Tech Support Forum - View Single Post - Re: Posted Logs-need Spyware Removal Help

adasha · 01-17-2008, 09:18 PM

Geez! When I tried to remove Winable, it kept freezing my computer. I had to go into the C: drive and search for all files with that in it, then delete those, then go to add/remove and remove it from there. It was very stubborn!

Here is the log.txt:

ComboFix 08-01-09.2 - Adasha Knight 2008-01-17 19:05:20.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.734 [GMT -6:00]
Running from: C:\Documents and Settings\Adasha Knight\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Adasha Knight\My Documents\CROSOF~1
C:\Program Files\Common Files\Real\Update_OB\realsched .exe
C:\Program Files\Common Files\tsks~1
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\myglobalsearch
C:\Program Files\myglobalsearch\bar\History\search
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\Temporary
C:\WINDOWS\mrofinu72.exe
C:\WINDOWS\system32\bhxjtvbx.dll
C:\WINDOWS\system32\ddrawe.dll
C:\WINDOWS\system32\dobe~1
C:\WINDOWS\system32\drivers\qlgojmza.dat
C:\WINDOWS\system32\goyanatn.ini
C:\WINDOWS\system32\hggefec.dll
C:\WINDOWS\system32\jtsxmesu.dll
C:\WINDOWS\system32\ntanayog.dll
C:\WINDOWS\system32\rtutv.ini
C:\WINDOWS\system32\rtutv.ini2
C:\WINDOWS\system32\rutjgknp.exe
C:\WINDOWS\system32\vtutr.dll
C:\WINDOWS\system32\vtutr.exe
C:\WINDOWS\system32\wapiicomsv.exe
C:\WINDOWS\system32\wnsxs~1
C:\WINDOWS\system32\wsnpoem
C:\WINDOWS\system32\wsnpoem\audio.dll
C:\WINDOWS\system32\wsnpoem\audio.dll.cla
C:\WINDOWS\system32\wsnpoem\video.dll

Code:

 <pre>
C:\Program Files\Common Files\Real\Update_OB\realsched .exe ---> QooBox
C:\Program Files\Intel\Wireless\Bin\ifrmewrk .exe ---> ifrmewrk.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched .exe ---> jusched.exe
C:\Program Files\QuickTime\qttask    .exe ---> qttask.exe
</pre>

.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\LEGACY_KMNFBMDR
-------\DomainService
-------\kmnfbmdr

((((((((((((((((((((((((( Files Created from 2007-12-18 to 2008-01-18 )))))))))))))))))))))))))))))))
.

2008-01-17 19:01 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-15 21:10 . 2008-01-15 21:10 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-09 14:31 . 2008-01-09 14:31 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-01-09 14:30 . 2008-01-09 14:30 <DIR> d-------- C:\ie-spyad_zo
2008-01-09 11:50 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\system32\drivers\SDTHOOK.SYS
2008-01-09 11:29 . 2008-01-09 13:47 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-01-09 11:29 . 2008-01-09 11:29 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-01-09 11:29 . 2008-01-09 11:29 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-01-09 11:29 . 2008-01-09 11:29 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-01-08 21:01 . 2008-01-08 21:01 <DIR> d-------- C:\Deckard
2008-01-04 23:31 . 2008-01-04 23:31 294 --ahs---- C:\WINDOWS\system32\cdsjfwqt.ini
2007-12-27 22:30 . 2007-12-27 22:30 <DIR> d-------- C:\VundoFix Backups
2007-12-23 12:40 . 2008-01-05 14:23 <DIR> d-------- C:\Program Files\AIMTunes
2007-12-23 12:27 . 2007-12-23 12:27 4,286 --a------ C:\WINDOWS\system32\MobileSidewalk.ico
2007-12-23 02:20 . 2007-12-24 00:50 382,464 --a------ C:\WINDOWS\mrofinu72.exe.tmp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-18 01:22 --------- d-----w C:\Program Files\QuickTime
2008-01-16 13:49 --------- d-----w C:\Program Files\Java
2008-01-09 19:15 --------- d-----w C:\Program Files\Lexmark 1200 Series
2008-01-09 19:09 --------- d-----w C:\Program Files\DIGStream
2007-12-23 18:42 --------- d-----w C:\Program Files\AIM6
2007-12-23 18:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL Downloads
2007-12-06 23:43 --------- d-----w C:\Program Files\LimeWire
2007-09-23 16:03 25,336 ----a-w C:\Documents and Settings\Adasha Knight\Application Data\GDIPFONTCACHEV1.DAT
2007-09-09 16:35 14,738 ----a-w C:\Program Files\videodownloader-1.1.1-fx.xpi
2007-01-19 04:36 722,176 ----a-w C:\Documents and Settings\Adasha Knight\gotomypc_428.exe
2006-06-25 02:14 5,244 ----a-w C:\Program Files\me 06 (84 x 114).jpg
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2008-01-17 18:40 385024]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2008-01-17 18:40 83608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-01-08 18:04 4898816]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-27 19:17 443968]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 18:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

