Tech Support Forum - View Single Post - I have a red Biohazed sign on my desktop with popup windows.

MsMason · 10-09-2007, 08:41 AM

I wanna start this post out by thanking you for all your help with my PC here is the info you wanted:

ComboFix 07-10-09.3 - Isaac Mason 2007-10-08 22:33:43.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.609 [GMT -6:00]
Running from: C:\Documents and Settings\Isaac Mason\desktop\combofix.exe
Command switches used :: /killall
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Starware337
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\epiRSS.bmp
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\epiRSS.bmp
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\epiRSS.png
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\epiRSS.png
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\epiSearch.bmp
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\epiSearch.bmp
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\epiSearch.png
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\epiSearch.png
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\FindIt.bmp
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\FindIt.bmp
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\FindItHot.bmp
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\FindItHot.bmp
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\findithotxp.png
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\findithotxp.png
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\finditxp.png
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\finditxp.png
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\Highlight.bmp
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\Highlight.bmp
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\HighlightHot.bmp
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\HighlightHot.bmp
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\highlighthotxp.png
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\highlighthotxp.png
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\highlightxp.png
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\highlightxp.png
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\Reference.bmp
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\Reference.bmp
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\ReferenceHot.bmp
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\ReferenceHot.bmp
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\referencehotxp.png
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\referencehotxp.png
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\referencexp.png
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\referencexp.png
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\starware_toolbar_icon.bmp
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\starware_toolbar_icon.bmp
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\Weather.bmp
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\Weather.bmp
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\weatherhotxp.png
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\weatherhotxp.png
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\weatherxp.png
C:\Documents and Settings\All Users\Application Data\Starware337\buttons\weatherxp.png
C:\Documents and Settings\All Users\Application Data\Starware337\contexts\error.xml
C:\Documents and Settings\All Users\Application Data\Starware337\contexts\error.xml
C:\Documents and Settings\All Users\Application Data\Starware337\contexts\related.xml
C:\Documents and Settings\All Users\Application Data\Starware337\contexts\related.xml
C:\Documents and Settings\All Users\Application Data\Starware337\contexts\Travel.xml
C:\Documents and Settings\All Users\Application Data\Starware337\contexts\Travel.xml
C:\Documents and Settings\All Users\Application Data\Starware337\images\walertXP.bmp
C:\Documents and Settings\All Users\Application Data\Starware337\images\walertXP.bmp
C:\Documents and Settings\All Users\Application Data\Starware337\SimpleUpdate\ProductMessagingConfig.xml
C:\Documents and Settings\All Users\Application Data\Starware337\SimpleUpdate\ProductMessagingConfig.xml
C:\Documents and Settings\All Users\Application Data\Starware337\SimpleUpdate\ProductMessagingConfig.xml.backup
C:\Documents and Settings\All Users\Application Data\Starware337\SimpleUpdate\ProductMessagingConfig.xml.backup
C:\Documents and Settings\All Users\Application Data\Starware337\SimpleUpdate\SimpleUpdateConfig.xml
C:\Documents and Settings\All Users\Application Data\Starware337\SimpleUpdate\SimpleUpdateConfig.xml
C:\Documents and Settings\All Users\Application Data\Starware337\SimpleUpdate\SimpleUpdateConfig.xml.backup
C:\Documents and Settings\All Users\Application Data\Starware337\SimpleUpdate\SimpleUpdateConfig.xml.backup
C:\Documents and Settings\All Users\Application Data\Starware337\SimpleUpdate\TimerManagerConfig.xml
C:\Documents and Settings\All Users\Application Data\Starware337\SimpleUpdate\TimerManagerConfig.xml
C:\Documents and Settings\All Users\Application Data\Starware337\SimpleUpdate\TimerManagerConfig.xml.backup
C:\Documents and Settings\All Users\Application Data\Starware337\SimpleUpdate\TimerManagerConfig.xml.backup
C:\Documents and Settings\Amalia Mally Mason\Application Data\install.dat
C:\Documents and Settings\Amalia Mally Mason\Application Data\install.dat
C:\Documents and Settings\Isaac Mason\Application Data\Starware337
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\BrowserSearch\BrowserSearch.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\BrowserSearch\BrowserSearch.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\BrowserSearch\BrowserSearch.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\BrowserSearch\BrowserSearch.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Configurator\Configurator.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Configurator\Configurator.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Configurator\Configurator.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Configurator\Configurator.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ErrorSearch\ErrorSearchOptions.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ErrorSearch\ErrorSearchOptions.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ErrorSearch\ErrorSearchOptions.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ErrorSearch\ErrorSearchOptions.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Games\GamesOptions.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Games\GamesOptions.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Games\GamesOptions.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Games\GamesOptions.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Games\images\active\Games0.bmp
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Games\images\active\Games0.bmp
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Layouts\ToolbarLayout.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Layouts\ToolbarLayout.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Layouts\ToolbarLayout.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Layouts\ToolbarLayout.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Manager\ManagerOptions.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Manager\ManagerOptions.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Manager\ManagerOptions.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Manager\ManagerOptions.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Movies\images\active\Movies0.bmp
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Movies\images\active\Movies0.bmp
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Movies\MoviesOptions.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Movies\MoviesOptions.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Movies\MoviesOptions.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Movies\MoviesOptions.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Recipes\RecipesOptions.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Recipes\RecipesOptions.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Recipes\RecipesOptions.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Recipes\RecipesOptions.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\RecipeSearch\RecipeSearchOptions.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\RecipeSearch\RecipeSearchOptions.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\RecipeSearch\RecipeSearchOptions.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\RecipeSearch\RecipeSearchOptions.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Reference\ReferenceOptions.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Reference\ReferenceOptions.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Reference\ReferenceOptions.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Reference\ReferenceOptions.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\RelatedSearch\RelatedSearchOptions.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\RelatedSearch\RelatedSearchOptions.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\RelatedSearch\RelatedSearchOptions.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\RelatedSearch\RelatedSearchOptions.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ScreensaversMarketingSitePager\images\active\ScreensaversMarketingSitePager0.bmp
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ScreensaversMarketingSitePager\images\active\ScreensaversMarketingSitePager0.bmp
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Toolbar\TBProductsOptions.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Toolbar\TBProductsOptions.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Toolbar\TBProductsOptions.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Toolbar\TBProductsOptions.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ToolbarLogo\ToolbarLogoOptions.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ToolbarLogo\ToolbarLogoOptions.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ToolbarLogo\ToolbarLogoOptions.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ToolbarLogo\ToolbarLogoOptions.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ToolbarSearch\ToolbarSearchOptions.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ToolbarSearch\ToolbarSearchOptions.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ToolbarSearch\ToolbarSearchOptions.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ToolbarSearch\ToolbarSearchOptions.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\TravelSearch\TravelSearchOptions.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\TravelSearch\TravelSearchOptions.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\TravelSearch\TravelSearchOptions.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\TravelSearch\TravelSearchOptions.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Weather\AlertArchive.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Weather\AlertArchive.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Weather\WeatherOptions.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Weather\WeatherOptions.xml
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Weather\WeatherOptions.xml.backup
C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Weather\WeatherOptions.xml.backup
C:\Program Files\FunWebProducts
C:\Program Files\FunWebProducts\Shared\00D7CAAD.dat
C:\Program Files\FunWebProducts\Shared\00EB9CF4.dat
C:\Program Files\Starware337
C:\Program Files\Starware337\brand.bmp
C:\Program Files\Starware337\icons\star_16.ico
C:\Program Files\Starware337\Starware337Config.xml
C:\Program Files\Starware337\Starware337Uninstall.exe
C:\Program Files\winupdates
C:\WINDOWS\dat.txt
C:\WINDOWS\msvb.dll
C:\WINDOWS\rs.txt
C:\WINDOWS\search_res.txt
C:\WINDOWS\sysdx.dll
C:\WINDOWS\system32\_000003_.tmp.dll
C:\WINDOWS\system32\_000005_.tmp.dll
C:\WINDOWS\system32\_000006_.tmp.dll
C:\WINDOWS\system32\_000007_.tmp.dll
C:\WINDOWS\system32\_000008_.tmp.dll
C:\WINDOWS\system32\_000009_.tmp.dll
C:\WINDOWS\system32\_000010_.tmp.dll
C:\WINDOWS\system32\_000011_.tmp.dll
C:\WINDOWS\system32\_000042_.tmp.dll
C:\WINDOWS\system32\bszip.dll
C:\WINDOWS\system32\cmd.com
C:\WINDOWS\system32\netstat.com
C:\WINDOWS\system32\ping.com
C:\WINDOWS\system32\taskkill.com
C:\WINDOWS\system32\tasklist.com
C:\WINDOWS\system32\tracert.com

