOWS\system32\ss.exe.exe failed!

Could not process line:
C:\WINDOWS\system32\ss.exe.exe
Status: 0xc0000034



File C:\WINDOWS\system32\cfltygd.dll not found!
Deletion of file C:\WINDOWS\system32\cfltygd.dll failed!

Could not process line:
C:\WINDOWS\system32\cfltygd.dll
Status: 0xc0000034



File C:\WINDOWS\.exe not found!
Deletion of file C:\WINDOWS\.exe failed!

Could not process line:
C:\WINDOWS\.exe
Status: 0xc0000034



File C:\WINDOWS\system32\wservice.exe not found!
Deletion of file C:\WINDOWS\system32\wservice.exe failed!

Could not process line:
C:\WINDOWS\system32\wservice.exe
Status: 0xc0000034



File C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\8394\gm.exe not found!
Deletion of file C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\8394\gm.exe failed!

Could not process line:
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\8394\gm.exe
Status: 0xc0000034



File C:\WINDOWS\system32\w3dad4f6.dll not found!
Deletion of file C:\WINDOWS\system32\w3dad4f6.dll failed!

Could not process line:
C:\WINDOWS\system32\w3dad4f6.dll
Status: 0xc0000034



File C:\WINDOWS\lqkpmisA.exe not found!
Deletion of file C:\WINDOWS\lqkpmisA.exe failed!

Could not process line:
C:\WINDOWS\lqkpmisA.exe
Status: 0xc0000034



File C:\WINDOWS\Sloopy7.exe not found!
Deletion of file C:\WINDOWS\Sloopy7.exe failed!

Could not process line:
C:\WINDOWS\Sloopy7.exe
Status: 0xc0000034



File C:\WINDOWS\system32\kernels88.exe not found!
Deletion of file C:\WINDOWS\system32\kernels88.exe failed!

Could not process line:
C:\WINDOWS\system32\kernels88.exe
Status: 0xc0000034



File C:\WINDOWS\ms0571997-7364.exe not found!
Deletion of file C:\WINDOWS\ms0571997-7364.exe failed!

Could not process line:
C:\WINDOWS\ms0571997-7364.exe
Status: 0xc0000034



File C:\winstall.exe not found!
Deletion of file C:\winstall.exe failed!

Could not process line:
C:\winstall.exe
Status: 0xc0000034



File C:\WINDOWS\system32\taskdir.exe not found!
Deletion of file C:\WINDOWS\system32\taskdir.exe failed!

Could not process line:
C:\WINDOWS\system32\taskdir.exe
Status: 0xc0000034



File C:\WINDOWS\jqx64712451.exe not found!
Deletion of file C:\WINDOWS\jqx64712451.exe failed!

Could not process line:
C:\WINDOWS\jqx64712451.exe
Status: 0xc0000034



File C:\Documents and Settings\Noom\Local Settings\Temp\35.tmp not found!
Deletion of file C:\Documents and Settings\Noom\Local Settings\Temp\35.tmp failed!

Could not process line:
C:\Documents and Settings\Noom\Local Settings\Temp\35.tmp
Status: 0xc0000034



File c:\windows\system32\ldcore.dll not found!
Deletion of file c:\windows\system32\ldcore.dll failed!

Could not process line:
c:\windows\system32\ldcore.dll
Status: 0xc0000034



File C:\WINDOWS\system32\cfltygd.dll not found!
Deletion of file C:\WINDOWS\system32\cfltygd.dll failed!

Could not process line:
C:\WINDOWS\system32\cfltygd.dll
Status: 0xc0000034



File C:\WINDOWS\system32\qbhtpcz.dll not found!
Deletion of file C:\WINDOWS\system32\qbhtpcz.dll failed!

Could not process line:
C:\WINDOWS\system32\qbhtpcz.dll
Status: 0xc0000034



File C:\WINDOWS\system32\oivyba.dll not found!
Deletion of file C:\WINDOWS\system32\oivyba.dll failed!

Could not process line:
C:\WINDOWS\system32\oivyba.dll
Status: 0xc0000034



Folder C:\Program Files\VSAdd-in not found!
Deletion of folder C:\Program Files\VSAdd-in failed!

Could not process line:
C:\Program Files\VSAdd-in
Status: 0xc0000034



Folder C:\Program Files\Super Codec not found!
Deletion of folder C:\Program Files\Super Codec failed!

Could not process line:
C:\Program Files\Super Codec
Status: 0xc0000034



Folder C:\Program Files\VirusBursters not found!
Deletion of folder C:\Program Files\VirusBursters failed!

Could not process line:
C:\Program Files\VirusBursters
Status: 0xc0000034



Folder C:\Program Files\SpySheriff not found!
Deletion of folder C:\Program Files\SpySheriff failed!

Could not process line:
C:\Program Files\SpySheriff
Status: 0xc0000034



Folder C:\Program Files\CMIntex not found!
Deletion of folder C:\Program Files\CMIntex failed!

Could not process line:
C:\Program Files\CMIntex
Status: 0xc0000034



Folder C:\Program Files\PSDream not found!
Deletion of folder C:\Program Files\PSDream failed!

Could not process line:
C:\Program Files\PSDream
Status: 0xc0000034



Folder C:\Program Files\PSCastor not found!
Deletion of folder C:\Program Files\PSCastor failed!

Could not process line:
C:\Program Files\PSCastor
Status: 0xc0000034



Folder C:\Program Files\Batty2 not found!
Deletion of folder C:\Program Files\Batty2 failed!

Could not process line:
C:\Program Files\Batty2
Status: 0xc0000034



Folder C:\WINDOWS\inet20004 not found!
Deletion of folder C:\WINDOWS\inet20004 failed!

Could not process line:
C:\WINDOWS\inet20004
Status: 0xc0000034



Registry key \Registry\Machine\System\CurrentControlSet\Services\pe386 not found!
Unload of driver pe386 failed!

Could not process line:
pe386
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33*

*Please print these instructions for reference*.

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below. *

O4 - HKLM\..\Run: [sys0236471997-7] C:\WINDOWS\sys0236471997-7.exe
O4 - HKLM\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKCU\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe

*Now *close all windows and browsers, other than HiJackThis*, then click Fix Checked.

Close Hijackthis.

Download the *FixDXC.reg *from the following link and save it on your desktop. (Right click on the link and select Save target as)


*FixDXC.reg Download Link*


Close Internet Explorer and keep it closed throughout the entire removal process.
Enter the *Control Panel *by clicking on the *Start* menu, then clicking on *Run*. Now type *Control* in the Open field and press the *OK *button.
Double-click on the Add or Remove Programs icon.
Look for the following entry and double-click on it.

*DeluxeCommunications*

If there is no *Add or Remove Programs *entry for this programs, click on *Start*, then *Run* and type the following in the Open field:

*C:\Program Files\DeluxeCommunications\Dxc.exe /u*

and press the OK button.
The DeluxeCommunications uninstall program will load and you will be asked to enter a security code. Enter the security code in the file and then press the OK button.










The uninstall process will then tell you that all browser windows will be closed if you continue. Press the Yes button to continue uninstalling DeluxeCommunications as shown in the figure below.








Close open windows to continue uninstalling DeluxeCommunications
Finally, when it asks if you would to reboot, as shown in the image below, press the Yes button so that your computer reboots.










Reboot to complete the DeluxeCommunications uninstallation

Doubleclick on the* FixDCX.reg *file. When it asks if you would like to add the information into the *Registry*, click on the *Yes* button and then on the *OK *button at next prompt..
Finally search for the following files. If they exist, they will be in the *%USERPROFILE%\Application Data *folder(C:\Documents and Settings\Noom\Application Data). When you find these files, delete them.


*[*]Dxcknwrd.dll
[*]Dxccwrd.dll*


*Boot in Safe mode*

Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

Using Windows Explorer (to get there right-click your Start button and go to "Explore"), please delete this *file* (if present):

*C:\WINDOWS\sys0236471997-7.exe*

Restart the computer.

Please download gmer rootkit detector from *Here*


Unzip it & double click the gmer.exe file
Select rootkit tab and press scan 
When it has finished press save & post back the log it makes 
Repeat the proces with the Autostarts tab and do the same there


----------



## dragnstyl33 (Nov 18, 2006)

I've done everything you've told me. The only thing is that I can not run GMER program, it always causes a system failure to my computer. I can only put the hjt log that has been updated. Also, some BraveSentry crap popped up on my computer as well.

Logfile of HijackThis v1.99.1
Scan saved at 10:30, on 06-11-21
Platform: Windows XP SP2, v.2149 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2149)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Updater.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Lexmark X74-X75\lxbbbmon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Adelphia HSAgent\bin\tgcmd.exe
C:\Program Files\Common Files\AOL\1162186374\ee\AOLSoftware.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\LVComsX.exe
C:\WINDOWS\system32\kernels88.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\xpupdate.exe
C:\Documents and Settings\Noom\Desktop\HijackThis.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Google\Web Accelerator\googlewebaccclient.exe
C:\WINDOWS\system32\dlh9jkd1q7.exe
C:\WINDOWS\system32\dlh9jkd1q7.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://localhost:9100/proxy.pac
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\dllcache\tintsetp.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\dllcache\tintsetp.exe /IMEName
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [iRiver Updater] \Updater.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [tgcmd] "c:\Program Files\Adelphia HSAgent\bin\tgcmd.exe" /server /startmonitor /deaf 
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1162186374\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ms061997-73647] C:\WINDOWS\ms061997-73647.exe
O4 - HKLM\..\Run: [System] C:\WINDOWS\system32\kernels88.exe
O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\system32\kernels88.exe
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Run Google Web Accelerator.lnk = C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.adelphia.net/sdccommon/download/tgctlins.cab
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish.com/SnapfishActivia.cab
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} - http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://www.vzwpix.com/activex/VerizonWirelessUploadControl.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {C915801D-6F00-49CD-8A9A-8DE5C11ADDC1} (Pixami Drag/Drop Upload UI Control) - http://www.photoworks.com/pixami/DragDropUploader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{952A9AC8-A5CF-4D22-99EB-FC83496CA1F2}: NameServer = 152.158.2.48
O17 - HKLM\System\CCS\Services\Tcpip\..\{FAAD30F5-4BD7-442F-94AB-A65BDC73BBF8}: NameServer = 152.158.2.48
O20 - AppInit_DLLs: c:\windows\system32\ldcore.dll
O23 - Service: Microsoft ASPI Manager (aspi113210) - Unknown owner - C:\WINDOWS\system32\aspi2178111.exe (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\lqkpmis.exe (file missing)


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

Download *SDFix* and save it to your desktop.

Please then reboot your computer in *Safe Mode* by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.

 In Safe Mode, right click the SDFix.zip folder and choose *Extract All*, 
 Open the extracted folder and double click *RunThis.bat* to start the script. 
 Type *Y* to begin the script.
 It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot. 
 Press any Key and it will restart the PC. 
 Your system will take longer that normal to restart as the fixtool will be running and removing files. 
 When the desktop loads the Fixtool will complete the removal and display *Finished*, then press any key to end the script and load your desktop icons.
 Finally open the SDFix folder on your desktop and copy and paste the contents of the results file *Report.txt* back onto the forum with a new HijackThis log

Please also run *Combofix* again and post the report. Id like to know if the rootkit was removed.


----------



## dragnstyl33 (Nov 18, 2006)

SDFix: Version 1.42
-------------------

Scan run on: 
06-11-21

Time:
12:27

Microsoft Windows XP [Version 5.1.2600]

Running from: C:\SDFix

Stage One...

Checking Services...

Name: 
-----
aspi113210
Windows Overlay Components

Path:
---- 
C:\WINDOWS\system32\aspi2178111.exe 
C:\WINDOWS\lqkpmis.exe

aspi113210 Deleted...
Windows Overlay Components Deleted...

Repairing Registry...

Restoring Default Hosts File...

Stage One Complete

Rebooting...

Stage Two...

Checking For Malware:
--------------------

C:\WINDOWS\2YN.EXE
C:\WINDOWS\G5V.EXE
C:\WINDOWS\QNO.EXE
C:\WINDOWS\YI5.EXE
C:\DOCUME~1\LOCALS~1\LOCALS~1\TEMP\STDRUN1.EXE
C:\DOCUME~1\LOCALS~1\LOCALS~1\TEMP\STDRUN10.EXE
C:\DOCUME~1\LOCALS~1\LOCALS~1\TEMP\STDRUN11.EXE
C:\DOCUME~1\LOCALS~1\LOCALS~1\TEMP\STDRUN2.EXE
C:\DOCUME~1\LOCALS~1\LOCALS~1\TEMP\STDRUN3.EXE
C:\DOCUME~1\LOCALS~1\LOCALS~1\TEMP\STDRUN4.EXE
C:\DOCUME~1\LOCALS~1\LOCALS~1\TEMP\STDRUN5.EXE
C:\DOCUME~1\LOCALS~1\LOCALS~1\TEMP\STDRUN6.EXE
C:\DOCUME~1\LOCALS~1\LOCALS~1\TEMP\STDRUN7.EXE
C:\DOCUME~1\LOCALS~1\LOCALS~1\TEMP\STDRUN8.EXE
C:\DOCUME~1\LOCALS~1\LOCALS~1\TEMP\STDRUN9.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN1.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN10.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN11.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN12.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN13.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN14.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN15.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN16.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN17.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN2.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN3.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN4.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN5.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN6.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN7.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN8.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN9.EXE
C:\WINDOWS\system32\ipv6monl.dll
C:\WINDOWS\system32\ldinfo.ldr
C:\WINDOWS\system32\msnav32.ax
C:\WINDOWS\tcb.pmw
C:\WINDOWS\Uninst2.htm
C:\WINDOWS\Unist1.htm

Backing Up and Removing any Files Found...

Final Check:

Services:
---------

Files:
------

Backups folder is located here - C:\SDFix\backups\backups.zip

FINISHED

Noom - 06-11-21 12:39:10.53 Service Pack 2, v.2149
ComboFix 06.11.9 - Running from: "C:\Documents and Settings\Noom\Desktop"

((((((((((((((((((((((((((((((( Files Created from 2006-10-21 to 2006-11-21 ))))))))))))))))))))))))))))))))))

2006-11-21	11:40	40,973	---hs----	C:\WINDOWS\system32\xxyyywt.dll
2006-11-21	11:40	19,240	--a------	C:\WINDOWS\nrp.exe
2006-11-21	11:39	2,560	--a------	C:\WINDOWS\vz1.exe
2006-11-21	11:38	8,058	--a------	C:\WINDOWS\2ky.exe
2006-11-21	11:38	106,712	--a------	C:\WINDOWS\3fl.exe
2006-11-21	10:19	4,169	--a------	C:\WINDOWS\system32\vxg6ame4.exe
2006-11-21	10:19	33,792	--a------	C:\WINDOWS\system32\vxga4me1.exe
2006-11-21	10:19	2,560	--a------	C:\WINDOWS\bfn.exe
2006-11-21	10:19	1,632	--a------	C:\WINDOWS\system32\vxga8me6.exe
2006-11-21	10:18	8,058	--a------	C:\WINDOWS\system32\kernels88.exe
2006-11-21	10:18	8,058	--a------	C:\WINDOWS\phk.exe
2006-11-21	10:18	7,408	--a------	C:\WINDOWS\system32\dlh9jkd1q7.exe
2006-11-21	10:18	6,687	--a------	C:\WINDOWS\system32\ldcore.dll
2006-11-21	10:18	4,547	--a------	C:\WINDOWS\system32\dlh9jkd1q5.exe
2006-11-21	10:18	2,518	--a------	C:\WINDOWS\system32\dlh9jkd1q1.exe
2006-11-21	10:18	18,672	--a------	C:\WINDOWS\system32\dlh9jkd1q2.exe
2006-11-21	10:18	16	--a------	C:\WINDOWS\system32\dlh9jkd1q8.exe
2006-11-21	10:18	106,712	--a------	C:\WINDOWS\ur3.exe
2006-11-21	10:17	7,680	--a------	C:\WINDOWS\vmmlog32.dll
2006-11-21	01:49	38,912	--a------	C:\WINDOWS\system32\aspi2135111.exe
2006-11-21	01:48	3,264	--a------	C:\WINDOWS\system32\vxga3me2.exe
2006-11-21	00:57	40,973	---hs----	C:\WINDOWS\system32\tuvwwxv.dll
2006-11-21	00:57	19,240	--a------	C:\WINDOWS\u5w.exe
2006-11-21	00:56	2,560	--a------	C:\WINDOWS\3fd.exe
2006-11-21	00:55	8,058	--a------	C:\WINDOWS\2g.exe
2006-11-21	00:55	106,712	--a------	C:\WINDOWS\rrs.exe
2006-11-20	17:41	727,611	---hs----	C:\WINDOWS\system32\hhiii.bak1
2006-11-20	17:41	692,276	---hs----	C:\WINDOWS\system32\iiihh.dll
2006-11-20	17:14	40,973	---hs----	C:\WINDOWS\system32\wvurpqn.dll
2006-11-20	17:14	19,240	--a------	C:\WINDOWS\iux.exe
2006-11-20	17:13	3,584	-r-hs----	C:\WINDOWS\13c134353.exe
2006-11-20	17:13	106,712	--a------	C:\WINDOWS\xit.exe
2006-11-20	17:12	8,058	--a------	C:\WINDOWS\zla.exe
2006-11-20	16:55	80	--a------	C:\WINDOWS\gmer_uninstall.cmd
2006-11-20	14:01	6,010	--a------	C:\Documents and Settings\Noom\h8WpsOS.exe
2006-11-18	12:20	65,568	--a------	C:\WINDOWS\system32\lzx32.sys
2006-11-18	04:15 d--------	C:\Documents and Settings\Noom\www.google.com
2006-11-15	16:49	49,152	--a------	C:\npbittorrent.dll

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2006-11-21 12:36	--------	d--------	C:\Program Files\Common Files
2006-11-21 12:11	2371	--a------	C:\Documents and Settings\Noom\Application Data\.googlewebacchosts
2006-11-21 11:38	--------	d--------	C:\Program Files\BraveSentry
2006-11-18 12:08	--------	d--------	C:\Documents and Settings\Noom\Application Data\SearchToolbarCorp
2006-11-18 04:00	--------	d---s----	C:\Documents and Settings\Noom\Application Data\Microsoft
2006-11-17 10:29	--------	d--------	C:\Program Files\BitTorrent
2006-11-17 10:18	--------	d--------	C:\Program Files\Common Files\Symantec Shared
2006-11-12 17:03	--------	d--------	C:\Program Files\viewsonic
2006-11-12 17:02	--------	d--h-----	C:\Program Files\InstallShield Installation Information
2006-11-11 18:34	--------	d--------	C:\Program Files\IrfanView
2006-11-05 13:37	--------	d--------	C:\Program Files\iTunes
2006-11-05 13:37	--------	d--------	C:\Program Files\iPod
2006-11-05 13:36	--------	d--------	C:\Program Files\QuickTime
2006-11-03 19:43	--------	d--------	C:\Documents and Settings\Noom\Application Data\BitTorrent
2006-11-03 19:39	--------	d--------	C:\Documents and Settings\Noom\Application Data\Skype
2006-10-29 21:33	--------	d--------	C:\Program Files\Common Files\Nullsoft
2006-10-29 21:33	--------	d--------	C:\Program Files\Common Files\AOL
2006-10-29 21:33	--------	d--------	C:\Program Files\AOL
2006-10-29 21:33	--------	d--------	C:\Program Files\AOD
2006-10-29 21:33	--------	d--------	C:\Documents and Settings\Noom\Application Data\acccore
2006-10-29 21:32	--------	d--------	C:\Program Files\Common Files\aolshare
2006-10-29 21:30	--------	d--------	C:\Program Files\AIM
2006-10-29 21:29	--------	d--------	C:\Documents and Settings\Noom\Application Data\Aim
2006-10-18 13:38	--------	d--------	C:\Documents and Settings\Noom\Application Data\AdobeUM
2006-10-17 17:04	--------	d--------	C:\Program Files\Lexmark X74-X75
2006-10-16 21:58	--------	d--------	C:\Program Files\Apple Software Update
2006-10-15 00:32	--------	d--------	C:\Program Files\Audacity
2006-09-28 11:40	--------	d--------	C:\Program Files\adelphia hsagent
2006-09-28 11:34	--------	d--------	C:\Program Files\Support.com
2006-09-24 11:23	39816	--a------	C:\Documents and Settings\Noom\Application Data\GDIPFONTCACHEV1.DAT
2006-09-24 10:26	--------	d--------	C:\Documents and Settings\Noom\Application Data\MySpace
2006-09-24 10:24	--------	d--------	C:\Program Files\MySpace
2006-09-22 06:36	53248	--a------	C:\WINDOWS\uni_7eh.exe
2006-09-19 15:43	109360	--a------	C:\WINDOWS\system32\GEARAspi.dll
2006-08-07 22:06	1218	--a------	C:\Documents and Settings\Noom\Application Data\AdobeDLM.log
2006-08-07 22:06	0	--a------	C:\Documents and Settings\Noom\Application Data\dm.ini

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Norton SystemWorks"="\"C:\\Program Files\\Norton SystemWorks\\cfgwiz.exe\" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz"
"LogitechSoftwareUpdate"="\"C:\\Program Files\\Logitech\\Video\\ManifestEngine.exe\" boot"
"NBJ"="\"C:\\Program Files\\Ahead\\Nero BackItUp\\nbj.exe\""
"Yahoo! Pager"="C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe -quiet"
"Aim6"=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32"
"PHIME2002ASync"="C:\\WINDOWS\\system32\\dllcache\\tintsetp.exe /SYNC"
"PHIME2002A"="C:\\WINDOWS\\system32\\dllcache\\tintsetp.exe /IMEName"
"SiSUSBRG"="C:\\WINDOWS\\SiSUSBrg.exe"
"SoundMan"="SOUNDMAN.EXE"
"Lexmark X74-X75"="\"C:\\Program Files\\Lexmark X74-X75\\lxbbbmgr.exe\""
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"LogitechVideoRepair"="C:\\Program Files\\Logitech\\Video\\ISStart.exe "
"LogitechVideoTray"="C:\\Program Files\\Logitech\\Video\\LogiTray.exe"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer"
"Logitech Utility"="Logi_MwX.Exe"
"zBrowser Launcher"="C:\\Program Files\\Logitech\\iTouch\\iTouch.exe"
"iRiver Updater"="\\Updater.exe"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\
65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"Adobe Photo Downloader"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\""
"tgcmd"="\"c:\\Program Files\\Adelphia HSAgent\\bin\\tgcmd.exe\" /server /startmonitor /deaf "
"HostManager"="C:\\Program Files\\Common Files\\AOL\\1162186374\\ee\\AOLSoftware.exe"
"IPHSend"="C:\\Program Files\\Common Files\\AOL\\IPHSend\\IPHSend.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,20,01,00,00,00,00,00,00,80,04,00,00,84,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=dword:40000004
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,f2,01,00,00,b9,00,00,00,7c,00,00,00,72,00,\
00,00,01,00,00,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
"{ff170564-36c8-43f7-9100-559e166405cf}"="cussers"
"{2C1CD3D7-86AC-4068-93BC-A02304BB3339}"="DCOM Server 3339"
"{2C1CD3D7-86AC-4068-93BC-A02304BB2236}"="DCOM Server 2236"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{0E55CC01-8113-487B-92F2-98C24D98A57F}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"Wallpaper"="C:\\WINDOWS\\desktop.html"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"NoActiveDesktop"=dword:00000000
"ClassicShell"=dword:00000000
"ForceActiveDesktopOn"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"UseDesktopIniCache"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcby
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\iiihh
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvwwxv
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winsys2freg
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wvutstu

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]	
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - Nat.job
C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - Noom.job
C:\WINDOWS\tasks\Norton SystemWorks One Button Checkup.job
C:\WINDOWS\tasks\Symantec Drmc.job

Completion time: 06-11-21 12:41:50.55 
C:\ComboFix.txt ... 06-11-21 12:41
C:\ComboFix2.txt ... 06-11-21 11:53
C:\ComboFix3.txt ... 06-11-21 11:27


----------



## dragnstyl33 (Nov 18, 2006)

Logfile of HijackThis v1.99.1
Scan saved at 13:10, on 06-11-21
Platform: Windows XP SP2, v.2149 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2149)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Updater.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Adelphia HSAgent\bin\tgcmd.exe
C:\Program Files\Common Files\AOL\1162186374\ee\AOLSoftware.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Lexmark X74-X75\lxbbbmon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\system32\LVComsX.exe
C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Google\Web Accelerator\googlewebaccclient.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Noom\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://localhost:9100/proxy.pac
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\dllcache\tintsetp.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\dllcache\tintsetp.exe /IMEName
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [iRiver Updater] \Updater.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [tgcmd] "c:\Program Files\Adelphia HSAgent\bin\tgcmd.exe" /server /startmonitor /deaf 
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1162186374\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Run Google Web Accelerator.lnk = C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.adelphia.net/sdccommon/download/tgctlins.cab
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish.com/SnapfishActivia.cab
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} - http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://www.vzwpix.com/activex/VerizonWirelessUploadControl.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {C915801D-6F00-49CD-8A9A-8DE5C11ADDC1} (Pixami Drag/Drop Upload UI Control) - http://www.photoworks.com/pixami/DragDropUploader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{952A9AC8-A5CF-4D22-99EB-FC83496CA1F2}: NameServer = 152.158.2.48
O17 - HKLM\System\CCS\Services\Tcpip\..\{FAAD30F5-4BD7-442F-94AB-A65BDC73BBF8}: NameServer = 152.158.2.48
O20 - AppInit_DLLs: c:\windows\system32\ldcore.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below. *

O4 - HKLM\..\Run: [ms061997-73647] C:\WINDOWS\ms061997-73647.exe
O4 - HKLM\..\Run: [System] C:\WINDOWS\system32\kernels88.exe
O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\system32\kernels88.exe
O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe

*Now *close all windows and browsers, other than HiJackThis*, then click Fix Checked.

