Thread: Still needing help with pop ups
View Single Post
Old 08-11-2007, 10:12 PM   #1 (permalink)
danster64
Registered User
 
Join Date: Oct 2006
Posts: 43
OS: XP


Still needing help with pop ups
Greetings:
I think that I may not have gotten rid of all the pop-ups on my wife's machine after the last fix. I noticed some kind of installer on the add/remove list so I removed it, but I am still getting some pop-ups.

I ran highjack this and below is my report. I also ran combo-fix thinking that I needed to do that first. I then realized that you only need highjack this first. Sorry if I messed up!

Here is my highjack this and combo fix.

Thanks, Dan

Deckard's System Scanner v20070711.54
Run by Mom on 2007-08-11 at 22:32:56
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis Clone ------------------------------------------------------------

Emulating logfile of HijackThis v1.99.1
Scan saved at 2007-08-11 22:33:26
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (6.00.2900.2180)

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\WLTRYSVC.EXE
C:\WINDOWS\system32\BCMWLTRY.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\gearsec.exe
C:\Program Files\McAfee.com\Agent\Mcdetect.exe
C:\Program Files\McAfee.com\VSO\McShield.exe
C:\Program Files\McAfee.com\Agent\McTskshd.exe
C:\Program Files\McAfee.com\Personal Firewall\MpfService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\McAfee\SpamKiller\MSKAgent.exe
C:\Program Files\McAfee.com\Personal Firewall\MpfTray.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\McAfee.com\Personal Firewall\MpfAgent.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
C:\Program Files\ComPlus Applications\vihorug22011.exe
C:\Program Files\NetWaiting\netwaiting.exe
C:\Program Files\Xtreme Desktop\xdc\xdc.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM6\aim6.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Mom\Desktop\dss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: 0 - {316C3DC2-0EE5-4712-A690-BA0BE6D69BE4} - C:\Program Files\Common Files\zyliv.dll
O2 - BHO: McAfee Anti-Phishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - C:\Program Files\McAfee\SpamKiller\McApfBHO.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: BayScribeBHO - {5E028439-81C7-4B82-BC74-25156306F532} - C:\Program Files\BayScribe\bayscribe.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {CF46BFB3-2ACC-441b-B82B-36B9562C7FF1} - C:\WINDOWS\system32\wxvhaeif.dll
O2 - BHO: (no name) - {E959E770-16F3-4212-B0A9-328F636E93C3} - C:\WINDOWS\system32\pmkhg.dll
O2 - BHO: (no name) - {E9BD0828-1FD9-410C-A50F-43EBE65D310F} - C:\WINDOWS\system32\hgghhef.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\Program Files\McAfee.com\VSO\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar1.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Norton Ghost 10.0] "C:\Program Files\Norton Ghost\Agent\GhostTray.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [XDc] C:\Program Files\Xtreme Desktop\xdc\startxdc.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
O4 - HKLM\..\Run: [vihorug] C:\Program Files\ComPlus Applications\vihorug22011.exe
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [SystemOptimizer] rundll32.exe "C:\WINDOWS\system32\bluovwxw.dll",forkonce
O4 - HKCU\..\RunOnce: [SynUnInstall] rundll32 "C:\DOCUME~1\Mom\LOCALS~1\Temp\SynISDLL.dll",deleteDirs C:\Program Files\Synaptics\
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - C:\Program Files\McAfee\SpamKiller\McApfBHO.dll
O9 - Extra 'Tools' menuitem: McAfee Anti-Phishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - C:\Program Files\McAfee\SpamKiller\McApfBHO.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (file missing)
O9 - Extra 'Tools' menuitem: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (file missing)
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra 'Tools' menuitem: (no name) - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://online.musicmatch.com (HKLM)
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} () - https://components.viewpoint.com/MTS...oupe_load.html
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework...ex/TmHcmsX.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1182429767203
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get.../ultrashim.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {D9E4E21E-60E0-11DA-91EB-00123F33E209} (DNInstallerOCX Class) - https://mq1webc2.speechmachines.org/...Installer2.cab
O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll
O20 - Winlogon Notify: hgghhef - C:\WINDOWS\system32\hgghhef.dll
O20 - Winlogon Notify: pmkhg - C:\WINDOWS\system32\pmkhg.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - "C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe"
O23 - Service: Apple Mobile Device - Apple, Inc. - "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - C:\Program Files\McAfee.com\Agent\Mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - C:\Program Files\McAfee.com\VSO\McShield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - C:\Program Files\McAfee.com\Agent\McTskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\Program Files\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\McAfee.com\Personal Firewall\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\Program Files\McAfee\SpamKiller\MSKSrvr.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE %SystemRoot%\System32\bcmwltry.exe