.
((((((((((((((((((((((((( Files Created from 2007-09-09 to 2007-10-09 )))))))))))))))))))))))))))))))
.

2007-10-08 22:32 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-08 15:09 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\4200Series
2007-10-08 15:08 <DIR> d-------- C:\Program Files\ABBYY FineReader 5.0 Sprint
2007-10-08 15:03 286,720 --a------ C:\WINDOWS\system32\lxbmcomm.dll
2007-10-08 15:03 73,728 --a------ C:\WINDOWS\system32\lxbmpwr.dll
2007-10-08 15:03 40,960 --a------ C:\WINDOWS\system32\lxbmvs.dll
2007-10-08 15:02 <DIR> d-------- C:\Program Files\Lexmark 4200 Series
2007-10-07 16:59 1,331,200 --------- C:\WINDOWS\UNNeroVision.exe
2007-10-07 16:58 89,184 --a------ C:\WINDOWS\system32\drivers\imagedrv.sys
2007-10-07 16:57 <DIR> d-------- C:\Program Files\Common Files\Ahead
2007-10-07 16:57 <DIR> d-------- C:\Program Files\Ahead
2007-10-07 16:57 569,344 --a------ C:\WINDOWS\system32\imagr5.dll
2007-10-07 16:57 544,768 --a------ C:\WINDOWS\system32\imagx5.dll
2007-10-07 16:57 283,920 --a------ C:\WINDOWS\system32\ImagXpr5.dll
2007-10-07 16:57 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2007-10-07 16:57 38,912 --a------ C:\WINDOWS\system32\picn20.dll
2007-10-07 16:20 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Gtek
2007-10-07 13:00 <DIR> d-------- C:\Deckard
2007-10-05 04:25 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2007-10-05 04:11 <DIR> d-------- C:\Documents and Settings\Isaac Mason\.housecall6.6
2007-10-03 19:16 <DIR> d-------- C:\Documents and Settings\Isaac Mason\Application Data\AOL
2007-10-03 19:13 65,536 --a------ C:\WINDOWS\wanmpsvc.exe
2007-10-03 19:11 <DIR> d-------- C:\Program Files\AOL 9.0
2007-10-03 13:53 <DIR> d-------- C:\Program Files\Adware Away
2007-10-02 21:34 1,742 --a------ C:\WINDOWS\system32\tmp.reg
2007-10-02 20:04 <DIR> d-------- C:\Documents and Settings\Isaac Mason\Application Data\PC Tools
2007-10-02 20:04 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2007-10-02 20:04 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2007-10-02 20:04 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-10-02 20:04 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2007-10-02 13:21 171,240 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
2007-10-02 13:21 71,496 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
2007-10-02 13:21 37,480 --a------ C:\WINDOWS\system32\drivers\mfesmfk.sys
2007-10-02 13:21 34,184 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
2007-10-02 13:21 32,008 --a------ C:\WINDOWS\system32\drivers\mferkdk.sys
2007-10-02 13:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL OCP
2007-10-02 12:56 <DIR> d-------- C:\Documents and Settings\Isaac Mason\Application Data\Sereniti
2007-10-02 12:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL Downloads
2007-10-02 12:13 <DIR> d-------- C:\mcafee_mcpr
2007-10-02 12:13 109,608 --a------ C:\WINDOWS\system32\drivers\Mpfp.sys
2007-10-02 12:12 <DIR> d-------- C:\Program Files\McAfee.com
2007-10-02 12:12 <DIR> d-------- C:\Program Files\McAfee
2007-10-02 12:12 <DIR> d-------- C:\Program Files\Common Files\McAfee
2007-10-02 11:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2007-10-02 11:14 426 --a------ C:\Documents and Settings\Isaac Mason\Menu-21114133.reg
2007-10-02 11:13 790 --a------ C:\Documents and Settings\Isaac Mason\BHO-21113517.reg
2007-10-02 11:12 7,827 --a------ C:\Documents and Settings\Isaac Mason\TB-21112156.reg
2007-10-02 11:12 972 --a------ C:\Documents and Settings\Isaac Mason\TB-21112309.reg
2007-10-02 11:12 556 --a------ C:\Documents and Settings\Isaac Mason\BHO-21112380.reg
2007-10-02 11:12 424 --a------ C:\Documents and Settings\Isaac Mason\BHO-21112546.reg
2007-10-02 11:11 437 --a------ C:\Documents and Settings\Isaac Mason\BHO-21111155.reg
2007-10-02 11:11 431 --a------ C:\Documents and Settings\Isaac Mason\BHO-2111172.reg
2007-10-02 11:09 8,306 --a------ C:\Documents and Settings\Isaac Mason\TB-2119115.reg
2007-10-02 11:09 8,188 --a------ C:\Documents and Settings\Isaac Mason\TB-2119162.reg
2007-10-02 11:09 635 --a------ C:\Documents and Settings\Isaac Mason\TB-211906.reg
2007-10-02 10:58 <DIR> d-------- C:\Program Files\Common Files\Scanner
2007-09-10 10:47 <DIR> d-------- C:\WHG0NNW1
2007-09-10 03:22 <DIR> d-------- C:\Program Files\Alarm
2007-09-09 22:25 <DIR> d-------- C:\Documents and Settings\Isaac Mason\Application Data\Ahead
2007-09-09 22:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Ahead
2007-09-09 21:33 <DIR> d-------- C:\Program Files\DVD Shrink
2007-09-09 21:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\DVD Shrink
2007-09-09 21:27 <DIR> d-------- C:\THE_NUMBER_23
2007-09-09 21:26 <DIR> d-------- C:\Program Files\DVD Decrypter

