Virus Java/ByteVerify, Downloader.Zlob, Trojanhorse & more.

cableguy · 04-19-2008, 01:40 AM

Hi Security Team,

My pc has been infected for quite some time. I believe there are a lot of viruses and spywares inside this system. AVG's not protecting my system. All programs seem to load very slow. It took ages to just click the Start button. Would appreciate if you could attend this as soon as possible. I've attached the following for your analysis.

Deckard's System Scanner v20071014.68
Run by Administrator on 2008-04-19 16:24:37
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.

-- Last 5 Restore Point(s) --
66: 2008-04-19 08:24:54 UTC - RP454 - Deckard's System Scanner Restore Point
65: 2008-04-19 07:49:10 UTC - RP453 - Removed InstallShield Restore Point
64: 2008-04-12 12:25:39 UTC - RP452 - Configured Your Application Name
63: 2008-04-12 12:24:30 UTC - RP451 - Configured Your Application Name
62: 2008-04-12 12:23:37 UTC - RP450 - Removed E-Center

-- First Restore Point --
1: 2008-03-29 11:56:50 UTC - RP389 - Configured VeohTV BETA

Backed up registry hives.
Performed disk cleanup.

Percentage of Memory in Use: 78% (more than 75%).
Total Physical Memory: 192 MiB (512 MiB recommended).

-- HijackThis Clone ------------------------------------------------------------

Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-04-19 16:26:45
Platform: Windows XP Service Pack 1 (5.01.2600)
MSIE: Internet Explorer (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator.PPC1\Desktop\dss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sg.news.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://sg.rd.yahoo.com/customize/ie/...rch.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: (no name) - {01FE095B-4190-4DBA-B26D-EBB863DF7709} - (no file)
O2 - BHO: (no name) - {071B64CC-DE4C-4B08-B602-77F75A025082} - (no file)
O2 - BHO: (no name) - {075B14B3-6DE7-4A31-B4F1-342889EBD917} - (no file)
O2 - BHO: (no name) - {0C232A58-86E4-47E5-886D-06F32942593B} - (no file)
O2 - BHO: (no name) - {0CC1AB92-52E3-4409-9AFF-DF66BECD8016} - (no file)
O2 - BHO: e404 helper - {0D574C9F-71F9-4F3C-BA6D-CF9C0E1E3EE8} - (no file)
O2 - BHO: (no name) - {10E99DAB-7A56-4B0F-AB3C-EF88F820FC4B} - (no file)
O2 - BHO: (no name) - {143588E2-A11A-4D26-B0E4-93AEB570C73B} - (no file)
O2 - BHO: (no name) - {19494287-4D36-409F-A390-D20E710F183E} - (no file)
O2 - BHO: (no name) - {1F366527-E8E8-415F-8084-35D323B3DEF3} - (no file)
O2 - BHO: (no name) - {24D26DEA-79DD-4BB9-852B-1282CDC5883C} - (no file)
O2 - BHO: (no name) - {26572950-42D5-4BA0-AB12-952768FE5912} - (no file)
O2 - BHO: (no name) - {2A6F87E4-F627-4EA9-B591-3A9761E542A4} - C:\WINDOWS\system32\ssqpm.dll
O2 - BHO: (no name) - {2A777FBB-7D94-48E8-8E73-93A34C9BE2C0} - (no file)
O2 - BHO: (no name) - {2CE4736D-4A1F-4A93-9461-8FEE22B3AB99} - (no file)
O2 - BHO: (no name) - {3725752F-AD3A-4932-9BA1-16AA24A2C6F5} - (no file)
O2 - BHO: (no name) - {3CDED179-60A5-4C6F-8342-1C4FEDFEED86} - (no file)
O2 - BHO: (no name) - {46A2C00B-8F57-4226-B63F-5DA017A20615} - (no file)
O2 - BHO: (no name) - {49EC75A6-40D4-410B-BA49-4B99D9E816D8} - (no file)
O2 - BHO: (no name) - {4B473956-D85C-4AE2-B83B-BA3FAC032A4F} - (no file)
O2 - BHO: (no name) - {4DBCE191-C000-4550-AC87-88601CA93691} - (no file)
O2 - BHO: (no name) - {4E0C3F4B-AE09-4207-AD98-46E4A09FB553} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {54E13E07-EEF0-48CB-B9DC-B4120190C3D5} - (no file)
O2 - BHO: (no name) - {576E9541-10E7-4FB3-B1E3-DB791DB57F53} - (no file)
O2 - BHO: (no name) - {5A9FC9BA-CF40-4BFA-9925-16E9DF194D77} - (no file)
O2 - BHO: (no name) - {6346BC9B-5719-402E-80E3-C10D369BF188} - (no file)
O2 - BHO: (no name) - {6860A44B-5D3E-433D-A7B5-D517F810D0E7} - (no file)
O2 - BHO: (no name) - {6AE8AD21-151E-471D-8A8D-61EE1C0B8586} - (no file)
O2 - BHO: (no name) - {71FA1D38-FCBE-4416-A3CD-32E047E8C542} - (no file)
O2 - BHO: (no name) - {74E45A97-521B-4CBF-9129-68CB2A1E5914} - (no file)
O2 - BHO: (no name) - {7647359E-E67F-417C-8389-CF7BEA5C13B7} - (no file)
O2 - BHO: (no name) - {7B34FFD7-AA7E-4355-91E3-DC5DE6E348EC} - (no file)
O2 - BHO: (no name) - {83F95AFE-B677-45A8-BDB0-CB12FB98BD1C} - (no file)
O2 - BHO: (no name) - {89EFD49D-5D90-4F20-ADED-DA130B4A5BB5} - (no file)