-- Files created between 2007-07-11 and 2007-08-11 -----------------------------

2007-08-11 22:21:05 0 d-------- C:\WINDOWS\LastGood
2007-08-11 22:09:07 246 --a------ C:\Program Files\Common Files\zyliv
2007-08-11 22:09:07 70144 --a------ C:\Program Files\Common Files\zyliv.dll
2007-08-11 22:08:58 135168 --a------ C:\WINDOWS\tk58.exe
2007-08-11 21:41:06 246 --a------ C:\Program Files\Common Files\zyliv874
2007-08-11 21:40:12 69184 --a------ C:\WINDOWS\system32\wxvhaeif.dll
2007-08-10 11:03:08 0 --a------ C:\Documents and Settings\Mom\721876
2007-08-10 10:58:07 125504 --a------ C:\WINDOWS\system32\bluovwxw.dll
2007-08-10 10:57:57 69184 --a------ C:\WINDOWS\system32\cojydbmm.dll
2007-08-10 10:51:51 75328 --a------ C:\WINDOWS\system32\xtkfqqqe.exe <Not Verified; ; DDC>
2007-08-10 10:49:37 1685466 ---hs---- C:\WINDOWS\system32\ghkmp.bak2
2007-08-10 09:27:45 52766 --a------ C:\WINDOWS\system32\ljdsrngr.exe <Not Verified; ; Browser Driver>
2007-08-10 09:26:20 9769 --a------ C:\WINDOWS\rassb0578.exe
2007-08-10 09:23:17 6421 ---hs---- C:\WINDOWS\system32\ghkmp.bak1
2007-08-10 09:23:06 231520 --a------ C:\WINDOWS\system32\pmkhg.dll
2007-08-10 09:18:22 756352 -r-hs---- C:\WINDOWS\vjcwogxA.exe <Not Verified; System Service; System Monitor Service>
2007-08-10 09:18:18 54784 --a------ C:\WINDOWS\vjcwogx.exe
2007-08-10 09:18:14 192582 --a------ C:\WINDOWS\system32\mwinkmdt.exe
2007-08-10 09:18:13 31254 --a------ C:\WINDOWS\system32\gebaaby.dll
2007-08-10 09:18:11 0 d-------- C:\WINDOWS\system32\configs
2007-08-10 09:18:07 52747 --a------ C:\WINDOWS\system32\dwdsrngt.exe <Not Verified; ; Browser Driver>
2007-08-10 09:18:06 0 d-------- C:\WINDOWS\system32\f02WtR
2007-08-10 09:18:05 0 d-------- C:\Temp
2007-08-10 09:18:03 31254 --a------ C:\WINDOWS\system32\hgghhef.dll
2007-08-09 15:54:29 0 d-------- C:\Documents and Settings\James\Application Data\Leadertech
2007-08-09 13:42:26 1421 --a------ C:\WINDOWS\checkip.dat
2007-08-05 18:12:04 0 d-------- C:\Program Files\Microsoft Encarta
2007-08-05 18:09:29 0 d-------- C:\Program Files\Microsoft ActiveSync
2007-08-05 18:09:12 0 d-------- C:\WINDOWS\ShellNew
2007-08-05 18:05:17 0 d-------- C:\Program Files\Microsoft Works
2007-08-05 18:04:09 0 d-------- C:\Program Files\Microsoft Works Suite 2002
2007-07-29 18:49:36 0 d-------- C:\Documents and Settings\James\Application Data\CyberLink
2007-07-28 22:40:24 0 d-------- C:\Documents and Settings\James\Application Data\AdobeUM
2007-07-28 22:40:16 0 d-------- C:\Documents and Settings\James\Application Data\Adobe
2007-07-27 17:57:07 0 d-------- C:\Documents and Settings\James\Application Data\Apple Computer
2007-07-25 21:23:54 41984 --a------ C:\WINDOWS\system32\xd2.dll
2007-07-25 21:23:54 0 d-------- C:\Program Files\Xtreme Desktop
2007-07-25 21:23:39 0 d--hs---- C:\WINDOWS\ftpcache
2007-07-23 18:42:18 0 d-------- C:\Documents and Settings\Mom\Application Data\acccore
2007-07-21 11:37:16 0 d---s---- C:\Documents and Settings\James\UserData
2007-07-18 21:58:26 0 d-------- C:\Documents and Settings\Jill\Application Data\acccore
2007-07-18 13:04:56 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-07-18 13:04:54 0 d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-07-17 12:23:36 118784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL <Not Verified; Microsoft Corporation; MSSTDFMT Object Library>
2007-07-17 12:23:35 0 d-------- C:\Program Files\SpywareBlaster
2007-07-16 23:18:35 0 d-------- C:\WINDOWS\system32\ActiveScan
2007-07-16 19:57:03 0 d-------- C:\Program Files\Lavasoft
2007-07-16 19:57:03 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-07-16 19:55:39 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-07-14 17:41:33 760 --a------ C:\WINDOWS\eReg.dat
2007-07-14 17:29:21 0 d-------- C:\Program Files\EA GAMES