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-09 04:43 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-10-08 21:32 --------- d-----w C:\Documents and Settings\Isaac Mason\Application Data\LimeWire
2007-10-08 21:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2007-10-08 21:10 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-08 09:08 --------- d-----w C:\Program Files\Spyware Doctor
2007-10-07 01:46 --------- d-----w C:\Program Files\DAP
2007-10-04 21:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2007-10-04 06:58 --------- d-----w C:\Documents and Settings\Isaac Mason\Application Data\Yahoo!
2007-10-04 01:16 --------- d-----w C:\Program Files\Common Files\AOL
2007-10-04 01:15 --------- d-----w C:\Program Files\Common Files\aolshare
2007-10-03 20:29 --------- d-----w C:\Program Files\Yahoo!
2007-10-02 18:38 --------- d-----w C:\Program Files\Trend Micro
2007-09-10 04:29 --------- d-----w C:\Program Files\The Weather Channel FW
2007-09-05 06:28 8,508 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-09-03 21:11 --------- d-----w C:\Program Files\MP4 Player
2007-09-03 21:11 --------- d-----w C:\Program Files\K-Lite Codec Pack
2007-09-03 21:11 --------- d-----w C:\Documents and Settings\Isaac Mason\Application Data\Media Player Classic
2007-08-22 19:03 --------- d-----w C:\Program Files\LimeWire
2007-08-16 04:15 --------- d-----w C:\Program Files\eMusic Download Manager
2007-08-16 03:55 --------- d-----w C:\Program Files\Rhapsody
2007-08-16 03:49 --------- d-----w C:\Documents and Settings\Isaac Mason\Application Data\InstallShield
2007-08-16 03:46 8,413 ----a-w C:\WINDOWS\system32\drivers\mcstrm.sys
2007-08-16 03:46 --------- d-----w C:\Documents and Settings\Isaac Mason\Application Data\Real
2007-08-14 23:48 --------- d-----w C:\Program Files\MSN Messenger
2007-08-09 23:09 --------- d-----w C:\Program Files\Kodak
2007-08-09 23:09 --------- d-----w C:\Program Files\Common Files\Kodak
2007-08-09 23:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kodak
2007-07-31 02:54 229,732 ----a-w C:\WINDOWS\Burn4Free_Toolbar_Uninstaller_8953.exe
2007-07-31 01:19 92,504 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-31 01:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-07-31 01:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-07-31 01:19 549,720 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll
2007-07-31 01:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-07-31 01:19 53,080 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-31 01:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-07-31 01:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-07-31 01:19 325,976 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll
2007-07-31 01:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-07-31 01:19 203,096 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll
2007-07-31 01:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-07-31 01:19 1,712,984 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-31 01:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-07-31 01:18 33,624 ----a-w C:\WINDOWS\system32\dllcache\wups.dll
2007-07-01 07:12 2 ----a-w C:\Documents and Settings\Amalia Mally Mason\Application Data\xxx.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]
"SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-09-27 13:43]
"Lexmark 4200 Series"="C:\Program Files\Lexmark 4200 Series\lxbmbmgr.exe" [2004-01-16 04:04]
"FaxCenterServer4_in_1"="C:\Program Files\Lexmark 4200 Series\Fax\fm3032.exe" [2004-01-22 10:59]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AOL Fast Start"="C:\PROGRA~1\AOL9~1.0\AOL.exe" [2007-04-18 00:49]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-18 11:09]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, append.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Dell Network Assistant.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Dell Network Assistant.lnk
backup=C:\WINDOWS\pss\Dell Network Assistant.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak software updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk
backup=C:\WINDOWS\pss\Kodak software updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=C:\WINDOWS\pss\QuickBooks Update Agent.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Vongo Tray.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Vongo Tray.lnk
backup=C:\WINDOWS\pss\Vongo Tray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ymetray.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ymetray.lnk
backup=C:\WINDOWS\pss\ymetray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Isaac Mason^Start Menu^Programs^Startup^LimeWire Acceleration Patch.lnk]
path=C:\Documents and Settings\Isaac Mason\Start Menu\Programs\Startup\LimeWire Acceleration Patch.lnk
backup=C:\WINDOWS\pss\LimeWire Acceleration Patch.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Isaac Mason^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=C:\Documents and Settings\Isaac Mason\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start]
"C:\Program Files\AOL 9.0\AOL.EXE" -b

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASM]
"C:\Program Files\AOL\Active Security Monitor\ASMonitor.exe" HIDEMAIN

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CashBuzz]
C:\Program Files\CashBuzz v.3.2\cashbuzz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader]
C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
"C:\Program Files\DellSupport\DSAgnt.exe" /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
C:\WINDOWS\system32\dla\tfswctrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator]
"C:\Program Files\DAP\DAP.EXE" /STARTUP

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
"C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DW4]
"C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyLinkAdvisor]
"C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
C:\WINDOWS\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer4_in_1]
"C:\Program Files\Lexmark 4200 Series\Fax\fm3032.exe" /s