O2 - BHO: (no name) - {8D5849C4-93F3-429D-FF34-260A2068897C} - (no file)
O2 - BHO: (no name) - {906F1B82-C722-419D-B26C-D9A42A3FBD57} - (no file)
O2 - BHO: (no name) - {90B2364C-F844-4069-8293-B151F070994B} - (no file)
O2 - BHO: (no name) - {986BC75D-E8A5-43A7-8971-052FC88F5036} - (no file)
O2 - BHO: (no name) - {9C166FBD-B031-4811-96F6-4D37F1E824CB} - (no file)
O2 - BHO: (no name) - {9ECCAF33-BED5-430D-8FA9-ED1552142CA6} - (no file)
O2 - BHO: (no name) - {9ED47DF6-1920-4FAF-B6EF-C795D2D9B66C} - (no file)
O2 - BHO: (no name) - {9FDBEF6C-3D64-45CA-A116-5BB97C522D94} - (no file)
O2 - BHO: (no name) - {A0AAC1AB-EB9E-4951-B576-F48F26105EE3} - (no file)
O2 - BHO: (no name) - {A3752E3C-6641-4F0C-A86B-B11F08CE933C} - (no file)
O2 - BHO: (no name) - {AB79E329-7FA2-4B34-813A-3AED19DF6EEB} - (no file)
O2 - BHO: (no name) - {AD4A5016-1188-49E9-8E07-C4323D4A2F97} - (no file)
O2 - BHO: (no name) - {B55157E8-AE0C-4178-87AA-7250CC69D9C3} - (no file)
O2 - BHO: (no name) - {B7D042F5-725B-4E41-8AA2-3508E3BC923B} - (no file)
O2 - BHO: (no name) - {C3BBFF18-D9A8-4156-B50E-2270640C59EE} - (no file)
O2 - BHO: (no name) - {C657C484-9142-49BA-BB2B-FA6E9C052411} - (no file)
O2 - BHO: (no name) - {C79F0C77-A964-4DDA-A503-5580ACB6ED4B} - (no file)
O2 - BHO: (no name) - {CEF5D03D-A74B-4D14-B4E4-EC8551695F0E} - (no file)
O2 - BHO: (no name) - {D5EF16DE-C074-4F4B-8308-A2241B2DFADE} - (no file)
O2 - BHO: (no name) - {D72446DB-8675-4002-81B2-0366CF1EC30E} - (no file)
O2 - BHO: (no name) - {D9546BB4-7243-4C63-962F-B80D55D8A443} - (no file)
O2 - BHO: (no name) - {DA94A918-1C4A-4437-A758-06759AFEBE96} - (no file)
O2 - BHO: (no name) - {DB6CB071-CF57-41DC-A77A-FBEDD535EE93} - (no file)
O2 - BHO: (no name) - {E2F8F7C7-954D-4336-BA99-27BFBEB73DAF} - C:\WINDOWS\system32\byxxwxy.dll
O2 - BHO: (no name) - {E4EDCD5E-0E84-452A-B8B6-6887FF0D43CC} - (no file)
O2 - BHO: (no name) - {E9438E2B-A47D-4285-A56F-037A965CA27B} - C:\WINDOWS\System32\pmkji.dll (file missing)
O2 - BHO: (no name) - {ECC90355-9BCE-4D55-9F4F-BF69BADA76E3} - (no file)
O2 - BHO: (no name) - {EDAE651D-7C91-4759-B160-200CEB8C781E} - (no file)
O2 - BHO: (no name) - {EDE8E8B2-28E8-4C6C-9688-F6D1065A59D7} - (no file)
O2 - BHO: (no name) - {F6210944-A83B-49EC-9E5E-8E69EFB07E30} - (no file)
O2 - BHO: (no name) - {FEB64E52-187A-48C6-87E1-E0C0B1C06014} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: (no name) - {DB9FBA9D-AB1B-4CC6-9745-F3B549D64E40} - (no file)
O4 - HKLM\..\Run: [\\Nasir\EPSON Stylus Photo R230 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIP.EXE /P38 "\\Nasir\EPSON Stylus Photo R230 Series" /O6 "USB002" /M "Stylus Photo R230"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [BM0ff3070b] Rundll32.exe "C:\WINDOWS\System32\tljjsfmd.dll",s
O4 - HKLM\..\Policies\Explorer\Run: [some] C:\Program Files\NetProject\scit.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Ebates - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm
O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.iefixgate.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.iefixgate.com/redirect.php (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} () - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} () - http://v4.windowsupdate.microsoft.co...163.1007638889
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O17 - HKLM\Software\..\Telephony: DomainName = sg.muhammadiyah.intra
O17 - HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: Domain = sg.muhammadiyah.intra
O17 - HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: Domain = sg.muhammadiyah.intra
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: Domain = sg.muhammadiyah.intra
O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL
O18 - Protocol: lid - {5C135180-9973-46D9-ABF4-148267CBB8BF} - C:\WINDOWS\system32\msvidctl.dll
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL
O20 - Winlogon Notify: byxxwxy - C:\WINDOWS\System32\byxxwxy.dll
O22 - SharedTaskScheduler: Hex port setting - {8D5849C4-93F3-429D-FF34-260A2068897C} - (no file)
O22 - SharedTaskScheduler: hyperproduction - {9d19a1a9-3cdf-4f15-a5ca-ea3905febded} - (no file)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgemc.exe