-- Find3M Report ---------------------------------------------------------------

2007-08-10 0952 3766 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2007-08-10 0950 88 -r-hs---- C:\WINDOWS\system32\94F63881E8.sys
2007-08-07 18:15:12 0 d-------- C:\Documents and Settings\Mom\Application Data\BayScribe
2007-07-28 0422 135 --a------ C:\Program Files\Common Files\dirtok.html
2007-07-20 21:22:05 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-07-19 11:16:49 0 d-------- C:\Program Files\DocQscribe
2007-07-17 22:12:37 0 d-------- C:\Program Files\Windows NT
2007-07-17 11:39:31 0 d-------- C:\Program Files\Winamp
2007-07-17 11:39:17 0 d-------- C:\Program Files\SmartFTP Client
2007-07-17 11:38:40 0 d-------- C:\Program Files\NetWaiting
2007-07-17 11:38:11 0 d-------- C:\Program Files\MSN Messenger
2007-07-17 11:37:58 0 d-------- C:\Program Files\Messenger
2007-07-17 11:37:30 0 d-------- C:\Program Files\iTunes
2007-07-17 11:37:04 0 d-------- C:\Program Files\Google
2007-07-17 11:36:41 0 d-------- C:\Program Files\Digital Line Detect
2007-07-17 11:36:41 0 d-------- C:\Program Files\DellSupport
2007-07-17 11:35:55 0 d-------- C:\Program Files\Common Files\Symantec Shared
2007-07-17 11:35:19 0 d-------- C:\Program Files\BayScribe
2007-07-16 19:08:12 0 d-------- C:\Program Files\Dell
2007-07-01 17:29:58 0 d-------- C:\Program Files\iPod
2007-07-01 17:29:36 0 d-------- C:\Program Files\QuickTime
2007-07-01 17:28:55 0 d-------- C:\Program Files\Apple Software Update
2007-07-01 17:28:27 0 d-------- C:\Program Files\Common Files\Apple
2007-07-01 17:09:00 0 d-------- C:\Program Files\Windows Media Connect 2
2007-06-30 16:47:11 0 d-------- C:\Documents and Settings\Mom\Application Data\Skype
2007-06-28 16:54:26 0 d-------- C:\Program Files\Skype
2007-06-28 16:54:22 0 d-------- C:\Program Files\Common Files\Skype
2007-06-27 09:04:14 0 d-------- C:\Program Files\Online Services
2007-06-26 16:27:04 0 d-------- C:\Documents and Settings\Mom\Application Data\Corel Photo Album
2007-06-25 09:43:45 0 d-------- C:\Documents and Settings\Mom\Application Data\AdobeUM
2007-06-23 22:47:19 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-06-23 22:43:44 0 d-------- C:\Program Files\MSXML 4.0
2007-06-23 16:02:00 0 d-------- C:\Program Files\Real
2007-06-22 11:52:32 0 d-------- C:\Program Files\AIM6
2007-06-22 11:52:03 0 d-------- C:\Program Files\Common Files\AOL
2007-06-21 08:46:13 0 d-------- C:\Documents and Settings\Mom\Application Data\CyberLink
2007-06-21 08:05:28 0 d-------- C:\Program Files\Common Files\Philips Speech Shared
2007-06-21 07:45:35 0 d-------- C:\Program Files\Common Files\Adobe
2007-06-21 07:45:35 0 d-------- C:\Documents and Settings\Mom\Application Data\Adobe
2007-06-21 07:42:06 0 d-------- C:\Documents and Settings\Mom\Application Data\Macromedia
2007-06-21 07:41:53 0 d-------- C:\Documents and Settings\Mom\Application Data\GTek
2007-06-21 07:40:50 0 d-------- C:\Documents and Settings\Mom\Application Data\Google
2007-06-21 07:36:26 0 d-------- C:\Documents and Settings\Mom\Application Data\McAfee.com Personal Firewall
2007-06-20 19:09:57 0 d-------- C:\Program Files\Audacity
2007-06-20 18:53:16 0 d-------- C:\Program Files\McAfee
2007-06-20 18:53:07 0 d-------- C:\Program Files\McAfee.com
2007-06-20 18:51:36 0 d-------- C:\Program Files\Corel Corporation
2007-06-20 18:51:10 0 d-------- C:\Program Files\Corel
2007-06-20 18:51:10 0 d-------- C:\Program Files\Common Files\Corel
2007-06-20 18:50:15 0 d-------- C:\Program Files\MUSICMATCH
2007-06-20 18:49:43 0 d-------- C:\Program Files\Common Files\InstallShield
2007-06-20 18:49:03 0 d-------- C:\Program Files\Norton Ghost
2007-06-20 18:48:10 0 d-------- C:\Documents and Settings\Mom\Application Data\Symantec
2007-06-20 18:47:58 0 d-------- C:\Program Files\Symantec
2007-06-20 18:47:01 0 d-------- C:\Program Files\Common Files\Sonic Shared
2007-06-20 18:46:36 0 d-------- C:\Program Files\Sonic
2007-06-20 18:46:29 0 d-------- C:\Program Files\EarthLink Setup
2007-06-20 18:46:22 0 d-------- C:\Program Files\America Online 9.0
2007-06-20 18:46:21 0 d-------- C:\Program Files\AOL Companion
2007-06-20 18:46:18 0 d-------- C:\Program Files\Common Files\aolshare
2007-06-20 18:46:08 0 d-------- C:\Program Files\Common Files\Nullsoft
2007-06-20 18:46:04 0 d-------- C:\Program Files\Common Files\Real
2007-06-20 18:45:08 335 --a------ C:\WINDOWS\nsreg.dat
2007-06-20 18:45:04 0 d-------- C:\Program Files\Microsoft Plus! Photo Story 2 LE
2007-06-20 18:45:02 0 d-------- C:\Program Files\Microsoft Plus! Digital Media Edition
2007-06-20 18:43:00 0 d-------- C:\Program Files\CyberLink
2007-06-20 18:42:36 0 d-------- C:\Program Files\Modem Helper
2007-06-20 18:41:42 0 d-------- C:\Program Files\Broadcom
2007-06-20 18:41:19 0 d-------- C:\Program Files\Synaptics
2007-06-20 18:41:06 0 d-------- C:\Documents and Settings\Mom\Application Data\InstallShield
2007-06-20 18:39:31 0 d-------- C:\Program Files\CONEXANT
2007-06-20 18:39:25 0 d-------- C:\Program Files\Sigmatel
2007-06-20 18:36:13 0 d-------- C:\Documents and Settings\Mom\Application Data\Sun
2007-06-20 18:36:11 0 d-------- C:\Program Files\Java
2007-06-20 18:36:00 0 d-------- C:\Program Files\Common Files\Java