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gwiz]
C:\WINDOWS\system32\arpl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
C:\Program Files\Common Files\AOL\1191351858\ee\AOLSoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
C:\WINDOWS\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
C:\WINDOWS\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
C:\WINDOWS\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
"c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
"C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 4200 Series]
"C:\Program Files\Lexmark 4200 Series\lxbmbmgr.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogonStudio]
"C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
"C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
"C:\Program Files\MSN Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\My Web Search Bar Search Scope Monitor]
"C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=2 /w

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyWebSearch Email Plugin]
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nektra OEAPI]
"C:\Program Files\Mailinfo\Mailinfo for Outlook Express\oe_mailinfo.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OE_OEM]
"C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pccguide.exe]
"C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
C:\Program Files\Picasa2\PicasaMediaDetector.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SDTray]
"C:\Program Files\Spyware Doctor\SDTrayApp.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedOptimizer]
C:\PROGRA~1\SPEEDO~1\SPO.EXE -s

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
"C:\Program Files\Windows Defender\MSASCui.exe" -hide

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
"C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"tmproxy"=2 (0x2)
"TmPfw"=2 (0x2)
"Tmntsrv"=2 (0x2)
"PcCtlCom"=2 (0x2)

R1 DcCam;Kodak Camera Proxy;C:\WINDOWS\system32\DRIVERS\DcCam.sys
R2 DCFS2K;Kodak DCFS2K Driver;C:\WINDOWS\system32\drivers\dcfs2k.sys
R2 elagopro;GoProto Protocol Driver for LELA;C:\WINDOWS\system32\DRIVERS\elagopro.sys
R2 elaunidr;UniDriver for LELA;C:\WINDOWS\system32\DRIVERS\elaunidr.sys
R2 sbbotdi;sbbotdi;\??\C:\PROGRA~1\SPEEDB~1\sbbotdi.sys
S1 Exportit;Exportit;C:\WINDOWS\system32\DRIVERS\exportit.sys
S3 DcFpoint;DcFpoint;C:\WINDOWS\system32\DRIVERS\DcFpoint.sys
S3 DcLps;Legacy Polling Service;C:\WINDOWS\system32\DRIVERS\DcLps.sys
S3 DcPTP;dcptp;C:\WINDOWS\system32\DRIVERS\DcPTP.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
AutoRun\command - E:\setup.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-10-02 18:13:23 C:\WINDOWS\Tasks\McDefragTask.job"
"2007-10-02 18:13:21 C:\WINDOWS\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
"2007-10-09 04:44:46 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-10-05 21:00:06 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-08 22:42:44
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwClose

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ATWPKT2]
"ImagePath"="\??\C:\WINDOWS\system32\drivers\ATWPKT2.SYS"
.
Completion time: 2007-10-08 22:45:46 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-10-08 22:45
.
--- E O F ---

Logfile of HijackThis v1.99.1
Scan saved at 7:48:40 AM, on 10/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Dell Network Assistant\hnm_svc.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\SPEEDB~1\VideoAcceleratorEngine.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\alg.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\AOL9~1.0\waol.exe
C:\PROGRA~1\AOL9~1.0\shellmon.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HijackThis\HijackThis.exe
c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe

R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\Search\YSearchSuggest.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: GoogleAFE - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\GoogleAFE\GoogleAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - (no file)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [Lexmark 4200 Series] "C:\Program Files\Lexmark 4200 Series\lxbmbmgr.exe"
O4 - HKLM\..\Run: [FaxCenterServer4_in_1] "C:\Program Files\Lexmark 4200 Series\Fax\fm3032.exe" /s
O4 - HKCU\..\Run: [AOL Fast Start] "C:\PROGRA~1\AOL9~1.0\AOL.EXE" -b
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10...I.cab55579.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10...y.cab55579.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10...t.cab55579.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab56986.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn...tDetection.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/40...rk/Coupons.cab
O16 - DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} (CBSTIEPrint Class) - http://offers.e-centives.com/cif/dow...in/actxcab.cab
O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} (LinkSys Content Update) - http://www.linksysfix.com/netcheck/6...l/gtdownls.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {C946EF6D-296D-4907-A6E1-ED0E8E5AF024} (LycosMail Upload Control) - http://mail.lycos.com/hanmail-ax/AttachMail.cab
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/.../en/crlocx.ocx
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10...y.cab55579.cab
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab57176.cab
O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} -
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - https://www.secure-session.com/include/XUpload.ocx
O16 - DPF: {FF3C5A9F-5A91-4930-80E8-4709194C2AD3} (CheckersZPA Object) - http://zone.msn.com/bingame/zpagames...A.cab55579.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: VideoAcceleratorEngine - Speedbit Ltd. - C:\PROGRA~1\SPEEDB~1\VideoAcceleratorEngine.exe
O23 - Service: Vongo Service - Starz Entertainment Group LLC - C:\Program Files\Vongo\VongoService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: WMP54Gv4SVC - Unknown owner - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe" "WMP54Gv4.exe (file missing)