S3 akshasp;Aladdin HASP Key;C:\WINDOWS\system32\DRIVERS\akshasp.sys [2005-07-20 20:08]

.
Contents of the 'Scheduled Tasks' folder
"2007-09-14 23:29:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-17 19:23:49
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-17 19:28:19 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-18 01:28:14
.
2007-07-12 03:53:47 --- E O F ---

Here is the HIJACK:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:17:42 PM, on 1/17/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1189315894890
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.dotphoto.com/ImageUploader4.cab
O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/download...2/axofupld.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://games.pogo.com/online2/pogo/b...ploader_v6.cab
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 4002 bytes

Thanks again!!!

01-17-2008, 09:18 PM	#5 (permalink)
adasha Registered User Join Date: Jan 2008 Location: Texas Posts: 12 OS: Windows XP	Re: Posted Logs-need Spyware Removal Help Geez! When I tried to remove Winable, it kept freezing my computer. I had to go into the C: drive and search for all files with that in it, then delete those, then go to add/remove and remove it from there. It was very stubborn! Here is the log.txt: ComboFix 08-01-09.2 - Adasha Knight 2008-01-17 19:05:20.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.734 [GMT -6:00] Running from: C:\Documents and Settings\Adasha Knight\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Adasha Knight\My Documents\CROSOF~1 C:\Program Files\Common Files\Real\Update_OB\realsched .exe C:\Program Files\Common Files\tsks~1 C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\myglobalsearch C:\Program Files\myglobalsearch\bar\History\search C:\Program Files\QuickTime\qttask .exe C:\Program Files\QuickTime\qttask .exe C:\Program Files\QuickTime\qttask .exe C:\Program Files\Temporary C:\WINDOWS\mrofinu72.exe C:\WINDOWS\system32\bhxjtvbx.dll C:\WINDOWS\system32\ddrawe.dll C:\WINDOWS\system32\dobe~1 C:\WINDOWS\system32\drivers\qlgojmza.dat C:\WINDOWS\system32\goyanatn.ini C:\WINDOWS\system32\hggefec.dll C:\WINDOWS\system32\jtsxmesu.dll C:\WINDOWS\system32\ntanayog.dll C:\WINDOWS\system32\rtutv.ini C:\WINDOWS\system32\rtutv.ini2 C:\WINDOWS\system32\rutjgknp.exe C:\WINDOWS\system32\vtutr.dll C:\WINDOWS\system32\vtutr.exe C:\WINDOWS\system32\wapiicomsv.exe C:\WINDOWS\system32\wnsxs~1 C:\WINDOWS\system32\wsnpoem C:\WINDOWS\system32\wsnpoem\audio.dll C:\WINDOWS\system32\wsnpoem\audio.dll.cla C:\WINDOWS\system32\wsnpoem\video.dll Code: <pre> C:\Program Files\Common Files\Real\Update_OB\realsched .exe ---> QooBox C:\Program Files\Intel\Wireless\Bin\ifrmewrk .exe ---> ifrmewrk.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched .exe ---> jusched.exe C:\Program Files\QuickTime\qttask .exe ---> qttask.exe </pre> . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_DOMAINSERVICE -------\LEGACY_KMNFBMDR -------\DomainService -------\kmnfbmdr ((((((((((((((((((((((((( Files Created from 2007-12-18 to 2008-01-18 ))))))))))))))))))))))))))))))) . 2008-01-17 19:01 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2008-01-15 21:10 . 2008-01-15 21:10 <DIR> d-------- C:\Program Files\Trend Micro 2008-01-09 14:31 . 2008-01-09 14:31 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-01-09 14:30 . 