Hi,
here is my vundofix file, hihack this file and combo fix file.
Thank you.
VundoFix V6.5.7
Checking Java version...
Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.
Scan started at 9:31:17 PM 8/12/2007
Listing files found while scanning....
C:\windows\system32\bluovwxw.dll
C:\windows\system32\gebaaby.dll
C:\WINDOWS\system32\ghkmp.bak1
C:\WINDOWS\system32\ghkmp.bak2
C:\WINDOWS\system32\ghkmp.ini
C:\windows\system32\hchbjnxt.ini
C:\WINDOWS\system32\hgghhef.dll
C:\WINDOWS\system32\pmkhg.dll
C:\windows\system32\txnjbhch.dll
C:\WINDOWS\system32\wxvhaeif.dll
C:\windows\system32\wxwvoulb.ini
C:\windows\system32\xxyyaby.dll
Beginning removal...
Attempting to delete C:\windows\system32\bluovwxw.dll
C:\windows\system32\bluovwxw.dll Has been deleted!
Attempting to delete C:\windows\system32\gebaaby.dll
C:\windows\system32\gebaaby.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\ghkmp.bak1
C:\WINDOWS\system32\ghkmp.bak1 Has been deleted!
Attempting to delete C:\WINDOWS\system32\ghkmp.bak2
C:\WINDOWS\system32\ghkmp.bak2 Has been deleted!
Attempting to delete C:\WINDOWS\system32\ghkmp.ini
C:\WINDOWS\system32\ghkmp.ini Has been deleted!
Attempting to delete C:\windows\system32\hchbjnxt.ini
C:\windows\system32\hchbjnxt.ini Has been deleted!
Attempting to delete C:\WINDOWS\system32\hgghhef.dll
C:\WINDOWS\system32\hgghhef.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\pmkhg.dll
C:\WINDOWS\system32\pmkhg.dll Has been deleted!
Attempting to delete C:\windows\system32\txnjbhch.dll
C:\windows\system32\txnjbhch.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\wxvhaeif.dll
C:\WINDOWS\system32\wxvhaeif.dll Has been deleted!
Attempting to delete C:\windows\system32\wxwvoulb.ini
C:\windows\system32\wxwvoulb.ini Has been deleted!
Attempting to delete C:\windows\system32\xxyyaby.dll
C:\windows\system32\xxyyaby.dll Has been deleted!
Performing Repairs to the registry.
Done!
VundoFix V6.5.7
Checking Java version...
Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.
Scan started at 9:43:59 PM 8/12/2007
Listing files found while scanning....
C:\windows\system32\hgghhef.dll
Beginning removal...
Attempting to delete C:\windows\system32\hgghhef.dll
C:\windows\system32\hgghhef.dll Has been deleted!
Performing Repairs to the registry.
Done!
Deckard's System Scanner v20070711.54
Run by Mom on 2007-08-12 at 21:55:06
Computer is in Normal Mode.
--------------------------------------------------------------------------------
-- HijackThis Clone ------------------------------------------------------------
Emulating logfile of HijackThis v1.99.1
Scan saved at 2007-08-12 21:55:36
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (6.00.2900.2180)
Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\WLTRYSVC.EXE
C:\WINDOWS\system32\BCMWLTRY.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\SmFycm9k\command.exe
C:\WINDOWS\system32\cmivcwsv.exe
C:\WINDOWS\system32\gearsec.exe
C:\Program Files\McAfee.com\Agent\Mcdetect.exe
C:\Program Files\McAfee.com\VSO\McShield.exe
C:\Program Files\McAfee.com\Agent\McTskshd.exe
C:\WINDOWS\explorer.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\Program Files\McAfee.com\Personal Firewall\MpfService.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Network Monitor\netmon.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\McAfee\SpamKiller\MSKAgent.exe
C:\Program Files\McAfee.com\Personal Firewall\MpfTray.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
C:\Program Files\ComPlus Applications\vihorug22011.exe
C:\WINDOWS\svhost.exe
C:\WINDOWS\retadpu77.exe
C:\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe
C:\Program Files\NetWaiting\netwaiting.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Common Files\W?nSxS\alg.exe
C:\Documents and Settings\Mom\Application Data\WinTouch\WinTouch.exe
C:\Documents and Settings\Mom\Application Data\Microsoft\Windows\sunvj.exe
C:\Program Files\Common Files\ukqw\ukqwm.exe
C:\Program Files\Xtreme Desktop\xdc\xdc.exe
C:\Program Files\McAfee.com\Personal Firewall\MpfAgent.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\Common Files\ukqw\ukqwa.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\WINDOWS\system32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Mom\Desktop\dss.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
http://www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
http://www.google.com/search?q=%s
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL =
http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
http://www.google.com/ie
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: McAfee Anti-Phishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - C:\Program Files\McAfee\SpamKiller\McApfBHO.dll