10-09-2007, 08:41 AM	#8 (permalink)
MsMason Registered User Join Date: Oct 2007 Posts: 10 OS: Win Xp SP-2	Re: I have a red Biohazed sign on my desktop with popup windows. I wanna start this post out by thanking you for all your help with my PC here is the info you wanted: ComboFix 07-10-09.3 - Isaac Mason 2007-10-08 22:33:43.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.609 [GMT -6:00] Running from: C:\Documents and Settings\Isaac Mason\desktop\combofix.exe Command switches used :: /killall * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\Starware337 C:\Documents and Settings\All Users\Application Data\Starware337\buttons\epiRSS.bmp C:\Documents and Settings\All Users\Application Data\Starware337\buttons\epiRSS.bmp C:\Documents and Settings\All Users\Application Data\Starware337\buttons\epiRSS.png C:\Documents and Settings\All Users\Application Data\Starware337\buttons\epiRSS.png C:\Documents and Settings\All Users\Application Data\Starware337\buttons\epiSearch.bmp C:\Documents and Settings\All Users\Application Data\Starware337\buttons\epiSearch.bmp C:\Documents and Settings\All Users\Application Data\Starware337\buttons\epiSearch.png C:\Documents and Settings\All Users\Application Data\Starware337\buttons\epiSearch.png C:\Documents and Settings\All Users\Application Data\Starware337\buttons\FindIt.bmp C:\Documents and Settings\All Users\Application Data\Starware337\buttons\FindIt.bmp C:\Documents and Settings\All Users\Application Data\Starware337\buttons\FindItHot.bmp C:\Documents and Settings\All Users\Application Data\Starware337\buttons\FindItHot.bmp C:\Documents and Settings\All Users\Application Data\Starware337\buttons\findithotxp.png C:\Documents and Settings\All Users\Application Data\Starware337\buttons\findithotxp.png C:\Documents and Settings\All Users\Application Data\Starware337\buttons\finditxp.png C:\Documents and Settings\All Users\Application Data\Starware337\buttons\finditxp.png C:\Documents and Settings\All Users\Application Data\Starware337\buttons\Highlight.bmp C:\Documents and Settings\All Users\Application Data\Starware337\buttons\Highlight.bmp C:\Documents and Settings\All Users\Application Data\Starware337\buttons\HighlightHot.bmp C:\Documents and Settings\All Users\Application Data\Starware337\buttons\HighlightHot.bmp C:\Documents and Settings\All Users\Application Data\Starware337\buttons\highlighthotxp.png C:\Documents and Settings\All Users\Application Data\Starware337\buttons\highlighthotxp.png C:\Documents and Settings\All Users\Application Data\Starware337\buttons\highlightxp.png C:\Documents and Settings\All Users\Application Data\Starware337\buttons\highlightxp.png C:\Documents and Settings\All Users\Application Data\Starware337\buttons\Reference.bmp C:\Documents and Settings\All Users\Application Data\Starware337\buttons\Reference.bmp C:\Documents and Settings\All Users\Application Data\Starware337\buttons\ReferenceHot.bmp C:\Documents and Settings\All Users\Application Data\Starware337\buttons\ReferenceHot.bmp C:\Documents and Settings\All Users\Application Data\Starware337\buttons\referencehotxp.png C:\Documents and Settings\All Users\Application Data\Starware337\buttons\referencehotxp.png C:\Documents and Settings\All Users\Application Data\Starware337\buttons\referencexp.png C:\Documents and Settings\All Users\Application Data\Starware337\buttons\referencexp.png C:\Documents and Settings\All Users\Application Data\Starware337\buttons\starware_toolbar_icon.bmp C:\Documents and Settings\All Users\Application Data\Starware337\buttons\starware_toolbar_icon.bmp C:\Documents and Settings\All Users\Application Data\Starware337\buttons\Weather.bmp C:\Documents and Settings\All Users\Application Data\Starware337\buttons\Weather.bmp C:\Documents and Settings\All Users\Application Data\Starware337\buttons\weatherhotxp.png C:\Documents and Settings\All Users\Application Data\Starware337\buttons\weatherhotxp.png C:\Documents and Settings\All Users\Application Data\Starware337\buttons\weatherxp.png C:\Documents and Settings\All Users\Application Data\Starware337\buttons\weatherxp.png C:\Documents and Settings\All Users\Application Data\Starware337\contexts\error.xml C:\Documents and Settings\All Users\Application Data\Starware337\contexts\error.xml C:\Documents and Settings\All Users\Application Data\Starware337\contexts\related.xml C:\Documents and Settings\All Users\Application Data\Starware337\contexts\related.xml C:\Documents and Settings\All Users\Application Data\Starware337\contexts\Travel.xml C:\Documents and Settings\All Users\Application Data\Starware337\contexts\Travel.xml C:\Documents and Settings\All Users\Application Data\Starware337\images\walertXP.bmp C:\Documents and Settings\All Users\Application Data\Starware337\images\walertXP.bmp C:\Documents and Settings\All Users\Application Data\Starware337\SimpleUpdate\ProductMessagingConfig.xml C:\Documents and Settings\All Users\Application Data\Starware337\SimpleUpdate\ProductMessagingConfig.xml C:\Documents and Settings\All Users\Application Data\Starware337\SimpleUpdate\ProductMessagingConfig.xml.backup C:\Documents and Settings\All Users\Application Data\Starware337\SimpleUpdate\ProductMessagingConfig.xml.backup C:\Documents and Settings\All Users\Application Data\Starware337\SimpleUpdate\SimpleUpdateConfig.xml C:\Documents and Settings\All Users\Application Data\Starware337\SimpleUpdate\SimpleUpdateConfig.xml C:\Documents and Settings\All Users\Application Data\Starware337\SimpleUpdate\SimpleUpdateConfig.xml.backup C:\Documents and Settings\All Users\Application Data\Starware337\SimpleUpdate\SimpleUpdateConfig.xml.backup C:\Documents and Settings\All Users\Application Data\Starware337\SimpleUpdate\TimerManagerConfig.xml C:\Documents and Settings\All Users\Application Data\Starware337\SimpleUpdate\TimerManagerConfig.xml C:\Documents and Settings\All Users\Application Data\Starware337\SimpleUpdate\TimerManagerConfig.xml.backup C:\Documents and Settings\All Users\Application Data\Starware337\SimpleUpdate\TimerManagerConfig.xml.backup C:\Documents and Settings\Amalia Mally Mason\Application Data\install.dat C:\Documents and Settings\Amalia Mally Mason\Application Data\install.dat C:\Documents and Settings\Isaac Mason\Application Data\Starware337 C:\Documents and Settings\Isaac Mason\Application Data\Starware337\BrowserSearch\BrowserSearch.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\BrowserSearch\BrowserSearch.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\BrowserSearch\BrowserSearch.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\BrowserSearch\BrowserSearch.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Configurator\Configurator.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Configurator\Configurator.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Configurator\Configurator.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Configurator\Configurator.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ErrorSearch\ErrorSearchOptions.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ErrorSearch\ErrorSearchOptions.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ErrorSearch\ErrorSearchOptions.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ErrorSearch\ErrorSearchOptions.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Games\GamesOptions.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Games\GamesOptions.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Games\GamesOptions.