2008-01-09 14:30 <DIR> d-------- C:\ie-spyad_zo 2008-01-09 11:50 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\system32\drivers\SDTHOOK.SYS 2008-01-09 11:29 . 2008-01-09 13:47 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2008-01-09 11:29 . 2008-01-09 11:29 30,590 --a------ C:\WINDOWS\system32\pavas.ico 2008-01-09 11:29 . 2008-01-09 11:29 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico 2008-01-09 11:29 . 2008-01-09 11:29 1,406 --a------ C:\WINDOWS\system32\Help.ico 2008-01-08 21:01 . 2008-01-08 21:01 <DIR> d-------- C:\Deckard 2008-01-04 23:31 . 2008-01-04 23:31 294 --ahs---- C:\WINDOWS\system32\cdsjfwqt.ini 2007-12-27 22:30 . 2007-12-27 22:30 <DIR> d-------- C:\VundoFix Backups 2007-12-23 12:40 . 2008-01-05 14:23 <DIR> d-------- C:\Program Files\AIMTunes 2007-12-23 12:27 . 2007-12-23 12:27 4,286 --a------ C:\WINDOWS\system32\MobileSidewalk.ico 2007-12-23 02:20 . 2007-12-24 00:50 382,464 --a------ C:\WINDOWS\mrofinu72.exe.tmp . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-18 01:22 --------- d-----w C:\Program Files\QuickTime 2008-01-16 13:49 --------- d-----w C:\Program Files\Java 2008-01-09 19:15 --------- d-----w C:\Program Files\Lexmark 1200 Series 2008-01-09 19:09 --------- d-----w C:\Program Files\DIGStream 2007-12-23 18:42 --------- d-----w C:\Program Files\AIM6 2007-12-23 18:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL Downloads 2007-12-06 23:43 --------- d-----w C:\Program Files\LimeWire 2007-09-23 16:03 25,336 ----a-w C:\Documents and Settings\Adasha Knight\Application Data\GDIPFONTCACHEV1.DAT 2007-09-09 16:35 14,738 ----a-w C:\Program Files\videodownloader-1.1.1-fx.xpi 2007-01-19 04:36 722,176 ----a-w C:\Documents and Settings\Adasha Knight\gotomypc_428.exe 2006-06-25 02:14 5,244 ----a-w C:\Program Files\me 06 (84 x 114).jpg . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Aim6"="" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2008-01-17 18:40 385024] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2008-01-17 18:40 83608] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-01-08 18:04 4898816] "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-27 19:17 443968] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless] C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 18:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll S3 akshasp;Aladdin HASP Key;C:\WINDOWS\system32\DRIVERS\akshasp.sys [2005-07-20 20:08] . Contents of the 'Scheduled Tasks' folder "2007-09-14 23:29:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************ catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-17 19:23:49 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . Completion time: 2008-01-17 19:28:19 - machine was rebooted ComboFix-quarantined-files.txt 2008-01-18 01:28:14 . 2007-07-12 03:53:47 --- E O F --- Here is the HIJACK: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:17:42 PM, on 1/17/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe C:\Program Files\AIM6\aim6.exe C:\Program Files\AIM6\aolsoftware.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/ O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1189315894890 O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.dotphoto.com/ImageUploader4.cab O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/download...2/axofupld.cab O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://games.pogo.com/online2/pogo/b...ploader_v6.cab O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe -- End of file - 4002 bytes Thanks again!!!