Ok,
Here is my main.txt file. And the extra.txt is copied. Thanks!
Deckard's System Scanner v20071014.68
Run by Elana on 2008-05-19 20:44:03
Computer is in Normal Mode.
--------------------------------------------------------------------------------
-- System Restore --------------------------------------------------------------
Successfully created a Deckard's System Scanner Restore Point.
-- Last 5 Restore Point(s) --
42: 2008-05-20 00:44:13 UTC - RP472 - Deckard's System Scanner Restore Point
41: 2008-05-19 23:02:35 UTC - RP471 - Software Distribution Service 3.0
40: 2008-05-19 23:02:34 UTC - RP470 - System Checkpoint
39: 2008-05-19 23:02:34 UTC - RP469 - System Checkpoint
38: 2008-05-19 23:02:34 UTC - RP468 - Last known good configuration
-- First Restore Point --
1: 2008-05-19 23:02:32 UTC - RP431 - System Checkpoint
Backed up registry hives.
Performed disk cleanup.
System Drive C: has 1.5 GiB (less than 15%) free.
-- HijackThis (run as Elana.exe) -----------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:47:30 PM, on 5/19/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\DisplayLink Core Software\DisplayLinkService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\DisplayLink Core Software\DisplayLinkKensingtonSupport.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\DisplayLink Core Software\DisplayLinkUI.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\PROGRA~1\SYMANT~1\vptray.exe
C:\Program Files\Desksware\Calendar.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\TrojanHunter 5.0\THGuard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Documents and Settings\Elana\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Elana.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://softwarereferral.com/jump.php...MjI6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {12620774-0739-4E25-857E-02181F2FB1F1} - C:\WINDOWS\system32\awtqonkH.dll (file missing)
O2 - BHO: (no name) - {21BDBF8D-2E66-4130-B4FD-5A66816806A3} - C:\WINDOWS\system32\xxyvutRL.dll
O2 - BHO: (no name) - {490317C4-5A88-4CE0-9AFB-187A05D1CE02} - C:\WINDOWS\system32\ssqOFYRj.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {8F45C699-9372-4072-A41F-DF58D0F5E0CB} - C:\WINDOWS\system32\jkkHaBsq.dll (file missing)
O2 - BHO: (no name) - {97F7302A-147C-4435-901C-184375993BE6} - C:\WINDOWS\system32\efcYQigE.dll
O2 - BHO: QXK Rhythm - {BA99F228-D9E2-47D5-9A8D-A295E8E52E93} - C:\WINDOWS\fvowketqplo.dll
O2 - BHO: (no name) - {D9AE2128-515E-43E8-AB00-1A882CC6A89F} - C:\WINDOWS\system32\nnnllJab.dll (file missing)
O3 - Toolbar: pvnsmfor - {5AC18EE0-E9B2-428D-844F-6D3EEA227215} - C:\WINDOWS\pvnsmfor.dll (file missing)
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [EPSON Stylus C64 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2C1.EXE /P23 "EPSON Stylus C64 Series" /O6 "USB001" /M "Stylus C64"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\\vptray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [Calendar] C:\Program Files\Desksware\Calendar.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [c00ccc95] rundll32.exe "C:\WINDOWS\system32\fqcpybuc.dll",b
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 5.0\THGuard.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe (User 'Default user')
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot\SDHelper.dll
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
https://fpdownload.macromedia.com/pu...sh/swflash.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: efcYQigE - C:\WINDOWS\SYSTEM32\efcYQigE.dll
O21 - SSODL: mpfanvqg - {90DE9082-22EF-48F0-B2D0-B9F2E42C665B} - C:\WINDOWS\mpfanvqg.dll
O21 - SSODL: vbksrofa - {A6A529D7-F35E-4FCC-AAE4-C3D50996FE5B} - C:\WINDOWS\vbksrofa.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Ad-Aware\aawservice.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: DisplayLink Service (DisplayLinkService) - DisplayLink Corp. - C:\Program Files\DisplayLink Core Software\DisplayLinkService.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Desktop Manager 5.5.709.30344 (GoogleDesktopManager-093007-112848) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm
--
End of file - 12191 bytes
-- File Associations -----------------------------------------------------------
All associations okay.