O2 - BHO: 0 - {4EE12DE6-FBEF-469F-65AC-24F3CF35EDE5} - C:\Program Files\Common Files\zyliv944.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: BayScribeBHO - {5E028439-81C7-4B82-BC74-25156306F532} - C:\Program Files\BayScribe\bayscribe.dll
O2 - BHO: (no name) - {770D2125-C293-4531-AA78-53BFEEEB49BF} - C:\WINDOWS\system32\pmkhg.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\Program Files\McAfee.com\VSO\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar1.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Norton Ghost 10.0] "C:\Program Files\Norton Ghost\Agent\GhostTray.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [XDc] C:\Program Files\Xtreme Desktop\xdc\startxdc.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
O4 - HKLM\..\Run: [vihorug] C:\Program Files\ComPlus Applications\vihorug22011.exe
O4 - HKLM\..\Run: [svhost] "C:\WINDOWS\svhost.exe"
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu77.exe 61A847B5BBF72815358B2B27128065E9C084320161C4661227A755E9C2933154389A
O4 - HKLM\..\Run: [Salestart] "C:\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe"
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Sen] "C:\PROGRA~1\COMMON~1\WNSXS~1\alg.exe" -vt yazb
O4 - HKCU\..\Run: [WinTouch] C:\Documents and Settings\Mom\Application Data\WinTouch\WinTouch.exe
O4 - HKCU\..\Run: [SfKg6w] C:\Documents and Settings\Mom\Application Data\Microsoft\Windows\sunvj.exe
O4 - HKCU\..\Run: [ukqw] C:\PROGRA~1\COMMON~1\ukqw\ukqwm.exe
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O8 - Extra context menu item: Add to Windows &Live Favorites -
http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - C:\Program Files\McAfee\SpamKiller\McApfBHO.dll
O9 - Extra 'Tools' menuitem: McAfee Anti-Phishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - C:\Program Files\McAfee\SpamKiller\McApfBHO.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (file missing)
O9 - Extra 'Tools' menuitem: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (file missing)
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} -
http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra 'Tools' menuitem: (no name) - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} -
http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone:
https://online.musicmatch.com (HKLM)
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} () -
https://components.viewpoint.com/MTS...oupe_load.html
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) -
http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) -
http://www.trendsecure.com/framework...ex/TmHcmsX.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://update.microsoft.com/windowsu...?1182429767203
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () -
http://fpdownload.macromedia.com/get.../ultrashim.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -
http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {D9E4E21E-60E0-11DA-91EB-00123F33E209} (DNInstallerOCX Class) -
https://mq1webc2.speechmachines.org/...Installer2.cab
O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - "C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe"
O23 - Service: Apple Mobile Device - Apple, Inc. - "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\SmFycm9k\command.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\cmivcwsv.exe /service
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - C:\Program Files\McAfee.com\Agent\Mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - C:\Program Files\McAfee.com\VSO\McShield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - C:\Program Files\McAfee.com\Agent\McTskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\Program Files\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\McAfee.com\Personal Firewall\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\Program Files\McAfee\SpamKiller\MSKSrvr.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe service
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE %SystemRoot%\System32\bcmwltry.exe
-- Files created between 2007-07-12 and 2007-08-12 -----------------------------
2007-08-12 21:48:49 246 --a------ C:\Program Files\Common Files\zyliv944
2007-08-12 21:48:27 70144 --a------ C:\Program Files\Common Files\zyliv944.dll
2007-08-12 21:31:17 0 d-------- C:\VundoFix Backups
2007-08-12 21
48 0 d-------- C:\WINDOWS\ukqw
2007-08-12 21
48 127578 --a------ C:\WINDOWS\system32\tsuninst.exe
2007-08-12 21
48 0 d-------- C:\Program Files\Common Files\ukqw
2007-08-12 21
41 70144 --a------ C:\Program Files\Common Files\zyliv782.dll
2007-08-12 15:04:54 70144 --a------ C:\Program Files\Common Files\zyliv173.dll
2007-08-12 15:04:46 0 d-------- C:\Documents and Settings\Mom\Application Data\WinTouch
2007-08-12 14:52:54 0 d-------- C:\Documents and Settings\LocalService\Application Data\NetMon
2007-08-12 14:46:54 0 d-------- C:\Documents and Settings\NetworkService\Application Data\Google