--
End of file - 12496 bytes

-- File Associations -----------------------------------------------------------

All associations okay.

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R2 hardlock - c:\windows\system32\drivers\hardlock.sys <Not Verified; Aladdin Knowledge Systems; Hardlock Device Driver for Windows NT>
R2 Haspnt - c:\windows\system32\drivers\haspnt.sys <Not Verified; Aladdin Knowledge Systems; Windows NT HASP Kernel Device Driver>
R4 PxHelp20 - c:\windows\system32\drivers\pxhelp20.sys (file missing)

S1 intelppm (Intel Processor Driver) - c:\windows\system32\drivers\intelppm.sys (file missing)
S2 PfModNT - c:\windows\system32\drivers\pfmodnt.sys (file missing)
S3 HTTP - c:\windows\system32\drivers\http.sys (file missing)
S3 NTSIM - c:\windows\system32\ntsim.sys <Not Verified; VIA Networking, Inc.; Network Device Monitor Utility>

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

S3 AdobeVersionCue - c:\program files\adobe\adobe version cue\service\versioncue.exe <Not Verified; Adobe Sytems; Adobe Version Cue™>

-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.

-- Scheduled Tasks -------------------------------------------------------------

2008-04-19 16:00:16 240 --ah----- C:\WINDOWS\Tasks\AD5A09BE9181BD2A.job
2008-03-21 17:15:00 406 --a------ C:\WINDOWS\Tasks\1-Click Maintenance.job

-- Files created between 2008-03-19 and 2008-04-19 -----------------------------

2008-04-19 16:16:52 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-04-19 16:16:46 0 d-------- C:\WINDOWS\System32\Kaspersky Lab
2008-04-19 16:16:41 0 d-------- C:\WINDOWS\LastGood
2008-04-19 16:12:38 0 d-------- C:\Program Files\Panda Security
2008-04-19 16:02:47 0 dr-h----- C:\Documents and Settings\Administrator.PPC1\Recent
2008-04-19 15:45:45 96320 --a------ C:\WINDOWS\System32\tljjsfmd.dll
2008-04-19 15:43:51 96320 --a------ C:\WINDOWS\System32\fpccbpxr.dll
2008-04-19 15:42:49 405 --ahs---- C:\WINDOWS\System32\mpqss.ini2
2008-04-19 15:42:17 274432 -----n--- C:\WINDOWS\System32\ssqpm.dll
2008-04-12 19:50:53 94272 --a------ C:\WINDOWS\System32\hbqftmhd.dll
2008-04-12 19:04:03 94272 --a------ C:\WINDOWS\System32\iufsfevy.dll
2008-04-12 19:02:36 175837 --ahs---- C:\WINDOWS\System32\ijkmp.ini2
2008-04-12 18:28:21 94272 --a------ C:\WINDOWS\System32\hkofauay.dll
2008-04-12 18:18:02 94272 --a------ C:\WINDOWS\System32\vsiintqj.dll
2008-03-29 19:56:25 267776 --a------ C:\WINDOWS\System32\jkhhf.dll
2008-03-29 19:51:12 39424 --a------ C:\WINDOWS\System32\byxxwxy.dll
2008-03-21 18:48:52 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-21 18:47:21 0 d-------- C:\Program Files\Helper
2008-03-21 18:47:06 0 d-------- C:\Program Files\NetProject
2008-03-21 12:50:27 2567 --a------ C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache

-- Find3M Report ---------------------------------------------------------------

2008-04-19 16:12:45 2483 --a------ C:\WINDOWS\mozver.dat
2008-04-19 16:00:07 0 d-------- C:\Program Files\DivX
2008-04-19 15:39:11 0 d-------- C:\Documents and Settings\Administrator.PPC1\Application Data\AVG7
2008-04-12 20:26:04 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-04-12 20:25:57 0 d-------- C:\Program Files\Creative
2008-04-12 20:20:40 0 d-------- C:\Program Files\Google
2008-04-12 20:13:30 0 d-------- C:\Program Files\Java
2008-04-12 20:13:29 0 d-------- C:\Program Files\Common Files
2008-04-12 18:24:59 0 d-------- C:\Program Files\Common Files\Real
2008-04-12 18:22:44 0 d-------- C:\Documents and Settings\Administrator.PPC1\Application Data\Real
2008-03-22 18:49:20 0 d-------- C:\Program Files\TextBridge Pro Millennium
2008-03-22 18:48:50 0 d-------- C:\Program Files\Common Files\ScanSoft Shared
2008-03-21 12:45:16 0 d-------- C:\Program Files\Yahoo!

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{01FE095B-4190-4DBA-B26D-EBB863DF7709}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{071B64CC-DE4C-4B08-B602-77F75A025082}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{075B14B3-6DE7-4A31-B4F1-342889EBD917}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0C232A58-86E4-47E5-886D-06F32942593B}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0CC1AB92-52E3-4409-9AFF-DF66BECD8016}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0D574C9F-71F9-4F3C-BA6D-CF9C0E1E3EE8}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{10E99DAB-7A56-4B0F-AB3C-EF88F820FC4B}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{143588E2-A11A-4D26-B0E4-93AEB570C73B}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{19494287-4D36-409F-A390-D20E710F183E}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1F366527-E8E8-415F-8084-35D323B3DEF3}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{24D26DEA-79DD-4BB9-852B-1282CDC5883C}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{26572950-42D5-4BA0-AB12-952768FE5912}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2A6F87E4-F627-4EA9-B591-3A9761E542A4}]
19/04/2008 15:42 274432 --------- C:\WINDOWS\System32\ssqpm.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2A777FBB-7D94-48E8-8E73-93A34C9BE2C0}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2CE4736D-4A1F-4A93-9461-8FEE22B3AB99}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3725752F-AD3A-4932-9BA1-16AA24A2C6F5}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3CDED179-60A5-4C6F-8342-1C4FEDFEED86}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{46A2C00B-8F57-4226-B63F-5DA017A20615}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{49EC75A6-40D4-410B-BA49-4B99D9E816D8}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4B473956-D85C-4AE2-B83B-BA3FAC032A4F}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4DBCE191-C000-4550-AC87-88601CA93691}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E0C3F4B-AE09-4207-AD98-46E4A09FB553}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54E13E07-EEF0-48CB-B9DC-B4120190C3D5}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{576E9541-10E7-4FB3-B1E3-DB791DB57F53}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5A9FC9BA-CF40-4BFA-9925-16E9DF194D77}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6346BC9B-5719-402E-80E3-C10D369BF188}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6860A44B-5D3E-433D-A7B5-D517F810D0E7}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6AE8AD21-151E-471D-8A8D-61EE1C0B8586}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{71FA1D38-FCBE-4416-A3CD-32E047E8C542}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74E45A97-521B-4CBF-9129-68CB2A1E5914}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7647359E-E67F-417C-8389-CF7BEA5C13B7}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7B34FFD7-AA7E-4355-91E3-DC5DE6E348EC}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{83F95AFE-B677-45A8-BDB0-CB12FB98BD1C}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{89EFD49D-5D90-4F20-ADED-DA130B4A5BB5}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8D5849C4-93F3-429D-FF34-260A2068897C}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{906F1B82-C722-419D-B26C-D9A42A3FBD57}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{90B2364C-F844-4069-8293-B151F070994B}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{986BC75D-E8A5-43A7-8971-052FC88F5036}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9C166FBD-B031-4811-96F6-4D37F1E824CB}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9ECCAF33-BED5-430D-8FA9-ED1552142CA6}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9ED47DF6-1920-4FAF-B6EF-C795D2D9B66C}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9FDBEF6C-3D64-45CA-A116-5BB97C522D94}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A0AAC1AB-EB9E-4951-B576-F48F26105EE3}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3752E3C-6641-4F0C-A86B-B11F08CE933C}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AB79E329-7FA2-4B34-813A-3AED19DF6EEB}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AD4A5016-1188-49E9-8E07-C4323D4A2F97}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B55157E8-AE0C-4178-87AA-7250CC69D9C3}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B7D042F5-725B-4E41-8AA2-3508E3BC923B}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C3BBFF18-D9A8-4156-B50E-2270640C59EE}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C657C484-9142-49BA-BB2B-FA6E9C052411}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C79F0C77-A964-4DDA-A503-5580ACB6ED4B}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CEF5D03D-A74B-4D14-B4E4-EC8551695F0E}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D5EF16DE-C074-4F4B-8308-A2241B2DFADE}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D72446DB-8675-4002-81B2-0366CF1EC30E}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D9546BB4-7243-4C63-962F-B80D55D8A443}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DA94A918-1C4A-4437-A758-06759AFEBE96}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DB6CB071-CF57-41DC-A77A-FBEDD535EE93}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E2F8F7C7-954D-4336-BA99-27BFBEB73DAF}]
29/03/2008 19:51 39424 --a------ C:\WINDOWS\System32\byxxwxy.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E4EDCD5E-0E84-452A-B8B6-6887FF0D43CC}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E9438E2B-A47D-4285-A56F-037A965CA27B}]
C:\WINDOWS\System32\pmkji.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ECC90355-9BCE-4D55-9F4F-BF69BADA76E3}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EDAE651D-7C91-4759-B160-200CEB8C781E}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EDE8E8B2-28E8-4C6C-9688-F6D1065A59D7}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F6210944-A83B-49EC-9E5E-8E69EFB07E30}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FEB64E52-187A-48C6-87E1-E0C0B1C06014}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"\\Nasir\EPSON Stylus Photo R230 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIP.exe" [09/03/2005 19:00]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [31/08/2007 19:43]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [19/04/2008 15:43]
"KernelFaultCheck"="C:\WINDOWS\system32\dumprep 0 -k" []
"BM0ff3070b"="C:\WINDOWS\System32\tljjsfmd.dll" [19/04/2008 15:45]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"some"=C:\Program Files\NetProject\scit.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{E2F8F7C7-954D-4336-BA99-27BFBEB73DAF}"= C:\WINDOWS\System32\byxxwxy.dll [29/03/2008 19:51 39424]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"System"="csqgj.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byxxwxy]
byxxwxy.dll 29/03/2008 19:51 39424 C:\WINDOWS\system32\byxxwxy.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\System32\ssqpm
"Notification Packages"= :\WINDOW