Close Hijackthis.


Download the attached file, unzip it and save it to your *C:\ drive.* (Overwrite the existing one)
When having saved it, the file path should be *C:\remove.txt*
Open the *Avenger*.
Check *Load Script from File *and then click the folder Icon on the right side of that section.
Then browse to *C:\remove.txt* and click *open* to load it.








Then click the *green light* icon.
This will begin the execution of the script currently in memory.
After you have clicked on the green light to begin execution of a script, the Avenger will set itself up to run the next time you reboot your computer, and then will prompt you to restart immediately.
After your system restarts, a log file should open with the results of Avengers actions. This log file is located at *C:\avenger.txt.* The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to *C:\avenger\backups.zip.*
Post the contents of the *C:\avenger.txt* file and a fresh *Hijackthis log*.


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

You are providing me with information drop by drop, consequently, by the time I post the log is completely different from the one you posted. That is quite confusing.

Your computer is being re-infected as we speak. Is *Norton* Active in the background? Do you have a Firewall active in the background. We will be wasting our time if there is no Antivirus or active Firewall present in the background.

Your computer is now also re-infected with *New.Net*.

First, Download *LSPFix.exe* to a convenient location. Do NOT run this program. This is *only* to be used if you lose Internet Access after removing NewDotNet.

Go to *Start * > *Control Panel * > *Add or Remove Programs * and remove the following:

*New.Net Applications* or *New.Net Domains* (_anything_ that says New.Net)

If it is not there, go here and follow *Procedure 4*: *NewDotNet Removal Procedure 4*.

In the event that you lose Internet access after removing New.Net, please double-click *LSPFix.exe* that you downloaded earlier. Check the "I know what I'm doing" button. You will see 2 panels. If there is any file listed in the "Remove" panel on the right-side, leave it as is and just click "*Finish>>*" then reboot your computer and you should now have access to the Internet. If nothing is listed under the "Remove Panel", do NOT do anything - just close the program. You will need to use another computer to come back here for further instructions on what to do.

Download *new.netfix.exe* by noahdfear. Save the file to your desktop. Double click, then click Start to extract the contents to it's own folder. Open the folder and double click the RunThis.bat file to start the tool. Follow the prompts and post the contents of the new.net.txt file it creates in the folder.


----------



## dragnstyl33 (Nov 18, 2006)

I'm running norton but the subscription has expired
Logfile of HijackThis v1.99.1
Scan saved at 17:52, on 06-11-21
Platform: Windows XP SP2, v.2149 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2149)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe
C:\Program Files\Lexmark X74-X75\lxbbbmon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\WINDOWS\System32\svchost.exe
C:\Updater.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Adelphia HSAgent\bin\tgcmd.exe
C:\WINDOWS\system32\LVComsX.exe
C:\Program Files\Common Files\AOL\1162186374\ee\AOLSoftware.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
C:\Program Files\Google\Web Accelerator\googlewebaccclient.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\OPScan.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Noom\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://localhost:9100/proxy.pac
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\dllcache\tintsetp.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\dllcache\tintsetp.exe /IMEName
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [iRiver Updater] \Updater.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [tgcmd] "c:\Program Files\Adelphia HSAgent\bin\tgcmd.exe" /server /startmonitor /deaf 
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1162186374\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [{A5-54-44-43-ZN}] c:\windows\system32\dwdsregt.exe SED001
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Run Google Web Accelerator.lnk = C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.adelphia.net/sdccommon/download/tgctlins.cab
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish.com/SnapfishActivia.cab
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} - http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://www.vzwpix.com/activex/VerizonWirelessUploadControl.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {C915801D-6F00-49CD-8A9A-8DE5C11ADDC1} (Pixami Drag/Drop Upload UI Control) - http://www.photoworks.com/pixami/DragDropUploader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{952A9AC8-A5CF-4D22-99EB-FC83496CA1F2}: NameServer = 152.158.2.48
O17 - HKLM\System\CCS\Services\Tcpip\..\{FAAD30F5-4BD7-442F-94AB-A65BDC73BBF8}: NameServer = 152.158.2.48
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

SDFix: Version 1.42
-------------------

Scan run on: 
06-11-21

Time:
12:27

Microsoft Windows XP [Version 5.1.2600]

Running from: C:\SDFix

Stage One...

Checking Services...

Name: 
-----
aspi113210
Windows Overlay Components

Path:
---- 
C:\WINDOWS\system32\aspi2178111.exe 
C:\WINDOWS\lqkpmis.exe

aspi113210 Deleted...
Windows Overlay Components Deleted...

Repairing Registry...

Restoring Default Hosts File...

Stage One Complete

Rebooting...

Stage Two...

Checking For Malware:
--------------------

C:\WINDOWS\2YN.EXE
C:\WINDOWS\G5V.EXE
C:\WINDOWS\QNO.EXE
C:\WINDOWS\YI5.EXE
C:\DOCUME~1\LOCALS~1\LOCALS~1\TEMP\STDRUN1.EXE
C:\DOCUME~1\LOCALS~1\LOCALS~1\TEMP\STDRUN10.EXE
C:\DOCUME~1\LOCALS~1\LOCALS~1\TEMP\STDRUN11.EXE
C:\DOCUME~1\LOCALS~1\LOCALS~1\TEMP\STDRUN2.EXE
C:\DOCUME~1\LOCALS~1\LOCALS~1\TEMP\STDRUN3.EXE
C:\DOCUME~1\LOCALS~1\LOCALS~1\TEMP\STDRUN4.EXE
C:\DOCUME~1\LOCALS~1\LOCALS~1\TEMP\STDRUN5.EXE
C:\DOCUME~1\LOCALS~1\LOCALS~1\TEMP\STDRUN6.EXE
C:\DOCUME~1\LOCALS~1\LOCALS~1\TEMP\STDRUN7.EXE
C:\DOCUME~1\LOCALS~1\LOCALS~1\TEMP\STDRUN8.EXE
C:\DOCUME~1\LOCALS~1\LOCALS~1\TEMP\STDRUN9.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN1.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN10.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN11.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN12.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN13.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN14.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN15.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN16.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN17.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN2.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN3.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN4.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN5.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN6.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN7.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN8.EXE
C:\DOCUME~1\NETWOR~1\LOCALS~1\TEMP\STDRUN9.EXE
C:\WINDOWS\system32\ipv6monl.dll
C:\WINDOWS\system32\ldinfo.ldr
C:\WINDOWS\system32\msnav32.ax
C:\WINDOWS\tcb.pmw
C:\WINDOWS\Uninst2.htm
C:\WINDOWS\Unist1.htm

Backing Up and Removing any Files Found...

Final Check:

Services:
---------

Files:
------

Backups folder is located here - C:\SDFix\backups\backups.zip

FINISHED


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below. *

O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} - http://www.ysbweb.com/ist/softwares/...sb_regular.cab

*Now *close all windows and browsers, other than HiJackThis*, then click Fix Checked.

Close Hijackthis.

The rest of the log looks clear, but I need to see the last *Avenger* report to confirm the baddies have been nuked.


----------



## dragnstyl33 (Nov 18, 2006)

still getting symantec mail server pop ups and multiple screen notifications of scanning messege. This is the first post not in safe mode.

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Error: could not initiate system shutdown.
Error code: 0


//////////////////////////////////////////


Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\gipyviix

*******************

Script file located at: \??\C:\Program Files\qudliyni.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



File C:\WINDOWS\Sloopy7.exe not found!
Deletion of file C:\WINDOWS\Sloopy7.exe failed!

Could not process line:
C:\WINDOWS\Sloopy7.exe
Status: 0xc0000034



File C:\WINDOWS\system32\aspi194211.exe not found!
Deletion of file C:\WINDOWS\system32\aspi194211.exe failed!

Could not process line:
C:\WINDOWS\system32\aspi194211.exe
Status: 0xc0000034



File C:\WINDOWS\system32\byxvsqp.dll not found!
Deletion of file C:\WINDOWS\system32\byxvsqp.dll failed!

Could not process line:
C:\WINDOWS\system32\byxvsqp.dll
Status: 0xc0000034



File C:\WINDOWS\mq2.exe not found!
Deletion of file C:\WINDOWS\mq2.exe failed!

Could not process line:
C:\WINDOWS\mq2.exe
Status: 0xc0000034



File C:\WINDOWS\c1e268626.exe not found!
Deletion of file C:\WINDOWS\c1e268626.exe failed!

Could not process line:
C:\WINDOWS\c1e268626.exe
Status: 0xc0000034



File C:\WINDOWS\vkr.exe not found!
Deletion of file C:\WINDOWS\vkr.exe failed!

Could not process line:
C:\WINDOWS\vkr.exe
Status: 0xc0000034



File C:\WINDOWS\4jh.exe not found!
Deletion of file C:\WINDOWS\4jh.exe failed!

Could not process line:
C:\WINDOWS\4jh.exe
Status: 0xc0000034



File C:\WINDOWS\pvt.exe not found!
Deletion of file C:\WINDOWS\pvt.exe failed!

Could not process line:
C:\WINDOWS\pvt.exe
Status: 0xc0000034



File C:\Documents and Settings\Noom\JFcW463.exe not found!
Deletion of file C:\Documents and Settings\Noom\JFcW463.exe failed!

Could not process line:
C:\Documents and Settings\Noom\JFcW463.exe
Status: 0xc0000034



File C:\WINDOWS\ms061997-73647.exe not found!
Deletion of file C:\WINDOWS\ms061997-73647.exe failed!

Could not process line:
C:\WINDOWS\ms061997-73647.exe
Status: 0xc0000034



File C:\WINDOWS\comdlj32.dll not found!
Deletion of file C:\WINDOWS\comdlj32.dll failed!

Could not process line:
C:\WINDOWS\comdlj32.dll
Status: 0xc0000034



File C:\Documents and Settings\Noom\H6Ws7cS.exe not found!
Deletion of file C:\Documents and Settings\Noom\H6Ws7cS.exe failed!

Could not process line:
C:\Documents and Settings\Noom\H6Ws7cS.exe
Status: 0xc0000034



File C:\Documents and Settings\Noom\dV.exe not found!
Deletion of file C:\Documents and Settings\Noom\dV.exe failed!

Could not process line:
C:\Documents and Settings\Noom\dV.exe
Status: 0xc0000034



File C:\Documents and Settings\Noom\UF82H6F.exe not found!
Deletion of file C:\Documents and Settings\Noom\UF82H6F.exe failed!

Could not process line:
C:\Documents and Settings\Noom\UF82H6F.exe
Status: 0xc0000034



File C:\Documents and Settings\Noom\viqogPE.exe not found!
Deletion of file C:\Documents and Settings\Noom\viqogPE.exe failed!

Could not process line:
C:\Documents and Settings\Noom\viqogPE.exe
Status: 0xc0000034



File C:\WINDOWS\system32\nbxoffih.dll not found!
Deletion of file C:\WINDOWS\system32\nbxoffih.dll failed!

Could not process line:
C:\WINDOWS\system32\nbxoffih.dll
Status: 0xc0000034



File C:\Documents and Settings\Noom\v7kQ031.exe not found!
Deletion of file C:\Documents and Settings\Noom\v7kQ031.exe failed!

Could not process line:
C:\Documents and Settings\Noom\v7kQ031.exe
Status: 0xc0000034



File C:\WINDOWS\system32\wvuspml.dll not found!
Deletion of file C:\WINDOWS\system32\wvuspml.dll failed!

Could not process line:
C:\WINDOWS\system32\wvuspml.dll
Status: 0xc0000034



File C:\WINDOWS\pns.exe not found!
Deletion of file C:\WINDOWS\pns.exe failed!

Could not process line:
C:\WINDOWS\pns.exe
Status: 0xc0000034



File C:\WINDOWS\uu.exe not found!
Deletion of file C:\WINDOWS\uu.exe failed!

Could not process line:
C:\WINDOWS\uu.exe
Status: 0xc0000034



File C:\WINDOWS\raq.exe not found!
Deletion of file C:\WINDOWS\raq.exe failed!

Could not process line:
C:\WINDOWS\raq.exe
Status: 0xc0000034



File C:\WINDOWS\bsf.exe not found!
Deletion of file C:\WINDOWS\bsf.exe failed!

Could not process line:
C:\WINDOWS\bsf.exe
Status: 0xc0000034



File C:\WINDOWS\system32\wpwswapt.exe not found!
Deletion of file C:\WINDOWS\system32\wpwswapt.exe failed!

Could not process line:
C:\WINDOWS\system32\wpwswapt.exe
Status: 0xc0000034



File C:\WINDOWS\system32\ybcdd.bak2 not found!
Deletion of file C:\WINDOWS\system32\ybcdd.bak2 failed!

Could not process line:
C:\WINDOWS\system32\ybcdd.bak2
Status: 0xc0000034



File C:\WINDOWS\system32\ybcdd.bak1 not found!
Deletion of file C:\WINDOWS\system32\ybcdd.bak1 failed!

Could not process line:
C:\WINDOWS\system32\ybcdd.bak1
Status: 0xc0000034



File C:\WINDOWS\system32\wvutstu.dll not found!
Deletion of file C:\WINDOWS\system32\wvutstu.dll failed!

Could not process line:
C:\WINDOWS\system32\wvutstu.dll
Status: 0xc0000034



File C:\WINDOWS\fym.exe not found!
Deletion of file C:\WINDOWS\fym.exe failed!

Could not process line:
C:\WINDOWS\fym.exe
Status: 0xc0000034



File C:\WINDOWS\ebx.exe not found!
Deletion of file C:\WINDOWS\ebx.exe failed!

Could not process line:
C:\WINDOWS\ebx.exe
Status: 0xc0000034



File C:\WINDOWS\1.exe not found!
Deletion of file C:\WINDOWS\1.exe failed!

Could not process line:
C:\WINDOWS\1.exe
Status: 0xc0000034



File C:\WINDOWS\2pd.exe not found!
Deletion of file C:\WINDOWS\2pd.exe failed!

Could not process line:
C:\WINDOWS\2pd.exe
Status: 0xc0000034



File C:\Documents and Settings\Noom\vLT7QJ5.exe not found!
Deletion of file C:\Documents and Settings\Noom\vLT7QJ5.exe failed!

Could not process line:
C:\Documents and Settings\Noom\vLT7QJ5.exe
Status: 0xc0000034



File C:\Documents and Settings\Noom\Ft0Bi5u.exe not found!
Deletion of file C:\Documents and Settings\Noom\Ft0Bi5u.exe failed!

Could not process line:
C:\Documents and Settings\Noom\Ft0Bi5u.exe
Status: 0xc0000034



File C:\WINDOWS\system32\ddcby.dll not found!
Deletion of file C:\WINDOWS\system32\ddcby.dll failed!

Could not process line:
C:\WINDOWS\system32\ddcby.dll
Status: 0xc0000034



File C:\WINDOWS\sys01736471997-2006.exe not found!
Deletion of file C:\WINDOWS\sys01736471997-2006.exe failed!

Could not process line:
C:\WINDOWS\sys01736471997-2006.exe
Status: 0xc0000034



File C:\Documents and Settings\Noom\xDmB554.exe not found!
Deletion of file C:\Documents and Settings\Noom\xDmB554.exe failed!

Could not process line:
C:\Documents and Settings\Noom\xDmB554.exe
Status: 0xc0000034



File C:\WINDOWS\system32\urqqpmm.dll not found!
Deletion of file C:\WINDOWS\system32\urqqpmm.dll failed!

Could not process line:
C:\WINDOWS\system32\urqqpmm.dll
Status: 0xc0000034



File C:\WINDOWS\kgz.exe not found!
Deletion of file C:\WINDOWS\kgz.exe failed!

Could not process line:
C:\WINDOWS\kgz.exe
Status: 0xc0000034



File C:\WINDOWS\system32\ipv6monk.dll not found!
Deletion of file C:\WINDOWS\system32\ipv6monk.dll failed!

Could not process line:
C:\WINDOWS\system32\ipv6monk.dll
Status: 0xc0000034



File C:\WINDOWS\tpd.exe not found!
Deletion of file C:\WINDOWS\tpd.exe failed!

Could not process line:
C:\WINDOWS\tpd.exe
Status: 0xc0000034



File C:\WINDOWS\u5p.exe not found!
Deletion of file C:\WINDOWS\u5p.exe failed!

Could not process line:
C:\WINDOWS\u5p.exe
Status: 0xc0000034



File C:\WINDOWS\owq.exe not found!
Deletion of file C:\WINDOWS\owq.exe failed!

Could not process line:
C:\WINDOWS\owq.exe
Status: 0xc0000034



File C:\WINDOWS\.exe not found!
Deletion of file C:\WINDOWS\.exe failed!

Could not process line:
C:\WINDOWS\.exe
Status: 0xc0000034



File C:\WINDOWS\system32\mllmk.dll not found!
Deletion of file C:\WINDOWS\system32\mllmk.dll failed!

Could not process line:
C:\WINDOWS\system32\mllmk.dll
Status: 0xc0000034

File C:\WINDOWS\system32\vxg6ame4.exe deleted successfully.


File C:\WINDOWS\system32\vxga8me6.exe not found!
Deletion of file C:\WINDOWS\system32\vxga8me6.exe failed!

Could not process line:
C:\WINDOWS\system32\vxga8me6.exe
Status: 0xc0000034

File C:\WINDOWS\system32\vxga4me1.exe deleted successfully.


File C:\WINDOWS\system32\awtsstr.dll not found!
Deletion of file C:\WINDOWS\system32\awtsstr.dll failed!

Could not process line:
C:\WINDOWS\system32\awtsstr.dll
Status: 0xc0000034

File C:\WINDOWS\system32\dlh9jkd1q5.exe deleted successfully.
File C:\WINDOWS\system32\dlh9jkd1q7.exe deleted successfully.
File C:\WINDOWS\system32\dlh9jkd1q2.exe deleted successfully.
File C:\WINDOWS\system32\dlh9jkd1q1.exe deleted successfully.
File C:\WINDOWS\system32\dlh9jkd1q8.exe deleted successfully.
File C:\WINDOWS\system32\kernels88.exe deleted successfully.


File C:\WINDOWS\ezf.exe not found!
Deletion of file C:\WINDOWS\ezf.exe failed!

Could not process line:
C:\WINDOWS\ezf.exe
Status: 0xc0000034



File C:\WINDOWS\jkp.exe not found!
Deletion of file C:\WINDOWS\jkp.exe failed!

Could not process line:
C:\WINDOWS\jkp.exe
Status: 0xc0000034



File C:\WINDOWS\zfj.exe not found!
Deletion of file C:\WINDOWS\zfj.exe failed!

Could not process line:
C:\WINDOWS\zfj.exe
Status: 0xc0000034



File C:\WINDOWS\oew.exe not found!
Deletion of file C:\WINDOWS\oew.exe failed!

Could not process line:
C:\WINDOWS\oew.exe
Status: 0xc0000034



File C:\WINDOWS\system32\xxwts.dll not found!
Deletion of file C:\WINDOWS\system32\xxwts.dll failed!

Could not process line:
C:\WINDOWS\system32\xxwts.dll
Status: 0xc0000034



File C:\WINDOWS\system32\cbayv.dll not found!
Deletion of file C:\WINDOWS\system32\cbayv.dll failed!

Could not process line:
C:\WINDOWS\system32\cbayv.dll
Status: 0xc0000034



File C:\WINDOWS\NDNuninstall7_22.exe not found!
Deletion of file C:\WINDOWS\NDNuninstall7_22.exe failed!

Could not process line:
C:\WINDOWS\NDNuninstall7_22.exe
Status: 0xc0000034



File C:\WINDOWS\system32\gebxvut.dll not found!
Deletion of file C:\WINDOWS\system32\gebxvut.dll failed!

Could not process line:
C:\WINDOWS\system32\gebxvut.dll
Status: 0xc0000034



File C:\WINDOWS\tfp.exe not found!
Deletion of file C:\WINDOWS\tfp.exe failed!

Could not process line:
C:\WINDOWS\tfp.exe
Status: 0xc0000034



File C:\WINDOWS\system32\durvilx.exe not found!
Deletion of file C:\WINDOWS\system32\durvilx.exe failed!

Could not process line:
C:\WINDOWS\system32\durvilx.exe
Status: 0xc0000034



File C:\WINDOWS\system32\ipv6monl.dll not found!
Deletion of file C:\WINDOWS\system32\ipv6monl.dll failed!

Could not process line:
C:\WINDOWS\system32\ipv6monl.dll
Status: 0xc0000034



File C:\WINDOWS\system32\tea0f3dc.dll not found!
Deletion of file C:\WINDOWS\system32\tea0f3dc.dll failed!

Could not process line:
C:\WINDOWS\system32\tea0f3dc.dll
Status: 0xc0000034



File C:\WINDOWS\srvszvvmfe.exe not found!
Deletion of file C:\WINDOWS\srvszvvmfe.exe failed!

Could not process line:
C:\WINDOWS\srvszvvmfe.exe
Status: 0xc0000034



File C:\WINDOWS\srvrdgapkd.exe not found!
Deletion of file C:\WINDOWS\srvrdgapkd.exe failed!

Could not process line:
C:\WINDOWS\srvrdgapkd.exe
Status: 0xc0000034



File C:\WINDOWS\lqkpmisA.exe not found!
Deletion of file C:\WINDOWS\lqkpmisA.exe failed!

Could not process line:
C:\WINDOWS\lqkpmisA.exe
Status: 0xc0000034

File C:\WINDOWS\tct101.dll deleted successfully.


File C:\WINDOWS\lqkpmis.exe not found!
Deletion of file C:\WINDOWS\lqkpmis.exe failed!

Could not process line:
C:\WINDOWS\lqkpmis.exe
Status: 0xc0000034

File C:\WINDOWS\nem220.dll deleted successfully.


File C:\WINDOWS\jqx64712451.exe not found!
Deletion of file C:\WINDOWS\jqx64712451.exe failed!

Could not process line:
C:\WINDOWS\jqx64712451.exe
Status: 0xc0000034



File C:\WINDOWS\system32\w3dad4f6.dll not found!
Deletion of file C:\WINDOWS\system32\w3dad4f6.dll failed!

Could not process line:
C:\WINDOWS\system32\w3dad4f6.dll
Status: 0xc0000034



File C:\WINDOWS\srvymrgqhp.exe not found!
Deletion of file C:\WINDOWS\srvymrgqhp.exe failed!

Could not process line:
C:\WINDOWS\srvymrgqhp.exe
Status: 0xc0000034



File C:\WINDOWS\srvivtrofr.exe not found!
Deletion of file C:\WINDOWS\srvivtrofr.exe failed!