2007-08-12 14:46:53 0 d-------- C:\Documents and Settings\NetworkService\Application Data\BayScribe
2007-08-12 14:46:52 0 dr------- C:\Documents and Settings\NetworkService\Favorites
2007-08-12 14:18:02 687592 --a------ C:\WINDOWS\system32\atmtd.dll
2007-08-12 14:17:56 0 d-------- C:\Documents and Settings\NetworkService\Application Data\NetMon
2007-08-12 14:17:51 32177 ---hs---- C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe
2007-08-12 14:17:50 1989 --a------ C:\WINDOWS\uninstall_nmon.vbs
2007-08-12 14:17:50 0 d--hs---- C:\WINDOWS\SmFycm9k
2007-08-12 14:17:50 0 d-------- C:\Program Files\Network Monitor
2007-08-12 14:17:48 0 d-------- C:\Program Files\Common Files\W?nSxS
2007-08-12 14:17:07 0 d-------- C:\Documents and Settings\Mom\Application Data\WinAntiSpyware 2007
2007-08-12 14:16:54 0 dr------- C:\Documents and Settings\All Users\Application Data\SalesMonitor
2007-08-12 14:16:51 79872 --a------ C:\WINDOWS\system32\drivers\FOPN.sys <Not Verified; Windows (R) Codename Longhorn DDK provider; Windows (R) Codename Longhorn DDK driver>
2007-08-12 14:16:40 0 d-------- C:\Program Files\Common Files\WinAntiSpyware 2007
2007-08-12 14:16:38 0 d-------- C:\Documents and Settings\All Users\Application Data\WinAntiSpyware 2007
2007-08-12 14:14:44 0 d-------- C:\WINDOWS\system32\f10WtR
2007-08-12 14:14:30 39424 --a------ C:\WINDOWS\retadpu77.exe
2007-08-12 14:14:29 0 d-------- C:\Program Files\svhost
2007-08-12 14:14:17 37888 --a------ C:\WINDOWS\svhost.exe <Not Verified; ; svhost>
2007-08-12 14:00:37 75328 --a------ C:\WINDOWS\system32\cmivcwsv.exe <Not Verified; ; DDC>
2007-08-12 14:00:11 70144 --a------ C:\Program Files\Common Files\zyliv496.dll
2007-08-11 22:09:07 70144 --a------ C:\Program Files\Common Files\zyliv.dll
2007-08-11 22:08:58 135168 --a------ C:\WINDOWS\tk58.exe
2007-08-11 21:41:06 246 --a------ C:\Program Files\Common Files\zyliv874
2007-08-10 11:03:08 0 --a------ C:\Documents and Settings\Mom\721876
2007-08-10 10:57:57 69184 --a------ C:\WINDOWS\system32\cojydbmm.dll
2007-08-10 10:51:51 75328 --a------ C:\WINDOWS\system32\xtkfqqqe.exe <Not Verified; ; DDC>
2007-08-10 09:27:45 52766 --a------ C:\WINDOWS\system32\ljdsrngr.exe <Not Verified; ; Browser Driver>
2007-08-10 09:26:20 9769 --a------ C:\WINDOWS\rassb0578.exe
2007-08-10 09:18:22 756352 -r-hs---- C:\WINDOWS\vjcwogxA.exe <Not Verified; System Service; System Monitor Service>
2007-08-10 09:18:18 54784 --a------ C:\WINDOWS\vjcwogx.exe
2007-08-10 09:18:14 192582 --a------ C:\WINDOWS\system32\mwinkmdt.exe
2007-08-10 09:18:11 0 d-------- C:\WINDOWS\system32\configs
2007-08-10 09:18:07 52747 --a------ C:\WINDOWS\system32\dwdsrngt.exe <Not Verified; ; Browser Driver>
2007-08-10 09:18:06 0 d-------- C:\WINDOWS\system32\f02WtR
2007-08-10 09:18:05 0 d-------- C:\Temp
2007-08-09 15:54:29 0 d-------- C:\Documents and Settings\James\Application Data\Leadertech
2007-08-09 13:42:26 1421 --a------ C:\WINDOWS\checkip.dat
2007-08-05 18:12:04 0 d-------- C:\Program Files\Microsoft Encarta
2007-08-05 18:09:29 0 d-------- C:\Program Files\Microsoft ActiveSync
2007-08-05 18:09:12 0 d-------- C:\WINDOWS\ShellNew
2007-08-05 18:05:17 0 d-------- C:\Program Files\Microsoft Works
2007-08-05 18:04:09 0 d-------- C:\Program Files\Microsoft Works Suite 2002
2007-07-29 18:49:36 0 d-------- C:\Documents and Settings\James\Application Data\CyberLink
2007-07-28 22:40:24 0 d-------- C:\Documents and Settings\James\Application Data\AdobeUM
2007-07-28 22:40:16 0 d-------- C:\Documents and Settings\James\Application Data\Adobe
2007-07-27 17:57:07 0 d-------- C:\Documents and Settings\James\Application Data\Apple Computer
2007-07-25 21:23:54 41984 --a------ C:\WINDOWS\system32\xd2.dll
2007-07-25 21:23:54 0 d-------- C:\Program Files\Xtreme Desktop
2007-07-25 21:23:39 0 d--hs---- C:\WINDOWS\ftpcache
2007-07-23 18:42:18 0 d-------- C:\Documents and Settings\Mom\Application Data\acccore
2007-07-21 11:37:16 0 d---s---- C:\Documents and Settings\James\UserData
2007-07-18 21:58:26 0 d-------- C:\Documents and Settings\Jill\Application Data\acccore
2007-07-18 13:04:56 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-07-18 13:04:54 0 d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-07-17 12:23:36 118784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL <Not Verified; Microsoft Corporation; MSSTDFMT Object Library>
2007-07-17 12:23:35 0 d-------- C:\Program Files\SpywareBlaster
2007-07-16 23:18:35 0 d-------- C:\WINDOWS\system32\ActiveScan
2007-07-16 19:57:03 0 d-------- C:\Program Files\Lavasoft
2007-07-16 19:57:03 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-07-16 19:55:39 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-07-14 17:41:33 760 --a------ C:\WINDOWS\eReg.dat
2007-07-14 17:29:21 0 d-------- C:\Program Files\EA GAMES
-- Find3M Report ---------------------------------------------------------------