-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------
R2 AegisP (AEGIS Protocol (IEEE 802.1x) v3.6.0.0) - c:\windows\system32\drivers\aegisp.sys <Not Verified; Meetinghouse Data Communications; AEGIS Client 3.6.0.0>
R2 s24trans (WLAN Transport) - c:\windows\system32\drivers\s24trans.sys <Not Verified; Intel Corporation; Intel Wireless LAN Packet Driver>
S0 cercsr6 - c:\windows\system32\drivers\cercsr6.sys <Not Verified; Adaptec, Inc.; Dell RAID Controller>
S3 new_drv (!!!!) - c:\windows\new_drv.sys (file missing)
S3 newnhamusbport (USB Display Adapter) - c:\windows\system32\drivers\newnhamusbport.sys (file missing)
S3 UIUSys (Conexant Setup API) - c:\windows\system32\drivers\uiusys.sys (file missing)
-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------
R2 DisplayLinkService (DisplayLink Service) - "c:\program files\displaylink core software\displaylinkservice.exe" <Not Verified; DisplayLink Corp.; DisplayLink Core Software v4.2.6975.0>
R2 RegSrvc (Intel(R) PROSet/Wireless Registry Service) - c:\program files\intel\wireless\bin\regsrvc.exe <Not Verified; Intel Corporation; Intel(R) PROSet/Wireless Registry Service>
R2 Viewpoint Manager Service - "c:\program files\viewpoint\common\viewpointservice.exe" <Not Verified; Viewpoint Corporation; Viewpoint Manager>
R2 WLANKEEPER (Intel(R) PROSet/Wireless SSO Service) - c:\program files\intel\wireless\bin\wlkeeper.exe <Not Verified; Intel(R) Corporation; SSO Service>
S3 x10nets (X10 Device Network Service) - c:\progra~1\common~1\x10\common\x10nets.exe <Not Verified; X10; x10 Module>
S4 FLEXnet Licensing Service - "c:\program files\common files\macrovision shared\flexnet publisher\fnplicensingservice.exe" <Not Verified; Macrovision Europe Ltd.; FLEXnet Publisher (32 bit)>
-- Device Manager: Disabled ----------------------------------------------------
Class GUID:
Description: AX88772
Device ID: USB\VID_0B95&PID_7720\000001
Manufacturer:
Name: AX88772
PNP Device ID: USB\VID_0B95&PID_7720\000001
Service:
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Base System Device
Device ID: PCI\VEN_1180&DEV_0843&SUBSYS_01D81028&REV_01\4&2FE911E8&0&0AF0
Manufacturer:
Name: Base System Device
PNP Device ID: PCI\VEN_1180&DEV_0843&SUBSYS_01D81028&REV_01\4&2FE911E8&0&0AF0
Service:
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Base System Device
Device ID: PCI\VEN_1180&DEV_0592&SUBSYS_01D81028&REV_0A\4&2FE911E8&0&0BF0
Manufacturer:
Name: Base System Device
PNP Device ID: PCI\VEN_1180&DEV_0592&SUBSYS_01D81028&REV_0A\4&2FE911E8&0&0BF0
Service:
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Base System Device
Device ID: PCI\VEN_1180&DEV_0852&SUBSYS_01D81028&REV_05\4&2FE911E8&0&0CF0
Manufacturer:
Name: Base System Device
PNP Device ID: PCI\VEN_1180&DEV_0852&SUBSYS_01D81028&REV_05\4&2FE911E8&0&0CF0
Service:
-- Scheduled Tasks -------------------------------------------------------------
2008-05-08 22:27:09 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
-- Files created between 2008-04-19 and 2008-05-19 -----------------------------
2008-05-19 20:30:46 0 d-------- C:\WINDOWS\privacy_danger
2008-05-19 19:03:12 91264 --a------ C:\WINDOWS\system32\fqcpybuc.dll
2008-05-19 19:02:22 912208 --ahs---- C:\WINDOWS\system32\LRtuvyxx.ini2
2008-05-19 19:02:19 318336 --a------ C:\WINDOWS\system32\xxyvutRL.dll
2008-05-19 19:01:39 0 d-------- C:\Documents and Settings\Administrator\Application Data\Macromedia
2008-05-19 19:01:39 0 d-------- C:\Documents and Settings\Administrator\Application Data\Adobe
2008-05-19 19:01:17 0 d-------- C:\Documents and Settings\Administrator\Application Data\Talkback
2008-05-19 18:57:18 0 d-------- C:\Documents and Settings\Administrator\Application Data\Mozilla
2008-05-15 07:24:38 1022080 --ahs---- C:\WINDOWS\system32\jRYFOqss.ini2
2008-05-15 07:24:34 318848 --a------ C:\WINDOWS\system32\ssqOFYRj.dll
2008-05-15 07:15:55 0 d-------- C:\Documents and Settings\Administrator\Application Data\TrojanHunter