Could not process line:
C:\WINDOWS\srvivtrofr.exe
Status: 0xc0000034



File C:\WINDOWS\system32\durvilx.dll not found!
Deletion of file C:\WINDOWS\system32\durvilx.dll failed!

Could not process line:
C:\WINDOWS\system32\durvilx.dll
Status: 0xc0000034



File C:\WINDOWS\k.exe not found!
Deletion of file C:\WINDOWS\k.exe failed!

Could not process line:
C:\WINDOWS\k.exe
Status: 0xc0000034

File C:\WINDOWS\system32\DomainHelper.dll deleted successfully.


File C:\WINDOWS\system32\tea0f3dc.sys not found!
Deletion of file C:\WINDOWS\system32\tea0f3dc.sys failed!

Could not process line:
C:\WINDOWS\system32\tea0f3dc.sys
Status: 0xc0000034



File C:\WINDOWS\kvh.exe not found!
Deletion of file C:\WINDOWS\kvh.exe failed!

Could not process line:
C:\WINDOWS\kvh.exe
Status: 0xc0000034



File C:\WINDOWS\system32\z2199.exe not found!
Deletion of file C:\WINDOWS\system32\z2199.exe failed!

Could not process line:
C:\WINDOWS\system32\z2199.exe
Status: 0xc0000034

File C:\WINDOWS\system32\sporder.dll deleted successfully.


File C:\WINDOWS\ids.exe not found!
Deletion of file C:\WINDOWS\ids.exe failed!

Could not process line:
C:\WINDOWS\ids.exe
Status: 0xc0000034

File C:\WINDOWS\vmmlog32.dll deleted successfully.
File C:\WINDOWS\system32\ldcore.dll deleted successfully.


File C:\WINDOWS\system32\z2570.exe not found!
Deletion of file C:\WINDOWS\system32\z2570.exe failed!

Could not process line:
C:\WINDOWS\system32\z2570.exe
Status: 0xc0000034

File C:\WINDOWS\NDNuninstall6_38.exe deleted successfully.


File C:\WINDOWS\system32\z2600.exe not found!
Deletion of file C:\WINDOWS\system32\z2600.exe failed!

Could not process line:
C:\WINDOWS\system32\z2600.exe
Status: 0xc0000034



File C:\WINDOWS\system32\z2885.exe not found!
Deletion of file C:\WINDOWS\system32\z2885.exe failed!

Could not process line:
C:\WINDOWS\system32\z2885.exe
Status: 0xc0000034



File C:\WINDOWS\system32\sghvn32.dll not found!
Deletion of file C:\WINDOWS\system32\sghvn32.dll failed!

Could not process line:
C:\WINDOWS\system32\sghvn32.dll
Status: 0xc0000034



File C:\WINDOWS\system32\z2319.exe not found!
Deletion of file C:\WINDOWS\system32\z2319.exe failed!

Could not process line:
C:\WINDOWS\system32\z2319.exe
Status: 0xc0000034



File C:\WINDOWS\system32\z2397.exe not found!
Deletion of file C:\WINDOWS\system32\z2397.exe failed!

Could not process line:
C:\WINDOWS\system32\z2397.exe
Status: 0xc0000034



File C:\WINDOWS\system32\z2612.exe not found!
Deletion of file C:\WINDOWS\system32\z2612.exe failed!

Could not process line:
C:\WINDOWS\system32\z2612.exe
Status: 0xc0000034



File C:\WINDOWS\system32\z2292.exe not found!
Deletion of file C:\WINDOWS\system32\z2292.exe failed!

Could not process line:
C:\WINDOWS\system32\z2292.exe
Status: 0xc0000034



File C:\WINDOWS\system32\z2999.exe not found!
Deletion of file C:\WINDOWS\system32\z2999.exe failed!

Could not process line:
C:\WINDOWS\system32\z2999.exe
Status: 0xc0000034



File C:\WINDOWS\system32\qbhtpcz.dll not found!
Deletion of file C:\WINDOWS\system32\qbhtpcz.dll failed!

Could not process line:
C:\WINDOWS\system32\qbhtpcz.dll
Status: 0xc0000034



File C:\WINDOWS\system32\zlbw.dll not found!
Deletion of file C:\WINDOWS\system32\zlbw.dll failed!

Could not process line:
C:\WINDOWS\system32\zlbw.dll
Status: 0xc0000034



File C:\WINDOWS\system32\w.exe not found!
Deletion of file C:\WINDOWS\system32\w.exe failed!

Could not process line:
C:\WINDOWS\system32\w.exe
Status: 0xc0000034



File C:\WINDOWS\system32\z1940.exe not found!
Deletion of file C:\WINDOWS\system32\z1940.exe failed!

Could not process line:
C:\WINDOWS\system32\z1940.exe
Status: 0xc0000034



File C:\WINDOWS\system32\se.exe.exe not found!
Deletion of file C:\WINDOWS\system32\se.exe.exe failed!

Could not process line:
C:\WINDOWS\system32\se.exe.exe
Status: 0xc0000034



File C:\WINDOWS\system32\CrtCD47.exe not found!
Deletion of file C:\WINDOWS\system32\CrtCD47.exe failed!

Could not process line:
C:\WINDOWS\system32\CrtCD47.exe
Status: 0xc0000034



File C:\WINDOWS\system32\taskdir.exe not found!
Deletion of file C:\WINDOWS\system32\taskdir.exe failed!

Could not process line:
C:\WINDOWS\system32\taskdir.exe
Status: 0xc0000034



File C:\WINDOWS\system32\google.png.exe not found!
Deletion of file C:\WINDOWS\system32\google.png.exe failed!

Could not process line:
C:\WINDOWS\system32\google.png.exe
Status: 0xc0000034



File C:\WINDOWS\system32\z2963.exe not found!
Deletion of file C:\WINDOWS\system32\z2963.exe failed!

Could not process line:
C:\WINDOWS\system32\z2963.exe
Status: 0xc0000034



File C:\WINDOWS\system32\adir.dll not found!
Deletion of file C:\WINDOWS\system32\adir.dll failed!

Could not process line:
C:\WINDOWS\system32\adir.dll
Status: 0xc0000034



File C:\WINDOWS\system32\z2774.exe not found!
Deletion of file C:\WINDOWS\system32\z2774.exe failed!

Could not process line:
C:\WINDOWS\system32\z2774.exe
Status: 0xc0000034



File C:\WINDOWS\system32\z3250.dll not found!
Deletion of file C:\WINDOWS\system32\z3250.dll failed!

Could not process line:
C:\WINDOWS\system32\z3250.dll
Status: 0xc0000034



File C:\WINDOWS\system32\z2750.exe not found!
Deletion of file C:\WINDOWS\system32\z2750.exe failed!

Could not process line:
C:\WINDOWS\system32\z2750.exe
Status: 0xc0000034



File C:\WINDOWS\system32\oivyba.dll not found!
Deletion of file C:\WINDOWS\system32\oivyba.dll failed!

Could not process line:
C:\WINDOWS\system32\oivyba.dll
Status: 0xc0000034



File C:\WINDOWS\system32\3339_32.dll not found!
Deletion of file C:\WINDOWS\system32\3339_32.dll failed!

Could not process line:
C:\WINDOWS\system32\3339_32.dll
Status: 0xc0000034



File C:\WINDOWS\system32\w.exe.exe not found!
Deletion of file C:\WINDOWS\system32\w.exe.exe failed!

Could not process line:
C:\WINDOWS\system32\w.exe.exe
Status: 0xc0000034



File C:\WINDOWS\system32\wservice.exe not found!
Deletion of file C:\WINDOWS\system32\wservice.exe failed!

Could not process line:
C:\WINDOWS\system32\wservice.exe
Status: 0xc0000034



File C:\WINDOWS\system32\ss.exe.exe not found!
Deletion of file C:\WINDOWS\system32\ss.exe.exe failed!

Could not process line:
C:\WINDOWS\system32\ss.exe.exe
Status: 0xc0000034



File C:\WINDOWS\system32\cfltygd.dll not found!
Deletion of file C:\WINDOWS\system32\cfltygd.dll failed!

Could not process line:
C:\WINDOWS\system32\cfltygd.dll
Status: 0xc0000034



File C:\WINDOWS\.exe not found!
Deletion of file C:\WINDOWS\.exe failed!

Could not process line:
C:\WINDOWS\.exe
Status: 0xc0000034



File C:\WINDOWS\system32\wservice.exe not found!
Deletion of file C:\WINDOWS\system32\wservice.exe failed!

Could not process line:
C:\WINDOWS\system32\wservice.exe
Status: 0xc0000034



File C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\8394\gm.exe not found!
Deletion of file C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\8394\gm.exe failed!

Could not process line:
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\8394\gm.exe
Status: 0xc0000034



File C:\WINDOWS\system32\w3dad4f6.dll not found!
Deletion of file C:\WINDOWS\system32\w3dad4f6.dll failed!

Could not process line:
C:\WINDOWS\system32\w3dad4f6.dll
Status: 0xc0000034



File C:\WINDOWS\lqkpmisA.exe not found!
Deletion of file C:\WINDOWS\lqkpmisA.exe failed!

Could not process line:
C:\WINDOWS\lqkpmisA.exe
Status: 0xc0000034



File C:\WINDOWS\Sloopy7.exe not found!
Deletion of file C:\WINDOWS\Sloopy7.exe failed!

Could not process line:
C:\WINDOWS\Sloopy7.exe
Status: 0xc0000034



File C:\WINDOWS\system32\kernels88.exe not found!
Deletion of file C:\WINDOWS\system32\kernels88.exe failed!

Could not process line:
C:\WINDOWS\system32\kernels88.exe
Status: 0xc0000034



File C:\WINDOWS\ms0571997-7364.exe not found!
Deletion of file C:\WINDOWS\ms0571997-7364.exe failed!

Could not process line:
C:\WINDOWS\ms0571997-7364.exe
Status: 0xc0000034



File C:\winstall.exe not found!
Deletion of file C:\winstall.exe failed!

Could not process line:
C:\winstall.exe
Status: 0xc0000034



File C:\WINDOWS\system32\taskdir.exe not found!
Deletion of file C:\WINDOWS\system32\taskdir.exe failed!

Could not process line:
C:\WINDOWS\system32\taskdir.exe
Status: 0xc0000034



File C:\WINDOWS\jqx64712451.exe not found!
Deletion of file C:\WINDOWS\jqx64712451.exe failed!

Could not process line:
C:\WINDOWS\jqx64712451.exe
Status: 0xc0000034



File C:\Documents and Settings\Noom\Local Settings\Temp\35.tmp not found!
Deletion of file C:\Documents and Settings\Noom\Local Settings\Temp\35.tmp failed!

Could not process line:
C:\Documents and Settings\Noom\Local Settings\Temp\35.tmp
Status: 0xc0000034



File c:\windows\system32\ldcore.dll not found!
Deletion of file c:\windows\system32\ldcore.dll failed!

Could not process line:
c:\windows\system32\ldcore.dll
Status: 0xc0000034



File C:\WINDOWS\system32\cfltygd.dll not found!
Deletion of file C:\WINDOWS\system32\cfltygd.dll failed!

Could not process line:
C:\WINDOWS\system32\cfltygd.dll
Status: 0xc0000034



File C:\WINDOWS\system32\qbhtpcz.dll not found!
Deletion of file C:\WINDOWS\system32\qbhtpcz.dll failed!

Could not process line:
C:\WINDOWS\system32\qbhtpcz.dll
Status: 0xc0000034



File C:\WINDOWS\system32\oivyba.dll not found!
Deletion of file C:\WINDOWS\system32\oivyba.dll failed!

Could not process line:
C:\WINDOWS\system32\oivyba.dll
Status: 0xc0000034



Folder C:\Program Files\VSAdd-in not found!
Deletion of folder C:\Program Files\VSAdd-in failed!

Could not process line:
C:\Program Files\VSAdd-in
Status: 0xc0000034



Folder C:\Program Files\Super Codec not found!
Deletion of folder C:\Program Files\Super Codec failed!

Could not process line:
C:\Program Files\Super Codec
Status: 0xc0000034



Folder C:\Program Files\VirusBursters not found!
Deletion of folder C:\Program Files\VirusBursters failed!

Could not process line:
C:\Program Files\VirusBursters
Status: 0xc0000034



Folder C:\Program Files\SpySheriff not found!
Deletion of folder C:\Program Files\SpySheriff failed!

Could not process line:
C:\Program Files\SpySheriff
Status: 0xc0000034



Folder C:\Program Files\CMIntex not found!
Deletion of folder C:\Program Files\CMIntex failed!

Could not process line:
C:\Program Files\CMIntex
Status: 0xc0000034

Folder C:\Program Files\PSDream deleted successfully.
Folder C:\Program Files\PSCastor deleted successfully.


Folder C:\Program Files\Batty2 not found!
Deletion of folder C:\Program Files\Batty2 failed!

Could not process line:
C:\Program Files\Batty2
Status: 0xc0000034



Folder C:\WINDOWS\inet20004 not found!
Deletion of folder C:\WINDOWS\inet20004 failed!

Could not process line:
C:\WINDOWS\inet20004
Status: 0xc0000034



Registry key \Registry\Machine\System\CurrentControlSet\Services\pe386 not found!
Unload of driver pe386 failed!

Could not process line:
pe386
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.


----------



## JSntgRvr (Jul 1, 2003)

Hi, 

That is not the Avenger report I want to see. Please check post #14.


----------



## dragnstyl33 (Nov 18, 2006)

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\colxsxft

*******************

Script file located at: \??\C:\Program Files\nvrnurwk.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\system32\xxyyywt.dll not found!
Deletion of file C:\WINDOWS\system32\xxyyywt.dll failed!

Could not process line:
C:\WINDOWS\system32\xxyyywt.dll
Status: 0xc0000034

File C:\WINDOWS\nrp.exe not found!
Deletion of file C:\WINDOWS\nrp.exe failed!

Could not process line:
C:\WINDOWS\nrp.exe
Status: 0xc0000034

File C:\WINDOWS\vz1.exe not found!
Deletion of file C:\WINDOWS\vz1.exe failed!

Could not process line:
C:\WINDOWS\vz1.exe
Status: 0xc0000034

File C:\WINDOWS\2ky.exe not found!
Deletion of file C:\WINDOWS\2ky.exe failed!

Could not process line:
C:\WINDOWS\2ky.exe
Status: 0xc0000034

File C:\WINDOWS\3fl.exe not found!
Deletion of file C:\WINDOWS\3fl.exe failed!

Could not process line:
C:\WINDOWS\3fl.exe
Status: 0xc0000034

File C:\WINDOWS\system32\vxg6ame4.exe not found!
Deletion of file C:\WINDOWS\system32\vxg6ame4.exe failed!

Could not process line:
C:\WINDOWS\system32\vxg6ame4.exe
Status: 0xc0000034

File C:\WINDOWS\system32\vxga4me1.exe not found!
Deletion of file C:\WINDOWS\system32\vxga4me1.exe failed!

Could not process line:
C:\WINDOWS\system32\vxga4me1.exe
Status: 0xc0000034

File C:\WINDOWS\bfn.exe not found!
Deletion of file C:\WINDOWS\bfn.exe failed!

Could not process line:
C:\WINDOWS\bfn.exe
Status: 0xc0000034

File C:\WINDOWS\system32\vxga8me6.exe not found!
Deletion of file C:\WINDOWS\system32\vxga8me6.exe failed!

Could not process line:
C:\WINDOWS\system32\vxga8me6.exe
Status: 0xc0000034

File C:\WINDOWS\system32\kernels88.exe not found!
Deletion of file C:\WINDOWS\system32\kernels88.exe failed!

Could not process line:
C:\WINDOWS\system32\kernels88.exe
Status: 0xc0000034

File C:\WINDOWS\phk.exe not found!
Deletion of file C:\WINDOWS\phk.exe failed!

Could not process line:
C:\WINDOWS\phk.exe
Status: 0xc0000034

File C:\WINDOWS\system32\dlh9jkd1q7.exe not found!
Deletion of file C:\WINDOWS\system32\dlh9jkd1q7.exe failed!

Could not process line:
C:\WINDOWS\system32\dlh9jkd1q7.exe
Status: 0xc0000034

File C:\WINDOWS\system32\ldcore.dll not found!
Deletion of file C:\WINDOWS\system32\ldcore.dll failed!

Could not process line:
C:\WINDOWS\system32\ldcore.dll
Status: 0xc0000034

File C:\WINDOWS\system32\dlh9jkd1q5.exe not found!
Deletion of file C:\WINDOWS\system32\dlh9jkd1q5.exe failed!

Could not process line:
C:\WINDOWS\system32\dlh9jkd1q5.exe
Status: 0xc0000034

File C:\WINDOWS\system32\dlh9jkd1q1.exe not found!
Deletion of file C:\WINDOWS\system32\dlh9jkd1q1.exe failed!

Could not process line:
C:\WINDOWS\system32\dlh9jkd1q1.exe
Status: 0xc0000034

File C:\WINDOWS\system32\dlh9jkd1q2.exe not found!
Deletion of file C:\WINDOWS\system32\dlh9jkd1q2.exe failed!

Could not process line:
C:\WINDOWS\system32\dlh9jkd1q2.exe
Status: 0xc0000034

File C:\WINDOWS\system32\dlh9jkd1q8.exe not found!
Deletion of file C:\WINDOWS\system32\dlh9jkd1q8.exe failed!

Could not process line:
C:\WINDOWS\system32\dlh9jkd1q8.exe
Status: 0xc0000034

File C:\WINDOWS\ur3.exe not found!
Deletion of file C:\WINDOWS\ur3.exe failed!

Could not process line:
C:\WINDOWS\ur3.exe
Status: 0xc0000034

File C:\WINDOWS\vmmlog32.dll not found!
Deletion of file C:\WINDOWS\vmmlog32.dll failed!

Could not process line:
C:\WINDOWS\vmmlog32.dll
Status: 0xc0000034

File C:\WINDOWS\system32\aspi2135111.exe not found!
Deletion of file C:\WINDOWS\system32\aspi2135111.exe failed!

Could not process line:
C:\WINDOWS\system32\aspi2135111.exe
Status: 0xc0000034

File C:\WINDOWS\system32\vxga3me2.exe not found!
Deletion of file C:\WINDOWS\system32\vxga3me2.exe failed!

Could not process line:
C:\WINDOWS\system32\vxga3me2.exe
Status: 0xc0000034

File C:\WINDOWS\system32\tuvwwxv.dll not found!
Deletion of file C:\WINDOWS\system32\tuvwwxv.dll failed!

Could not process line:
C:\WINDOWS\system32\tuvwwxv.dll
Status: 0xc0000034

File C:\WINDOWS\u5w.exe not found!
Deletion of file C:\WINDOWS\u5w.exe failed!

Could not process line:
C:\WINDOWS\u5w.exe
Status: 0xc0000034

File C:\WINDOWS\3fd.exe not found!
Deletion of file C:\WINDOWS\3fd.exe failed!

Could not process line:
C:\WINDOWS\3fd.exe
Status: 0xc0000034

File C:\WINDOWS\2g.exe not found!
Deletion of file C:\WINDOWS\2g.exe failed!

Could not process line:
C:\WINDOWS\2g.exe
Status: 0xc0000034

File C:\WINDOWS\rrs.exe not found!
Deletion of file C:\WINDOWS\rrs.exe failed!

Could not process line:
C:\WINDOWS\rrs.exe
Status: 0xc0000034

File C:\WINDOWS\system32\hhiii.bak1 not found!
Deletion of file C:\WINDOWS\system32\hhiii.bak1 failed!

Could not process line:
C:\WINDOWS\system32\hhiii.bak1
Status: 0xc0000034

File C:\WINDOWS\system32\iiihh.dll not found!
Deletion of file C:\WINDOWS\system32\iiihh.dll failed!

Could not process line:
C:\WINDOWS\system32\iiihh.dll
Status: 0xc0000034

File C:\WINDOWS\system32\wvurpqn.dll not found!
Deletion of file C:\WINDOWS\system32\wvurpqn.dll failed!

Could not process line:
C:\WINDOWS\system32\wvurpqn.dll
Status: 0xc0000034

File C:\WINDOWS\iux.exe not found!
Deletion of file C:\WINDOWS\iux.exe failed!

Could not process line:
C:\WINDOWS\iux.exe
Status: 0xc0000034

File C:\WINDOWS\13c134353.exe not found!
Deletion of file C:\WINDOWS\13c134353.exe failed!

Could not process line:
C:\WINDOWS\13c134353.exe
Status: 0xc0000034

File C:\WINDOWS\xit.exe not found!
Deletion of file C:\WINDOWS\xit.exe failed!

Could not process line:
C:\WINDOWS\xit.exe
Status: 0xc0000034

File C:\WINDOWS\zla.exe not found!
Deletion of file C:\WINDOWS\zla.exe failed!

Could not process line:
C:\WINDOWS\zla.exe
Status: 0xc0000034

File C:\Documents and Settings\Noom\h8WpsOS.exe not found!
Deletion of file C:\Documents and Settings\Noom\h8WpsOS.exe failed!

Could not process line:
C:\Documents and Settings\Noom\h8WpsOS.exe
Status: 0xc0000034

File C:\WINDOWS\system32\lzx32.sys not found!
Deletion of file C:\WINDOWS\system32\lzx32.sys failed!

Could not process line:
C:\WINDOWS\system32\lzx32.sys
Status: 0xc0000034

File C:\WINDOWS\ms061997-73647.exe not found!
Deletion of file C:\WINDOWS\ms061997-73647.exe failed!

Could not process line:
C:\WINDOWS\ms061997-73647.exe
Status: 0xc0000034

File C:\Windows\xpupdate.exe not found!
Deletion of file C:\Windows\xpupdate.exe failed!

Could not process line:
C:\Windows\xpupdate.exe
Status: 0xc0000034

File c:\windows\system32\ldcore.dll not found!
Deletion of file c:\windows\system32\ldcore.dll failed!

Could not process line:
c:\windows\system32\ldcore.dll
Status: 0xc0000034

Completed script processing.

*******************

Finished! Terminate.

Logfile of HijackThis v1.99.1
Scan saved at 11:31, on 06-11-22
Platform: Windows XP SP2, v.2149 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2149)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Updater.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Adelphia HSAgent\bin\tgcmd.exe
C:\Program Files\Common Files\AOL\1162186374\ee\AOLSoftware.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
C:\Program Files\Lexmark X74-X75\lxbbbmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\LVComsX.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Google\Web Accelerator\googlewebaccclient.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Documents and Settings\Noom\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://localhost:9100/proxy.pac
O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0E55CC01-8113-487B-92F2-98C24D98A57F} - C:\WINDOWS\system32\tuvwwxv.dll (file missing)
O2 - BHO: (no name) - {192c5b4a-3efd-40c7-9f99-c472deb8efc0} - C:\Program Files\Super Codec\isaddon.dll (file missing)
O2 - BHO: (no name) - {25BF04FB-93AA-47B3-91DC-953E4CB2B5D0} - C:\WINDOWS\system32\iiihh.dll (file missing)
O2 - BHO: (no name) - {2D86128A-F318-A748-A871-09AFA0430634} - C:\WINDOWS\system32\sciekad.dll
O2 - BHO: Google Web Accelerator Helper - {69A87B7D-DE56-4136-9655-716BA50C19C7} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Domain Helper - {B8A5DE1C-BC13-4DD2-BF00-7BE3C603F9F2} - C:\WINDOWS\system32\DomainHelper.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {C1C2F12D-7490-4326-8E4D-1D2FC2305A3F} - C:\WINDOWS\system32\ddcby.dll (file missing)
O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINDOWS\system32\ljyyvwgx.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\dllcache\tintsetp.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\dllcache\tintsetp.exe /IMEName
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [iRiver Updater] \Updater.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [tgcmd] "c:\Program Files\Adelphia HSAgent\bin\tgcmd.exe" /server /startmonitor /deaf 
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1162186374\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [{A5-54-44-43-ZN}] c:\windows\system32\dwdsregt.exe SED001
O4 - HKLM\..\Run: [pdvyeng.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\pdvyeng.dll,drjbxce
O4 - HKLM\..\Run: [System] C:\WINDOWS\system32\kernels88.exe
O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\system32\kernels88.exe
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Run Google Web Accelerator.lnk = C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.adelphia.net/sdccommon/download/tgctlins.cab
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish.com/SnapfishActivia.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://www.vzwpix.com/activex/VerizonWirelessUploadControl.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {C915801D-6F00-49CD-8A9A-8DE5C11ADDC1} (Pixami Drag/Drop Upload UI Control) - http://www.photoworks.com/pixami/DragDropUploader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{952A9AC8-A5CF-4D22-99EB-FC83496CA1F2}: NameServer = 152.158.2.48
O17 - HKLM\System\CCS\Services\Tcpip\..\{FAAD30F5-4BD7-442F-94AB-A65BDC73BBF8}: NameServer = 152.158.2.48
O20 - Winlogon Notify: ddcby - C:\WINDOWS\system32\ddcby.dll (file missing)
O20 - Winlogon Notify: iiihh - C:\WINDOWS\system32\iiihh.dll (file missing)
O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll
O20 - Winlogon Notify: tuvwwxv - tuvwwxv.dll (file missing)
O20 - Winlogon Notify: winsys2freg - C:\Documents and Settings\All Users\Documents\Settings\winsys2f.dll
O20 - Winlogon Notify: wvutstu - wvutstu.dll (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33*. 