-- Registry Dump ---------------------------------------------------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
{316C3DC2-0EE5-4712-A690-BA0BE6D69BE4} C:\Program Files\Common Files\zyliv.dll
{41D68ED8-4CFF-4115-88A6-6EBB8AF19000} c:\program files\mcafee\spamkiller\mcapfbho.dll
{5CA3D70E-1895-11CF-8E15-001234567890} C:\WINDOWS\system32\dla\tfswshx.dll
{5E028439-81C7-4B82-BC74-25156306F532} C:\Program Files\BayScribe\bayscribe.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} c:\program files\google\googletoolbar1.dll
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
{CF46BFB3-2ACC-441b-B82B-36B9562C7FF1} C:\WINDOWS\system32\wxvhaeif.dll
{E959E770-16F3-4212-B0A9-328F636E93C3} C:\WINDOWS\system32\pmkhg.dll
{E9BD0828-1FD9-410C-A50F-43EBE65D310F} C:\WINDOWS\system32\hgghhef.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SigmatelSysTrayApp"="stsystra.exe"
"Dell QuickSet"="C:\\Program Files\\Dell\\QuickSet\\quickset.exe"
"PCMService"="\"C:\\Program Files\\Dell\\Media Experience\\PCMService.exe\""
"DVDLauncher"="\"C:\\Program Files\\CyberLink\\PowerDVD\\DVDLauncher.exe\""
"ISUSPM Startup"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\isuspm.exe\" -startup"
"ISUSScheduler"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"Norton Ghost 10.0"="\"C:\\Program Files\\Norton Ghost\\Agent\\GhostTray.exe\""
@=""
"VSOCheckTask"="\"C:\\PROGRA~1\\McAfee.com\\VSO\\mcmnhdlr.exe\" /checktask"
"OASClnt"="C:\\Program Files\\McAfee.com\\VSO\\oasclnt.exe"
"MCAgentExe"="c:\\PROGRA~1\\mcafee.com\\agent\\mcagent.exe"
"MCUpdateExe"="c:\\PROGRA~1\\mcafee.com\\agent\\mcupdate.exe"
"MSKDetectorExe"="C:\\PROGRA~1\\McAfee\\SPAMKI~1\\MSKDetct.exe /startup"
"MSKAGENTEXE"="C:\\PROGRA~1\\McAfee\\SPAMKI~1\\MskAgent.exe"
"VirusScan Online"="c:\\PROGRA~1\\mcafee.com\\vso\\mcvsshld.exe"
"MPFExe"="C:\\PROGRA~1\\McAfee.com\\PERSON~1\\MpfTray.exe"
"WinampAgent"="C:\\Program Files\\Winamp\\winampa.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"XDc"="C:\\Program Files\\Xtreme Desktop\\xdc\\startxdc.exe"
"WorksFUD"="C:\\Program Files\\Microsoft Works\\wkfud.exe"
"Microsoft Works Portfolio"="C:\\Program Files\\Microsoft Works\\WksSb.exe /AllUsers"
"Microsoft Works Update Detection"="C:\\Program Files\\Common Files\\Microsoft Shared\\Works Shared\\WkUFind.exe"
"Corel Photo Downloader"="C:\\Program Files\\Corel\\Corel Photo Album 6\\MediaDetect.exe"
"vihorug"="C:\\Program Files\\ComPlus Applications\\vihorug22011.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ModemOnHold"="C:\\Program Files\\NetWaiting\\netWaiting.exe"
"DellSupport"="\"C:\\Program Files\\DellSupport\\DSAgnt.exe\" /startup"
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"Aim6"="\"C:\\Program Files\\AIM6\\aim6.exe\" /d locale=en-US ee://aol/imApp"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"SystemOptimizer"="rundll32.exe \"C:\\WINDOWS\\system32\\bluovwxw.dll\",forkonce"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
"SynUnInstall"="rundll32 \"C:\\DOCUME~1\\Mom\\LOCALS~1\\Temp\\SynISDLL.dll\",deleteDirs C:\\Program Files\\Synaptics\\"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoCDBurning"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source REG_SZ C:\Program Files\Common Files\dirtok.html