2008-05-14 19:56:03 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-05-14 19:34:38 0 d-------- C:\Program Files\Trend Micro
2008-05-14 19:33:22 0 --a------ C:\WINDOWS\system32\frbbpomt.dll
2008-05-14 19:32:40 1102150 --ahs---- C:\WINDOWS\system32\Hknoqtwa.ini2
2008-05-13 20:00:57 0 d-------- C:\Documents and Settings\Elana\Application Data\TrojanHunter
2008-05-13 19:57:27 62910 --a------ C:\Program Files\Uninstall.exe <Not Verified; $PROGRAMNAME; $PROGRAMNAME>
2008-05-13 19:57:27 0 --a------ C:\Program Files\uninstall.dat
2008-05-13 09:14:44 0 d-------- C:\Program Files\TrojanHunter 5.0
2008-05-13 08:44:02 958804 --ahs---- C:\WINDOWS\system32\baJllnnn.ini2
2008-05-12 23:01:59 0 d--h----- C:\Documents and Settings\Administrator\Templates
2008-05-12 23:01:59 0 dr------- C:\Documents and Settings\Administrator\Start Menu
2008-05-12 23:01:59 0 dr-h----- C:\Documents and Settings\Administrator\SendTo
2008-05-12 23:01:59 0 d--h----- C:\Documents and Settings\Administrator\Recent
2008-05-12 23:01:59 0 d--h----- C:\Documents and Settings\Administrator\PrintHood
2008-05-12 23:01:59 0 d--h----- C:\Documents and Settings\Administrator\NetHood
2008-05-12 23:01:59 0 d-------- C:\Documents and Settings\Administrator\My Documents
2008-05-12 23:01:59 0 d--h----- C:\Documents and Settings\Administrator\Local Settings
2008-05-12 23:01:59 0 d-------- C:\Documents and Settings\Administrator\Favorites
2008-05-12 23:01:59 0 d-------- C:\Documents and Settings\Administrator\Desktop
2008-05-12 23:01:59 0 d--hs---- C:\Documents and Settings\Administrator\Cookies
2008-05-12 23:01:59 0 dr-h----- C:\Documents and Settings\Administrator\Application Data
2008-05-12 23:01:59 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2008-05-12 23:01:59 0 d-------- C:\Documents and Settings\Administrator\Application Data\Intel
2008-05-12 23:01:58 524288 --ah----- C:\Documents and Settings\Administrator\NTUSER.DAT
2008-05-12 18:21:00 0 d-------- C:\Documents and Settings\Elana\Application Data\TmpRecentIcons
2008-05-12 16:53:13 56664 --ahs---- C:\WINDOWS\system32\qsBaHkkj.ini2
2008-05-12 16:48:09 1 --a------ C:\WINDOWS\system32\kr_done1de
2008-05-12 16:48:05 29312 --a------ C:\WINDOWS\system32\efcYQigE.dll
2008-05-12 16:47:57 81920 --a------ C:\WINDOWS\oadkxrts.exe
2008-05-12 16:47:57 167936 --a------ C:\WINDOWS\mpfanvqg.dll
2008-05-12 16:47:57 217088 --a------ C:\WINDOWS\fvowketqplo.dll
-- Find3M Report ---------------------------------------------------------------
2008-05-19 20:33:22 0 d-------- C:\Program Files\Trillian
2008-05-19 20:31:03 0 d-------- C:\Program Files\Symantec AntiVirus
2008-05-11 18:18:52 0 d-------- C:\Program Files\PokerStars
2008-05-11 17:00:33 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-05-11 16:59:38 0 d-------- C:\Program Files\EPSON
2008-05-11 16:57:13 0 d-------- C:\Program Files\Common Files
2008-04-19 12:50:58 0 d-------- C:\Program Files\Apple Software Update
2008-04-06 12:55:50 0 d-------- C:\Documents and Settings\Elana\Application Data\BitTorrent
2008-04-05 11:55:29 0 d-------- C:\Program Files\iTunes
2008-04-05 11:55:07 0 d-------- C:\Program Files\iPod
2008-04-05 11:52:04 0 d-------- C:\Program Files\QuickTime
2008-03-30 22:30:20 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-03-30 22:26:59 0 d-------- C:\Program Files\ABC Amber WordPerfect Converter
2008-03-30 21:30:30 0 d-------- C:\Program Files\Ad-Aware
2008-03-29 18:24:47 0 d-------- C:\Documents and Settings\Elana\Application Data\ooVoo Details
2008-03-29 18:24:31 0 d-------- C:\Program Files\ooVoo
2008-03-22 10:16:41 0 d-------- C:\Program Files\Spybot
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{12620774-0739-4E25-857E-02181F2FB1F1}]
C:\WINDOWS\system32\awtqonkH.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{21BDBF8D-2E66-4130-B4FD-5A66816806A3}]
05/19/2008 07:02 PM 318336 --a------ C:\WINDOWS\system32\xxyvutRL.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{490317C4-5A88-4CE0-9AFB-187A05D1CE02}]