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Games\GamesOptions.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Games\images\active\Games0.bmp C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Games\images\active\Games0.bmp C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Layouts\ToolbarLayout.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Layouts\ToolbarLayout.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Layouts\ToolbarLayout.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Layouts\ToolbarLayout.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Manager\ManagerOptions.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Manager\ManagerOptions.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Manager\ManagerOptions.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Manager\ManagerOptions.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Movies\images\active\Movies0.bmp C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Movies\images\active\Movies0.bmp C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Movies\MoviesOptions.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Movies\MoviesOptions.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Movies\MoviesOptions.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Movies\MoviesOptions.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Recipes\RecipesOptions.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Recipes\RecipesOptions.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Recipes\RecipesOptions.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Recipes\RecipesOptions.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\RecipeSearch\RecipeSearchOptions.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\RecipeSearch\RecipeSearchOptions.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\RecipeSearch\RecipeSearchOptions.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\RecipeSearch\RecipeSearchOptions.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Reference\ReferenceOptions.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Reference\ReferenceOptions.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Reference\ReferenceOptions.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Reference\ReferenceOptions.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\RelatedSearch\RelatedSearchOptions.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\RelatedSearch\RelatedSearchOptions.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\RelatedSearch\RelatedSearchOptions.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\RelatedSearch\RelatedSearchOptions.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ScreensaversMarketingSitePager\images\active\ScreensaversMarketingSitePager0.bmp C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ScreensaversMarketingSitePager\images\active\ScreensaversMarketingSitePager0.bmp C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Toolbar\TBProductsOptions.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Toolbar\TBProductsOptions.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Toolbar\TBProductsOptions.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Toolbar\TBProductsOptions.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ToolbarLogo\ToolbarLogoOptions.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ToolbarLogo\ToolbarLogoOptions.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ToolbarLogo\ToolbarLogoOptions.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ToolbarLogo\ToolbarLogoOptions.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ToolbarSearch\ToolbarSearchOptions.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ToolbarSearch\ToolbarSearchOptions.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ToolbarSearch\ToolbarSearchOptions.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\ToolbarSearch\ToolbarSearchOptions.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\TravelSearch\TravelSearchOptions.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\TravelSearch\TravelSearchOptions.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\TravelSearch\TravelSearchOptions.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\TravelSearch\TravelSearchOptions.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Weather\AlertArchive.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Weather\AlertArchive.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Weather\WeatherOptions.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Weather\WeatherOptions.xml C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Weather\WeatherOptions.xml.backup C:\Documents and Settings\Isaac Mason\Application Data\Starware337\Weather\WeatherOptions.xml.backup C:\Program Files\FunWebProducts C:\Program Files\FunWebProducts\Shared\00D7CAAD.dat C:\Program Files\FunWebProducts\Shared\00EB9CF4.dat C:\Program Files\Starware337 C:\Program Files\Starware337\brand.bmp C:\Program Files\Starware337\icons\star_16.ico C:\Program Files\Starware337\Starware337Config.xml C:\Program Files\Starware337\Starware337Uninstall.exe C:\Program Files\winupdates C:\WINDOWS\dat.txt C:\WINDOWS\msvb.dll C:\WINDOWS\rs.txt C:\WINDOWS\search_res.txt C:\WINDOWS\sysdx.dll C:\WINDOWS\system32\_000003_.tmp.dll C:\WINDOWS\system32\_000005_.tmp.dll C:\WINDOWS\system32\_000006_.tmp.dll C:\WINDOWS\system32\_000007_.tmp.dll C:\WINDOWS\system32\_000008_.tmp.dll C:\WINDOWS\system32\_000009_.tmp.dll C:\WINDOWS\system32\_000010_.tmp.dll C:\WINDOWS\system32\_000011_.tmp.dll C:\WINDOWS\system32\_000042_.tmp.dll C:\WINDOWS\system32\bszip.dll C:\WINDOWS\system32\cmd.com C:\WINDOWS\system32\netstat.com C:\WINDOWS\system32\ping.com C:\WINDOWS\system32\taskkill.com C:\WINDOWS\system32\tasklist.com C:\WINDOWS\system32\tracert.com . ((((((((((((((((((((((((( Files Created from 2007-09-09 to 2007-10-09 ))))))))))))))))))))))))))))))) . 2007-10-08 22:32 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-08 15:09 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\4200Series 2007-10-08 15:08 <DIR> d-------- C:\Program Files\ABBYY FineReader 5.0 Sprint 2007-10-08 15:03 286,720 --a------ C:\WINDOWS\system32\lxbmcomm.dll 2007-10-08 15:03 73,728 --a------ C:\WINDOWS\system32\lxbmpwr.dll 2007-10-08 15:03 40,960 --a------ C:\WINDOWS\system32\lxbmvs.dll 2007-10-08 15:02 <DIR> d-------- C:\Program Files\Lexmark 4200 Series 2007-10-07 16:59 1,331,200 --------- C:\WINDOWS\UNNeroVision.exe 2007-10-07 16:58 89,184 --a------ C:\WINDOWS\system32\drivers\imagedrv.sys 2007-10-07 16:57 <DIR> d-------- C:\Program Files\Common Files\Ahead 2007-10-07 16:57 <DIR> d-------- C:\Program Files\Ahead 2007-10-07 16:57 569,344 --a------ C:\WINDOWS\system32\imagr5.dll 2007-10-07 16:57 544,768 --a------ C:\WINDOWS\system32\imagx5.dll 2007-10-07 16:57 283,920 --a------ C:\WINDOWS\system32\ImagXpr5.dll 2007-10-07 16:57 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2007-10-07 16:57 38,912 --a------ C:\WINDOWS\system32\picn20.dll 2007-10-07 16:20 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Gtek 2007-10-07 13:00 <DIR> d-------- C:\Deckard 2007-10-05 04:25 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys 2007-10-05 04:11 <DIR> d-------- C:\Documents and Settings\Isaac Mason\.housecall6.6 2007-10-03 19:16 <DIR> d-------- C:\Documents and Settings\Isaac Mason\Application Data\AOL 2007-10-03 19:13 65,536 --a------ C:\WINDOWS\wanmpsvc.exe 2007-10-03 19:11 <DIR> d-------- C:\Program Files\AOL 9.0 2007-10-03 13:53 <DIR> d-------- C:\Program Files\Adware Away 2007-10-02 21:34 1,742 --a------ C:\WINDOWS\system32\tmp.reg 2007-10-02 20:04 <DIR> d-------- C:\Documents and Settings\Isaac Mason\Application Data\PC Tools 2007-10-02 20:04 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-10-02 20:04 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-10-02 20:04 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-10-02 20:04 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-10-02 13:21 171,240 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys 2007-10-02 13:21 71,496 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys 2007-10-02 13:21 37,480 --a------ C:\WINDOWS\system32\drivers\mfesmfk.sys 2007-10-02 13:21 34,184 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys 2007-10-02 13:21 32,008 --a------ C:\WINDOWS\system32\drivers\mferkdk.sys 2007-10-02 13:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL OCP 2007-10-02 12:56 <DIR> d-------- C:\Documents and Settings\Isaac Mason\Application Data\Sereniti 2007-10-02 12:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL Downloads 2007-10-02 12:13 <DIR> d-------- C:\mcafee_mcpr 2007-10-02 12:13 109,608 --a------ C:\WINDOWS\system32\drivers\Mpfp.sys 2007-10-02 12:12 <DIR> d-------- C:\Program Files\McAfee.com 2007-10-02 12:12 <DIR> d-------- C:\Program Files\McAfee 2007-10-02 12:12 <DIR> d-------- C:\Program Files\Common Files\McAfee 2007-10-02 11:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee 2007-10-02 11:14 426 --a------ C:\Documents and Settings\Isaac Mason\Menu-21114133.reg 2007-10-02 11:13 790 --a------ C:\Documents and Settings\Isaac Mason\BHO-21113517.reg 2007-10-02 11:12 7,827 --a------ C:\Documents and Settings\Isaac Mason\TB-21112156.reg 2007-10-02 11:12 972 --a------ C:\Documents and Settings\Isaac Mason\TB-21112309.reg 2007-10-02 11:12 556 --a------ C:\Documents and Settings\Isaac Mason\BHO-21112380.reg 2007-10-02 11:12 424 --a------ C:\Documents and Settings\Isaac Mason\BHO-21112546.reg 2007-10-02 11:11 437 --a------ C:\Documents and Settings\Isaac Mason\BHO-21111155.reg 2007-10-02 11:11 431 --a------ C:\Documents and Settings\Isaac Mason\BHO-2111172.reg 2007-10-02 11:09 8,306 --a------ C:\Documents and Settings\Isaac Mason\TB-2119115.reg 2007-10-02 11:09 8,188 --a------ C:\Documents and Settings\Isaac Mason\TB-2119162.reg 2007-10-02 11:09 635 --a------ C:\Documents and Settings\Isaac Mason\TB-211906.reg 2007-10-02 10:58 <DIR> d-------- C:\Program Files\Common Files\Scanner 2007-09-10 10:47 <DIR> d-------- C:\WHG0NNW1 2007-09-10 03:22 <DIR> d-------- C:\Program Files\Alarm 2007-09-09 22:25 <DIR> d-------- C:\Documents and Settings\Isaac Mason\Application Data\Ahead 2007-09-09 22:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Ahead 2007-09-09 21:33 <DIR> d-------- C:\Program Files\DVD Shrink 2007-09-09 21:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\DVD Shrink 2007-09-09 21:27 <DIR> d-------- C:\THE_NUMBER_23 2007-09-09 21:26 <DIR> d-------- C:\Program Files\DVD Decrypter . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-09 04:43 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2007-10-08 21:32 --------- d-----w C:\Documents and Settings\Isaac Mason\Application Data\LimeWire 2007-10-08 21:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater 2007-10-08 21:10 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-10-08 09:08 --------- d-----w C:\Program Files\Spyware Doctor 2007-10-07 01:46 --------- d-----w C:\Program Files\DAP 2007-10-04 21:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL 2007-10-04 06:58 --------- d-----w C:\Documents and Settings\Isaac Mason\Application Data\Yahoo! 2007-10-04 01:16 --------- d-----w C:\Program Files\Common Files\AOL 2007-10-04 01:15 --------- d-----w C:\Program Files\Common Files\aolshare 2007-10-03 20:29 --------- d-----w C:\Program Files\Yahoo! 2007-10-02 18:38 --------- d-----w C:\Program Files\Trend Micro 2007-09-10 04:29 --------- d-----w C:\Program Files\The Weather Channel FW 2007-09-05 06:28 8,508 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2007-09-03 21:11 --------- d-----w C:\Program Files\MP4 Player 2007-09-03 21:11 --------- d-----w C:\Program Files\K-Lite Codec Pack 2007-09-03 21:11 --------- d-----w C:\Documents and Settings\Isaac Mason\Application Data\Media Player Classic 2007-08-22 19:03 --------- d-----w C:\Program Files\LimeWire 2007-08-16 04:15 --------- d-----w C:\Program Files\eMusic Download Manager 2007-08-16 03:55 --------- d-----w C:\Program Files\Rhapsody 2007-08-16 03:49 --------- d-----w C:\Documents and Settings\Isaac Mason\Application Data\InstallShield 2007-08-16 03:46 8,413 ----a-w C:\WINDOWS\system32\drivers\mcstrm.sys 2007-08-16 03:46 --------- d-----w C:\Documents and Settings\Isaac Mason\Application Data\Real 2007-08-14 23:48 --------- d-----w C:\Program Files\MSN Messenger 2007-08-09 23:09 --------- d-----w C:\Program Files\Kodak 2007-08-09 23:09 --------- d-----w C:\Program Files\Common Files\Kodak 2007-08-09 23:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kodak 2007-07-31 02:54 229,732 ----a-w C:\WINDOWS\Burn4Free_Toolbar_Uninstaller_8953.exe 2007-07-31 01:19 92,504 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll 2007-07-31 01:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-07-31 01:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-07-31 01:19 549,720 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll 2007-07-31 01:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-07-31 01:19 53,080 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe 2007-07-31 01:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-07-31 01:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-07-31 01:19 325,976 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll 2007-07-31 01:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-07-31 01:19 203,096 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll 2007-07-31 01:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-07-31 01:19 1,712,984 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll 2007-07-31 01:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-07-31 01:18 33,624 ----a-w C:\WINDOWS\system32\dllcache\wups.dll 2007-07-01 07:12 2 ----a-w C:\Documents and Settings\Amalia Mally Mason\Application Data\xxx.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50] "SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-09-27 13:43] "Lexmark 4200 Series"="C:\Program Files\Lexmark 4200 Series\lxbmbmgr.exe" [2004-01-16 04:04] "FaxCenterServer4_in_1"="C:\Program Files\Lexmark 4200 Series\Fax\fm3032.exe" [2004-01-22 10:59] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AOL Fast Start"="C:\PROGRA~1\AOL9~1.0\AOL.exe" [2007-04-18 00:49] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-18 11:09] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, append.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Dell Network Assistant.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Dell Network Assistant.lnk backup=C:\WINDOWS\pss\Dell Network Assistant.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak software updater.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk backup=C:\WINDOWS\pss\Kodak software updater.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk backup=C:\WINDOWS\pss\QuickBooks Update Agent.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Vongo Tray.