Sooner or later they gonna have to stop. Check the sites you visit. It is possible you are collecting this malware from an especific site.

Your *Java* is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of *Java* components and upgrade the application.

*Upgrading Java*: 

Download the latest version of *Java Runtime Environment (JRE) 5.0 Update 9*.
Scroll down to where it says "*The J2SE Runtime Environment (JRE) allows end-users to run Java applications*".
Click the "*Download*" button to the right.
Check the box that says: "*Accept License Agreement*".
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to *Start* > *Control Panel*, double-click on *Add/Remove *programs and remove all older versions of Java.
Check any item with Java Runtime Environment *(JRE or J2SE)* in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java version.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on the download to install the newest version.

Please download *VundoFix.exe* to your desktop.
Double-click *VundoFix.exe* to run it.
You will receive a message saying vundofix will close and re-open in a minute or less. Click *OK*
When VundoFix re-opens, click the *Scan for Vundo* button.
Once it's done scanning, click the *Remove Vundo* button.
You will receive a prompt asking if you want to remove the files, click *YES*
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will shutdown your computer, click *OK*.
Turn your computer back on.
*Note:* It is possible that *VundoFix* encountered a file it could not remove. In this case, *VundoFix* will run on reboot, simply follow the above instructions starting from "Click the *Scan for Vundo *button" when VundoFix appears at reboot.

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below (If exist). *

O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)
O2 - BHO: (no name) - {0E55CC01-8113-487B-92F2-98C24D98A57F} - C:\WINDOWS\system32\tuvwwxv.dll (file missing)
O2 - BHO: (no name) - {192c5b4a-3efd-40c7-9f99-c472deb8efc0} - C:\Program Files\Super Codec\isaddon.dll (file missing)
O2 - BHO: (no name) - {25BF04FB-93AA-47B3-91DC-953E4CB2B5D0} - C:\WINDOWS\system32\iiihh.dll (file missing)
O2 - BHO: (no name) - {2D86128A-F318-A748-A871-09AFA0430634} - C:\WINDOWS\system32\sciekad.dll
O2 - BHO: Domain Helper - {B8A5DE1C-BC13-4DD2-BF00-7BE3C603F9F2} - C:\WINDOWS\system32\DomainHelper.dll (file missing)
O2 - BHO: (no name) - {C1C2F12D-7490-4326-8E4D-1D2FC2305A3F} - C:\WINDOWS\system32\ddcby.dll (file missing)
O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINDOWS\system32\ljyyvwgx.dll (file missing)
O4 - HKLM\..\Run: [{A5-54-44-43-ZN}] c:\windows\system32\dwdsregt.exe SED001
O4 - HKLM\..\Run: [pdvyeng.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\pdvyeng.dll,drjbxce
O4 - HKLM\..\Run: [System] C:\WINDOWS\system32\kernels88.exe
O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\system32\kernels88.exe
O20 - Winlogon Notify: ddcby - C:\WINDOWS\system32\ddcby.dll (file missing)
O20 - Winlogon Notify: iiihh - C:\WINDOWS\system32\iiihh.dll (file missing)
O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll
O20 - Winlogon Notify: tuvwwxv - tuvwwxv.dll (file missing)
O20 - Winlogon Notify: winsys2freg - C:\Documents and Settings\All Users\Documents\Settings\winsys2f.dll
O20 - Winlogon Notify: wvutstu - wvutstu.dll (file missing)

*Now *close all windows and browsers, other than HiJackThis*, then click Fix Checked.

Close Hijackthis.


Download the attached file, unzip it and save it to your *C:\ drive.* (Overwrite the previous one)
When having saved it, the file path should be *C:\remove.txt*
Open the *Avenger*.
Check *Load Script from File *and then click the folder Icon on the right side of that section.
Then browse to *C:\remove.txt* and click *open* to load it.








Then click the *"green light"* icon.
This will begin the execution of the script currently in memory.
After you have clicked on the "green light" to begin execution of a script, the Avenger will set itself up to run the next time you reboot your computer, and then will prompt you to restart immediately.
After your system restarts, a log file should open with the results of Avenger's actions. This log file is located at *C:\avenger.txt.* The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to *C:\avenger\backups.zip.*
Post the contents of the *C:\avenger.txt* file and a fresh *Hijackthis log* and the contents of C:\*vundofix.txt*


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 



> I'm running norton but the subscription has expired


What version of Norton are you running? Are you planning to keep Norton as your antivirus? Seems that Norton is not keeping-up with your protection.


----------



## dragnstyl33 (Nov 18, 2006)

Hi, for some reason I'm not able to download the new Java. I ran vundofix and it didn't find anything. I ran Avenger and when the computer restarted it produced an error log.
The only thing I can think of to do was post an updated HJT log after I deleted the files that were noted. Norton is the only virus protector that I have, I don't know if I can afford to buy anything else. Any recommendations?

Logfile of HijackThis v1.99.1
Scan saved at 23:45, on 06-11-22
Platform: Windows XP SP2, v.2149 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2149)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Noom\Desktop\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Web Accelerator Helper - {69A87B7D-DE56-4136-9655-716BA50C19C7} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\dllcache\tintsetp.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\dllcache\tintsetp.exe /IMEName
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [iRiver Updater] \Updater.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [tgcmd] "c:\Program Files\Adelphia HSAgent\bin\tgcmd.exe" /server /startmonitor /deaf 
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1162186374\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Run Google Web Accelerator.lnk = C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.adelphia.net/sdccommon/download/tgctlins.cab
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish.com/SnapfishActivia.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://www.vzwpix.com/activex/VerizonWirelessUploadControl.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {C915801D-6F00-49CD-8A9A-8DE5C11ADDC1} (Pixami Drag/Drop Upload UI Control) - http://www.photoworks.com/pixami/DragDropUploader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{952A9AC8-A5CF-4D22-99EB-FC83496CA1F2}: NameServer = 152.158.2.48
O17 - HKLM\System\CCS\Services\Tcpip\..\{FAAD30F5-4BD7-442F-94AB-A65BDC73BBF8}: NameServer = 152.158.2.48
O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll
O20 - Winlogon Notify: winsys2freg - C:\Documents and Settings\All Users\Documents\Settings\winsys2f.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

*Run the Avenger as requested on post #21. and post the reports.*

There are two options, you can download a trial version of *Nod32*, which is one of the best Antivirus Programs in the market, or, if you cannot afford *Nod32*, we can download *AVG Free*. I have used AVG Free for years and have no complaints.. It will also be a good idea to download a Firewall such as *Zone Alarm*, which is also free.

But first I need to know which version of Norton is installed. To remove Norton we may need to run a program to fully remove it, based on its version.

Let me know which version of Norton is installed. I will provide you with the process to remove *Norton* and install *AVG Free *or *Nod32*, which ever you prefer, and *Zone Alarm *as a Firewall.


----------



## dragnstyl33 (Nov 18, 2006)

I wasn't able to download the java file link that you sent me so I didn't delete the old java files yet.

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\riigpgma

*******************

Script file located at: \??\C:\Program Files\culfnkto.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



File C:\Documents and Settings\All Users\Documents\Settings\winsys2f.dll not found!
Deletion of file C:\Documents and Settings\All Users\Documents\Settings\winsys2f.dll failed!

Could not process line:
C:\Documents and Settings\All Users\Documents\Settings\winsys2f.dll
Status: 0xc0000034



File C:\WINDOWS\system32\rpcc.dll not found!
Deletion of file C:\WINDOWS\system32\rpcc.dll failed!

Could not process line:
C:\WINDOWS\system32\rpcc.dll
Status: 0xc0000034



File C:\WINDOWS\system32\kernels88.exe not found!
Deletion of file C:\WINDOWS\system32\kernels88.exe failed!

Could not process line:
C:\WINDOWS\system32\kernels88.exe
Status: 0xc0000034



File C:\WINDOWS\system32\pdvyeng.dll not found!
Deletion of file C:\WINDOWS\system32\pdvyeng.dll failed!

Could not process line:
C:\WINDOWS\system32\pdvyeng.dll
Status: 0xc0000034



File c:\windows\system32\dwdsregt.exe not found!
Deletion of file c:\windows\system32\dwdsregt.exe failed!

Could not process line:
c:\windows\system32\dwdsregt.exe
Status: 0xc0000034



File C:\WINDOWS\system32\sciekad.dll not found!
Deletion of file C:\WINDOWS\system32\sciekad.dll failed!

Could not process line:
C:\WINDOWS\system32\sciekad.dll
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

Post a fresh Hijackthis log. *You still have not idicated the version of Norton in te computer*


----------



## dragnstyl33 (Nov 18, 2006)

Norton 2005 Premier (Symantec) version 8.00.99

Logfile of HijackThis v1.99.1
Scan saved at 11:31, on 06-11-23
Platform: Windows XP SP2, v.2149 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2149)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Noom\Desktop\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Web Accelerator Helper - {69A87B7D-DE56-4136-9655-716BA50C19C7} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\dllcache\tintsetp.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\dllcache\tintsetp.exe /IMEName
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [iRiver Updater] \Updater.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [tgcmd] "c:\Program Files\Adelphia HSAgent\bin\tgcmd.exe" /server /startmonitor /deaf 
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1162186374\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Run Google Web Accelerator.lnk = C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.adelphia.net/sdccommon/download/tgctlins.cab
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish.com/SnapfishActivia.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://www.vzwpix.com/activex/VerizonWirelessUploadControl.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {C915801D-6F00-49CD-8A9A-8DE5C11ADDC1} (Pixami Drag/Drop Upload UI Control) - http://www.photoworks.com/pixami/DragDropUploader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{952A9AC8-A5CF-4D22-99EB-FC83496CA1F2}: NameServer = 152.158.2.48
O17 - HKLM\System\CCS\Services\Tcpip\..\{FAAD30F5-4BD7-442F-94AB-A65BDC73BBF8}: NameServer = 152.158.2.48
O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll (file missing)
O20 - Winlogon Notify: winsys2freg - C:\Documents and Settings\All Users\Documents\Settings\winsys2f.dll (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below. *

O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll (file missing)
O20 - Winlogon Notify: winsys2freg - C:\Documents and Settings\All Users\Documents\Settings\winsys2f.dll (file missing)

*Now *close all windows and browsers, other than HiJackThis*, then click Fix Checked.

Close Hijackthis.

*Please follow these instructions in the order given:*

Download the Norton Removal Tool for Windows XP/2000 *Here*. Save this tool to your desktop, but do not run it yet.

Download the AVG Free version Installer from *Here*. Again,save this program to your desktop, but do not run it yet.

Download the Zone Alarm Installer from *Here*. Again,save this program to your desktop, but do not run it yet.

*Reboot into safe mode.*

Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

Please go to Start > Control Panel > *Add/Remove Programs* and remove the following:

*All programs related to Norton and Symantec *

If you cannot remove these programs in Normal Mode, attempt to remove these programs in Normal Mode. (Safe Mode is Recomended )

Once done, or even if you experience problems removing these programs, run the *Symantect's Removal Tool*. On the Windows desktop, double-click the *Norton Removal tool *icon. Follow the on-screen instructions. Your computer may be restarted more than once, and you may be asked to repeat some steps after the computer restarts.

Once Norton is removed, run the *AVG Installer*.

Once AVG is installed, run the *Zone Alarm installer*.

Upgrade the virus definitions online on both of these programs. If possible, run a complete AVG Scan on your computer. Send anything found to the Virus Vault (Quatrantine).

Once done, Post a fresh *Hjackthis log.* Let me know how it went.


----------



## dragnstyl33 (Nov 18, 2006)

not able to access internet from normal mode now. AVG Scan found 247 threats and cleaned 47. Anything that wasn't able to be cleaned was sent to virus vault.

Did I still need to delet my Java settings?

Logfile of HijackThis v1.99.1
Scan saved at 13:37, on 06-11-23
Platform: Windows XP SP2, v.2149 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2149)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Noom\Desktop\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Web Accelerator Helper - {69A87B7D-DE56-4136-9655-716BA50C19C7} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\dllcache\tintsetp.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\dllcache\tintsetp.exe /IMEName
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [iRiver Updater] \Updater.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [tgcmd] "c:\Program Files\Adelphia HSAgent\bin\tgcmd.exe" /server /startmonitor /deaf 
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1162186374\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Run Google Web Accelerator.lnk = C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.adelphia.net/sdccommon/download/tgctlins.cab
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish.com/SnapfishActivia.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://www.vzwpix.com/activex/VerizonWirelessUploadControl.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {C915801D-6F00-49CD-8A9A-8DE5C11ADDC1} (Pixami Drag/Drop Upload UI Control) - http://www.photoworks.com/pixami/DragDropUploader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{952A9AC8-A5CF-4D22-99EB-FC83496CA1F2}: NameServer = 152.158.2.48
O17 - HKLM\System\CCS\Services\Tcpip\..\{FAAD30F5-4BD7-442F-94AB-A65BDC73BBF8}: NameServer = 152.158.2.48
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

Except for the JAVA, that log looks clear. There is only one entry related to Norton. Download the enclosed file and extract its contents to the desktop. Overwrite any file that may exists. Once extracted, double click on the *Service.bat *file. The MSDOS window will flash for a second. That is normal. That will take care of the Norton Entry in your log.

Now, in regard to *JAVA*. Download the Windows (Offline Installation) JAVA Bundle from *here* and save it to the desktop. Once the download is completed, double click on the installation package. Follow the prompt. You will be given the option to *repair JAVA*. Take that option and your JAVA will be upgraded. No need to remove your previous JAVA.

*How is the computer doing?*


----------



## dragnstyl33 (Nov 18, 2006)

The computer seems to be running great, but for some reason my desktop is stuck and I can't change my background. Also, I'm not sure why but I'm not able to download from the link that you sent me for the java repair. When I try to delete messages from my mailbox (yahoo) an error screen pops up and says that iedw.exe has encountered and error.

Happy Thanksgiving by the way =) And trully thanks for the help so far. I see the silver lining as I get your replies and advice.


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

Lets see if we can take a deeper look:

Click *here* to download WinPFind .

Right Click the Zip Folder and Select "Extract All" 
Extract it somewhere you will remember like the Desktop 
Dont do anything with it yet!

*Reboot into Safe Mode*

Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.


Double click WinPFind.exe 
Click "Start Scan" 
It will scan the entire System, so please be patient! 
Once the Scan is Complete, *restart the computer back in Normal Mode.* 
Go to the WinPFind folder 
Locate *WinPFind.txt *
Place those results in the next reply!


----------



## dragnstyl33 (Nov 18, 2006)

I restarted the computer in safe mode and then ran winpfind.exe and clicked the scan button. it scanned for a while but always seems to freeze up at the same point and is not able to complete. The screen just goes blank and the log is not provided. Not sure what I should do now.


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

There is an updated version for Combofix. If you have the older version, please delete it. Then download and Extract the new version of *ComboFix* to your Desktop.

Reboot to Safe mode:

Restart your computer and begin tapping the F8 key on your keyboard just before Windows starts to load. If done right a Windows Advanced Options menu will appear. Select the Safe Mode option and press Enter.

Perform the following actions in *Safe Mode*.

Double click *combofix.exe * and follow the prompts.
When finished, it shall produce a log for you. Post that log and a *HiJackthis* log in your next reply
*Note: Do not mouseclick combofix's window while its running. That may cause it to stall*


----------



## dragnstyl33 (Nov 18, 2006)

Noom - 06-11-25 13:34:58.80 Service Pack 2, v.2149
ComboFix 06.11.22W - Running from: "C:\Documents and Settings\Noom\Desktop"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
C:\WINDOWS\system32\svch0st.exe
C:\WINDOWS\system32\KB95842.log

((((((((((((((((((((((((((((((( Files Created from 2006-10-25 to 2006-11-25 ))))))))))))))))))))))))))))))))))

2006-11-25	13:39 d--------	C:\WINDOWS\erdnt
2006-11-24	01:18	68,894	--a------	C:\WINDOWS\system32\wwww.exe
2006-11-24	01:18	53,760	--a------	C:\WINDOWS\system32\jb.exe
2006-11-24	01:18	2,560	-r-hs----	C:\WINDOWS\system32\jbloader.dll
2006-11-24	01:18	15,480	-r-hs----	C:\WINDOWS\system32\jbhook.dll
2006-11-24	01:17	5,243	--a------	C:\WINDOWS\system32\systen32.exe
2006-11-23	13:22 d--------	C:\WINDOWS\system32\ZoneLabs
2006-11-23	13:22 d--------	C:\WINDOWS\Internet Logs
2006-11-23	13:22 d--------	C:\Program Files\Zone Labs
2006-11-23	13:21 dr-h-----	C:\$VAULT$.AVG
2006-11-23	12:56	816,672	--a------	C:\WINDOWS\system32\drivers\avg7core.sys
2006-11-23	12:56	4,960	--a------	C:\WINDOWS\system32\drivers\avgtdi.sys
2006-11-23	12:56	4,224	--a------	C:\WINDOWS\system32\drivers\avg7rsw.sys
2006-11-23	12:56	3,968	--a------	C:\WINDOWS\system32\drivers\avgclean.sys
2006-11-23	12:56	28,416	--a------	C:\WINDOWS\system32\drivers\avg7rsxp.sys
2006-11-23	12:56	18,240	--a------	C:\WINDOWS\system32\drivers\avgmfx86.sys
2006-11-23	12:56 d--------	C:\Program Files\Grisoft
2006-11-23	12:56 d--------	C:\Documents and Settings\Noom\Application Data\AVG7
2006-11-23	12:56 d--------	C:\Documents and Settings\All Users\Application Data\Grisoft
2006-11-23	12:56 d--------	C:\Documents and Settings\All Users\Application Data\avg7
2006-11-23	12:45 d--hs----	C:\Config.Msi
2006-11-22	11:19	60,416	--a------	C:\WINDOWS\system32\drivers\yktqppao.sys
2006-11-22	11:19	60,416	--a------	C:\WINDOWS\system32\drivers\qhetalef.sys
2006-11-21	14:56	60,416	--a------	C:\WINDOWS\system32\drivers\iokecb^n.sys
2006-11-21	14:08	40,973	---hs----	C:\WINDOWS\system32\nnnnonk.dll
2006-11-21	14:07	90,624	--a------	C:\WINDOWS\vcdb32.dll
2006-11-21	14:07	51,200	--a------	C:\WINDOWS\system32\msvcrl.dll
2006-11-21	14:07	42,637	--a------	C:\WINDOWS\system32\restorea6.exe
2006-11-21	14:07	13,792	--a------	C:\WINDOWS\system32\dlh9jkd1q6.exe
2006-11-21	14:06	727,729	---hs----	C:\WINDOWS\system32\hhiii.bak2
2006-11-20	16:55	80	--a------	C:\WINDOWS\gmer_uninstall.cmd
2006-11-18	13:17 d--------	C:\WINDOWS\pss
2006-11-18	12:08 d--------	C:\Documents and Settings\Noom\Application Data\SearchToolbarCorp
2006-11-18	10:22 d--hs----	C:\WINDOWS\CSC
2006-11-18	04:15 d--------	C:\Documents and Settings\Noom\www.google.com
2006-11-15	16:49	49,152	--a------	C:\npbittorrent.dll
2006-11-11	18:34 d--------	C:\Program Files\IrfanView
2006-11-05	13:37 d--------	C:\Program Files\iTunes
2006-10-29	21:33 d--------	C:\Program Files\Common Files\Nullsoft
2006-10-29	21:33 d--------	C:\Documents and Settings\Noom\Application Data\acccore
2006-10-29	21:33 d--------	C:\Documents and Settings\All Users\Application Data\AOL
2006-10-29	21:32 d--------	C:\Program Files\Common Files\aolshare
2006-10-29	21:32 d--------	C:\Program Files\Common Files\AOL
2006-10-29	21:32 d--------	C:\Program Files\AOL
2006-10-29	21:30 d--------	C:\Documents and Settings\All Users\Application Data\AOL Downloads

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2006-11-25 13:32	2371	--a------	C:\Documents and Settings\Noom\Application Data\.googlewebacchosts
2006-11-24 13:04	--------	d---s----	C:\Documents and Settings\Noom\Application Data\Microsoft
2006-11-23 15:21	10240	--ahs----	C:\Program Files\Thumbs.db
2006-11-23 12:54	--------	d--------	C:\Program Files\Norton SystemWorks
2006-11-23 12:54	--------	d--------	C:\Program Files\Common Files\Symantec Shared
2006-11-23 12:49	--------	d--------	C:\Program Files\Common Files
2006-11-22 13:41	1030144	--a------	C:\WINDOWS\explorer.exe
2006-11-21 14:07	656	--a------	C:\WINDOWS\system32\sfc_os.dll
2006-11-21 14:07	--------	d--------	C:\Program Files\Internet Explorer
2006-11-17 10:29	--------	d--------	C:\Program Files\BitTorrent
2006-11-12 17:03	--------	d--------	C:\Program Files\viewsonic
2006-11-12 17:02	--------	d--h-----	C:\Program Files\InstallShield Installation Information
2006-11-05 13:37	--------	d--------	C:\Program Files\iPod
2006-11-05 13:36	--------	d--------	C:\Program Files\QuickTime
2006-11-03 19:43	--------	d--------	C:\Documents and Settings\Noom\Application Data\BitTorrent
2006-11-03 19:39	--------	d--------	C:\Documents and Settings\Noom\Application Data\Skype
2006-10-29 21:33	--------	d--------	C:\Program Files\AOD
2006-10-29 21:30	--------	d--------	C:\Program Files\AIM
2006-10-29 21:29	--------	d--------	C:\Documents and Settings\Noom\Application Data\Aim
2006-10-18 13:38	--------	d--------	C:\Documents and Settings\Noom\Application Data\AdobeUM
2006-10-17 17:04	--------	d--------	C:\Program Files\Lexmark X74-X75
2006-10-16 21:58	--------	d--------	C:\Program Files\Apple Software Update
2006-10-15 00:32	--------	d--------	C:\Program Files\Audacity
2006-09-28 11:40	--------	d--------	C:\Program Files\adelphia hsagent
2006-09-28 11:34	--------	d--------	C:\Program Files\Support.com
2006-09-24 11:23	39816	--a------	C:\Documents and Settings\Noom\Application Data\GDIPFONTCACHEV1.DAT
2006-08-07 22:06	1218	--a------	C:\Documents and Settings\Noom\Application Data\AdobeDLM.log
2006-08-07 22:06	0	--a------	C:\Documents and Settings\Noom\Application Data\dm.ini