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2683804368-1490112732-1395025495-1155\Scripts\Logon\0\0]
"Script"=MHQLOGON.BAT

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator.PPC1^Start Menu^Programs^Startup^ImationFlashDetect.lnk]
path=C:\Documents and Settings\Administrator.PPC1\Start Menu\Programs\Startup\ImationFlashDetect.lnk
backup=C:\WINDOWS\pss\ImationFlashDetect.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
backup=C:\WINDOWS\pss\Acrobat Assistant.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
"C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeVersionCue]
C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio]
RunDll32 cmicnfg.cpl,CMICtrlWnd

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\System32\CTFMON.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTRegRun]
C:\WINDOWS\CTRegRun.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dmsgg.exe]
C:\WINDOWS\System32\dmsgg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\E06ADXRC_2588375]
"C:\Program Files\Microsoft Encarta\Encarta Premium 2006\EDICT.EXE" -m

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstantAccess]
C:\Program Files\TextBridge Pro Millennium\Bin\InstantAccess.exe /h

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\keybdll]
wormexe.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\link part internet bird]
C:\Documents and Settings\All Users\Application Data\amok idle link part\BENDERROR.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsNetHelper]
mozilla-text.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NexusServer]
"C:\Program Files\Common Files\Canopus Shared\ProCoder 2\Kernel\PNXSERVR.exe" -SelfLaunch

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\QTTask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemWindows]
C:\WINDOWS\system32\scvhost.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
"C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vptray]
C:\PROGRA~1\NavNT\vptray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer]
VTTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowsUpdate]
wormexe.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

-- Hosts -----------------------------------------------------------------------

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

8120 more entries in hosts file.

-- End of Deckard's System Scanner: finished at 2008-04-19 16:28:16 ------------

Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Professional (build 2600) SP 1.0
Architecture: X86; Language: English

CPU 0: Intel(R) Pentium(R) 4 CPU 2.80GHz
CPU 1: Intel(R) Pentium(R) 4 CPU 2.80GHz
Percentage of Memory in Use: 70%
Physical Memory (total/avail): 191.48 MiB / 55.76 MiB
Pagefile Memory (total/avail): 1379.25 MiB / 978.95 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1946.75 MiB

A: is Removable (No Media)
C: is Fixed (NTFS) - 76.68 GiB total, 53.74 GiB free.
D: is CDROM (No Media)

\\.\PHYSICALDRIVE0 - HDS722580VLAT20 - 76.69 GiB - 1 partition
\PARTITION0 (bootable) - Installable File System - 76.68 GiB - C:

-- Security Center -------------------------------------------------------------

AUOptions is set to notify before install.
AUState says computer has updates disabled.

-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Administrator.PPC1\Application Data
CLASSPATH=.;C:\Program Files\Java\jre1.5.0_06\lib\ext\QTJava.zip
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=PPC1
ComSpec=C:\WINDOWS\system32\cmd.exe
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Administrator.PPC1
LOGONSERVER=\\PPC1
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Microsoft SQL Server\80\Tools\Binn\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 3 Stepping 3, GenuineIntel
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=0303
ProgramFiles=C:\Program Files
PROMPT=$P$G
QTJAVA=C:\Program Files\Java\jre1.5.0_06\lib\ext\QTJava.zip
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\ADMINI~1.PPC\LOCALS~1\Temp
TMP=C:\DOCUME~1\ADMINI~1.PPC\LOCALS~1\Temp
USERDOMAIN=PPC1
USERNAME=Administrator
USERPROFILE=C:\Documents and Settings\Administrator.PPC1
windir=C:\WINDOWS

-- User Profiles ---------------------------------------------------------------

adib (new local)
Administrator.PPC1 (admin)
pendep0 (admin)
Administrator.MUHAMMADIYAH (admin)
adihermawan (new local, net ready)
penerangan (admin)
Administrator (admin)