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{E9BD0828-1FD9-410C-A50F-43EBE65D310F}"=""

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hgghhef
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmkhg

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0


[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c9951c62-3977-11dc-ba67-00038a000015}]
Shell\AutoRun\command F:\setupSNK.exe


-- End of Deckard's System Scanner: finished at 2007-08-11 at 22:35:06 ---------


"Mom" - 2007-08-11 21:52:18 - ComboFix 07-07-17.8 - Service Pack 2 NTFS


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\Common Files\dirtok.html
C:\Program Files\Common Files\zyliv.dll
C:\Program Files\Common Files\zyliv870.dll
C:\Program Files\Common Files\zyliv874.dll
C:\Program Files\inetget2
C:\Program Files\inetget2\popinstall.exe
C:\Program Files\web buying
C:\Program Files\web buying\v1.8.1\wbuninst.exe
C:\Program Files\winpop
C:\Program Files\winpop\UnInstall.exe
C:\Program Files\winpop\winpop.exe
C:\WINDOWS\b122.exe
C:\WINDOWS\dls0523pmw.exe
C:\WINDOWS\offun.exe
C:\WINDOWS\rau001978.exe
C:\WINDOWS\system32\A1
C:\WINDOWS\system32\A1\kq22011.exe
C:\WINDOWS\system32\B1
C:\WINDOWS\system32\ldcore.dll
C:\WINDOWS\system32\msnav32.ax
C:\WINDOWS\system32\win
C:\WINDOWS\system32\win\w7q.exe
C:\WINDOWS\system32\winpfz32.sys
C:\WINDOWS\system32\X2
C:\WINDOWS\system32\X2\x5.exe
C:\WINDOWS\system32\zxdnt3d.cfg
C:\WINDOWS\TISKY009.exe
C:\WINDOWS\tk58.exe
C:\WINDOWS\wbun.exe


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_DOMAINSERVICE
-------\LEGACY_NET_AGENT
-------\LEGACY_WINDOWS_OVERLAY_COMPONENTS
-------\DomainService
-------\Net Agent
-------\Windows Overlay Components


((((((((((((((((((((((((( Files Created from 2007-07-12 to 2007-08-12 )))))))))))))))))))))))))))))))