2007-08-12 14:51:57 0 d-------- C:\Program Files\Dell
2007-08-12 14:48:28 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-08-12 14:17:48 0 d-------- C:\Program Files\Common Files\W?nSxS
2007-08-10 09
52 3766 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2007-08-10 09
50 88 -r-hs---- C:\WINDOWS\system32\94F63881E8.sys
2007-08-07 18:15:12 0 d-------- C:\Documents and Settings\Mom\Application Data\BayScribe
2007-07-28 04
22 135 --a------ C:\Program Files\Common Files\dirtok.html
2007-07-19 11:16:49 0 d-------- C:\Program Files\DocQscribe
2007-07-17 22:12:37 0 d-------- C:\Program Files\Windows NT
2007-07-17 11:39:31 0 d-------- C:\Program Files\Winamp
2007-07-17 11:39:17 0 d-------- C:\Program Files\SmartFTP Client
2007-07-17 11:38:40 0 d-------- C:\Program Files\NetWaiting
2007-07-17 11:38:11 0 d-------- C:\Program Files\MSN Messenger
2007-07-17 11:37:58 0 d-------- C:\Program Files\Messenger
2007-07-17 11:37:30 0 d-------- C:\Program Files\iTunes
2007-07-17 11:37:04 0 d-------- C:\Program Files\Google
2007-07-17 11:36:41 0 d-------- C:\Program Files\Digital Line Detect
2007-07-17 11:36:41 0 d-------- C:\Program Files\DellSupport
2007-07-17 11:35:55 0 d-------- C:\Program Files\Common Files\Symantec Shared
2007-07-17 11:35:19 0 d-------- C:\Program Files\BayScribe
2007-07-11 02:29:38 22016 --a------ C:\WINDOWS\b138.exe
2007-07-11 02:29:38 28160 --a------ C:\WINDOWS\b103.exe
2007-07-01 17:29:58 0 d-------- C:\Program Files\iPod
2007-07-01 17:29:36 0 d-------- C:\Program Files\QuickTime
2007-07-01 17:28:55 0 d-------- C:\Program Files\Apple Software Update
2007-07-01 17:28:27 0 d-------- C:\Program Files\Common Files\Apple
2007-07-01 17:09:00 0 d-------- C:\Program Files\Windows Media Connect 2
2007-06-30 16:47:11 0 d-------- C:\Documents and Settings\Mom\Application Data\Skype
2007-06-28 16:54:26 0 d-------- C:\Program Files\Skype
2007-06-28 16:54:22 0 d-------- C:\Program Files\Common Files\Skype
2007-06-27 09:04:14 0 d-------- C:\Program Files\Online Services
2007-06-26 16:27:04 0 d-------- C:\Documents and Settings\Mom\Application Data\Corel Photo Album
2007-06-25 09:43:45 0 d-------- C:\Documents and Settings\Mom\Application Data\AdobeUM
2007-06-23 22:47:19 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-06-23 22:43:44 0 d-------- C:\Program Files\MSXML 4.0
2007-06-23 16:02:00 0 d-------- C:\Program Files\Real
2007-06-22 11:52:32 0 d-------- C:\Program Files\AIM6
2007-06-22 11:52:03 0 d-------- C:\Program Files\Common Files\AOL
2007-06-21 08:46:13 0 d-------- C:\Documents and Settings\Mom\Application Data\CyberLink
2007-06-21 08:05:28 0 d-------- C:\Program Files\Common Files\Philips Speech Shared
2007-06-21 07:45:35 0 d-------- C:\Program Files\Common Files\Adobe
2007-06-21 07:45:35 0 d-------- C:\Documents and Settings\Mom\Application Data\Adobe
2007-06-21 07:42:06 0 d-------- C:\Documents and Settings\Mom\Application Data\Macromedia
2007-06-21 07:41:53 0 d-------- C:\Documents and Settings\Mom\Application Data\GTek
2007-06-21 07:40:50 0 d-------- C:\Documents and Settings\Mom\Application Data\Google
2007-06-21 07:36:26 0 d-------- C:\Documents and Settings\Mom\Application Data\McAfee.com Personal Firewall
2007-06-20 19:09:57 0 d-------- C:\Program Files\Audacity
2007-06-20 18:53:16 0 d-------- C:\Program Files\McAfee
2007-06-20 18:53:07 0 d-------- C:\Program Files\McAfee.com
2007-06-20 18:51:36 0 d-------- C:\Program Files\Corel Corporation
2007-06-20 18:51:10 0 d-------- C:\Program Files\Corel
2007-06-20 18:51:10 0 d-------- C:\Program Files\Common Files\Corel
2007-06-20 18:50:15 0 d-------- C:\Program Files\MUSICMATCH
2007-06-20 18:49:43 0 d-------- C:\Program Files\Common Files\InstallShield
2007-06-20 18:49:03 0 d-------- C:\Program Files\Norton Ghost
2007-06-20 18:48:10 0 d-------- C:\Documents and Settings\Mom\Application Data\Symantec
2007-06-20 18:47:58 0 d-------- C:\Program Files\Symantec
2007-06-20 18:47:01 0 d-------- C:\Program Files\Common Files\Sonic Shared
2007-06-20 18:46:36 0 d-------- C:\Program Files\Sonic
2007-06-20 18:46:29 0 d-------- C:\Program Files\EarthLink Setup
2007-06-20 18:46:22 0 d-------- C:\Program Files\America Online 9.0
2007-06-20 18:46:21 0 d-------- C:\Program Files\AOL Companion
2007-06-20 18:46:18 0 d-------- C:\Program Files\Common Files\aolshare
2007-06-20 18:46:08 0 d-------- C:\Program Files\Common Files\Nullsoft
2007-06-20 18:46:04 0 d-------- C:\Program Files\Common Files\Real
2007-06-20 18:45:08 335 --a------ C:\WINDOWS\nsreg.dat
2007-06-20 18:45:04 0 d-------- C:\Program Files\Microsoft Plus! Photo Story 2 LE
2007-06-20 18:45:02 0 d-------- C:\Program Files\Microsoft Plus! Digital Media Edition
2007-06-20 18:43:00 0 d-------- C:\Program Files\CyberLink
2007-06-20 18:42:36 0 d-------- C:\Program Files\Modem Helper
2007-06-20 18:41:42 0 d-------- C:\Program Files\Broadcom