-- Add/Remove Programs ---------------------------------------------------------

--> RunDll32 "C:\Program Files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll",LaunchSetup "C:\Program Files\InstallShield Installation Information\{416DFEDD-9F1B-4EFC-AF70-FCA891AE0251}\zidxp.exe"
--> RunDll32 "C:\Program Files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll",LaunchSetup "C:\Program Files\InstallShield Installation Information\{91A4AD99-69CE-4745-97B7-0E0DFBECFDE5}\setup.exe"
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5CDDF96A-BC34-4D72-9ABA-E1FFF0C39977}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{01958032-9877-4118-B87F-9EFA74B3F15F}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D3E4251D-8364-4698-B0E0-A7C799384403}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EFB21DE7-8C19-4A88-BB28-A766E16493BC}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{63A317D0-60A6-43FC-848A-9FE4A53B29CE}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{88B1984E-36F0-47B8-B8DC-728966807A9C}\SETUP.EXE" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A82F10CB-18B5-4EAC-AEF2-FA49CD565626}\setup.exe" -l0x9
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Acrobat 6.0.1 Professional --> MsiExec.exe /I{AC76BA86-1033-0000-7760-000000000001}
Adobe Creative Suite --> C:\PROGRA~1\INSTAL~1\{D52EC~1\setup.exe /Relaunched=yes /Uninstall /Relaunched=yes
Adobe Flash Player ActiveX --> C:\WINDOWS\System32\Macromed\Flash\uninstall_activeX.exe
Adobe PageMaker 7.0 --> C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Adobe\PageMaker 7.0\Uninst.isu" -c"C:\Program Files\Adobe\PageMaker 7.0\Uninst.dll"
Adobe PageMaker Plug-in Pack --> RunDll32 "C:\Program Files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll",LaunchSetup "C:\Program Files\InstallShield Installation Information\{12345678-1234-1234-1234-123456789ABC}\zidxp.exe"
Adobe SVG Viewer 3.0 --> C:\Program Files\Common Files\Adobe\SVG Viewer 3.0\Uninstall\Winstall.exe -u -fC:\Program Files\Common Files\Adobe\SVG Viewer 3.0\Uninstall\Install.log
Advanced Networking Pack for Windows XP --> C:\WINDOWS\$NtUninstallKB817778$\spuninst\spuninst.exe
Ahead Nero Burning ROM --> C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
Ahead NeroVision Express --> C:\WINDOWS\UNNeroVision.exe /UNINSTALL
AVG 7.5 --> C:\Program Files\Grisoft\AVG7\setup.exe /UNINSTALL
AVG Anti-Spyware 7.5 --> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe
C-Media 3D Audio --> C:\WINDOWS\CMIUnInstall.exe
C-Media WDM Audio Driver --> C:\WINDOWS\system32\cmirmdrv.exe
CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe"
CD-LabelPrint --> "C:\Program Files\CD-LabelPrint\Uninstal.exe" Canon.CDLabelPrint.Application
Creative Live! Cam Vista IM User's Guide (English) --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\Creative Live! Cam Vista IM\Creative Live! Cam Vista IM User's Guide\English\CTManual.isu"
Creative Software AutoUpdate --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{88B1984E-36F0-47B8-B8DC-728966807A9C}\SETUP.EXE" -l0x9 /remove
Creative System Information --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{63A317D0-60A6-43FC-848A-9FE4A53B29CE}\setup.exe" -l0x9 /remove
Ebates Moe Money Maker --> "C:\Program Files\EbatesMoeMoneyMaker4\EbatesMoeMoneyMaker.exe" unebmm10350
FLV Player 1.3.2 --> "C:\Program Files\FLVPlayer\uninstall.exe"
HighMAT Extension to Microsoft Windows XP CD Writing Wizard --> MsiExec.exe /X{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}
Kaspersky Online Scanner --> C:\WINDOWS\System32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
LiveUpdate 1.6 (Symantec Corporation) --> C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE /U
Macromedia Shockwave Player --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
Microsoft Data Access Components KB870669 --> C:\WINDOWS\muninst.exe C:\WINDOWS\INF\KB870669.inf
Microsoft Office XP Professional with FrontPage --> MsiExec.exe /I{90280409-6000-11D3-8CFE-0050048383C9}
Microsoft SQL Server Desktop Engine (SONY_MEDIAMGR) --> MsiExec.exe /X{E09B48B5-E141-427A-AB0C-D3605127224A}
Microsoft Text-to-Speech Engine 4.0 (English) --> RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\msTTSf22.inf, Uninstall
Mozilla Firefox (2.0.0.12) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Outlook Express Q823353 --> C:\WINDOWS\oeuninst.exe C:\WINDOWS\INF\Q823353.inf
QuickTime --> MsiExec.exe /I{E0D51394-1D45-460A-B62D-383BC4F8B335}
S3 S3Display --> vtuninst.exe -reg 5 'HKLM\Software\S3\VT\S3Uninst\S3Display'
S3 S3Gamma2 --> vtuninst.exe -reg 5 'HKLM\Software\S3\VT\S3Uninst\S3Gamma2'
S3 S3Info2 --> vtuninst.exe -reg 5 'HKLM\Software\S3\VT\S3Uninst\S3Info2'
S3 S3Overlay --> vtuninst.exe -reg 5 'HKLM\Software\S3\VT\S3Uninst\S3Overlay'
Sony Media Manager 2.2 --> MsiExec.exe /X{71A41426-C7A4-4DCF-A9ED-C5B4B105ED1D}
Sony Vegas 7.0 --> MsiExec.exe /X{251C3815-7A55-4607-A82D-C3B98F0FBAB8}
Spybot - Search & Destroy --> "C:\Program Files\Spybot - Search & Destroy\unins000.exe"
UniChrome II Graphics Display Driver and Utilities --> C:\PROGRA~1\S3\S3\s3setvga.exe -s -fC:\PROGRA~1\S3\S3\S3.uns
VIA Rhine Family Fast Ethernet Adapter --> Rundll32.exe vuins32.dll,vuins32Ex Rhine

-- Application Event Log -------------------------------------------------------

Event Record #/Type1640 / Warning
Event Submitted/Written: 04/19/2008 03:58:40 PM
Event ID/Source: 19011 / MSSQL$SONY_MEDIAMGR
Event Description:
(SpnRegister) : Error 1359

Event Record #/Type1639 / Error
Event Submitted/Written: 04/19/2008 03:55:33 PM
Event ID/Source: 15 / AutoEnrollment
Event Description:
Automatic certificate enrollment for local system failed to contact the active directory (0x80072095). A directory service error has occurred.
Enrollment will not be performed.

Event Record #/Type1622 / Error
Event Submitted/Written: 04/19/2008 03:54:30 PM
Event ID/Source: 1053 / Userenv
Event Description:
Windows cannot determine the user or computer name. (An internal error occurred. ). Group Policy processing aborted.

Event Record #/Type1606 / Error
Event Submitted/Written: 04/19/2008 03:37:56 PM
Event ID/Source: 15 / AutoEnrollment
Event Description:
Automatic certificate enrollment for local system failed to contact the active directory (0x80072095). A directory service error has occurred.
Enrollment will not be performed.