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Vongo Tray.lnk backup=C:\WINDOWS\pss\Vongo Tray.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ymetray.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ymetray.lnk backup=C:\WINDOWS\pss\ymetray.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Isaac Mason^Start Menu^Programs^Startup^LimeWire Acceleration Patch.lnk] path=C:\Documents and Settings\Isaac Mason\Start Menu\Programs\Startup\LimeWire Acceleration Patch.lnk backup=C:\WINDOWS\pss\LimeWire Acceleration Patch.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Isaac Mason^Start Menu^Programs^Startup^LimeWire On Startup.lnk] path=C:\Documents and Settings\Isaac Mason\Start Menu\Programs\Startup\LimeWire On Startup.lnk backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start] "C:\Program Files\AOL 9.0\AOL.EXE" -b [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASM] "C:\Program Files\AOL\Active Security Monitor\ASMonitor.exe" HIDEMAIN [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CashBuzz] C:\Program Files\CashBuzz v.3.2\cashbuzz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla] C:\WINDOWS\system32\dla\tfswctrl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray] C:\WINDOWS\ehome\ehtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer4_in_1] "C:\Program Files\Lexmark 4200 Series\Fax\fm3032.exe" /s [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gwiz] C:\WINDOWS\system32\arpl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager] C:\Program Files\Common Files\AOL\1191351858\ee\AOLSoftware.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers] C:\WINDOWS\system32\igfxpers.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray] C:\WINDOWS\system32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] "c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] %systemroot%\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 4200 Series] "C:\Program Files\Lexmark 4200 Series\lxbmbmgr.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=2 /w [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nektra OEAPI] "C:\Program Files\Mailinfo\Mailinfo for Outlook Express\oe_mailinfo.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedOptimizer] C:\PROGRA~1\SPEEDO~1\SPO.EXE -s [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "tmproxy"=2 (0x2) "TmPfw"=2 (0x2) "Tmntsrv"=2 (0x2) "PcCtlCom"=2 (0x2) R1 DcCam;Kodak Camera Proxy;C:\WINDOWS\system32\DRIVERS\DcCam.sys R2 DCFS2K;Kodak DCFS2K Driver;C:\WINDOWS\system32\drivers\dcfs2k.sys R2 elagopro;GoProto Protocol Driver for LELA;C:\WINDOWS\system32\DRIVERS\elagopro.sys R2 elaunidr;UniDriver for LELA;C:\WINDOWS\system32\DRIVERS\elaunidr.sys R2 sbbotdi;sbbotdi;\??\C:\PROGRA~1\SPEEDB~1\sbbotdi.sys S1 Exportit;Exportit;C:\WINDOWS\system32\DRIVERS\exportit.sys S3 DcFpoint;DcFpoint;C:\WINDOWS\system32\DRIVERS\DcFpoint.sys S3 DcLps;Legacy Polling Service;C:\WINDOWS\system32\DRIVERS\DcLps.sys S3 DcPTP;dcptp;C:\WINDOWS\system32\DRIVERS\DcPTP.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}] AutoRun\command - E:\setup.exe . Contents of the 'Scheduled Tasks' folder "2007-10-02 18:13:23 C:\WINDOWS\Tasks\McDefragTask.job" "2007-10-02 18:13:21 C:\WINDOWS\Tasks\McQcTask.job" - c:\PROGRA~1\mcafee\mqc\QcConsol.exe "2007-10-09 04:44:46 C:\WINDOWS\Tasks\MP Scheduled Scan.job" - C:\Program Files\Windows Defender\MpCmdRun.exe "2007-10-05 21:00:06 C:\WINDOWS\Tasks\Norton Security Scan.job" - C:\Program Files\Norton Security Scan\Nss.exe . ************************************************************************ catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-08 22:42:44 Windows 5.1.2600 Service Pack 2 NTFS detected NTDLL code modification: ZwClose scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ATWPKT2] "ImagePath"="\??\C:\WINDOWS\system32\drivers\ATWPKT2.SYS" . Completion time: 2007-10-08 22:45:46 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-10-08 22:45 . --- E O F --- Logfile of HijackThis v1.99.1 Scan saved at 7:48:40 AM, on 10/9/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Program Files\Dell Network Assistant\hnm_svc.exe C:\WINDOWS\system32\drivers\KodakCCS.exe C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe C:\PROGRA~1\McAfee\MSC\mcpromgr.exe c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Program Files\Spyware Doctor\svcntaux.exe C:\Program Files\Spyware Doctor\swdsvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\SPEEDB~1\VideoAcceleratorEngine.exe C:\WINDOWS\wanmpsvc.exe C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe C:\WINDOWS\ehome\mcrdsvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\System32\alg.exe c:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\Program Files\Spyware Doctor\SDTrayApp.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\PROGRA~1\AOL9~1.0\waol.exe C:\PROGRA~1\AOL9~1.0\shellmon.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\HijackThis\HijackThis.exe c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\Search\YSearchSuggest.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: GoogleAFE - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\GoogleAFE\GoogleAE.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: (no name) - {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - (no file) O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe" O4 - HKLM\..\Run: [Lexmark 4200 Series] "C:\Program Files\Lexmark 4200 Series\lxbmbmgr.exe" O4 - HKLM\..\Run: [FaxCenterServer4_in_1] "C:\Program Files\Lexmark 4200 Series\Fax\fm3032.exe" /s O4 - HKCU\..\Run: [AOL Fast Start] "C:\PROGRA~1\AOL9~1.0\AOL.EXE" -b O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10...I.cab55579.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10...y.cab55579.cab O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10...t.cab55579.cab O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab56986.cab O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn...tDetection.cab O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/40...rk/Coupons.cab O16 - DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} (CBSTIEPrint Class) - http://offers.e-centives.com/cif/dow...in/actxcab.cab O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} (LinkSys Content Update) - http://www.linksysfix.com/netcheck/6...l/gtdownls.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O16 - DPF: {C946EF6D-296D-4907-A6E1-ED0E8E5AF024} (LycosMail Upload Control) - http://mail.lycos.com/hanmail-ax/AttachMail.cab O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/.../en/crlocx.ocx O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10...y.cab55579.cab O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab57176.cab O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} - O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - https://www.secure-session.com/include/XUpload.ocx O16 - DPF: {FF3C5A9F-5A91-4930-80E8-4709194C2AD3} (CheckersZPA Object) - http://zone.msn.com/bingame/zpagames...A.cab55579.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing) O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe O23 - Service: VideoAcceleratorEngine - Speedbit Ltd. - C:\PROGRA~1\SPEEDB~1\VideoAcceleratorEngine.exe O23 - Service: Vongo Service - Starz Entertainment Group LLC - C:\Program Files\Vongo\VongoService.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe O23 - Service: WMP54Gv4SVC - Unknown owner - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe" "WMP54Gv4.exe (file missing)