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"LogitechSoftwareUpdate"="\"C:\\Program Files\\Logitech\\Video\\ManifestEngine.exe\" boot"
"NBJ"="\"C:\\Program Files\\Ahead\\Nero BackItUp\\nbj.exe\""
"Yahoo! Pager"="C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe -quiet"
"Aim6"=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32"
"PHIME2002ASync"="C:\\WINDOWS\\system32\\dllcache\\tintsetp.exe /SYNC"
"PHIME2002A"="C:\\WINDOWS\\system32\\dllcache\\tintsetp.exe /IMEName"
"SiSUSBRG"="C:\\WINDOWS\\SiSUSBrg.exe"
"SoundMan"="SOUNDMAN.EXE"
"Lexmark X74-X75"="\"C:\\Program Files\\Lexmark X74-X75\\lxbbbmgr.exe\""
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"LogitechVideoRepair"="C:\\Program Files\\Logitech\\Video\\ISStart.exe "
"LogitechVideoTray"="C:\\Program Files\\Logitech\\Video\\LogiTray.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"Logitech Utility"="Logi_MwX.Exe"
"zBrowser Launcher"="C:\\Program Files\\Logitech\\iTouch\\iTouch.exe"
"iRiver Updater"="\\Updater.exe"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\
65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"Adobe Photo Downloader"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\""
"tgcmd"="\"c:\\Program Files\\Adelphia HSAgent\\bin\\tgcmd.exe\" /server /startmonitor /deaf "
"HostManager"="C:\\Program Files\\Common Files\\AOL\\1162186374\\ee\\AOLSoftware.exe"
"IPHSend"="C:\\Program Files\\Common Files\\AOL\\IPHSend\\IPHSend.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"systen32.exe"="C:\\WINDOWS\\system32\\systen32.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,80,00,00,00,00,00,00,00,00,02,00,00,c2,01,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,2c,01,00,00,00,00,00,00,74,04,00,00,84,03,\
00,00,04,00,00,40
"RestoredStateInfo"=hex:18,00,00,00,2c,01,00,00,00,00,00,00,74,04,00,00,84,03,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
"{ff170564-36c8-43f7-9100-559e166405cf}"="cussers"
"{2C1CD3D7-86AC-4068-93BC-A02304BB3339}"="DCOM Server 3339"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{0E55CC01-8113-487B-92F2-98C24D98A57F}"=""
"{55667788-ABCD-1234-5678-00C04FD8DBD8}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"Wallpaper"="C:\\WINDOWS\\desktop.html"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"NoActiveDesktop"=dword:00000000
"ClassicShell"=dword:00000000
"ForceActiveDesktopOn"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"UseDesktopIniCache"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load]
"ip"=hex:38,c2,6a,bc,3d,78,04,59,34,25,14,0a,aa,86,eb,88,62,40,2a,02,be,db,85,\
63,23,1d,c5,a0,63,67,e7,ae,2e,34,ef,e6,3a,77,c0,9e,60,bc,88,19,a5,d9,74,81,\
2d,04,e4,5d,f4,d9,49,b9,60,df,45,f4,75,b4,26,ec,65,ec,66,ec,62,ea,4c,d8,30,\
9f,0b,db,b0,04,a5,11,70,81,63,d5,f2,4b,da,ad,22,83,9a,65,79,a7,f4,34,74,e1,\
f0,30,60,bc,99,05,25,69,90,99,fe,08,29,44,3d,ac,a1,c4,ff,0b,05,33,2c,54,1a,\
25,72,7b,3a,26,3b,2c,65,29,78,6d,50,41,33,6b,4b,56,f9,cb,a5,8f,6b,0f,26,08,\
e2,da,88,70,39,02,8a,ba,7f,67,f1,aa,2f,6b,aa,ad,7f,79,89,9d,60,a4,d4,09,b0,\
c4,21,81,74,05,e4,04,f8,d9,43,82,35,c3,4a,f8,7d,ec,23,a1,20,ac,65,f9,60,b9,\
03,8d,22,a3,5a,c5,e0,09,b7,15,79,cd,21,d4,b2,55,8d,ff,25,dc,cc,3c,79,ae,ec,\
35,3a,f0,b1,79,35,fb,9a,3c,25,7c,8b,cb,f1,0b,28,44,3c,83,b6,97,b7,59,49,30,\
24,55,4d,6d,79,66,6a,60,6c,3c,23,24,7e,78,49,54,7d,7b,29,1c,fd,c6,b6,80,62,\
4d,21,43,b0,94,81,60,35,10,c8,aa,2d,63,e9,a4,6d,23,e1,bb,63,31,cd,81,0e,fe,\
ce,19,bd,84,21,d2,73,00,a3,4c,f2,96,1c,ec,62,f8,4a,fa,7f,fb,76,e4,63,f5,24,\
c4,75,f4,4b,c3,21,b3,08,9c,b0,60,aa,07,6f,d3,29,88,e4,50,8b,ff,62,d6,9f,74,\
71,e9,ec,35,74,b1,f7,73,3f,f6,d3,06,37,3f,8a,ce,ff,05,26,0f,63,8e,a9,86,ba,\
57,05,22,30,49,04,34,63,29,29,67,20,31,24,24,7c,39,11,01,70,71,49,1c,b0,dd,\
a0,c1,2d,49,64,07,f1,d4,81,2c,04,33,ed,9d,4f,2c,e0,a8,74,61,a9,a8,60,29,84,\
d6,7c,f3,96,07,ac,8b,36,9f,3c,08,aa,59,e5,8d,44,a5,39,c1,41,a4,64,ec,7c,f5,\
20,ef,65,e4,75,a4,74,f8,0e,ef,58,9b,e2,17,f8,03,72,9f,78,80,fe,49,91,e5,60,\
85,dd,29,75,f4,f0,24,78,b5,a4,27,71,b4,c1,4c,10,70,97,ca,e7,06,36,45,3e,c6,\
ff,84,f1,59,0c,25,34,41,57,23,3f,26,73,76,77,2f,6a,7e,7f,75,46,1f,23,3e,09,\
56,ba,87,a5,92,70,59,64,44,e3,99,c3,3c,71,56,84,f4,76,69,b4,e1,2d,2d,a4,fc,\
20,69,84,dc,25,b1,90,5d,b0,c4,2c,81,6e,00,a9,4c,ad,bd,26,98,04,ee,41,fd,79,\
fd,24,ac,61,f1,74,a9,37,a5,46,c3,7e,ed,14,d9,e3,5d,bd,0d,65,9c,66,85,f9,57,\
81,bc,28,94,cd,3e,78,bd,be,70,35,f1,a1,6b,2e,80,cb,04,32,31,b4,f0,de,55,26,\
53,3e,dd,a6,db,ae,20,0b,24,32,11,74,78,63,7a,73,6e,72,65,38,6b,62,27,03,11,\
6d,30,00,1d,f9,dd,ad,8e,6e,40,28,54,b7,94,8a,70,2d,14,99,f3,40,28,f7,b2,77,\
2e,f6,ad,3a,79,89,94,31,e4,85,55,e3,d4,6e,e5,42,28,80,76,f5,9d,0d,a5,6a,91,\
09,f4,75,fa,77,e0,67,e4,66,e6,68,a4,06,f8,2e,b2,0b,8b,e2,4c,a7,15,20,f1,0d,\
a7,bf,69,85,e2,33,86,cb,2b,74,eb,a3,7a,2d,a0,a4,21,64,ad,d4,02,7a,3e,cb,ca,\
f9,1d,21,4a,65,98,ea,cb,f1,17,0f,3e,26,50,49,7c,62,60,67,60,2e,62,6b,64,3f,\
6a,45,42,6f,7b,4a,1d,ff,89,e9,8d,20,14,74,59,b0,94,81,31,34,15,84,f4,78,69,\
ea,a0,6d,24,b9,b9,71,2a,d7,92,2f,f5,81,19,bd,88,34,d1,20,46,f8,4b,e2,c7,58,\
b3,32,8f,18,f0,7e,f9,71,f5,20,f5,7d,f9,75,a4,50,d4,38,a5,44,97,f1,44,a1,5c,\
41,f5,09,d7,ac,5b,96,af,67,ca,89,38,30,a1,f0,35,70,b2,be,66,3f,aa,cd,05,25,\
7a,81,c0,be,0b,25,4f,6b,8e,a2,c8,fd,1c,16,38,23,50,0a,7a,7f,64,2b,72,61,72,\
2b,23,3e,7d,4b,11,6d,3d,44,4c,a0,99,e4,cc,65,01,30,0d,b0,94,8c,31,67,45,89,\
eb,20,69,e7,a9,61,33,e5,aa,64,3c,d6,82,67,b1,c9,58,e0,99,64,86,3c,03,b6,17,\
ac,9b,5a,ed,30,91,57,ed,69,e5,61,bc,22,ed,6d,e7,75,b4,4c,d4,29,b6,0c,8d,aa,\
18,f1,51,25,ff,1a,8a,ff,55,8b,e3,7a,d1,87,69,20,f9,b4,71,30,9f,da,2f,7f,b7,\
d0,5c,33,78,9e,dc,aa,5e,74,04,22,df,ee,89,d1,2d,29,71,2f,43,04,5a,78,6c,67,\
6a,20,42,65,7b,74,39,6a,44,2d,33,01,0b,aa,95,a6,93,3e,06,7f,44,f1,99,8c,65,\
34,01,d7,e3,3f,66,f7,a8,74,24,ef,ac,69,77,c6,90,2e,fa,8b,5f,f1,84,21,d3,69,\
02,a5,07,f3,96,09,fe,33,d0,57,b6,3a,a7,60,ee,20,ac,68,a9,25,a9,14,91,6d,a2,\
44,ca,b0,04,a1,41,74,c5,64,c4,f8,19,8a,f0,2d,94,99,29,71,ba,f7,22,6f,a5,e1,\
69,3d,ab,c1,01,60,36,c4,9e,b0,44,25,45,64,88,b0,c0,ff,17,05,3d,7d,16,09,77,\
71,64,61,3c,2a,40,50,44,3a,39,09,54,31,24,05,15,e3,94,ee,91,61,52,37,0a,ff,\
dd,81,3b,6d,1c,c1,aa,63,28,e3,a4,62,2e,fc,f4,32,10,ca,92,2f,e3,96,5c,f3,9d,\
64,e0,54,2c,e4,6a,f1,8b,00,f1,0e,c4,49,fb,75,fb,26,a6,3b,ac,65,a9,37,f1,50,\
c5,30,a2,5e,d6,bf,5e,b3,16,2e,d6,21,85,fc,4a,82,f0,32,96,cb,77,73,a6,e9,66,\
20,ec,e1,69,64,bd,84,5c,2c,31,d2,89,a0,49,69,49,20,c6,b7,c0,f7,17,44,3e,2e,\
11,50,76,37,29,29,73,65,71,24,2e,2c,7b,56,0f,73,7f,44,38,c4,e4,e4,b1,49,6f,\
78,0b,e2,87,d8,58,0e,21,f1,8d,30,3d,fd,b1,65,7c,a6,bd,75,21,d0,d3,60,ff,85,\
54,f5,d4,66,c0,74,0c,b4,40,fe,db,5a,ed,22,c3,1a,a5,72,fb,3a,bd,6c,e0,66,ec,\
7c,b9,42,de,32,ec,46,9d,f5,5a,b0,08,6e,c0,30,80,ff,57,c6,af,74,df,84,0a,79,\
ae,ea,61,4f,af,a4,3d,7f,e5,8b,1d,21,73,81,d5,ae,53,78,43,72,c1,eb,97,ac,0a,\
01,3d,25,52,50,39,7e,68,69,64,3d,23,60,6c,63,6d,4d,5f,21,25,0d,16,fe,8b,e4,\
88,64,1c,66,0d,f5,ca,90,78,2e,10,d0,b0,7f,27,a6,e1,74,28,f0,a5,75,64,86,a2,\
25,fd,81,5a,e4,c9,25,81,64,04,b7,5d,f9,97,05,a5,29,de,4a,bb,30,fd,65,e3,69,\
ef,60,ec,68,a4,06,82,62,ef,58,96,e0,5d,ad,0e,6e,81,32,88,fc,4c,81,ac,62,b0,\
c7,3a,7f,bc,ea,35,53,b4,e9,24,71,ab,dd,53,60,62,81,d5,f5,0a,30,44,64,dc,e6,\
da,f5,15,01,32,34,54,40,3b,2e,48,67,62,6f,74,6a,7d,30,4a,51,5c,2d,30,16,00,\
ac,86,ab,91,74,48,2b,07,ae,85,8b,61,34,18,cb,b7,30,3f,e5,ad,75,24,b9,eb,44,\
2b,c5,9f,33,f7,81,4b,b2,d7,10,d3,61,0f,b7,4f,f5,8b,58,fe,2f,c1,50,f0,7f,e7,\
3a,bd,6f,f1,70,e0,7f,f7,04,c7,21,bd,11,9c,ad,0b,86,08,6c,cd,14,88,e9,1b,da,\
d3,29,9d,c8,79,40,a8,fd,7d,2f,ae,f4,3d,79,b6,ca,4f,7c,7e,94,cd,f9,06,2a,01,\
76,80,a8,dc,f5,44,46,13,32,5e,4f,7c,62,68,63,64,22,3f,46,7b,7f,72,41,43,21,\
36,01,45,bf,c6,b4,95,69,4e,2a,57,ac,d6,94,65,29,1e,ca,f9,66,28,e8,b4,65,7c,\
a6,9d,62,38,c0,94,62,af,b0,4b,f1,8d,21,9d,2f,0e,b4,5d,f9,96,0a,ef,7c,de,54,\
ed,79,e6,6a,a1,76,e0,68,fc,75,a4,06,fc,25,a2,17,98,f7,4c,85,0d,65,d3,30,9a,\
b2,07,a9,f4,33,82,c5,3e,75,ba,a4,67,61,ac,f4,17,4e,f9,e5,1d,25,63,90,ca,ac,\
46,2b,51,74,88,ab,c7,ae,45,0b,21,34,58,4b,77,30,7f,65,6d,75,64,39,2b,5d,78,\
4d,5f,0d,34,0a,0c,b2,97,85,82,63,4e,31,07,e4,99,b7,74,32,07,cd,ba,75,3a,b8,\
ee,6f,31,f0,a0,7f,37,9a,cd,6f,e2,81,55,f5,8a,30,9f,27,5a,e9,48,b0,91,10,a5,\
30,c2,1e,b6,3f,fe,73,f6,2e,e3,72,a4,79,b7,46,d0,2e,b2,0b,9d,f5,5f,a5,0d,65,\
cf,27,80,f1,17,81,e2,6f,98,ca,3d,75,b1,aa,2b,73,b1,a4,64,62,f9,cc,05,34,61,\
de,96,bf,1d,36,40,66,87,ac,dc,fe,0d,01,23,6e,52,4b,74,3f,6b,65,6f,63,6e,60,\
6c,66,78,48,54,2e,32,0d,18,be,cc,b7,ce,69,4f,20,0c,e8,97,8e,62,30,51,89,fc,\
2b,64,e5,e1,68,35,f0,b9,63,63,8b,de,37,e6,93,0b,be,8b,25,cf,63,0e,b4,46,e0,\
8c,08,b0,32,9f,41,ea,3f,c8,74,f1,42,d1,41,a6,63,fc,56,c7,2c,b4,10,d6,e3,4c,\
b6,17,69,cf,7b,99,cf,49,82,ac,23,d7,d4,06,79,ad,b9,24,73,b1,a2,39,4f,a9,c9,\
4c,22,7e,c4,94,e2,49,2c,55,74,91,fe,86,bf,0d,16,30,26,57,4c,6c,7e,7d,61,73,\
2e,62,6b,64,3f,7b,45,5f,23,3e,14,16,e0,dc,a8,80,72,0f,21,1a,bf,d0,8a,75,25,\
09,8a,a9,78,39,a4,ec,25,7a,a9,a8,30,31,d0,85,30,e2,de,16,bf,8c,3c,d5,72,00,\
aa,4c,e4,d7,06,b0,2e,d4,57,ed,7f,a7,61,f2,2f,ef,74,e8,77,fc,0b,dd,2f,b6,0d,\
97,c0,48,b6,15,69,c2,31,85,f1,4b,81,e2,6e,99,d0,34,30,e4,f6,61,68,b5,f0,39,\
2a,f6,8b,05,32,70,82,df,f8,1c,2a,55,65,93,ea,ca,ff,14,4b,33,21,5f,41,6a,64,\
66,2a,64,73,2e,68,66,77,70,4a,61,21,23,10,10,f3,dc,a8,80,72,44,37,47,f8,cd,\
89,31,6d,54,9f,f4,71,69,ec,b5,74,31,f7,f3,3f,76,d3,86,37,bf,86,5b,e6,88,2a,\
c4,74,4f,a7,46,fd,d6,08,be,23,d0,48,c6,72,ed,6a,f5,2f,ed,6b,ee,79,f7,7b,d3,\
22,a7,05,97,f5,5d,9b,22,41,f2,6a,81,e4,54,88,b1,6d,83,84,31,64,bd,f4,7b,2f,\
ee,f0,3b,71,bf,c2,19,35,7f,90,dc,e2,47,27,4e,6d,ce,a6,cb,e6,18,0a,34,34,1f,\
47,76,7d,26,68,6e,67,68,6a,56,72,7b,52,50,2e,34,10,26,d3,e8,97,cf,68,55,29,\
05,b0,94,c1,2a,6d,10,84,b1,64,3d,f4,b2,3a,6e,ab,a6,79,77,c7,90,2a,f0,89,58,\
f4,9b,2d,c5,2e,04,b7,06,d3,98,0e,b0,0d,d0,40,eb,79,ed,2b,ee,69,ae,74,fd,4f,\
f6,4d,9e,0c,be,03,90,fe,06,a2,08,72,cc,25,8a,fc,58,92,f4,6e,81,cc,29,30,e4,\
f6,61,68,b5,f0,39,2a,f6,8b,05,32,70,82,df,f8,1c,2a,55,65,93,ea,ca,ff,14,4b,\
32,21,5b,45,74,71,6d,76,68,64,2f,61,7a,3f,70,4a,55,25,29,4a,09,f8,d9,e4,cc,\
25,1a,69,08,b0,d1,90,65,30,02,9e,f6,3f,3e,f3,b6,2e,34,ea,a0,73,38,ce,90,6e,\
f4,97,16,c0,86,36,d5,61,0d,97,4c,e2,8f,08,b4,34,8e,54,f8,77,b4,35,b0,31,b1,\
3d,b9,22,a9,13,80,74,e8,56,d9,bd,5b,e4,09,74,d5,34,d3,bf,16,90,e3,21,97,c2,\
31,65,a7,f0,24,72,ef,e7,26,7d,f6,d1,1f,29,72,85,d3,f1,46,14,4e,72,95,a5,c5,\
c3,1c,16,27,2c,54,50,37,60,61,74,21,2d,24,3f,24,71,39,4c,45,34,21,17,43,bf,\
86,b3,96,77,12,6a,07,f5,cd,86,70,2e,1a,8a,ba,7f,24,e9,a3,61,2f,ef,e7,73,36,\
c9,df,21,e4,cb,57,f5,9d,26,c0,6e,0a,eb,4b,f1,97,0f,bc,21,d8,4a,b9,3d,fb,24,\
e9,74,f5,74,b3,3f,b6,50,c3,21,b7,02,91,e5,47,b0,04,72,8f,27,86,fd,16,87,fe,\
2d,9c,c6,38,7e,a2,aa,29,74,ac,a4,64,35
"pstincl"=hex:f5,ab,8e,90,60,78,57,42,7b,21,17,0e,ab,c5,ab,86,69,4f,7f,08,f3,\
da,8b,64,2e,05,9f,ac,63,2c,f6,fa,75,32,ed,ad,2b,29,c5,83,2f,fd,81,02,e0,9a,\
37,d6,72,05
"uincl"=hex:99,f5,b2,32,78,6d,50,41,33,6b,4b,56,f9,cb,a5,8f,6b,0f,26,08,e2,da,\
88,70,39,02,8a,ba,7f,67,f1,aa,2f,6b,ab,a5,7f,3e,cd,9f,2d,f4,89,5b,f5,9b,6a,\
c5,6f,5a,ac,5d,e4,89,17,eb,6f,9e,4d,fb,71,e7,6f,af,61,ef,66,fc,63,f0,4a,d4,\
33,a2,4a,9a,ff,44,eb,4b,2f,cd,2b,8e,ff,57,97,f4,32,87,c8,3c,64,f2,ec,35,74,\
b1,f7,73,3f,f6,cb,1d,22,23,ca,d7,f1,1d,2d,4e,6e,84,b0,87,f3,16,09,6a,28,45,\
50,69,63,33,2b,2e,6d,78,2a,60,76,37,47,5e,2d,7e,4e,56,f6,c6,b6,8c,73,4d,2b,\
0e,f9,d7,ca,70,33,01,9f,b1,64,3d,f4,b2,3a,6e,ab,be,75,35,c7,9e,2d,f4,ce,17,\
f3,86,69,ce,70,04,b6,48,e4,90,12,b4,22,d0,4a,f2,3e,ea,6b,af,75,ea,2b,a3,3f,\
ea,50,d0,32,a5,4a,9d
"forwas"=hex:15,26,db,fb,69

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter	REG_MULTI_SZ HTTPFilter\0\0
LocalService	REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService	REG_MULTI_SZ DnsCache\0\0
DcomLaunch	REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss	REG_MULTI_SZ RpcSs\0\0
imgsvc	REG_MULTI_SZ StiSvc\0\0
termsvcs	REG_MULTI_SZ TermService\0\0

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\AppleSoftwareUpdate.job

Completion time: 06-11-25 13:40:43.11
C:\ComboFix.txt ... 06-11-25 13:40


----------



## dragnstyl33 (Nov 18, 2006)

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\AppleSoftwareUpdate.job

Completion time: 06-11-25 13:40:43.11
C:\ComboFix.txt ... 06-11-25 13:40

Logfile of HijackThis v1.99.1
Scan saved at 13:43, on 06-11-25
Platform: Windows XP SP2, v.2149 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2149)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Updater.exe
C:\Program Files\Lexmark X74-X75\lxbbbmon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Adelphia HSAgent\bin\tgcmd.exe
C:\Program Files\Common Files\AOL\1162186374\ee\AOLSoftware.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\systen32.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
C:\WINDOWS\system32\LVComsX.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Google\Web Accelerator\googlewebaccclient.exe
C:\WINDOWS\system32\SVCH0ST.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Documents and Settings\Noom\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://localhost:9100/proxy.pac
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Web Accelerator Helper - {69A87B7D-DE56-4136-9655-716BA50C19C7} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\dllcache\tintsetp.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\dllcache\tintsetp.exe /IMEName
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [iRiver Updater] \Updater.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [tgcmd] "c:\Program Files\Adelphia HSAgent\bin\tgcmd.exe" /server /startmonitor /deaf 
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1162186374\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [systen32.exe] C:\WINDOWS\system32\systen32.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Run Google Web Accelerator.lnk = C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.adelphia.net/sdccommon/download/tgctlins.cab
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish.com/SnapfishActivia.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://www.vzwpix.com/activex/VerizonWirelessUploadControl.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {C915801D-6F00-49CD-8A9A-8DE5C11ADDC1} (Pixami Drag/Drop Upload UI Control) - http://www.photoworks.com/pixami/DragDropUploader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{952A9AC8-A5CF-4D22-99EB-FC83496CA1F2}: NameServer = 152.158.2.48
O17 - HKLM\System\CCS\Services\Tcpip\..\{FAAD30F5-4BD7-442F-94AB-A65BDC73BBF8}: NameServer = 152.158.2.48
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

Download the enclosed file (Overwrite any existing one). Save and extract its contents to the desktop. It is a folder containing a Registry Entries file, *Regfix.reg* . Once extracted, open the folder and double click on the *Regfix.reg* file and select *Yes* when prompted to merge it into the registry.

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below. *

O4 - HKLM\..\Run: [systen32.exe] C:\WINDOWS\system32\systen32.exe

*Now *close all windows and browsers, other than HiJackThis*, then click Fix Checked.

Close Hijackthis.

* Go to Control Panel > Internet Options. Click on the Programs tab, then click the "Reset Web Settings" button. Click Apply then OK.

* Next go to Control Panel > Display. Click on the "Desktop" tab then click the "Customize Desktop" button. Click on the "Web" tab. Under "Web Pages" Delete everything except for "My Current Home Page". Click OK then Apply and OK.


Download the attached file, unzip it and save it to your *C:\ drive.* (Overwrite any existing one)
When having saved it, the file path should be *C:\remove.txt*
Open the *Avenger*.
Check *Load Script from File *and then click the folder Icon on the right side of that section.
Then browse to *C:\remove.txt* and click *open* to load it.