Event Record #/Type1599 / Error
Event Submitted/Written: 04/19/2008 03:36:47 PM
Event ID/Source: 1053 / Userenv
Event Description:
Windows cannot determine the user or computer name. (An internal error occurred. ). Group Policy processing aborted.

-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.

-- System Event Log ------------------------------------------------------------

Event Record #/Type675 / Warning
Event Submitted/Written: 04/19/2008 03:58:40 PM
Event ID/Source: 8193 / LSASRV
Event Description:
The Security System could not establish a secured connection with the server LDAP/pusatad01.Madiyah.intra/Madiyah.intra. No authentication protocol was available.

Event Record #/Type674 / Warning
Event Submitted/Written: 04/19/2008 03:58:40 PM
Event ID/Source: 8192 / LSASRV
Event Description:
The Security System detected an attempted downgrade attack for
server LDAP/pusatad01.Madiyah.intra/Madiyah.intra. The failure code from authentication protocol Kerberos
was "There are currently no logon servers available to service the logon request.
(0xc000005e)".

Event Record #/Type672 / Warning
Event Submitted/Written: 04/19/2008 03:55:33 PM
Event ID/Source: 8193 / LSASRV
Event Description:
The Security System could not establish a secured connection with the server ldap/pusatad01.Madiyah.intra. No authentication protocol was available.

Event Record #/Type671 / Warning
Event Submitted/Written: 04/19/2008 03:55:33 PM
Event ID/Source: 8192 / LSASRV
Event Description:
The Security System detected an attempted downgrade attack for
server ldap/pusatad01.Madiyah.intra. The failure code from authentication protocol Kerberos
was "There are currently no logon servers available to service the logon request.
(0xc000005e)".

Event Record #/Type666 / Warning
Event Submitted/Written: 04/19/2008 03:54:15 PM
Event ID/Source: 8193 / LSASRV
Event Description:
The Security System could not establish a secured connection with the server LDAP/pusatad01.Madiyah.intra. No authentication protocol was available.

-- End of Deckard's System Scanner: finished at 2008-04-19 16:28:16 ------------

cableguy · 04-28-2008, 08:30 AM

reposting. Been 9 days already.

**TheBruce1** · 04-28-2008, 02:21 PM

Hello and welcome to TSF

Apologises for the delay getting to your log. The helpers here are all volunteers and we have been very busy lately. If you are still having malware problems, follow instructions below.

Please run Deckard System Scanner(DSS)and post the main.txt.

cableguy · 04-30-2008, 06:09 PM

Ok...here goes...

Deckard's System Scanner v20071014.68
Run by Administrator on 2008-05-01 09:04:48
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Percentage of Memory in Use: 87% (more than 75%).
Total Physical Memory: 192 MiB (512 MiB recommended).