2007-06-20 18:41:19 0 d-------- C:\Program Files\Synaptics
2007-06-20 18:41:06 0 d-------- C:\Documents and Settings\Mom\Application Data\InstallShield
2007-06-20 18:39:31 0 d-------- C:\Program Files\CONEXANT
2007-06-20 18:36:13 0 d-------- C:\Documents and Settings\Mom\Application Data\Sun
2007-06-20 18:36:11 0 d-------- C:\Program Files\Java
2007-06-20 18:36:00 0 d-------- C:\Program Files\Common Files\Java
-- Registry Dump ---------------------------------------------------------------
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
{41D68ED8-4CFF-4115-88A6-6EBB8AF19000} c:\program files\mcafee\spamkiller\mcapfbho.dll
{4EE12DE6-FBEF-469F-65AC-24F3CF35EDE5} C:\Program Files\Common Files\zyliv944.dll
{5CA3D70E-1895-11CF-8E15-001234567890} C:\WINDOWS\system32\dla\tfswshx.dll
{5E028439-81C7-4B82-BC74-25156306F532} C:\Program Files\BayScribe\bayscribe.dll
{770D2125-C293-4531-AA78-53BFEEEB49BF} C:\WINDOWS\system32\pmkhg.dll [x]
{9030D464-4C02-4ABF-8ECC-5164760863C6} C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} c:\program files\google\googletoolbar1.dll
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SigmatelSysTrayApp"="stsystra.exe"
"PCMService"="\"C:\\Program Files\\Dell\\Media Experience\\PCMService.exe\""
"DVDLauncher"="\"C:\\Program Files\\CyberLink\\PowerDVD\\DVDLauncher.exe\""
"ISUSPM Startup"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\isuspm.exe\" -startup"
"ISUSScheduler"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"Norton Ghost 10.0"="\"C:\\Program Files\\Norton Ghost\\Agent\\GhostTray.exe\""
@=""
"VSOCheckTask"="\"C:\\PROGRA~1\\McAfee.com\\VSO\\mcmnhdlr.exe\" /checktask"
"OASClnt"="C:\\Program Files\\McAfee.com\\VSO\\oasclnt.exe"
"MCAgentExe"="c:\\PROGRA~1\\mcafee.com\\agent\\mcagent.exe"
"MCUpdateExe"="C:\\PROGRA~1\\mcafee.com\\agent\\McUpdate.exe"
"MSKDetectorExe"="C:\\PROGRA~1\\McAfee\\SPAMKI~1\\MSKDetct.exe /startup"
"MSKAGENTEXE"="C:\\PROGRA~1\\McAfee\\SPAMKI~1\\MskAgent.exe"
"VirusScan Online"="c:\\PROGRA~1\\mcafee.com\\vso\\mcvsshld.exe"
"MPFExe"="C:\\PROGRA~1\\McAfee.com\\PERSON~1\\MpfTray.exe"
"WinampAgent"="C:\\Program Files\\Winamp\\winampa.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"XDc"="C:\\Program Files\\Xtreme Desktop\\xdc\\startxdc.exe"
"WorksFUD"="C:\\Program Files\\Microsoft Works\\wkfud.exe"
"Microsoft Works Portfolio"="C:\\Program Files\\Microsoft Works\\WksSb.exe /AllUsers"
"Microsoft Works Update Detection"="C:\\Program Files\\Common Files\\Microsoft Shared\\Works Shared\\WkUFind.exe"
"Corel Photo Downloader"="C:\\Program Files\\Corel\\Corel Photo Album 6\\MediaDetect.exe"
"vihorug"="C:\\Program Files\\ComPlus Applications\\vihorug22011.exe"
"svhost"="\"C:\\WINDOWS\\svhost.exe\""
"runner1"="C:\\WINDOWS\\retadpu77.exe 61A847B5BBF72815358B2B27128065E9C084320161C4661227A755E9C2933154389A"
"Salestart"="\"C:\\Program Files\\Common Files\\WinAntiSpyware 2007\\WAS7Mon.exe\""
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ModemOnHold"="C:\\Program Files\\NetWaiting\\netWaiting.exe"
"DellSupport"="\"C:\\Program Files\\DellSupport\\DSAgnt.exe\" /startup"
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"Aim6"="\"C:\\Program Files\\AIM6\\aim6.exe\" /d locale=en-US ee://aol/imApp"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"Sen"="\"C:\\PROGRA~1\\COMMON~1\\WNSXS~1\\alg.exe\" -vt yazb"
"WinTouch"="C:\\Documents and Settings\\Mom\\Application Data\\WinTouch\\WinTouch.exe"
"SfKg6w"="C:\\Documents and Settings\\Mom\\Application Data\\Microsoft\\Windows\\sunvj.exe"
"ukqw"="C:\\PROGRA~1\\COMMON~1\\ukqw\\ukqwm.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoCDBurning"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source REG_SZ C:\Program Files\Common Files\dirtok.html
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{E9BD0828-1FD9-410C-A50F-43EBE65D310F}"=""
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c9951c62-3977-11dc-ba67-00038a000015}]
Shell\AutoRun\command F:\setupSNK.exe
-- End of Deckard's System Scanner: finished at 2007-08-12 at 21:56:02 ---------
"Mom" - 2007-08-12 21:56:45 - ComboFix 07-07-17.8 - Service Pack 2 NTFS
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\DOCUME~1\ALLUSE~1\APPLIC~1.\salesmonitor
C:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007
C:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007\Data\Abbr
C:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007\Data\ProductCode
C:\DOCUME~1\Mom\APPLIC~1.\winantispyware 2007
C:\DOCUME~1\Mom\APPLIC~1.\winantispyware 2007\Logs\update.log
C:\DOCUME~1\Mom\APPLIC~1\WinTouch\wintouch.cfg
C:\DOCUME~1\Mom\APPLIC~1\WinTouch\WinTouch.exe
C:\DOCUME~1\Mom\APPLIC~1\WinTouch\WTUninstaller.exe
C:\Program Files\Common Files\dirtok.html
C:\Program Files\Common Files\winantispyware 2007
C:\Program Files\Common Files\winantispyware 2007\err.log