Then click the *green light* icon.
This will begin the execution of the script currently in memory.
After you have clicked on the green light to begin execution of a script, the Avenger will set itself up to run the next time you reboot your computer, and then will prompt you to restart immediately.
After your system restarts, a log file should open with the results of Avengers actions. This log file is located at *C:\avenger.txt.* The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to *C:\avenger\backups.zip.*
Post the contents of the *C:\avenger.txt* file and a fresh *Hijackthis log*.


----------



## dragnstyl33 (Nov 18, 2006)

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\nxbbcbqc

*******************

Script file located at: \??\C:\Program Files\lhfabxbc.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\system32\wwww.exe deleted successfully.
File C:\WINDOWS\system32\jb.exe deleted successfully.
File C:\WINDOWS\system32\jbloader.dll deleted successfully.
File C:\WINDOWS\system32\jbhook.dll deleted successfully.
File C:\WINDOWS\system32\systen32.exe deleted successfully.
File C:\WINDOWS\system32\drivers\yktqppao.sys deleted successfully.
File C:\WINDOWS\system32\drivers\qhetalef.sys deleted successfully.
File C:\WINDOWS\system32\drivers\iokecb^n.sys deleted successfully.
File C:\WINDOWS\system32\nnnnonk.dll deleted successfully.
File C:\WINDOWS\system32\msvcrl.dll deleted successfully.
File C:\WINDOWS\system32\restorea6.exe deleted successfully.
File C:\WINDOWS\system32\dlh9jkd1q6.exe deleted successfully.
File C:\WINDOWS\system32\hhiii.bak2 deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Logfile of HijackThis v1.99.1
Scan saved at 16:20, on 06-11-25
Platform: Windows XP SP2, v.2149 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2149)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Updater.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Adelphia HSAgent\bin\tgcmd.exe
C:\Program Files\Common Files\AOL\1162186374\ee\AOLSoftware.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Lexmark X74-X75\lxbbbmon.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\LVComsX.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
C:\Program Files\Google\Web Accelerator\googlewebaccclient.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Documents and Settings\Noom\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://localhost:9100/proxy.pac
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Web Accelerator Helper - {69A87B7D-DE56-4136-9655-716BA50C19C7} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\dllcache\tintsetp.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\dllcache\tintsetp.exe /IMEName
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [iRiver Updater] \Updater.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [tgcmd] "c:\Program Files\Adelphia HSAgent\bin\tgcmd.exe" /server /startmonitor /deaf 
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1162186374\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Run Google Web Accelerator.lnk = C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.adelphia.net/sdccommon/download/tgctlins.cab
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish.com/SnapfishActivia.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://www.vzwpix.com/activex/VerizonWirelessUploadControl.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {C915801D-6F00-49CD-8A9A-8DE5C11ADDC1} (Pixami Drag/Drop Upload UI Control) - http://www.photoworks.com/pixami/DragDropUploader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{952A9AC8-A5CF-4D22-99EB-FC83496CA1F2}: NameServer = 152.158.2.48
O17 - HKLM\System\CCS\Services\Tcpip\..\{FAAD30F5-4BD7-442F-94AB-A65BDC73BBF8}: NameServer = 152.158.2.48
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

How is the computer doing now?


----------



## dragnstyl33 (Nov 18, 2006)

there are still virus attacks but the avg gets them, do I heal them or do I put them in the vault?

my Background is still stuck in a gray page ontop of my previous bg wallpaper I don't know how to fix that.

Also, it seems that my internet connection is sometimes connected and sometimes not but my brother's computer (which is using my connection) works fine.

besides that everything else seems fine. I'm still not able to submit replies without the page kicking me off the site.


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

I see some suspicious entries in the registry. I will attempt to modify these entries.

Please Backup your registry with *ERUNT* and create a *Restore point *as a precaution.


Enter your *Control Panel *and double-click on *Network Connections*
Then right click on your *Default Connection*
Usually Local Area Connection for Cable and DSL

Left click on *Properties*
Double-Click on the *Internet Protocol (TCP/IP*) item
Select the radio dial that says *Obtain DNS Servers Automa*tically
Press OK twice to get out of the properties screen
Restart the computer
Go to *Start*->*Run*->Type *CMD* and click *Ok*. The *MSDOS* Window will be displayed. At the command prompt, type the following and press *Enter* after each line:

*ipconfig /flushdns* (The space between g and / is needed)
*Exit*

Download the enclosed file (Overwrite any previous *regfix.zip *and *regfix.reg* files). Save and extract its contents to the desktop. It is a folder containing a Registry Entries file, *Regfix.reg* . Once extracted, open the folder and double click on the *Regfix.reg* file and select *Yes* when prompted to merge it into the registry.

Restart the computer and test.


----------



## dragnstyl33 (Nov 18, 2006)

I don't see any file enclosed, and I don't have ERUNT, am I missing something?


----------



## JSntgRvr (Jul 1, 2003)

dragnstyl33 said:


> I don't see any file enclosed, and I don't have ERUNT, am I missing something?


Sorry about that. Busy week!

Here you go!


----------



## dragnstyl33 (Nov 18, 2006)

that regfix worked great, my desktop is back to normal. Now the only thing that I can see that is still messed up ismy computer takes really long to boot up and the screen stays empty for a while. Other than that it seems to be working fine but then again the virus protector stops this thing called moodlogic and lexxps.


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

Click *here* to download *Dr.Web CureIt *and save it to your desktop.

Doubleclick the *drweb-cureit.exe *file and allow to run the express scan
This will scan the files currently running in memory and when something is found, click the *yes* button when it asks you if you want to cure it. This is only a short scan.
Once the short scan has finished, mark the drives that you want to scan.
Select all drives. A red dot shows which drives have been chosen.
Click the green arrow at the right, and the scan will start.
Click *'Yes to all' *if it asks if you want to cure/move the file.
When the scan has finished, look if you can click next icon next to the files found: 








If so, click it and then click the next icon right below and select Move incurable as you'll see in next image: 








This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
After selecting, in the *Dr.Web CureIt *menu on top, click file and choose save report list
Save the report to your desktop. The report will be called *DrWeb.csv*
*Close Dr.Web Cureit*.
Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
After reboot, post the contents of the log from *Dr.Web *you saved previously in your next reply along with a new *HijackThis log*. 
Please do an online scan with Kaspersky WebScanner

Click on *Kaspersky Online Scanner*

You will be promted to install an ActiveX component from Kaspersky, Click *Yes*.
The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on *NEXT
*
Now click on *Scan Settings*
In the scan settings make that the following are selected:
*Scan using the following Anti-Virus database:*

*Extended (if available otherwise Standard)*

*Scan Options:*

*Scan Archives
Scan Mail Bases*

Click *OK*
Now under select a target to scan:
Select *My Computer*

This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
Now click on the *Save as Text* button:

Save the file to your desktop.
*Copy and paste that information in your next post, along with a Hijackthis log and the Dr. WebCureit log.*..


----------



## dragnstyl33 (Nov 18, 2006)

Logfile of HijackThis v1.99.1
Scan saved at 18:47, on 06-11-26
Platform: Windows XP SP2, v.2149 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2149)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Updater.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Common Files\AOL\1162186374\ee\AOLSoftware.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Lexmark X74-X75\lxbbbmon.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Google\Web Accelerator\googlewebaccclient.exe
C:\WINDOWS\system32\LVComsX.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Documents and Settings\Noom\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://localhost:9100/proxy.pac
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Web Accelerator Helper - {69A87B7D-DE56-4136-9655-716BA50C19C7} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\dllcache\tintsetp.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\dllcache\tintsetp.exe /IMEName
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [iRiver Updater] \Updater.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1162186374\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Run Google Web Accelerator.lnk = C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.adelphia.net/sdccommon/download/tgctlins.cab
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish.com/SnapfishActivia.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://www.vzwpix.com/activex/VerizonWirelessUploadControl.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {C915801D-6F00-49CD-8A9A-8DE5C11ADDC1} (Pixami Drag/Drop Upload UI Control) - http://www.photoworks.com/pixami/DragDropUploader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{952A9AC8-A5CF-4D22-99EB-FC83496CA1F2}: NameServer = 152.158.2.48
O17 - HKLM\System\CCS\Services\Tcpip\..\{FAAD30F5-4BD7-442F-94AB-A65BDC73BBF8}: NameServer = 152.158.2.48
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

tgcmd.exe;c:\program files\adelphia hsagent\bin;Probably DLOADER.Trojan;Incurable.Will be moved after reboot.;
inst.exe;C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.3.30.1;Probably BACKDOOR.Trojan;Incurable.Moved.;
i9.tmp;C:\Documents and Settings\LocalService\Local Settings\Temp;Adware.Surfside;Incurable.Moved.;
u18.tmp;C:\Documents and Settings\LocalService\Local Settings\Temp;Adware.Surfside;Incurable.Moved.;
iB.tmp;C:\Documents and Settings\NetworkService\Local Settings\Temp;Adware.Surfside;Incurable.Moved.;
iC.tmp;C:\Documents and Settings\NetworkService\Local Settings\Temp;Adware.Surfside;Incurable.Moved.;
jb[1].exe;C:\Documents and Settings\Noom\Local Settings\Temporary Internet Files\Content.IE5\ODUZC5AV;BackDoor.Generic.1468;Deleted.;
sdcmon.dll;C:\Program Files\adelphia hsagent\bin;Probably DLOADER.Trojan;Incurable.Moved.;
tgcmd.exe;C:\Program Files\adelphia hsagent\bin;Probably DLOADER.Trojan;Incurable.Moved.;
tgupdate.exe;C:\Program Files\adelphia hsagent\bin;Probably DLOADER.Trojan;Incurable.Moved.;
MiniBugTransporter.dll;C:\Program Files\AWS\WeatherBug;Adware.Aws;Incurable.Moved.;
00028506.DLL;C:\RECYCLER\NPROTECT;Adware.NewDotNet;Incurable.Moved.;
00029914.EXE;C:\RECYCLER\NPROTECT;Trojan.Spambot;Deleted.;
00029932.dll;C:\RECYCLER\NPROTECT;Trojan.Virtumod;Deleted.;
00029940.dll;C:\RECYCLER\NPROTECT;Trojan.Virtumod;Deleted.;
00029942.dll;C:\RECYCLER\NPROTECT;Trojan.Virtumod;Deleted.;
A0000069.EXE;C:\System Volume Information\_restore{18DA4AE2-DAD5-43E1-9954-1FD172EF03E3}\RP1;Trojan.Spambot;Deleted.;
A0000070.dll;C:\System Volume Information\_restore{18DA4AE2-DAD5-43E1-9954-1FD172EF03E3}\RP1;Trojan.Virtumod;Deleted.;
A0000071.dll;C:\System Volume Information\_restore{18DA4AE2-DAD5-43E1-9954-1FD172EF03E3}\RP1;Trojan.Virtumod;Deleted.;
A0000072.dll;C:\System Volume Information\_restore{18DA4AE2-DAD5-43E1-9954-1FD172EF03E3}\RP1;Trojan.Virtumod;Deleted.;
SVCH0ST.EXE;C:\WINDOWS\system32;BackDoor.Generic.1468;Deleted.;
mirc.exe;E:\mIRC;Program.mIRC.616;Incurable.Moved.;
mirc.exe;E:\mIRC\backup;Program.mIRC.616;Incurable.Moved.;


----------



## dragnstyl33 (Nov 18, 2006)

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
06-11-26 18:46
Operating System: Microsoft Windows XP Professional, Service Pack 2, v.2149 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 27/11/2006
Kaspersky Anti-Virus database records: 245693
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\

Scan Statistics:
Total number of scanned objects: 53747
Number of viruses found: 36
Number of infected objects: 185 / 0
Number of suspicious objects: 0
Duration of the scan process: 00:31:24


----------



## dragnstyl33 (Nov 18, 2006)

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\Administrator\Local Settings\Temp\4178\gm.exe	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck	Object is locked	skipped
C:\Documents and Settings\LocalService\Cookies\index.dat	Object is locked	skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	Object is locked	skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	Object is locked	skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat	Object is locked	skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat	Object is locked	skipped
C:\Documents and Settings\LocalService\NTUSER.DAT	Object is locked	skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG	Object is locked	skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat	Object is locked	skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	Object is locked	skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	Object is locked	skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat	Object is locked	skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat	Object is locked	skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT	Object is locked	skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG	Object is locked	skipped
C:\Documents and Settings\Noom\Cookies\index.dat	Object is locked	skipped
C:\Documents and Settings\Noom\DoctorWeb\Quarantine\00028506.DLL	Infected: not-a-virus:AdWare.Win32.NewDotNet	skipped
C:\Documents and Settings\Noom\DoctorWeb\Quarantine\i9.tmp	Infected: not-a-virus:AdWare.Win32.SurfSide.ax	skipped
C:\Documents and Settings\Noom\DoctorWeb\Quarantine\iB.tmp	Infected: not-a-virus:AdWare.Win32.SurfSide.ax	skipped
C:\Documents and Settings\Noom\DoctorWeb\Quarantine\iC.tmp	Infected: not-a-virus:AdWare.Win32.SurfSide.ax	skipped
C:\Documents and Settings\Noom\DoctorWeb\Quarantine\mirc.exe	Infected: not-a-virus:Client-IRC.Win32.mIRC.616	skipped
C:\Documents and Settings\Noom\DoctorWeb\Quarantine\mirc___0.exe	Infected: not-a-virus:Client-IRC.Win32.mIRC.616	skipped
C:\Documents and Settings\Noom\DoctorWeb\Quarantine\u18.tmp	Infected: not-a-virus:AdWare.Win32.SurfSide.bb	skipped
C:\Documents and Settings\Noom\Local Settings\Application Data\AOL\UserProfiles\All Users\cls\common.cls	Object is locked	skipped
C:\Documents and Settings\Noom\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	Object is locked	skipped
C:\Documents and Settings\Noom\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	Object is locked	skipped
C:\Documents and Settings\Noom\Local Settings\History\History.IE5\index.dat	Object is locked	skipped
C:\Documents and Settings\Noom\Local Settings\Temp\googlewebaccclient.exe.log	Object is locked	skipped
C:\Documents and Settings\Noom\Local Settings\Temp\GoogleWebAccelerator.pac	Object is locked	skipped
C:\Documents and Settings\Noom\Local Settings\Temp\GoogleWebAcceleratorCache	Object is locked	skipped
C:\Documents and Settings\Noom\Local Settings\Temp\GoogleWebAccWarden.exe.log	Object is locked	skipped
C:\Documents and Settings\Noom\Local Settings\Temp\~DF834A.tmp	Object is locked	skipped
C:\Documents and Settings\Noom\Local Settings\Temporary Internet Files\Content.IE5\index.dat	Object is locked	skipped
C:\Documents and Settings\Noom\ntuser.dat	Object is locked	skipped
C:\Documents and Settings\Noom\NTUSER.DAT.LOG	Object is locked	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\02225AEB.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0B9A0E4E.htm	Infected: Exploit.HTML.Mht	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0C5A1058.tmp	Infected: not-a-virus:AdWare.Win32.ZenoSearch.o	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0C716161.htm	Infected: Trojan-Downloader.JS.IstBar.j	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0D735F61.htm	Infected: Trojan.Win32.TopAntiSpyware.a	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0ED205A4.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0ED205A4.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0F40764A.htm	Infected: Trojan-Downloader.JS.IstBar.j	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\102C4252.exe	Infected: not-a-virus:AdTool.Win32.WhenU.a	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\12442AF1.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\148621EB.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\148621EB.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\14901FE1.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\14901FE1.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\149D47D2.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\14BA41B2.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\14D73B91.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\14F53571.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1727634F.tmp	Infected: Trojan-Downloader.Win32.Dyfuca.gen	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\172B0D4B.tmp	Infected: Trojan-Downloader.Win32.Dyfuca.ey	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\237A0856.tmp	Infected: Trojan-Downloader.Win32.Small.cxx	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\23E07E5D.exe	Infected: Backdoor.Win32.Hupigon.cj	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\23E07E5D.tmp	Infected: Trojan-Downloader.Win32.Small.cxx	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2874096B.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\288E594E.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\28AC532E.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\28C94D0E.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2A572847.exe	Infected: Trojan-Proxy.Win32.Agent.gt	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2BB44489.tmp	Infected: Trojan-Downloader.Win32.Dyfuca.eg	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2EB10F6D.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2EB76366.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2F4A44C4.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2F4A44C4.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2F9F0867.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2FB30451.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2FB30451.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2FBC0247.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2FC02C43.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2FC02C43.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2FD7522A.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2FF77606.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\31C3154F.tmp	Infected: Trojan-Downloader.Win32.Qoologic.at	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\36854A87.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\368B1E80.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\368F487C.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\37B50B39.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\37BB5F32.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\37BB5F32.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\37BE092E.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\37BE092E.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\37C2332A.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\37F44FF5.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\37F44FF5.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\392877C4.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\392877C4.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3A6C1D59.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3BDC005B.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3BFD2437.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3C1A1E17.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3C2E1A01.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3C2E1A01.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3C3717F7.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3E445967.exe	Infected: Backdoor.Win32.Hupigon.cj	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3E8346DF.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3EA140BF.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3EC1649B.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3EC1649B.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3EC40E98.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3ECB6290.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3ECB6290.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\41F76037.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\41F76037.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\41FA0A34.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\440F730A.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\44121D07.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\450A13F6.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\450A13F6.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\46475D2C.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\46680108.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\468250EB.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4698691F.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\469F4ACB.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\46B662FE.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\46B90CFB.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\46B90CFB.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\46B90CFB.tmp	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\46C060F4.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\46C30AF0.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\46C30AF0.tmp	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\46C634EC.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\46C634EC.tmp	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\46CD08E5.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\46CD08E5.tmp	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\46D35CDE.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\46D35CDE.tmp	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\46DA30D7.tmp	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\47153249.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\47153249.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\484603C8.exe	Infected: Trojan-Downloader.Win32.IstBar.mx	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\484A2DC4.exe	Infected: Trojan-Downloader.Win32.IstBar.nt	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\484D57C1.exe	Infected: Trojan-Downloader.Win32.IstBar.gen	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\485001BD.c70	Infected: not-a-virus:AdWare.Win32.SurfAccuracy.d	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\485001BD.dll	Infected: Trojan-Downloader.Win32.IstBar.gen	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\48D85F7F.exe	Infected: Backdoor.Win32.Delf.vp	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4C8F53D5.exe	Infected: not-a-virus:AdWare.Win32.Maxifiles.l	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4DE010BD.htm	Infected: Trojan.Win32.TopAntiSpyware.a	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\50650B77.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\50650B77.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\506B5F70.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\506B5F70.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\50C30081.dll	Infected: not-a-virus:AdWare.Win32.Agent.e	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\50C30081.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\50C72A7E.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\50E17A61.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\50FB4A44.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\525E1892.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\525E1892.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\52F94457.EXE	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\54224514.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\54266F11.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\544A3CE9.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\544D66E6.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\551D6B29.htm	Infected: Exploit.VBS.Phel.a	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\560A07C1.exe	Infected: Trojan.Win32.Dialer.ht	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\560D31BE.exe/data0001.cab/VVSN.exe	Infected: not-a-virus:AdWare.Win32.SaveNow.z	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\560D31BE.exe/data0001.cab	Infected: not-a-virus:AdWare.Win32.SaveNow.z	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\560D31BE.exe	Embedded CAB: infected - 2	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\560D31BE.exe	CryptFF: infected - 2	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\568747A7.exe	Infected: Backdoor.Win32.Rbot.agq	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\568A71A3.exe	Infected: Trojan-Proxy.Win32.Agent.gt	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\568D1BA0.exe	Infected: Backdoor.Win32.Rbot.agq	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\56EC5D37.exe	Infected: Trojan.Win32.Autoit.n	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\573E3D5B.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\573E3D5B.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\57513945.exe	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\584E44C6.tmp	Infected: not-a-virus:AdWare.Win32.ZenoSearch.o	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5AC3017B.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5AC62B78.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5ACA5574.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5ACA5574.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5BDA00AB.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5BDA00AB.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5D7879F3.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5D7B23F0.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5D7B23F0.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5F5E2164.exe	Infected: not-a-virus:AdWare.Win32.WinAD.bo	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5FDA71E1.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5FDA71E1.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\60947E87.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\609B527F.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64C77BB1.tmp	Infected: Trojan-Downloader.Win32.Small.dam	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6C2D13C4.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6C2D13C4.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6CB97706.exe	Infected: not-a-virus:AdWare.Win32.Maxifiles.u	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6CEC78BE.exe	Infected: Trojan-Clicker.Win32.VB.lb	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6D1862C1.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6D1B0CBE.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6F7D746A.tmp	Infected: Exploit.HTML.Mht	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\75E75AF0.ga2	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\7628727A.tmp	Infected: not-virus:Hoax.Win32.Renos.ap	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\762F4673.exe	Infected: Trojan-Downloader.Win32.Small.cxx	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\762F4673.tmp	Infected: Trojan-Downloader.Win32.Small.cxx	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\7632706F.exe	Infected: Backdoor.Win32.Hupigon.cj	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\7632706F.tmp	Infected: not-a-virus:AdWare.Win32.NewDotNet.e	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\76361A6B.tmp	Infected: Trojan-Downloader.Win32.Dyfuca.gen	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\763C6E64.tmp	Infected: Trojan-Downloader.Win32.Dyfuca.ey	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\763F1861.tmp	Infected: Trojan-Downloader.Win32.Dyfuca.ey	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\76466C59.tmp	Infected: Trojan-Downloader.Win32.Qoologic.at	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\76491656.tmp	Infected: Trojan-Downloader.Win32.Dyfuca.eg	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\76506A4F.exe	Infected: Trojan-Downloader.Win32.Small.cxx	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\76506A4F.tmp	Infected: Trojan-Downloader.Win32.Small.cxx	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\7653144B.exe	Infected: Trojan-Downloader.Win32.Small.cxx	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\7653144B.tmp	Infected: Trojan-Downloader.Win32.Small.cxx	skipped
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\7E4D5AB8.exe	Infected: Trojan-Downloader.Win32.Small.coy	skipped
C:\System Volume Information\_restore{18DA4AE2-DAD5-43E1-9954-1FD172EF03E3}\RP1\A0000081.DLL	Infected: not-a-virus:AdWare.Win32.NewDotNet	skipped
C:\System Volume Information\_restore{18DA4AE2-DAD5-43E1-9954-1FD172EF03E3}\RP1\change.log	Object is locked	skipped
C:\WINDOWS\Debug\PASSWD.LOG	Object is locked	skipped
C:\WINDOWS\Internet Logs\DRAGON.ldb	Object is locked	skipped
C:\WINDOWS\Internet Logs\fwdbglog.txt	Object is locked	skipped
C:\WINDOWS\Internet Logs\fwpktlog.txt	Object is locked	skipped
C:\WINDOWS\Internet Logs\IAMDB.RDB	Object is locked	skipped
C:\WINDOWS\Internet Logs\tvDebug.log	Object is locked	skipped
C:\WINDOWS\SchedLgU.Txt	Object is locked	skipped
C:\WINDOWS\Sti_Trace.log	Object is locked	skipped
C:\WINDOWS\system32\CatRoot2\edb.log	Object is locked	skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb	Object is locked	skipped
C:\WINDOWS\system32\config\AppEvent.Evt	Object is locked	skipped
C:\WINDOWS\system32\config\default	Object is locked	skipped
C:\WINDOWS\system32\config\default.LOG	Object is locked	skipped
C:\WINDOWS\system32\config\SAM	Object is locked	skipped
C:\WINDOWS\system32\config\SAM.LOG	Object is locked	skipped
C:\WINDOWS\system32\config\SecEvent.Evt	Object is locked	skipped
C:\WINDOWS\system32\config\SECURITY	Object is locked	skipped
C:\WINDOWS\system32\config\SECURITY.LOG	Object is locked	skipped
C:\WINDOWS\system32\config\software	Object is locked	skipped
C:\WINDOWS\system32\config\software.LOG	Object is locked	skipped
C:\WINDOWS\system32\config\SysEvent.Evt	Object is locked	skipped
C:\WINDOWS\system32\config\system	Object is locked	skipped
C:\WINDOWS\system32\config\system.LOG	Object is locked	skipped
C:\WINDOWS\system32\drivers\etc\hosts.tim	Infected: Trojan.Win32.Qhost.it	skipped
C:\WINDOWS\system32\h323log.txt	Object is locked	skipped
C:\WINDOWS\system32\LogFiles\HTTPERR\httperr1.log	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP	Object is locked	skipped
C:\WINDOWS\Temp\ZLT038ea.TMP	Object is locked	skipped
C:\WINDOWS\Temp\ZLT038fd.TMP	Object is locked	skipped
C:\WINDOWS\wiadebug.log	Object is locked	skipped
C:\WINDOWS\wiaservc.log	Object is locked	skipped
D:\System Volume Information\MountPointManagerRemoteDatabase	Object is locked	skipped
E:\System Volume Information\_restore{18DA4AE2-DAD5-43E1-9954-1FD172EF03E3}\RP1\A0000082.exe	Infected: not-a-virus:Client-IRC.Win32.mIRC.616	skipped
E:\System Volume Information\_restore{18DA4AE2-DAD5-43E1-9954-1FD172EF03E3}\RP1\A0000083.exe	Infected: not-a-virus:Client-IRC.Win32.mIRC.616	skipped

Scan process completed.