2007-08-11 21:40 69,184 --a------ C:\WINDOWS\system32\wxvhaeif.dll
2007-08-10 10:58 125,504 --a------ C:\WINDOWS\system32\bluovwxw.dll
2007-08-10 10:57 69,184 --a------ C:\WINDOWS\system32\cojydbmm.dll
2007-08-10 10:51 75,328 --a------ C:\WINDOWS\system32\xtkfqqqe.exe
2007-08-10 10:49 1,685,466 ---hs---- C:\WINDOWS\system32\ghkmp.bak2
2007-08-10 09:27 52,766 --a------ C:\WINDOWS\system32\ljdsrngr.exe
2007-08-10 09:26 9,769 --a------ C:\WINDOWS\rassb0578.exe
2007-08-10 09:23 6,421 ---hs---- C:\WINDOWS\system32\ghkmp.bak1
2007-08-10 09:23 231,520 --a------ C:\WINDOWS\system32\pmkhg.dll
2007-08-10 09:18 756,352 -r-hs---- C:\WINDOWS\vjcwogxA.exe
2007-08-10 09:18 54,784 --a------ C:\WINDOWS\vjcwogx.exe
2007-08-10 09:18 52,747 --a------ C:\WINDOWS\system32\dwdsrngt.exe
2007-08-10 09:18 31,254 --a------ C:\WINDOWS\system32\hgghhef.dll
2007-08-10 09:18 31,254 --a------ C:\WINDOWS\system32\gebaaby.dll
2007-08-10 09:18 192,582 --a------ C:\WINDOWS\system32\mwinkmdt.exe
2007-08-10 09:18 <DIR> d-------- C:\WINDOWS\system32\f02WtR
2007-08-10 09:18 <DIR> d-------- C:\WINDOWS\system32\configs
2007-08-10 09:18 <DIR> d-------- C:\Temp\fse
2007-08-10 09:18 <DIR> d-------- C:\Temp\1cb
2007-08-10 09:18 <DIR> d-------- C:\Temp
2007-08-09 15:54 <DIR> d-------- C:\DOCUME~1\James\APPLIC~1\Leadertech
2007-08-09 13:42 1,421 --a------ C:\WINDOWS\checkip.dat
2007-08-05 18:12 <DIR> d-------- C:\Program Files\Microsoft Encarta
2007-08-05 18:09 <DIR> d-------- C:\WINDOWS\ShellNew
2007-08-05 18:09 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2007-08-05 18:05 <DIR> d-------- C:\Program Files\Microsoft Works
2007-08-05 18:04 <DIR> d-------- C:\Program Files\Microsoft Works Suite 2002
2007-07-29 18:49 <DIR> d-------- C:\DOCUME~1\James\APPLIC~1\CyberLink
2007-07-28 22:40 <DIR> d-------- C:\DOCUME~1\James\APPLIC~1\AdobeUM
2007-07-27 17:57 <DIR> d-------- C:\DOCUME~1\James\APPLIC~1\Apple Computer
2007-07-25 21:23 41,984 --a------ C:\WINDOWS\system32\xd2.dll
2007-07-25 21:23 <DIR> d--hs---- C:\WINDOWS\ftpcache
2007-07-23 18:42 <DIR> d-------- C:\DOCUME~1\Mom\APPLIC~1\acccore
2007-07-21 11:37 <DIR> d---s---- C:\DOCUME~1\James\UserData
2007-07-18 21:58 <DIR> d-------- C:\DOCUME~1\Jill\APPLIC~1\acccore
2007-07-18 13:04 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-07-18 13:04 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-07-17 22:07 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-17 13:21 <DIR> d-------- C:\Deckard
2007-07-17 12:23 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2007-07-17 12:23 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-07-16 23:18 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-07-16 19:57 <DIR> d-------- C:\Program Files\Lavasoft
2007-07-16 19:57 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-07-16 19:55 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-07-14 17:41 760 --a------ C:\WINDOWS\eReg.dat
2007-07-14 17:29 <DIR> d-------- C:\Program Files\EA GAMES
2007-07-13 14:56 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2007-07-13 14:56 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-12 02:55:28 246 ----a-w C:\Program Files\Common Files\zyliv874
2007-08-12 02:49:53 -------- d-----w C:\Program Files\Soulseek
2007-08-10 1452 3,766 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-08-10 1450 88 --sh--r C:\WINDOWS\system32\94F63881E8.sys
2007-08-07 23:15:12 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\BayScribe
2007-07-21 02:22:05 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-07-19 16:16:49 -------- d-----w C:\Program Files\DocQscribe
2007-07-18 03:12:37 -------- d-----w C:\Program Files\Windows NT
2007-07-17 16:39:31 -------- d-----w C:\Program Files\Winamp
2007-07-17 16:39:17 -------- d-----w C:\Program Files\SmartFTP Client
2007-07-17 16:38:40 -------- d-----w C:\Program Files\NetWaiting
2007-07-17 16:38:11 -------- d-----w C:\Program Files\MSN Messenger
2007-07-17 16:37:58 -------- d-----w C:\Program Files\Messenger
2007-07-17 16:37:30 -------- d-----w C:\Program Files\iTunes
2007-07-17 16:37:04 -------- d-----w C:\Program Files\Google
2007-07-17 16:36:41 -------- d-----w C:\Program Files\Digital Line Detect
2007-07-17 16:36:41 -------- d-----w C:\Program Files\DellSupport
2007-07-17 16:35:55 -------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-07-17 16:35:19 -------- d-----w C:\Program Files\BayScribe
2007-07-17 12:18:40 -------- d-----w C:\Program Files\Windows Live Toolbar
2007-07-17 00:08:12 -------- d-----w C:\Program Files\Dell
2007-07-17 00:07:25 -------- d-----w C:\Program Files\Ares
2007-07-14 22:41:39 12,400 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-07-01 22:29:58 -------- d-----w C:\Program Files\iPod
2007-07-01 22:29:36 -------- d-----w C:\Program Files\QuickTime
2007-07-01 22:28:55 -------- d-----w C:\Program Files\Apple Software Update
2007-07-01 22:28:27 -------- d-----w C:\Program Files\Common Files\Apple
2007-07-01 22:09:00 -------- d-----w C:\Program Files\Windows Media Connect 2
2007-06-30 21:47:11 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\Skype
2007-06-28 21:54:26 -------- d-----w C:\Program Files\Skype
2007-06-28 21:54:22 -------- d-----w C:\Program Files\Common Files\Skype
2007-06-27 14:04:14 -------- d-----w C:\Program Files\Online Services
2007-06-26 21:27:04 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\Corel Photo Album
2007-06-25 14:43:45 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\AdobeUM
2007-06-24 03:47:19 -------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-06-24 03:43:44 -------- d-----w C:\Program Files\MSXML 4.0
2007-06-23 21:02:00 -------- d-----w C:\Program Files\Real
2007-06-22 16:52:32 -------- d-----w C:\Program Files\AIM6
2007-06-22 16:52:03 -------- d-----w C:\Program Files\Common Files\AOL
2007-06-21 13:46:13 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\CyberLink
2007-06-21 13:05:28 -------- d-----w C:\Program Files\Common Files\Philips Speech Shared
2007-06-21 12:41:53 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\GTek
2007-06-21 12:40:50 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\Google