C:\Program Files\Common Files\winantispyware 2007\uwas7cw.exe
C:\Program Files\Common Files\winantispyware 2007\WAS7Mon.exe
C:\Program Files\Common Files\wnsxs~1
C:\Program Files\Common Files\wnsxs~1\alg.exe
C:\Program Files\Common Files\Yazzle1122OinAdmin.exe
C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe
C:\Program Files\Common Files\zyliv.dll
C:\Program Files\Common Files\zyliv173.dll
C:\Program Files\Common Files\zyliv496.dll
C:\Program Files\Common Files\zyliv782.dll
C:\Program Files\Common Files\zyliv944.dll
C:\Program Files\network monitor
C:\Program Files\network monitor\netmon.exe
C:\Program Files\svhost
C:\Program Files\svhost\wr-1-0000077.exe
C:\WINDOWS\retadpu77.exe
C:\WINDOWS\SmFycm9k\asappsrv.dll
C:\WINDOWS\SmFycm9k\command.exe
C:\WINDOWS\svhost.exe
C:\WINDOWS\system32\atmtd.dll
C:\WINDOWS\system32\atmtd.dll._
C:\WINDOWS\system32\drivers\fopn.sys
C:\WINDOWS\system32\tsuninst.exe
C:\WINDOWS\tk58.exe
C:\WINDOWS\uninstall_nmon.vbs
C:\WINDOWS\wr.txt
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
-------\LEGACY_CMDSERVICE
-------\LEGACY_DOMAINSERVICE
-------\LEGACY_NETWORK_MONITOR
-------\cmdService
-------\DomainService
-------\Network Monitor
((((((((((((((((((((((((( Files Created from 2007-07-13 to 2007-08-13 )))))))))))))))))))))))))))))))
2007-08-12 21:31 <DIR> d-------- C:\VundoFix Backups
2007-08-12 21:06 <DIR> d-------- C:\WINDOWS\ukqw
2007-08-12 21:06 <DIR> d-------- C:\Program Files\Common Files\ukqw
2007-08-12 14:52 <DIR> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\NetMon
2007-08-12 14:46 <DIR> d-------- C:\DOCUME~1\NETWOR~1\APPLIC~1\Google
2007-08-12 14:46 <DIR> d-------- C:\DOCUME~1\NETWOR~1\APPLIC~1\BayScribe
2007-08-12 14:17 <DIR> d--hs---- C:\WINDOWS\SmFycm9k
2007-08-12 14:17 <DIR> d-------- C:\DOCUME~1\NETWOR~1\APPLIC~1\NetMon
2007-08-12 14:14 <DIR> d-------- C:\WINDOWS\system32\f10WtR
2007-08-12 14:00 75,328 --a------ C:\WINDOWS\system32\cmivcwsv.exe
2007-08-10 10:57 69,184 --a------ C:\WINDOWS\system32\cojydbmm.dll
2007-08-10 10:51 75,328 --a------ C:\WINDOWS\system32\xtkfqqqe.exe
2007-08-10 09:27 52,766 --a------ C:\WINDOWS\system32\ljdsrngr.exe
2007-08-10 09:26 9,769 --a------ C:\WINDOWS\rassb0578.exe
2007-08-10 09:18 756,352 -r-hs---- C:\WINDOWS\vjcwogxA.exe
2007-08-10 09:18 54,784 --a------ C:\WINDOWS\vjcwogx.exe
2007-08-10 09:18 52,747 --a------ C:\WINDOWS\system32\dwdsrngt.exe
2007-08-10 09:18 192,582 --a------ C:\WINDOWS\system32\mwinkmdt.exe
2007-08-10 09:18 <DIR> d-------- C:\WINDOWS\system32\f02WtR
2007-08-10 09:18 <DIR> d-------- C:\WINDOWS\system32\configs
2007-08-10 09:18 <DIR> d-------- C:\Temp\fse
2007-08-10 09:18 <DIR> d-------- C:\Temp\1cb
2007-08-10 09:18 <DIR> d-------- C:\Temp
2007-08-09 15:54 <DIR> d-------- C:\DOCUME~1\James\APPLIC~1\Leadertech
2007-08-09 13:42 1,421 --a------ C:\WINDOWS\checkip.dat
2007-08-05 18:12 <DIR> d-------- C:\Program Files\Microsoft Encarta
2007-08-05 18:09 <DIR> d-------- C:\WINDOWS\ShellNew
2007-08-05 18:09 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2007-08-05 18:05 <DIR> d-------- C:\Program Files\Microsoft Works
2007-08-05 18:04 <DIR> d-------- C:\Program Files\Microsoft Works Suite 2002
2007-07-29 18:49 <DIR> d-------- C:\DOCUME~1\James\APPLIC~1\CyberLink
2007-07-28 22:40 <DIR> d-------- C:\DOCUME~1\James\APPLIC~1\AdobeUM
2007-07-27 17:57 <DIR> d-------- C:\DOCUME~1\James\APPLIC~1\Apple Computer
2007-07-25 21:23 41,984 --a------ C:\WINDOWS\system32\xd2.dll
2007-07-25 21:23 <DIR> d--hs---- C:\WINDOWS\ftpcache
2007-07-23 18:42 <DIR> d-------- C:\DOCUME~1\Mom\APPLIC~1\acccore
2007-07-21 11:37 <DIR> d---s---- C:\DOCUME~1\James\UserData
2007-07-18 21:58 <DIR> d-------- C:\DOCUME~1\Jill\APPLIC~1\acccore
2007-07-18 13:04 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-07-18 13:04 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-07-17 22:07 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-17 13:21 <DIR> d-------- C:\Deckard
2007-07-17 12:23 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2007-07-17 12:23 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-07-16 23:18 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-07-16 19:57 <DIR> d-------- C:\Program Files\Lavasoft
2007-07-16 19:57 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-07-16 19:55 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-07-14 17:41 760 --a------ C:\WINDOWS\eReg.dat
2007-07-14 17:29 <DIR> d-------- C:\Program Files\EA GAMES
2007-07-13 14:56 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2007-07-13 14:56 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-08-13 02:51:49 246 ----a-w C:\Program Files\Common Files\zyliv944
2007-08-12 19:51:57 -------- d-----w C:\Program Files\Dell
2007-08-12 19:48:28 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-08-12 02:55:28 246 ----a-w C:\Program Files\Common Files\zyliv874