-- HijackThis Clone ------------------------------------------------------------

Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-05-01 09:05:57
Platform: Windows XP Service Pack 1 (5.01.2600)
MSIE: Internet Explorer (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator.PPC1\Desktop\dss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sg.news.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: (no name) - {01FE095B-4190-4DBA-B26D-EBB863DF7709} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {071B64CC-DE4C-4B08-B602-77F75A025082} - (no file)
O2 - BHO: (no name) - {075B14B3-6DE7-4A31-B4F1-342889EBD917} - (no file)
O2 - BHO: (no name) - {0C232A58-86E4-47E5-886D-06F32942593B} - (no file)
O2 - BHO: (no name) - {0CC1AB92-52E3-4409-9AFF-DF66BECD8016} - (no file)
O2 - BHO: e404 helper - {0D574C9F-71F9-4F3C-BA6D-CF9C0E1E3EE8} - (no file)
O2 - BHO: (no name) - {10E99DAB-7A56-4B0F-AB3C-EF88F820FC4B} - (no file)
O2 - BHO: (no name) - {143588E2-A11A-4D26-B0E4-93AEB570C73B} - (no file)
O2 - BHO: (no name) - {19494287-4D36-409F-A390-D20E710F183E} - (no file)
O2 - BHO: (no name) - {1F366527-E8E8-415F-8084-35D323B3DEF3} - (no file)
O2 - BHO: (no name) - {24D26DEA-79DD-4BB9-852B-1282CDC5883C} - (no file)
O2 - BHO: (no name) - {26572950-42D5-4BA0-AB12-952768FE5912} - (no file)
O2 - BHO: (no name) - {2A777FBB-7D94-48E8-8E73-93A34C9BE2C0} - (no file)
O2 - BHO: (no name) - {2CE4736D-4A1F-4A93-9461-8FEE22B3AB99} - (no file)
O2 - BHO: (no name) - {3725752F-AD3A-4932-9BA1-16AA24A2C6F5} - (no file)
O2 - BHO: (no name) - {3CDED179-60A5-4C6F-8342-1C4FEDFEED86} - (no file)
O2 - BHO: (no name) - {46A2C00B-8F57-4226-B63F-5DA017A20615} - (no file)
O2 - BHO: (no name) - {49EC75A6-40D4-410B-BA49-4B99D9E816D8} - (no file)
O2 - BHO: (no name) - {4B473956-D85C-4AE2-B83B-BA3FAC032A4F} - (no file)
O2 - BHO: (no name) - {4DBCE191-C000-4550-AC87-88601CA93691} - (no file)
O2 - BHO: (no name) - {4E0C3F4B-AE09-4207-AD98-46E4A09FB553} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {54E13E07-EEF0-48CB-B9DC-B4120190C3D5} - (no file)
O2 - BHO: (no name) - {576E9541-10E7-4FB3-B1E3-DB791DB57F53} - (no file)
O2 - BHO: (no name) - {5A9FC9BA-CF40-4BFA-9925-16E9DF194D77} - (no file)
O2 - BHO: (no name) - {5C50F12D-ECB1-4726-9D6F-56C5F96A87E4} - C:\WINDOWS\System32\ssqpm.dll (file missing)
O2 - BHO: (no name) - {6346BC9B-5719-402E-80E3-C10D369BF188} - (no file)
O2 - BHO: (no name) - {6860A44B-5D3E-433D-A7B5-D517F810D0E7} - (no file)
O2 - BHO: (no name) - {6AE8AD21-151E-471D-8A8D-61EE1C0B8586} - (no file)
O2 - BHO: (no name) - {71FA1D38-FCBE-4416-A3CD-32E047E8C542} - (no file)
O2 - BHO: (no name) - {74E45A97-521B-4CBF-9129-68CB2A1E5914} - (no file)
O2 - BHO: (no name) - {7647359E-E67F-417C-8389-CF7BEA5C13B7} - (no file)
O2 - BHO: (no name) - {7B34FFD7-AA7E-4355-91E3-DC5DE6E348EC} - (no file)
O2 - BHO: (no name) - {83F95AFE-B677-45A8-BDB0-CB12FB98BD1C} - (no file)
O2 - BHO: (no name) - {89EFD49D-5D90-4F20-ADED-DA130B4A5BB5} - (no file)
O2 - BHO: (no name) - {8D5849C4-93F3-429D-FF34-260A2068897C} - (no file)
O2 - BHO: (no name) - {906F1B82-C722-419D-B26C-D9A42A3FBD57} - (no file)
O2 - BHO: (no name) - {90B2364C-F844-4069-8293-B151F070994B} - (no file)
O2 - BHO: (no name) - {986BC75D-E8A5-43A7-8971-052FC88F5036} - (no file)
O2 - BHO: (no name) - {9C166FBD-B031-4811-96F6-4D37F1E824CB} - (no file)
O2 - BHO: (no name) - {9ECCAF33-BED5-430D-8FA9-ED1552142CA6} - (no file)
O2 - BHO: (no name) - {9ED47DF6-1920-4FAF-B6EF-C795D2D9B66C} - (no file)
O2 - BHO: (no name) - {9FDBEF6C-3D64-45CA-A116-5BB97C522D94} - (no file)
O2 - BHO: (no name) - {A0AAC1AB-EB9E-4951-B576-F48F26105EE3} - (no file)
O2 - BHO: (no name) - {A3752E3C-6641-4F0C-A86B-B11F08CE933C} - (no file)
O2 - BHO: (no name) - {AB79E329-7FA2-4B34-813A-3AED19DF6EEB} - (no file)
O2 - BHO: (no name) - {AD4A5016-1188-49E9-8E07-C4323D4A2F97} - (no file)
O2 - BHO: (no name) - {B55157E8-AE0C-4178-87AA-7250CC69D9C3} - (no file)
O2 - BHO: (no name) - {B7D042F5-725B-4E41-8AA2-3508E3BC923B} - (no file)
O2 - BHO: (no name) - {C3BBFF18-D9A8-4156-B50E-2270640C59EE} - (no file)
O2 - BHO: (no name) - {C657C484-9142-49BA-BB2B-FA6E9C052411} - (no file)
O2 - BHO: (no name) - {C79F0C77-A964-4DDA-A503-5580ACB6ED4B} - (no file)
O2 - BHO: (no name) - {CEF5D03D-A74B-4D14-B4E4-EC8551695F0E} - (no file)
O2 - BHO: (no name) - {D5EF16DE-C074-4F4B-8308-A2241B2DFADE} - (no file)
O2 - BHO: (no name) - {D72446DB-8675-4002-81B2-0366CF1EC30E} - (no file)
O2 - BHO: (no name) - {D9546BB4-7243-4C63-962F-B80D55D8A443} - (no file)
O2 - BHO: (no name) - {DA94A918-1C4A-4437-A758-06759AFEBE96} - (no file)
O2 - BHO: (no name) - {DB6CB071-CF57-41DC-A77A-FBEDD535EE93} - (no file)
O2 - BHO: (no name) - {E2F8F7C7-954D-4336-BA99-27BFBEB73DAF} - C:\WINDOWS\system32\byxxwxy.dll
O2 - BHO: (no name) - {E4EDCD5E-0E84-452A-B8B6-6887FF0D43CC} - (no file)
O2 - BHO: (no name) - {E9438E2B-A47D-4285-A56F-037A965CA27B} - (no file)
O2 - BHO: (no name) - {ECC90355-9BCE-4D55-9F4F-BF69BADA76E3} - (no file)
O2 - BHO: (no name) - {EDAE651D-7C91-4759-B160-200CEB8C781E} - (no file)
O2 - BHO: (no name) - {EDE8E8B2-28E8-4C6C-9688-F6D1065A59D7} - (no file)
O2 - BHO: (no name) - {F6210944-A83B-49EC-9E5E-8E69EFB07E30} - (no file)
O2 - BHO: (no name) - {FEB64E52-187A-48C6-87E1-E0C0B1C06014} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: (no name) - {DB9FBA9D-AB1B-4CC6-9745-F3B549D64E40} - (no file)
O4 - HKLM\..\Run: [\\Nasir\EPSON Stylus Photo R230 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIP.EXE /P38 "\\Nasir\EPSON Stylus Photo R230 Series" /O6 "USB002" /M "Stylus Photo R230"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [BM0ff3070b] Rundll32.exe "C:\WINDOWS\System32\anbfwlpt.dll",s
O4 - HKLM\..\Policies\Explorer\Run: [some] C:\Program Files\NetProject\scit.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.iefixgate.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.iefixgate.com/redirect.php (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} () - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} () - http://v4.windowsupdate.microsoft.co...163.1007638889
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} () - http://download.macromedia.com/pub/s...sh/swflash.cab
O17 - HKLM\Software\..\Telephony: DomainName = sg.muhammadiyah.intra
O17 - HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: Domain = sg.muhammadiyah.intra
O17 - HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: Domain = sg.muhammadiyah.intra
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: Domain = sg.muhammadiyah.intra
O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL
O18 - Protocol: lid - {5C135180-9973-46D9-ABF4-148267CBB8BF} - C:\WINDOWS\system32\msvidctl.dll
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL
O20 - Winlogon Notify: byxxwxy - C:\WINDOWS\System32\byxxwxy.dll
O22 - SharedTaskScheduler: Hex port setting - {8D5849C4-93F3-429D-FF34-260A2068897C} - (no file)
O22 - SharedTaskScheduler: hyperproduction - {9d19a1a9-3cdf-4f15-a5ca-ea3905febded} - (no file)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgemc.exe

--
End of file - 12640 bytes

-- Files created between 2008-04-01 and 2008-05-01 -----------------------------

2008-04-26 18:07:10 0 dr-h----- C:\Documents and Settings\Administrator.PPC1\Application Data\yahoo!
2008-04-20 07:59:02 95296 --a------ C:\WINDOWS\System32\whxnnvjh.dll
2008-04-19 23:10:53 95296 --a------ C:\WINDOWS\System32\sxwbldlu.dll
2008-04-19 16:16:52 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-04-19 16:16:46 0 d-------- C:\WINDOWS\System32\Kaspersky Lab
2008-04-19 16:16:41 0 d-------- C:\WINDOWS\LastGood
2008-04-19 16:12:38 0 d-------- C:\Program Files\Panda Security
2008-04-19 16:02:47 0 dr-h----- C:\Documents and Settings\Administrator.PPC1\Recent
2008-04-19 15:45:45 96320 --a------ C:\WINDOWS\System32\tljjsfmd.dll
2008-04-19 15:43:51 96320 --a------ C:\WINDOWS\System32\fpccbpxr.dll
2008-04-19 15:42:49 593 --ahs---- C:\WINDOWS\System32\mpqss.ini2
2008-04-12 19:02:36 175837 --ahs---- C:\WINDOWS\System32\ijkmp.ini2