2007-06-21 12:36:26 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\McAfee.com Personal Firewall
2007-06-21 01:58:30 -------- d-----w C:\Program Files\Power Tab Software
2007-06-21 00:09:57 -------- d-----w C:\Program Files\Audacity
2007-06-20 23:53:16 -------- d-----w C:\Program Files\McAfee
2007-06-20 23:53:07 -------- d-----w C:\Program Files\McAfee.com
2007-06-20 23:51:36 -------- d-----w C:\Program Files\Corel Corporation
2007-06-20 23:51:10 -------- d-----w C:\Program Files\Corel
2007-06-20 23:51:10 -------- d-----w C:\Program Files\Common Files\Corel
2007-06-20 23:50:15 -------- d-----w C:\Program Files\MUSICMATCH
2007-06-20 23:49:43 -------- d-----w C:\Program Files\Common Files\InstallShield
2007-06-20 23:49:04 4,608 ----a-w C:\WINDOWS\system32\drivers\symlcbrd.sys
2007-06-20 23:49:03 -------- d-----w C:\Program Files\Norton Ghost
2007-06-20 23:48:10 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\Symantec
2007-06-20 23:47:58 -------- d-----w C:\Program Files\Symantec
2007-06-20 23:47:01 -------- d-----w C:\Program Files\Common Files\Sonic Shared
2007-06-20 23:46:36 -------- d-----w C:\Program Files\Sonic
2007-06-20 23:46:29 -------- d-----w C:\Program Files\EarthLink Setup
2007-06-20 23:46:22 -------- d-----w C:\Program Files\America Online 9.0
2007-06-20 23:46:21 -------- d-----w C:\Program Files\AOL Companion
2007-06-20 23:46:20 -------- d-----w C:\Program Files\Learn2.com
2007-06-20 23:46:18 -------- d-----w C:\Program Files\Common Files\aolshare
2007-06-20 23:46:08 -------- d-----w C:\Program Files\Common Files\Nullsoft
2007-06-20 23:46:04 8,552 ----a-w C:\WINDOWS\system32\drivers\asctrm.sys
2007-06-20 23:46:04 -------- d-----w C:\Program Files\Common Files\Real
2007-06-20 23:45:08 335 ----a-w C:\WINDOWS\nsreg.dat
2007-06-20 23:45:04 -------- d-----w C:\Program Files\Microsoft Plus! Photo Story 2 LE
2007-06-20 23:45:02 -------- d-----w C:\Program Files\Microsoft Plus! Digital Media Edition
2007-06-20 23:43:49 -------- d-----w C:\Program Files\NetZeroInstallers
2007-06-20 23:43:00 -------- d-----w C:\Program Files\CyberLink
2007-06-20 23:42:36 -------- d-----w C:\Program Files\Modem Helper
2007-06-20 23:41:42 -------- d-----w C:\Program Files\Broadcom
2007-06-20 23:41:19 -------- d-----w C:\Program Files\Synaptics
2007-06-20 23:41:06 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\InstallShield
2007-06-20 23:39:31 -------- d-----w C:\Program Files\CONEXANT
2007-06-20 23:39:25 -------- d-----w C:\Program Files\Sigmatel
2007-06-20 01:47:50 6,171 ----a-w C:\WINDOWS\system32\drivers\1028_Dell_INS_I6400.mrk
2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2003-11-03 14:17 54248 --a------ C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{41D68ED8-4CFF-4115-88A6-6EBB8AF19000}]
2005-07-12 18:02 262236 --a------ c:\program files\mcafee\spamkiller\mcapfbho.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
2004-12-06 01:05 118842 --a------ C:\WINDOWS\system32\dla\tfswshx.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5E028439-81C7-4B82-BC74-25156306F532}]
2007-06-14 09:10 258048 --a------ C:\Program Files\BayScribe\bayscribe.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
2006-08-31 20:33 322368 --a------ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
2007-06-20 22:05 2403392 -ra------ c:\program files\google\googletoolbar1.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
2007-07-04 23:08 325048 --a------ C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CF46BFB3-2ACC-441b-B82B-36B9562C7FF1}]
2007-08-11 21:40 69184 --a------ C:\WINDOWS\system32\wxvhaeif.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E959E770-16F3-4212-B0A9-328F636E93C3}]
2007-08-10 09:23 231520 --a------ C:\WINDOWS\system32\pmkhg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E9BD0828-1FD9-410C-A50F-43EBE65D310F}]
2007-08-10 09:18 31254 --a------ C:\WINDOWS\system32\hgghhef.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 16:30 C:\WINDOWS\stsystra.exe]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2007-02-20 12:29]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 11:48]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 20:15]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 20:29]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 10:44]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 10:44]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-12-13 15:30]
"Norton Ghost 10.0"="C:\Program Files\Norton Ghost\Agent\GhostTray.exe" [2005-12-07 16:05]
"@"="" []
"VSOCheckTask"="C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 18:18]
"OASClnt"="C:\Program Files\McAfee.com\VSO\oasclnt.exe" [2005-08-11 22:02]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-07-01 19:22]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [2005-08-26 14:26]
"MSKDetectorExe"="C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe" [2005-07-12 19:05]
"MSKAGENTEXE"="C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe" [2005-07-12 18:06]
"VirusScan Online"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" [2005-08-10 12:49]
"MPFExe"="C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe" [2005-08-18 17:52]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2004-12-20 13:41]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-28 09:14]
"XDc"="C:\Program Files\Xtreme Desktop\xdc\startxdc.exe" [2006-10-02 23:09]
"WorksFUD"="C:\Program Files\Microsoft Works\wkfud.exe" [2001-10-05 19:34]
"Microsoft Works Portfolio"="C:\Program Files\Microsoft Works\WksSb.exe" [2001-08-23 16:52]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2001-08-16 23:41]
"Corel Photo Downloader"="C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe" [2006-02-09 17:34]
"vihorug"="C:\Program Files\ComPlus Applications\vihorug22011.exe" [2007-08-07 15:30]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ModemOnHold"="C:\Program Files\NetWaiting\netWaiting.exe" [2003-09-10 02:24]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-04 23:08]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-04-27 16:17]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"SystemOptimizer"="C:\WINDOWS\system32\bluovwxw.dll,forkonce" []