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

*Reboot into safe mode.*

Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

Set Explorer to view Hidden Files and Folders:

Right-click your Start button and go to "Explore".
Select Tools from the menu
Select Folder Options
Select the View tab
Click on Show all Files and Folders
Select *Apply to All Folders *| *Yes* | *Apply* |* OK*.

Using Windows Explorer (to get there right-click your Start button and go to "Explore"), please navigate to these *folders* and delete all files and folders therein :

*C:\Documents and Settings\Administrator\Local Settings\Temp
C:\Documents and Settings\LocalService\Local Settings\Temp
C:\Documents and Settings\NetworkService\Local Settings\Temp
C:\Documents and Settings\Noom\Local Settings\Temp
C:\Windows\TEMP*

Using Windows Explorer (to get there right-click your Start button and go to "Explore"), please delete these *folders* (if present):

*E:\mIRC*

Using Windows Explorer (to get there right-click your Start button and go to "Explore"), please delete these *files* (if present):

*C:\WINDOWS\system32\drivers\etc\hosts.tim *

Empty (Clear - Delete) the quarantine of the following programs:

*Norton AntiVirus
DoctorWeb*

If having problems clearing the quarantine, using Windows Explorer (to get there right-click your Start button and go to "Explore"), please navigate to these *folders* and clear them all.

*C:\Documents and Settings\Noom\DoctorWeb\Quarantine
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine*

Last thing to do, Empty your *Recycle Bin*

Set Explorer to Defaults:

Right-click your Start button and go to "Explore".
Select Tools from the menu
Select Folder Options
Select the View tab
Click on Restore Defaults
Select *Apply to All Folders *| *Yes* | *Apply* |* OK*

Restart the computer.

*How is it doing?*


----------



## dragnstyl33 (Nov 18, 2006)

the computer is working pretty good now, almost 100% I think, the only thing is that there is something going on when I restart. An outline of a box appears and then disappears and my time in the task bar is stuck on military time. It takes a really long time for my desktop icons to appear also.


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33*. 

That could be a program in the backgroung in the process of sutting down. I wouldn't put any attention to it at this point, but if it becomes worse, please do not hesitate to contact us.

You deserve a Congratulation.







I am glad we were able to handle this malware.

Reset and Re-enable your System Restore to remove bad files that have been backed up by Windows. The files in System Restore are protected to prevent any programmes changing them. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected.)

To reset your restore points, please note that you will need to log into your computer with an account which has full administrator access. You will know if the account has administrator access because you will be able to see the System Restore tab. If the tab is missing, you are logged in under a limited account.

(Windows XP)

1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK..

The following is a list of tools and utilities that I like to suggest to people. This list is full of great tools and utilities to help you understand how you got infected and how to keep from getting infected again. 
*Spybot Search & Destroy *- Uber powerful tool which can search and annhilate nasties that make it onto your system. Now with an Immunize section that will help prevent future infections.

*AdAware* - Another very powerful tool which searches and kills nasties that infect your system. AdAware and Spybot Search & Destroy compliment each other very well.

*SpywareBlaster* - Great prevention tool to keep nasties from installing on your system.

*SpywareGuard* - Works as a Spyware "Shield" to protect your computer from getting malware in the first place.

*IE-SpyAd* - puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.

*CleanUP*! - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.

Windows Updates - It is *very important* to make sure that both Internet Explorer and Windows are kept current with *the latest critical security patches* from Microsoft. To do this just start *Internet Explorer* and select *Tools > Windows Update*, and follow the online instructions from there.

*Google Toolbar* - Free google toolbar that allows you to use the powerful Google search engine from the bar, but also blocks pop up windows.

*Trillian* or *Miranda-IM* - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read *this* article by Tony Klein.

Click *Here* for some advise from our security Experts.

Here are some routine maintenance practices that you should do on a regular basis to keep your machine running efficiently.

Click start then run, type *Prefetch* then press enter, click edit then select all, right click any file then click delete, confirm delete.

Click start, all Programmes, Accessories, System Tools to run *Disc Clean up*, then from System Tools, also run *Disc Defragmenter*.

Click start then run, *ChkDsk /R* then press enter, type Y to confirm for next boot, press enter then reboot.

Windows will appear to load normally then either the monitor will show progress or the screen will go blank, *do not disturb this process*.

This will take an hour or so before it gets to the desktop.

*Remove unnecessary startups*

This should be done through the System Configuration Utility. Go to *Start* > *Run* and type in *msconfig*. Click OK or hit the Enter key.

Click on the "*Startup*" tab and remove the check by the items that you have determined are unnecessary. Click "*Apply*" then "*Close*"

You will be prompted to restart. Go ahead and restart.

Upon restart you will be confronted with a dialogue box warning about running in selective startup. Just ignore that message and put a check in the box by "*Don't show me this message or launch the System Configuration Utility when Windows starts*" and click "OK". You will not be bothered by the message again.

Keep in mind that some entries will be re-enabled in the startups each time you use that particular program. Therefore, you will have to find the option in that programs preferences that says something like "*Load with Windows*" or "*Run when Windows Starts*" and disable that option.

Go here for info on msconfig:

*Pacs Portal*

You can look up the startups at the following links to help determine what is needed and what is not:

*ComputerCops* 
*BleepingComputer* 
*Answers That Work* 
*Windows Startup*

Please use the thread's Tools and mark this thread as "*Solved*".

Best wishes! :up:


----------



## dragnstyl33 (Nov 18, 2006)

I posted this on another subject heading but then realized that it could have been all the deleting that caused this but my computer won't seem to recognize my printer any more. When I try to add a printer an error box appears and says that the print spooler is that running or something like that.

Also, is there a way to change the time on my tool bar from 24 to 12hr time?

thanks


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 



dragnstyl33 said:


> I posted this on another subject heading but then realized that it could have been all the deleting that caused this but my computer won't seem to recognize my printer any more. When I try to add a printer an error box appears and says that the print spooler is that running or something like that.
> 
> Also, is there a way to change the time on my tool bar from 24 to 12hr time?
> 
> thanks


For the time:

Start->Control Panel->Regional Setting/Language->Customize.

About your printer:

Can you post the exact error message?


----------



## dragnstyl33 (Nov 18, 2006)

I went to start menu, control, dates/times/settings/languages, but when I click the customize arrow in category view nothing happens.

error message: Operation could not be completed. The Print Spooler service is not running.


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

It is Start->Control Panel->Regional and Language Options->Customize. See Screenshot below.

Go to Start->Run->type *Services.msc* and click Ok. Scroll down to *Remote Procedure Call (RPC)* and double click on it. Make sure the service is started and it is set to Automatic. Perform the same actions with *Print Spooler* and 
*Remote Procedure Call (RPC) locator*. If any of these services are stopped, start the Service. If you receive an error while attempting to start any of these services, post the exact error message. If these Services are missing, please let me know.


----------



## dragnstyl33 (Nov 18, 2006)

I have no icon for regional and language options. Also I started the three resources that you pointed out. the RPC is set to automatic and the RPC is on manual but I don't know how to change it.


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

Run *Services.msc* -> Doubleclick on the Service -> Select Automatic from the dropdown menu -> Click Ok

For the Regional Setttings run the following command:

*Control intl.cpl*

Then follow the instructions above.


----------



## dragnstyl33 (Nov 18, 2006)

I changed the setting of the RPC to automatic. in the run: Control intl.cpl, and nothing happened.

I have to keep on starting the print spooler servince even though it's set to autoatic.

I tried to rerun my software installer but it says that the print spooler service isn't running.

It says that there is no computer connected but I check all the connections and that doesn't make any sense.


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

Lets see if there are restrictions in your registry.

Download the enclosed file: 
Save and extract its contents to the desktop. It is a folder containing a batchfile, *Policies.bat* . Once extracted, open the folder and double click on the *Policies.bat* file. Post the log it creates.


----------



## dragnstyl33 (Nov 18, 2006)

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop
NoChangingWallpaper	REG_DWORD	0x0
NoComponents	REG_DWORD	0x0
NoAddingComponents	REG_DWORD	0x0
NoDeletingComponents	REG_DWORD	0x0
NoEditingComponents	REG_DWORD	0x0
NoHTMLWallPaper	REG_DWORD	0x0

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoDriveTypeAutoRun	REG_DWORD	0x91
NoActiveDesktop	REG_DWORD	0x0
ClassicShell	REG_DWORD	0x0
ForceActiveDesktopOn	REG_DWORD	0x0

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
UseDesktopIniCache	REG_DWORD	0x1

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum
{BDEADF00-C265-11D0-BCED-00A0C90AB50F}	REG_DWORD	0x1
{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}	REG_DWORD	0x40000021
{0DF44EAA-FF21-4412-828E-260A8728E7F1}	REG_DWORD	0x20

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Ratings

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\system
dontdisplaylastusername	REG_DWORD	0x0
legalnoticecaption	REG_SZ	
legalnoticetext	REG_SZ	
shutdownwithoutlogon	REG_DWORD	0x1
undockwithoutlogon	REG_DWORD	0x1

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
AutoRestartShell	REG_DWORD	0x1
DefaultDomainName	REG_SZ	DRAGON
DefaultUserName	REG_SZ	Noom
LegalNoticeCaption	REG_SZ	
LegalNoticeText	REG_SZ	
PowerdownAfterShutdown	REG_SZ	0
ReportBootOk	REG_SZ	1
Shell	REG_SZ	Explorer.exe
ShutdownWithoutLogon	REG_SZ	0
System	REG_SZ	
Userinit	REG_SZ	C:\WINDOWS\system32\userinit.exe,
VmApplet	REG_SZ	rundll32 shell32,Control_RunDLL "sysdm.cpl"
SfcQuota	REG_DWORD	0xffffffff
allocatecdroms	REG_SZ	0
allocatedasd	REG_SZ	0
allocatefloppies	REG_SZ	0
cachedlogonscount	REG_SZ	10
forceunlocklogon	REG_DWORD	0x0
passwordexpirywarning	REG_DWORD	0xe
scremoveoption	REG_SZ	0
AllowMultipleTSSessions	REG_DWORD	0x1
UIHost	REG_EXPAND_SZ	logonui.exe
LogonType	REG_DWORD	0x1
Background	REG_SZ	0 0 0
DebugServerCommand	REG_SZ	no
SFCDisable	REG_DWORD	0x0
WinStationsDisabled	REG_SZ	0
HibernationPreviouslyEnabled	REG_DWORD	0x1
ShowLogonOptions	REG_DWORD	0x0
AltDefaultUserName	REG_SZ	Noom
AltDefaultDomainName	REG_SZ	DRAGON
AutoAdminLogon	REG_SZ	0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}
<NO NAME>	REG_SZ	Wireless
ProcessGroupPolicy	REG_SZ	ProcessWIRELESSPolicy
DllName	REG_EXPAND_SZ	gptext.dll
NoUserPolicy	REG_DWORD	0x1
NoGPOListChanges	REG_DWORD	0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}
<NO NAME>	REG_SZ	Folder Redirection
ProcessGroupPolicyEx	REG_SZ	ProcessGroupPolicyEx
DllName	REG_EXPAND_SZ	fdeploy.dll
NoMachinePolicy	REG_DWORD	0x1
NoSlowLink	REG_DWORD	0x1
PerUserLocalSettings	REG_DWORD	0x1
NoGPOListChanges	REG_DWORD	0x0
NoBackgroundPolicy	REG_DWORD	0x0
GenerateGroupPolicy	REG_SZ	GenerateGroupPolicy
EventSources	REG_MULTI_SZ	(Folder Redirection,Application)\0\0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}
<NO NAME>	REG_SZ	Microsoft Disk Quota
NoMachinePolicy	REG_DWORD	0x0
NoUserPolicy	REG_DWORD	0x1
NoSlowLink	REG_DWORD	0x1
NoBackgroundPolicy	REG_DWORD	0x1
NoGPOListChanges	REG_DWORD	0x1
PerUserLocalSettings	REG_DWORD	0x0
RequiresSuccessfulRegistry	REG_DWORD	0x1
EnableAsynchronousProcessing	REG_DWORD	0x0
DllName	REG_EXPAND_SZ	dskquota.dll
ProcessGroupPolicy	REG_SZ	ProcessGroupPolicy

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}
<NO NAME>	REG_SZ	QoS Packet Scheduler
ProcessGroupPolicy	REG_SZ	ProcessPSCHEDPolicy
DllName	REG_EXPAND_SZ	gptext.dll
NoUserPolicy	REG_DWORD	0x1
NoGPOListChanges	REG_DWORD	0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{42B5FAAE-6536-11d2-AE5A-0000F87571E3}
<NO NAME>	REG_SZ	Scripts
ProcessGroupPolicy	REG_SZ	ProcessScriptsGroupPolicy
ProcessGroupPolicyEx	REG_SZ	ProcessScriptsGroupPolicyEx
GenerateGroupPolicy	REG_SZ	GenerateScriptsGroupPolicy
DllName	REG_EXPAND_SZ	gptext.dll
NoSlowLink	REG_DWORD	0x1
NoGPOListChanges	REG_DWORD	0x1
NotifyLinkTransition	REG_DWORD	0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}
ProcessGroupPolicy	REG_SZ	SceProcessSecurityPolicyGPO
GenerateGroupPolicy	REG_SZ	SceGenerateGroupPolicy
ExtensionRsopPlanningDebugLevel	REG_DWORD	0x1
ProcessGroupPolicyEx	REG_SZ	SceProcessSecurityPolicyGPOEx
ExtensionDebugLevel	REG_DWORD	0x1
DllName	REG_EXPAND_SZ	scecli.dll
<NO NAME>	REG_SZ	Security
NoUserPolicy	REG_DWORD	0x1
NoGPOListChanges	REG_DWORD	0x1
EnableAsynchronousProcessing	REG_DWORD	0x1
MaxNoGPOListChangesInterval	REG_DWORD	0x3c0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}
ProcessGroupPolicyEx	REG_SZ	ProcessGroupPolicyEx
GenerateGroupPolicy	REG_SZ	GenerateGroupPolicy
ProcessGroupPolicy	REG_SZ	ProcessGroupPolicy
DllName	REG_EXPAND_SZ	iedkcs32.dll
<NO NAME>	REG_SZ	Internet Explorer Branding
NoSlowLink	REG_DWORD	0x1
NoBackgroundPolicy	REG_DWORD	0x0
NoGPOListChanges	REG_DWORD	0x1
NoMachinePolicy	REG_DWORD	0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}
ProcessGroupPolicy	REG_SZ	SceProcessEFSRecoveryGPO
DllName	REG_EXPAND_SZ	scecli.dll
<NO NAME>	REG_SZ	EFS recovery
NoUserPolicy	REG_DWORD	0x1
NoGPOListChanges	REG_DWORD	0x1
RequiresSuccessfulRegistry	REG_DWORD	0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}
<NO NAME>	REG_SZ	Microsoft Offline Files
DllName	REG_EXPAND_SZ	%SystemRoot%\System32\cscui.dll
EnableAsynchronousProcessing	REG_DWORD	0x0
NoBackgroundPolicy	REG_DWORD	0x0
NoGPOListChanges	REG_DWORD	0x0
NoMachinePolicy	REG_DWORD	0x0
NoSlowLink	REG_DWORD	0x0
NoUserPolicy	REG_DWORD	0x1
PerUserLocalSettings	REG_DWORD	0x0
ProcessGroupPolicy	REG_SZ	ProcessGroupPolicy
RequiresSuccessfulRegistry	REG_DWORD	0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}
<NO NAME>	REG_SZ	Software Installation
DllName	REG_EXPAND_SZ	appmgmts.dll
ProcessGroupPolicyEx	REG_SZ	ProcessGroupPolicyObjectsEx
GenerateGroupPolicy	REG_SZ	GenerateGroupPolicy
NoBackgroundPolicy	REG_DWORD	0x0
RequiresSucessfulRegistry	REG_DWORD	0x0
NoSlowLink	REG_DWORD	0x1
PerUserLocalSettings	REG_DWORD	0x1
EventSources	REG_MULTI_SZ	(Application Management,Application)\0(MsiInstaller,Application)\0\0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{e437bc1c-aa7d-11d2-a382-00c04f991e27}
<NO NAME>	REG_SZ	IP Security
ProcessGroupPolicy	REG_SZ	ProcessIPSECPolicy
DllName	REG_EXPAND_SZ	gptext.dll
NoUserPolicy	REG_DWORD	0x1
NoGPOListChanges	REG_DWORD	0x0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain
Asynchronous	REG_DWORD	0x0
Impersonate	REG_DWORD	0x0
DllName	REG_EXPAND_SZ	crypt32.dll
Logoff	REG_SZ	ChainWlxLogoffEvent

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet
Asynchronous	REG_DWORD	0x0
Impersonate	REG_DWORD	0x0
DllName	REG_EXPAND_SZ	cryptnet.dll
Logoff	REG_SZ	CryptnetWlxLogoffEvent

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll
DLLName	REG_SZ	cscdll.dll
Logon	REG_SZ	WinlogonLogonEvent
Logoff	REG_SZ	WinlogonLogoffEvent
ScreenSaver	REG_SZ	WinlogonScreenSaverEvent
Startup	REG_SZ	WinlogonStartupEvent
Shutdown	REG_SZ	WinlogonShutdownEvent
StartShell	REG_SZ	WinlogonStartShellEvent
Impersonate	REG_DWORD	0x0
Asynchronous	REG_DWORD	0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp
DLLName	REG_SZ	wlnotify.dll
Logon	REG_SZ	SCardStartCertProp
Logoff	REG_SZ	SCardStopCertProp
Lock	REG_SZ	SCardSuspendCertProp
Unlock	REG_SZ	SCardResumeCertProp
Enabled	REG_DWORD	0x1
Impersonate	REG_DWORD	0x1
Asynchronous	REG_DWORD	0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule
Asynchronous	REG_DWORD	0x0
DllName	REG_EXPAND_SZ	wlnotify.dll
Impersonate	REG_DWORD	0x0
StartShell	REG_SZ	SchedStartShell
Logoff	REG_SZ	SchedEventLogOff

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy
Logoff	REG_SZ	WLEventLogoff
Impersonate	REG_DWORD	0x0
Asynchronous	REG_DWORD	0x1
DllName	REG_EXPAND_SZ	sclgntfy.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn
DLLName	REG_SZ	WlNotify.dll
Lock	REG_SZ	SensLockEvent
Logon	REG_SZ	SensLogonEvent
Logoff	REG_SZ	SensLogoffEvent
Safe	REG_DWORD	0x1
MaxWait	REG_DWORD	0x258
StartScreenSaver	REG_SZ	SensStartScreenSaverEvent
StopScreenSaver	REG_SZ	SensStopScreenSaverEvent
Startup	REG_SZ	SensStartupEvent
Shutdown	REG_SZ	SensShutdownEvent
StartShell	REG_SZ	SensStartShellEvent
PostShell	REG_SZ	SensPostShellEvent
Disconnect	REG_SZ	SensDisconnectEvent
Reconnect	REG_SZ	SensReconnectEvent
Unlock	REG_SZ	SensUnlockEvent
Impersonate	REG_DWORD	0x1
Asynchronous	REG_DWORD	0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv
Asynchronous	REG_DWORD	0x0
DllName	REG_EXPAND_SZ	wlnotify.dll
Impersonate	REG_DWORD	0x0
Logoff	REG_SZ	TSEventLogoff
Logon	REG_SZ	TSEventLogon
PostShell	REG_SZ	TSEventPostShell
Shutdown	REG_SZ	TSEventShutdown
StartShell	REG_SZ	TSEventStartShell
Startup	REG_SZ	TSEventStartup
MaxWait	REG_DWORD	0x258
Reconnect	REG_SZ	TSEventReconnect
Disconnect	REG_SZ	TSEventDisconnect

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon
DLLName	REG_SZ	wlnotify.dll
Logon	REG_SZ	RegisterTicketExpiredNotificationEvent
Logoff	REG_SZ	UnregisterTicketExpiredNotificationEvent
Impersonate	REG_DWORD	0x1
Asynchronous	REG_DWORD	0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SCLogon

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
HelpAssistant	REG_DWORD	0x0
TsInternetUser	REG_DWORD	0x0
SQLAgentCmdExec	REG_DWORD	0x0
NetShowServices	REG_DWORD	0x0
IWAM_	REG_DWORD	0x10000
IUSR_	REG_DWORD	0x10000
VUSR_	REG_DWORD	0x10000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Credentials

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Spooler
DependOnService	REG_MULTI_SZ	RPCSS\0\0
Description	REG_SZ	Loads files to memory for later printing.
DisplayName	REG_SZ	Print Spooler
ErrorControl	REG_DWORD	0x1
FailureActions	REG_BINARY	80510100000000000000000003000000E8470C000100000060EA00000100000060EA00000000000000000000
Group	REG_SZ	SpoolerGroup
ImagePath	REG_EXPAND_SZ	%SystemRoot%\system32\spoolsv.exe
ObjectName	REG_SZ	LocalSystem
Start	REG_DWORD	0x2
Type	REG_DWORD	0x110
DependOnGroup	REG_MULTI_SZ	\0

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Spooler\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Spooler\Performance
Close	REG_SZ	PerfClose
Collect	REG_SZ	PerfCollect
Collect Timeout	REG_DWORD	0x7d0
Library	REG_SZ	winspool.drv
Object List	REG_SZ	1450
Open	REG_SZ	PerfOpen
Open Timeout	REG_DWORD	0xfa0
WbemAdapFileSignature	REG_BINARY	F0C30C1B41B0FA5D4F24BC9D31CF0560
WbemAdapFileTime	REG_BINARY	0092C730064FC401
WbemAdapFileSize	REG_DWORD	0x23600
WbemAdapStatus	REG_DWORD	0x0

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Spooler\Security
Security	REG_BINARY	01001480900000009C000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200600004000000000014008D01020001010000000000050B000000000018009D0102000102000000000005200000002302000000001800FF010F000102000000000005200000002002000000001400FD010200010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Spooler\Enum
0	REG_SZ	Root\LEGACY_SPOOLER\0000
Count	REG_DWORD	0x1
NextInstance	REG_DWORD	0x1

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Spooler
DependOnService	REG_MULTI_SZ	RPCSS\0\0
Description	REG_SZ	Loads files to memory for later printing.
DisplayName	REG_SZ	Print Spooler
ErrorControl	REG_DWORD	0x1
FailureActions	REG_BINARY	80510100000000000000000003000000E8470C000100000060EA00000100000060EA00000000000000000000
Group	REG_SZ	SpoolerGroup
ImagePath	REG_EXPAND_SZ	%SystemRoot%\system32\spoolsv.exe
ObjectName	REG_SZ	LocalSystem
Start	REG_DWORD	0x2
Type	REG_DWORD	0x110
DependOnGroup	REG_MULTI_SZ	\0

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Spooler\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Spooler\Performance
Close	REG_SZ	PerfClose
Collect	REG_SZ	PerfCollect
Collect Timeout	REG_DWORD	0x7d0
Library	REG_SZ	winspool.drv
Object List	REG_SZ	1450
Open	REG_SZ	PerfOpen
Open Timeout	REG_DWORD	0xfa0
WbemAdapFileSignature	REG_BINARY	F0C30C1B41B0FA5D4F24BC9D31CF0560
WbemAdapFileTime	REG_BINARY	0092C730064FC401
WbemAdapFileSize	REG_DWORD	0x23600
WbemAdapStatus	REG_DWORD	0x0

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Spooler\Security
Security	REG_BINARY	01001480900000009C000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200600004000000000014008D01020001010000000000050B000000000018009D0102000102000000000005200000002302000000001800FF010F000102000000000005200000002002000000001400FD010200010100000000000512000000010100000000000512000000010100000000000512000000

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler
DependOnService	REG_MULTI_SZ	RPCSS\0\0
Description	REG_SZ	Loads files to memory for later printing.
DisplayName	REG_SZ	Print Spooler
ErrorControl	REG_DWORD	0x1
FailureActions	REG_BINARY	80510100000000000000000003000000E8470C000100000060EA00000100000060EA00000000000000000000
Group	REG_SZ	SpoolerGroup
ImagePath	REG_EXPAND_SZ	%SystemRoot%\system32\spoolsv.exe
ObjectName	REG_SZ	LocalSystem
Start	REG_DWORD	0x2
Type	REG_DWORD	0x110
DependOnGroup	REG_MULTI_SZ	\0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler\Performance
Close	REG_SZ	PerfClose
Collect	REG_SZ	PerfCollect
Collect Timeout	REG_DWORD	0x7d0
Library	REG_SZ	winspool.drv
Object List	REG_SZ	1450
Open	REG_SZ	PerfOpen
Open Timeout	REG_DWORD	0xfa0
WbemAdapFileSignature	REG_BINARY	F0C30C1B41B0FA5D4F24BC9D31CF0560
WbemAdapFileTime	REG_BINARY	0092C730064FC401
WbemAdapFileSize	REG_DWORD	0x23600
WbemAdapStatus	REG_DWORD	0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler\Security
Security	REG_BINARY	01001480900000009C000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200600004000000000014008D01020001010000000000050B000000000018009D0102000102000000000005200000002302000000001800FF010F000102000000000005200000002002000000001400FD010200010100000000000512000000010100000000000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler\Enum
0	REG_SZ	Root\LEGACY_SPOOLER\0000
Count	REG_DWORD	0x1
NextInstance	REG_DWORD	0x1


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

I see nothing wrong on that log. It could be due to a corrupted driver.