05/15/2008 07:24 AM 318848 --a------ C:\WINDOWS\system32\ssqOFYRj.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8F45C699-9372-4072-A41F-DF58D0F5E0CB}]
C:\WINDOWS\system32\jkkHaBsq.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{97F7302A-147C-4435-901C-184375993BE6}]
05/12/2008 04:48 PM 29312 --a------ C:\WINDOWS\system32\efcYQigE.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BA99F228-D9E2-47D5-9A8D-A295E8E52E93}]
05/12/2008 01:24 PM 217088 --a------ C:\WINDOWS\fvowketqplo.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D9AE2128-515E-43E8-AB00-1A882CC6A89F}]
C:\WINDOWS\system32\nnnllJab.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [10/18/2006 07:04 PM]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [10/18/2006 06:58 PM]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [03/08/2006 01:48 PM]
"SigmatelSysTrayApp"="stsystra.exe" [03/24/2006 06:30 PM C:\WINDOWS\stsystra.exe]
"itype"="C:\Program Files\Microsoft IntelliType Pro\itype.exe" [07/07/2006 07:14 PM]
"EPSON Stylus C64 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2C1.exe" []
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [07/14/2006 06:07 PM]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [07/14/2006 06:04 PM]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [07/14/2006 06:08 PM]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [07/19/2006 07:26 PM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25 AM]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [02/05/2007 07:52 PM]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [10/14/2007 12:27 PM]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [10/25/2007 05:33 PM]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [10/25/2007 05:37 PM]
"vptray"="C:\PROGRA~1\SYMANT~1\\vptray.exe" [09/27/2006 08:33 PM]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 11:16 PM]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [07/15/2005 05:48 PM]
"Calendar"="C:\Program Files\Desksware\Calendar.exe" [03/10/2008 11:30 PM]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [03/28/2008 11:37 PM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [03/30/2008 10:36 AM]
"c00ccc95"="C:\WINDOWS\system32\fqcpybuc.dll" [05/19/2008 07:03 PM]
"THGuard"="C:\Program Files\TrojanHunter 5.0\THGuard.exe" [03/25/2008 07:08 PM]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 06:00 AM]
C:\Documents and Settings\Elana\Start Menu\Programs\Startup\
Trillian.lnk - C:\Program Files\Trillian\trillian.exe [12/11/2007 1:00:00 AM]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= file:///C:\WINDOWS\privacy_danger\index.htm
FriendlyName= Privacy Protection
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{97F7302A-147C-4435-901C-184375993BE6}"= C:\WINDOWS\system32\efcYQigE.dll [05/12/2008 04:48 PM 29312]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"mpfanvqg"= {90DE9082-22EF-48F0-B2D0-B9F2E42C665B} - C:\WINDOWS\mpfanvqg.dll [05/12/2008 01:23 PM 167936]
"vbksrofa"= {A6A529D7-F35E-4FCC-AAE4-C3D50996FE5B} - C:\WINDOWS\vbksrofa.dll [ ]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcYQigE]
efcYQigE.dll 05/12/2008 04:48 PM 29312 C:\WINDOWS\system32\efcYQigE.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\xxyvutRL
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc p2psvc p2pimsvc p2pgasvc PNRPSvc
hpdevmgmt hpqcxs08 hpqddsvc
-- Hosts -----------------------------------------------------------------------
127.0.0.1 hityou.com
127.0.0.1
www.hityou.com
127.0.0.1 180searchassistant.com
127.0.0.1
www.180searchassistant.com
127.0.0.1 180solutions.com
127.0.0.1
www.180solutions.com
127.0.0.1 bis.180solutions.com
127.0.0.1 config.180solutions.com
127.0.0.1 cts.180solutions.com
127.0.0.1 downloads.180solutions.com
6641 more entries in hosts file.
-- End of Deckard's System Scanner: finished at 2008-05-19 20:49:11 ------------