2007-08-10 14
52 3,766 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-08-10 14
50 88 --sh--r C:\WINDOWS\system32\94F63881E8.sys
2007-08-07 23:15:12 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\BayScribe
2007-07-19 16:16:49 -------- d-----w C:\Program Files\DocQscribe
2007-07-18 03:12:37 -------- d-----w C:\Program Files\Windows NT
2007-07-17 16:39:31 -------- d-----w C:\Program Files\Winamp
2007-07-17 16:39:17 -------- d-----w C:\Program Files\SmartFTP Client
2007-07-17 16:38:40 -------- d-----w C:\Program Files\NetWaiting
2007-07-17 16:38:11 -------- d-----w C:\Program Files\MSN Messenger
2007-07-17 16:37:58 -------- d-----w C:\Program Files\Messenger
2007-07-17 16:37:30 -------- d-----w C:\Program Files\iTunes
2007-07-17 16:37:04 -------- d-----w C:\Program Files\Google
2007-07-17 16:36:41 -------- d-----w C:\Program Files\Digital Line Detect
2007-07-17 16:36:41 -------- d-----w C:\Program Files\DellSupport
2007-07-17 16:35:55 -------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-07-17 16:35:19 -------- d-----w C:\Program Files\BayScribe
2007-07-14 22:41:39 12,400 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-07-11 07:29:38 28,160 ----a-w C:\WINDOWS\b103.exe
2007-07-11 07:29:38 22,016 ----a-w C:\WINDOWS\b138.exe
2007-07-01 22:29:58 -------- d-----w C:\Program Files\iPod
2007-07-01 22:29:36 -------- d-----w C:\Program Files\QuickTime
2007-07-01 22:28:55 -------- d-----w C:\Program Files\Apple Software Update
2007-07-01 22:28:27 -------- d-----w C:\Program Files\Common Files\Apple
2007-07-01 22:09:00 -------- d-----w C:\Program Files\Windows Media Connect 2
2007-06-30 21:47:11 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\Skype
2007-06-28 21:54:26 -------- d-----w C:\Program Files\Skype
2007-06-28 21:54:22 -------- d-----w C:\Program Files\Common Files\Skype
2007-06-27 14:04:14 -------- d-----w C:\Program Files\Online Services
2007-06-26 21:27:04 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\Corel Photo Album
2007-06-25 14:43:45 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\AdobeUM
2007-06-24 03:47:19 -------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-06-24 03:43:44 -------- d-----w C:\Program Files\MSXML 4.0
2007-06-23 21:02:00 -------- d-----w C:\Program Files\Real
2007-06-22 16:52:32 -------- d-----w C:\Program Files\AIM6
2007-06-22 16:52:03 -------- d-----w C:\Program Files\Common Files\AOL
2007-06-21 13:46:13 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\CyberLink
2007-06-21 13:05:28 -------- d-----w C:\Program Files\Common Files\Philips Speech Shared
2007-06-21 12:41:53 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\GTek
2007-06-21 12:40:50 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\Google
2007-06-21 12:36:26 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\McAfee.com Personal Firewall
2007-06-21 00:09:57 -------- d-----w C:\Program Files\Audacity
2007-06-20 23:53:16 -------- d-----w C:\Program Files\McAfee
2007-06-20 23:53:07 -------- d-----w C:\Program Files\McAfee.com
2007-06-20 23:51:36 -------- d-----w C:\Program Files\Corel Corporation
2007-06-20 23:51:10 -------- d-----w C:\Program Files\Corel
2007-06-20 23:51:10 -------- d-----w C:\Program Files\Common Files\Corel
2007-06-20 23:50:15 -------- d-----w C:\Program Files\MUSICMATCH
2007-06-20 23:49:43 -------- d-----w C:\Program Files\Common Files\InstallShield
2007-06-20 23:49:04 4,608 ----a-w C:\WINDOWS\system32\drivers\symlcbrd.sys
2007-06-20 23:49:03 -------- d-----w C:\Program Files\Norton Ghost
2007-06-20 23:48:10 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\Symantec
2007-06-20 23:47:58 -------- d-----w C:\Program Files\Symantec
2007-06-20 23:47:01 -------- d-----w C:\Program Files\Common Files\Sonic Shared
2007-06-20 23:46:36 -------- d-----w C:\Program Files\Sonic
2007-06-20 23:46:29 -------- d-----w C:\Program Files\EarthLink Setup
2007-06-20 23:46:22 -------- d-----w C:\Program Files\America Online 9.0
2007-06-20 23:46:21 -------- d-----w C:\Program Files\AOL Companion
2007-06-20 23:46:18 -------- d-----w C:\Program Files\Common Files\aolshare
2007-06-20 23:46:08 -------- d-----w C:\Program Files\Common Files\Nullsoft
2007-06-20 23:46:04 8,552 ----a-w C:\WINDOWS\system32\drivers\asctrm.sys
2007-06-20 23:46:04 -------- d-----w C:\Program Files\Common Files\Real
2007-06-20 23:45:08 335 ----a-w C:\WINDOWS\nsreg.dat
2007-06-20 23:45:04 -------- d-----w C:\Program Files\Microsoft Plus! Photo Story 2 LE
2007-06-20 23:45:02 -------- d-----w C:\Program Files\Microsoft Plus! Digital Media Edition
2007-06-20 23:43:00 -------- d-----w C:\Program Files\CyberLink
2007-06-20 23:42:36 -------- d-----w C:\Program Files\Modem Helper
2007-06-20 23:41:42 -------- d-----w C:\Program Files\Broadcom
2007-06-20 23:41:19 -------- d-----w C:\Program Files\Synaptics