Remove the connection between the Printer and the computer.
Go to The Add/Remove Programs in the control Panel, and delete all programs related to printers
Go to the Modems option in the control Panel and delete all Modems present. Click File, Server Properties. Select the Drivers tab Remove all entries.
Restart the computer.

With the computer Off, reconnect the printer, turn it On and start the computer. When the Wizard detects the printer, cancel the installation. Insert the Printer's software and install.

Keep me posted.


----------



## dragnstyl33 (Nov 18, 2006)

error message. There was a problem installing your new hardware.

The remote procedure call is not active.

but when I check it the computer says that it is running.

also, Control intl.cpl in the "run" command box does not do anything on my computer


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

Please download FileFind from Atribune.
Unzip the file and save it to your desktop.

To run *FileFind*, please do the following:
Click on *FileFind.exe*
In the box labeled "*Directory*"
Enter: *C:\*

In the box labeled "*File*"
Enter: *intl.cpl *

Now click on the "*Search*" button
Once the utility has found the files click on "*Export*"
A Notepad will open up. Please copy the entire contents of the Notepad and paste them here.
NOTE: The notepad is saved on your *C:\ *drive as "*Export.txt*"
Download the enclosed file. Save and extract its contents to the desktop. It is a folder containing a batchfile, *Collect.bat *. Once extracted, open the folder and double click on the *Collect.bat *file. Post the log it creates


----------



## dragnstyl33 (Nov 18, 2006)

C:\WINDOWS\system32\intl.cpl - 129536 Bytes
C:\WINDOWS\system32\dllcache\intl.cpl - 129536 Bytes


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

Copy and paste the following on the Run command line and click OK:

C:\WINDOWS\system32\intl.cpl

Let me see the results of the *Collect.bat *file.


----------



## dragnstyl33 (Nov 18, 2006)

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RpcLocator
Type	REG_DWORD	0x10
Start	REG_DWORD	0x2
ErrorControl	REG_DWORD	0x1
ImagePath	REG_EXPAND_SZ	%SystemRoot%\system32\locator.exe
DisplayName	REG_SZ	Remote Procedure Call (RPC) Locator
DependOnService	REG_MULTI_SZ	LanmanWorkstation\0\0
DependOnGroup	REG_MULTI_SZ	\0
ObjectName	REG_SZ	NT AUTHORITY\NetworkService
Description	REG_SZ	Manages the RPC name service database.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RpcLocator\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RpcLocator\Security

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RpcLocator\Enum

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RpcSs
Description	REG_SZ	Provides the endpoint mapper and other miscellaneous RPC services.
DisplayName	REG_SZ	Remote Procedure Call (RPC)
ErrorControl	REG_DWORD	0x1
Group	REG_SZ	COM Infrastructure
ImagePath	REG_EXPAND_SZ	%SystemRoot%\system32\svchost -k rpcss
ObjectName	REG_SZ	NT AUTHORITY\NetworkService
Start	REG_DWORD	0x2
Type	REG_DWORD	0x20
FailureActions	REG_BINARY	00000000000000000000000001000000000000000200000060EA0000

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RpcSs\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RpcSs\Security

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RpcSs\Enum

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lanmanworkstation
Type	REG_DWORD	0x20
Start	REG_DWORD	0x2
ErrorControl	REG_DWORD	0x1
ImagePath	REG_EXPAND_SZ	%SystemRoot%\system32\svchost.exe -k netsvcs
DisplayName	REG_SZ	Workstation
Group	REG_SZ	NetworkProvider
ObjectName	REG_SZ	LocalSystem
Description	REG_SZ	Creates and maintains client network connections to remote servers. If this service is stopped, these connections will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lanmanworkstation\Linkage

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lanmanworkstation\NetworkProvider

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lanmanworkstation\parameters

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lanmanworkstation\Security

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lanmanworkstation\Enum

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\RpcLocator
Type	REG_DWORD	0x10
Start	REG_DWORD	0x2
ErrorControl	REG_DWORD	0x1
ImagePath	REG_EXPAND_SZ	%SystemRoot%\system32\locator.exe
DisplayName	REG_SZ	Remote Procedure Call (RPC) Locator
DependOnService	REG_MULTI_SZ	LanmanWorkstation\0\0
DependOnGroup	REG_MULTI_SZ	\0
ObjectName	REG_SZ	NT AUTHORITY\NetworkService
Description	REG_SZ	Manages the RPC name service database.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\RpcLocator\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\RpcLocator\Security

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\RpcSs
Description	REG_SZ	Provides the endpoint mapper and other miscellaneous RPC services.
DisplayName	REG_SZ	Remote Procedure Call (RPC)
ErrorControl	REG_DWORD	0x1
Group	REG_SZ	COM Infrastructure
ImagePath	REG_EXPAND_SZ	%SystemRoot%\system32\svchost -k rpcss
ObjectName	REG_SZ	NT AUTHORITY\NetworkService
Start	REG_DWORD	0x2
Type	REG_DWORD	0x20
FailureActions	REG_BINARY	00000000000000000000000001000000000000000200000060EA0000

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\RpcSs\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\RpcSs\Security

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\lanmanworkstation
Type	REG_DWORD	0x20
Start	REG_DWORD	0x2
ErrorControl	REG_DWORD	0x1
ImagePath	REG_EXPAND_SZ	%SystemRoot%\system32\svchost.exe -k netsvcs
DisplayName	REG_SZ	Workstation
Group	REG_SZ	NetworkProvider
ObjectName	REG_SZ	LocalSystem
Description	REG_SZ	Creates and maintains client network connections to remote servers. If this service is stopped, these connections will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\lanmanworkstation\Linkage

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\lanmanworkstation\NetworkProvider

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\lanmanworkstation\parameters

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\lanmanworkstation\Security

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcLocator
Type	REG_DWORD	0x10
Start	REG_DWORD	0x2
ErrorControl	REG_DWORD	0x1
ImagePath	REG_EXPAND_SZ	%SystemRoot%\system32\locator.exe
DisplayName	REG_SZ	Remote Procedure Call (RPC) Locator
DependOnService	REG_MULTI_SZ	LanmanWorkstation\0\0
DependOnGroup	REG_MULTI_SZ	\0
ObjectName	REG_SZ	NT AUTHORITY\NetworkService
Description	REG_SZ	Manages the RPC name service database.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcLocator\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcLocator\Security

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcLocator\Enum

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs
Description	REG_SZ	Provides the endpoint mapper and other miscellaneous RPC services.
DisplayName	REG_SZ	Remote Procedure Call (RPC)
ErrorControl	REG_DWORD	0x1
Group	REG_SZ	COM Infrastructure
ImagePath	REG_EXPAND_SZ	%SystemRoot%\system32\svchost -k rpcss
ObjectName	REG_SZ	NT AUTHORITY\NetworkService
Start	REG_DWORD	0x2
Type	REG_DWORD	0x20
FailureActions	REG_BINARY	00000000000000000000000001000000000000000200000060EA0000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\Security

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\Enum

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation
Type	REG_DWORD	0x20
Start	REG_DWORD	0x2
ErrorControl	REG_DWORD	0x1
ImagePath	REG_EXPAND_SZ	%SystemRoot%\system32\svchost.exe -k netsvcs
DisplayName	REG_SZ	Workstation
Group	REG_SZ	NetworkProvider
ObjectName	REG_SZ	LocalSystem
Description	REG_SZ	Creates and maintains client network connections to remote servers. If this service is stopped, these connections will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\Linkage

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\NetworkProvider

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\Security

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\Enum


this is what was copied to the Run command line, C:\WINDOWS\system32\intl.cpl , Nothing happened


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

Those entries are correct. Lets find out if corresponding files are present:

Click on *FileFind.exe*
In the box labeled "*Directory*"
Enter: *C:\*

In the box labeled "*File*"
Enter: *locator.exe*

Now click on the "*Search*" button
Once the utility has found the files click on "*Export*"
A Notepad will open up. Please copy the entire contents of the Notepad and paste them here.
NOTE: The notepad is saved on your *C:\ *drive as "*Export.txt*"

Perform the same actions with *Spoolsv.exe*

In regard to *intl.cpl *, copy and paste the following on the Run command line (Do not type)

*Control C:\WINDOWS\system32\dllcache\intl.cpl *

Let me know the results.


----------



## dragnstyl33 (Nov 18, 2006)

C:\WINDOWS\system32\locator.exe - 75264 Bytes
C:\WINDOWS\system32\dllcache\locator.exe - 75264 Bytes

C:\WINDOWS\system32\spoolsv.exe - 56832 Bytes
C:\WINDOWS\system32\dllcache\spoolsv.exe - 56832 Bytes

Control C:\WINDOWS\system32\dllcache\intl.cpl ---- did not produce a result


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

Lets remove the printer's Drivers. This time we will go a little deeper. First I need some information from your registry.

Download the enclosed file. Save and extract its contents to the desktop. It is a folder containing a batchfile, *Collect_2.bat *. Once extracted, open the folder and double click on the *Collect_2.bat *file. Post the log it creates


----------



## dragnstyl33 (Nov 18, 2006)

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows NT x86\Drivers

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows NT x86\Drivers\Version-3
Directory	REG_SZ	3
MajorVersion	REG_DWORD	0x3
MinorVersion	REG_DWORD	0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows NT x86\Drivers\Version-3\CAPTURE FAX BVRP
Configuration File	REG_SZ	UNIDRVUI.DLL
Data File	REG_SZ	BVRPWF2000.GPD
Driver	REG_SZ	UNIDRV.DLL
Help File	REG_SZ	UNIDRV.HLP
Monitor	REG_SZ	
Datatype	REG_SZ	RAW
Dependent Files	REG_MULTI_SZ	BVRPWF2000.DLL\0UNIRES.DLL\0STDNAMES.GPD\0\0
Previous Names	REG_MULTI_SZ	\0?
Version	REG_DWORD	0x3
TempDir	REG_DWORD	0x0
Attributes	REG_DWORD	0x2
Manufacturer	REG_SZ	
OEM URL	REG_SZ	
HardwareID	REG_SZ	
Provider	REG_SZ	
DriverDate	REG_BINARY	0000000000000000
DriverVersion	REG_BINARY	0000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows NT x86\Drivers\Version-3\Lexmark 1020 Color Jetprinter
Configuration File	REG_SZ	UNIDRVUI.DLL
Data File	REG_SZ	LX1020CJ.GPD
Driver	REG_SZ	UNIDRV.DLL
Help File	REG_SZ	UNIDRV.HLP
Monitor	REG_SZ	
Datatype	REG_SZ	
Dependent Files	REG_MULTI_SZ	UNIRES.DLL\0LMIKJRES.DLL\0STDNAMES.GPD\0\0
Previous Names	REG_MULTI_SZ	\0?
Version	REG_DWORD	0x3
TempDir	REG_DWORD	0x0
Attributes	REG_DWORD	0x2
Manufacturer	REG_SZ	Lexmark
OEM URL	REG_SZ	http://go.microsoft.com/fwlink/?LinkID=40&prd=10798&sbp=Printers
HardwareID	REG_SZ	lexmark_____________db48
Provider	REG_SZ	Microsoft Windows XP
DriverDate	REG_BINARY	008062C5C001C101
DriverVersion	REG_BINARY	6508280A01000500

! REG.EXE VERSION 3.0

HKEY_CLASSES_ROOT\.cpl
<NO NAME>	REG_SZ	cplfile
Generic	REG_SZ	system
ZAMailSafeExt	REG_SZ	zl7

HKEY_CLASSES_ROOT\.cpl\PersistentHandler
<NO NAME>	REG_SZ	{098f2470-bae0-11cd-b579-08002b30bfeb}

! REG.EXE VERSION 3.0

HKEY_CLASSES_ROOT\cplfile
<NO NAME>	REG_SZ	Control Panel extension

HKEY_CLASSES_ROOT\cplfile\shell

HKEY_CLASSES_ROOT\cplfile\shell\cplopen
<NO NAME>	REG_SZ	Open with Control Panel

HKEY_CLASSES_ROOT\cplfile\shell\cplopen\command
<NO NAME>	REG_SZ	rundll32.exe shell32.dll,Control_RunDLL "%1",%*

HKEY_CLASSES_ROOT\cplfile\shell\runas

HKEY_CLASSES_ROOT\cplfile\shell\runas\command
<NO NAME>	REG_SZ	rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

*Zone Alarm* is blocking .cpl files from running, by renaming its extension. I wonder if that is also the case with your printer.

Please reboot the computer in Safe mode, and throughout the Add/Remove programs option in the Control Panel, remove Zone Alarm.

Restart the computer and attempt to reinstall your printer and run *Control intl.cpl*.

Keep me posted.


----------



## dragnstyl33 (Nov 18, 2006)

removed ZoneAlarm in safe mode and restarted computer. Printer still no luck, cpl. still nothing too.


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

Please create a Restore point:


Click *Start*, point to *All Programs*, point to *Accessories*, point to *System Tools*, and then click *System Restore*.
In the System Restore dialog box, click *Create a restore point*, and then click *Next*. 
Type a description for your restore point, such as "Before Modification", then click *Create*.

I am enclosing two files. One is a registry file, *Regfix.reg*, and the other a batch file to obtain more information from your registry, *Collect_3.bat*.

Upon extracting these files, doubleclick on the *regfix.reg *file and select Yes when prompted to merge into the registry. *Restart the computer*.

Now, check your control Panel for the Regional icon and let me know if it works.

Double click on the *Collect_3.bat *file and post the log it produces.


----------



## dragnstyl33 (Nov 18, 2006)

still no regional icon when I go to control panel.

same response when trying to add printer. Operation could not be completed. The print spooler service is not running.

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\BJ Language Monitor
Driver	REG_SZ	cnbjmon.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Lexmark Network Port
Driver	REG_SZ	LEXLMPM.DLL

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Local Port
Driver	REG_SZ	localspl.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\PJL Language Monitor
Driver	REG_SZ	pjlmon.dll
EOJTimeout	REG_DWORD	0xea60

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port
Driver	REG_SZ	tcpmon.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports
StatusUpdateInterval	REG_DWORD	0xa
StatusUpdateEnabled	REG_DWORD	0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\USB Monitor
Driver	REG_SZ	usbmon.dll


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

Lets remove all printer drivers from the computer, then reinstall. Since we will need to edit the registry, create a restore point as a precaution.

Click *Start*, point to *All Programs*, point to *Accessories*, point to *System Tools*, and then click *System Restore*.
In the System Restore dialog box, click *Create a restore point*, and then click *Next*. 
Type a description for your restore point, such as "*Prior to Modification*", then click *Create*.

Download the enclosed file. Save and extract its contents to the desktop. It is a folder containing a Registry Entries file, *PrintDriver.reg * . *Do nothing with it yet. We will run this file shortly.*

Lets start removing the drivers:


Remove the connection between the Printer and the computer.
Go to The Add/Remove Programs in the control Panel, and delete all programs related to printers
Go to the Modems option in the control Panel and delete all Modems present. Click File, Server Properties. 
Select the Drivers tab Remove all entries.
Navigate to the C:\Windows\system32\spool\drivers\w32x86.
Inside the w32x86 folder, there will be folders with the names 2 and 3 (one or more of these may not be present)
Delete all of the files and sub-folders in each of the 2 and 3 folders, but not the folders themselves.
Doubleclick on the *PrintDriver.reg *file and select Yes when prompted to be merge into the registry.
Shutdown the computer.

With the computer Off, reconnect the printer, turn it On and start the computer. When the Wizard detects the printer, cancel the installation. Insert the Printer's software and install.

Keep me posted.

PD: Just in case we are dealing with a corrrupted System file, do you have the Windows XP installation CD to perform a system check?


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

This is so strange that you cannot run the intl.cpl, as all indicators are in place.

Copy and paste the following on the Run command line and click Ok:

rundll32.exe shell32.dll,Control_RunDLL intl.cpl,,0


----------



## dragnstyl33 (Nov 18, 2006)

I'm not sure what happened but when we were doing all the fixing for the virus my time just changed to 24hr time and I can't change it at all.

I go to the control panel and in the classic view I do not even see a regional settings icon.

If I switch to category view then I click the date, time, language and regional options.

then I pick task, change the format of numbers, date, and time but nothing happens.


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

I'ld like to discard the presence of a downloader trojan called Downloader.Agent.awf or Downloader.Agent.ayy. This trojan replaces legitimate files that are common on most computers with an infected file. It then moves the legitimate file to a "bak" or backup folder. Please follow the directions below to run FindAWF so we can identify the files that have been infected, if any, and the backups.

Click *here* to download FindAWF.exe and save it to your desktop.

Double-click on the FindAWF.exe file to run it.
It will open a command prompt and ask you to "Press any key to continue".
Press any key and the FindAWF tool will begin scanning your computer for the infected AWF files and the backups the trojan created.
It may take a few minutes to complete so be patient.
When it is complete, it will open a text file in notepad called AWF.txt which will automatically be saved to your desktop or whatever location you ran the file from.
Come back here to this thread and copy and paste the contents of the AWF.txt file in your next reply.

I need to know if you have the Windows XP Installation CD to perform a System Check. Also, any improvement after the last fix?


----------



## dragnstyl33 (Nov 18, 2006)

I have a windows cd but i don't have the key for it. 


Find AWF report by noahdfear ©2006


21504 byte files found
~~~~~~~~~~~~~



21504 byte files sorted with strings
~~~~~~~~~~~~~~~~~~~~~



25600 byte files found
~~~~~~~~~~~~~



25600 byte files sorted with strings
~~~~~~~~~~~~~~~~~~~~~



26450 byte files found
~~~~~~~~~~~~~



26450 byte files sorted with strings
~~~~~~~~~~~~~~~~~~~~~



bak folders found
~~~~~~~~~~~



Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~



end of report


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

We don't need the key for now, but in case you need it, download KeyFinder from *Here*. It will extract the key for you. That is always good to have in a safe place.

Go to Start -> Run, type *SFC /ScanNow* and click Ok. That will check for any missing or corrupted protected system files.

Let me know how it went. *Let me see also a fresh Hijackthis log.*


----------



## dragnstyl33 (Nov 18, 2006)

it said that the application failed to initialize properly (0xc000007b) when I copied SFC /ScanNow into run.

Logfile of HijackThis v1.99.1
Scan saved at 16:40, on 06-12-02
Platform: Windows XP SP2, v.2149 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2149)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Updater.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Common Files\AOL\1162186374\ee\AOLSoftware.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\LVComsX.exe
C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Google\Web Accelerator\googlewebaccclient.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Noom\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://localhost:9100/proxy.pac
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Web Accelerator Helper - {69A87B7D-DE56-4136-9655-716BA50C19C7} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\dllcache\tintsetp.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\dllcache\tintsetp.exe /IMEName
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [iRiver Updater] \Updater.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1162186374\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Run Google Web Accelerator.lnk = C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.adelphia.net/sdccommon/download/tgctlins.cab
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish.com/SnapfishActivia.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://www.vzwpix.com/activex/VerizonWirelessUploadControl.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {C915801D-6F00-49CD-8A9A-8DE5C11ADDC1} (Pixami Drag/Drop Upload UI Control) - http://www.photoworks.com/pixami/DragDropUploader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{952A9AC8-A5CF-4D22-99EB-FC83496CA1F2}: NameServer = 152.158.2.48
O17 - HKLM\System\CCS\Services\Tcpip\..\{FAAD30F5-4BD7-442F-94AB-A65BDC73BBF8}: NameServer = 152.158.2.48
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

Try using that command in *Safe Mode*.


----------



## dragnstyl33 (Nov 18, 2006)

used it in safe mode, still the same error message as the other post.


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 



dragnstyl33 said:


> used it in safe mode, still the same error message as the other post.


That error message in Safe Mode is an indication that there is a problem with your Windows XP installation. At this point I would reccomend a *Repair Install*. Although your personal data is not involved during the repair install, as a precaution, you should backup this data. During the Repair Install the registry will be re-created, thus applications that depend upon registry entries (Almost all) will not be functional after the Repair Install and will need to re reinstalled. Also, the installation will need to be validated and activated by microsoft in order to receive the Security Updates.

For information on how to perform a *Repair Install *click *Here*.

Keep me posted.


----------



## dragnstyl33 (Nov 18, 2006)

I just ran my windows cd and used the update function and everything is working again. I can print and I changed my time as well. The keyfinder that you sent worked great. thanks again for you help.


----------



## JSntgRvr (Jul 1, 2003)

Hi, *dragnstyl33* 

Congratulations.









The following is a list of tools and utilities that I like to suggest to people. This list is full of great tools and utilities to help you understand how you got infected and how to keep from getting infected again.
*Spybot Search & Destroy *- Uber powerful tool which can search and annhilate nasties that make it onto your system. Now with an Immunize section that will help prevent future infections.

*AdAware* - Another very powerful tool which searches and kills nasties that infect your system. AdAware and Spybot Search & Destroy compliment each other very well.

*SpywareBlaster* - Great prevention tool to keep nasties from installing on your system.

*SpywareGuard* - Works as a Spyware "Shield" to protect your computer from getting malware in the first place.

*IE-SpyAd* - puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.

*CleanUP*! - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.

Windows Updates - It is *very important* to make sure that both Internet Explorer and Windows are kept current with *the latest critical security patches* from Microsoft. To do this just start *Internet Explorer* and select *Tools > Windows Update*, and follow the online instructions from there.

*Google Toolbar* - Free google toolbar that allows you to use the powerful Google search engine from the bar, but also blocks pop up windows.

*Trillian* or *Miranda-IM* - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read *this* article by Tony Klein.

Click *Here* for some advise from our security Experts.

Glad I could be of help. :up: Best wishes!


----------



## Flrman1 (Jul 26, 2002)

Since this problem has been solved, I'm closing this thread. If you need it reopened please PM me or one of the other mods.

Anyone else with a similar problem please start a "New Thread".


----------