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2007-06-20 18:42:51]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]
Microsoft Works Calendar Reminders.lnk - C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2001-08-07 1854]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= C:\Program Files\Common Files\dirtok.html
FriendlyName=

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{E9BD0828-1FD9-410C-A50F-43EBE65D310F}"="C:\WINDOWS\system32\hgghhef.dll" [2007-08-10 09:18]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hgghhef]
hgghhef.dll --a------ 2007-08-10 09:18 31254 C:\WINDOWS\system32\hgghhef.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmkhg]
C:\WINDOWS\system32\pmkhg.dll --a------ 2007-08-10 09:23 231520 C:\WINDOWS\system32\pmkhg.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c9951c62-3977-11dc-ba67-00038a000015}]
AutoRun\command- F:\setupSNK.exe


Contents of the 'Scheduled Tasks' folder
2007-08-10 19:07:01 C:\WINDOWS\tasks\McAfee.com Scan for Viruses - My Computer (OSTLUND-Jarrod).job

**************************************************************************

catchme 0.3.1040 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-11 22:05:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-11 22:10:09 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-11 22:10
C:\ComboFix2.txt ... 2007-07-18 11:36
C:\ComboFix3.txt ... 2007-07-18 11:22

--- E O F ---
danster64 is offline  
Important Information
Join the #1 Tech Support Forum Today - It's Totally Free!

TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free.

Join TechSupportforum.com Today - Click Here