2007-06-20 23:41:06 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\InstallShield
2007-06-20 23:39:31 -------- d-----w C:\Program Files\CONEXANT
2007-06-20 01:47:50 6,171 ----a-w C:\WINDOWS\system32\drivers\1028_Dell_INS_I6400.mrk
2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2005-07-29 21:24:26 472 --sha-r C:\WINDOWS\SmFycm9k\mAIVwA64.vbs
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2003-11-03 14:17 54248 --a------ C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1A4DE1F2-CF89-4F5A-EAA6-7CBB4EE9114B}]
2007-08-12 22:03 70144 --a------ C:\Program Files\Common Files\zyliv.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{41D68ED8-4CFF-4115-88A6-6EBB8AF19000}]
2005-07-12 18:02 262236 --a------ c:\program files\mcafee\spamkiller\mcapfbho.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
2004-12-06 01:05 118842 --a------ C:\WINDOWS\system32\dla\tfswshx.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5E028439-81C7-4B82-BC74-25156306F532}]
2007-06-14 09:10 258048 --a------ C:\Program Files\BayScribe\bayscribe.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{770D2125-C293-4531-AA78-53BFEEEB49BF}]
C:\WINDOWS\system32\pmkhg.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
2006-08-31 20:33 322368 --a------ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
2007-06-20 22:05 2403392 -ra------ c:\program files\google\googletoolbar1.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
2007-07-04 23:08 325048 --a------ C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 16:30 C:\WINDOWS\stsystra.exe]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 20:15]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 20:29]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 10:44]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 10:44]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-12-13 15:30]
"Norton Ghost 10.0"="C:\Program Files\Norton Ghost\Agent\GhostTray.exe" [2005-12-07 16:05]
"@"="" []
"VSOCheckTask"="C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 18:18]
"OASClnt"="C:\Program Files\McAfee.com\VSO\oasclnt.exe" [2005-08-11 22:02]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-07-01 19:22]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\McUpdate.exe" [2005-08-26 14:26]
"MSKDetectorExe"="C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe" [2005-07-12 19:05]
"MSKAGENTEXE"="C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe" [2005-07-12 18:06]
"VirusScan Online"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" [2005-08-10 12:49]
"MPFExe"="C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe" [2005-08-18 17:52]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2004-12-20 13:41]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-28 09:14]
"XDc"="C:\Program Files\Xtreme Desktop\xdc\startxdc.exe" [2006-10-02 23:09]
"WorksFUD"="C:\Program Files\Microsoft Works\wkfud.exe" [2001-10-05 19:34]
"Microsoft Works Portfolio"="C:\Program Files\Microsoft Works\WksSb.exe" [2001-08-23 16:52]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2001-08-16 23:41]
"Corel Photo Downloader"="C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe" [2006-02-09 17:34]
"vihorug"="C:\Program Files\ComPlus Applications\vihorug22011.exe" [2007-08-07 15:30]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ModemOnHold"="C:\Program Files\NetWaiting\netWaiting.exe" [2003-09-10 02:24]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-04 23:08]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-04-27 16:17]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"Sen"="C:\PROGRA~1\COMMON~1\WNSXS~1\alg.exe" []
"SfKg6w"="C:\Documents and Settings\Mom\Application Data\Microsoft\Windows\sunvj.exe" [2007-08-12 15:05]
"ukqw"="C:\PROGRA~1\COMMON~1\ukqw\ukqwm.exe" [2006-07-19 14:56]
C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2007-06-20 18:42:51]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]
Microsoft Works Calendar Reminders.lnk - C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2001-08-07 18
54]
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= C:\Program Files\Common Files\dirtok.html
FriendlyName=
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c9951c62-3977-11dc-ba67-00038a000015}]
AutoRun\command- F:\setupSNK.exe
Contents of the 'Scheduled Tasks' folder
2007-08-10 19:07:01 C:\WINDOWS\tasks\McAfee.com Scan for Viruses - My Computer (OSTLUND-Jarrod).job
**************************************************************************
catchme 0.3.1040 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-08-12 22:02:26
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden registry entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 2007-08-12 22:04:38 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-12 22:04
C:\ComboFix2.txt ... 2007-08-11 22:10
--- E O F ---