-- Find3M Report ---------------------------------------------------------------

2008-05-01 08:36:57 0 d-------- C:\Documents and Settings\Administrator.PPC1\Application Data\AVG7
2008-04-26 18:09:29 0 d-------- C:\Program Files\Sony
2008-04-26 18

31 0 d-------- C:\Program Files\Yahoo!
2008-04-20 09:40:17 0 d-------- C:\Program Files\Helper
2008-04-20 08:01:27 0 d-------- C:\Program Files\Creative
2008-04-19 16:12:45 2483 --a------ C:\WINDOWS\mozver.dat
2008-04-19 16:00:07 0 d-------- C:\Program Files\DivX
2008-04-12 20:26:04 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-04-12 20:20:40 0 d-------- C:\Program Files\Google
2008-04-12 20:13:30 0 d-------- C:\Program Files\Java
2008-04-12 20:13:29 0 d-------- C:\Program Files\Common Files
2008-04-12 18:24:59 0 d-------- C:\Program Files\Common Files\Real
2008-04-12 18:22:44 0 d-------- C:\Documents and Settings\Administrator.PPC1\Application Data\Real
2008-03-29 19:56:36 267776 --a------ C:\WINDOWS\System32\jkhhf.dll
2008-03-29 19:51:21 0 d-------- C:\Program Files\NetProject
2008-03-29 19:51:12 39424 --a------ C:\WINDOWS\System32\byxxwxy.dll
2008-03-22 18:49:20 0 d-------- C:\Program Files\TextBridge Pro Millennium
2008-03-22 18:48:50 0 d-------- C:\Program Files\Common Files\ScanSoft Shared

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{01FE095B-4190-4DBA-B26D-EBB863DF7709}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{071B64CC-DE4C-4B08-B602-77F75A025082}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{075B14B3-6DE7-4A31-B4F1-342889EBD917}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0C232A58-86E4-47E5-886D-06F32942593B}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0CC1AB92-52E3-4409-9AFF-DF66BECD8016}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0D574C9F-71F9-4F3C-BA6D-CF9C0E1E3EE8}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{10E99DAB-7A56-4B0F-AB3C-EF88F820FC4B}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{143588E2-A11A-4D26-B0E4-93AEB570C73B}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{19494287-4D36-409F-A390-D20E710F183E}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1F366527-E8E8-415F-8084-35D323B3DEF3}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{24D26DEA-79DD-4BB9-852B-1282CDC5883C}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{26572950-42D5-4BA0-AB12-952768FE5912}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2A777FBB-7D94-48E8-8E73-93A34C9BE2C0}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2CE4736D-4A1F-4A93-9461-8FEE22B3AB99}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3725752F-AD3A-4932-9BA1-16AA24A2C6F5}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3CDED179-60A5-4C6F-8342-1C4FEDFEED86}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{46A2C00B-8F57-4226-B63F-5DA017A20615}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{49EC75A6-40D4-410B-BA49-4B99D9E816D8}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4B473956-D85C-4AE2-B83B-BA3FAC032A4F}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4DBCE191-C000-4550-AC87-88601CA93691}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E0C3F4B-AE09-4207-AD98-46E4A09FB553}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54E13E07-EEF0-48CB-B9DC-B4120190C3D5}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{576E9541-10E7-4FB3-B1E3-DB791DB57F53}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5A9FC9BA-CF40-4BFA-9925-16E9DF194D77}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5C50F12D-ECB1-4726-9D6F-56C5F96A87E4}]
C:\WINDOWS\System32\ssqpm.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6346BC9B-5719-402E-80E3-C10D369BF188}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6860A44B-5D3E-433D-A7B5-D517F810D0E7}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6AE8AD21-151E-471D-8A8D-61EE1C0B8586}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{71FA1D38-FCBE-4416-A3CD-32E047E8C542}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74E45A97-521B-4CBF-9129-68CB2A1E5914}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7647359E-E67F-417C-8389-CF7BEA5C13B7}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7B34FFD7-AA7E-4355-91E3-DC5DE6E348EC}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{83F95AFE-B677-45A8-BDB0-CB12FB98BD1C}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{89EFD49D-5D90-4F20-ADED-DA130B4A5BB5}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8D5849C4-93F3-429D-FF34-260A2068897C}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{906F1B82-C722-419D-B26C-D9A42A3FBD57}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{90B2364C-F844-4069-8293-B151F070994B}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{986BC75D-E8A5-43A7-8971-052FC88F5036}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9C166FBD-B031-4811-96F6-4D37F1E824CB}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9ECCAF33-BED5-430D-8FA9-ED1552142CA6}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9ED47DF6-1920-4FAF-B6EF-C795D2D9B66C}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9FDBEF6C-3D64-45CA-A116-5BB97C522D94}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A0AAC1AB-EB9E-4951-B576-F48F26105EE3}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3752E3C-6641-4F0C-A86B-B11F08CE933C}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AB79E329-7FA2-4B34-813A-3AED19DF6EEB}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AD4A5016-1188-49E9-8E07-C4323D4A2F97}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B55157E8-AE0C-4178-87AA-7250CC69D9C3}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B7D042F5-725B-4E41-8AA2-3508E3BC923B}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C3BBFF18-D9A8-4156-B50E-2270640C59EE}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C657C484-9142-49BA-BB2B-FA6E9C052411}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C79F0C77-A964-4DDA-A503-5580ACB6ED4B}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CEF5D03D-A74B-4D14-B4E4-EC8551695F0E}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D5EF16DE-C074-4F4B-8308-A2241B2DFADE}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D72446DB-8675-4002-81B2-0366CF1EC30E}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D9546BB4-7243-4C63-962F-B80D55D8A443}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DA94A918-1C4A-4437-A758-06759AFEBE96}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DB6CB071-CF57-41DC-A77A-FBEDD535EE93}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E2F8F7C7-954D-4336-BA99-27BFBEB73DAF}]
29/03/2008 19:51 39424 --a------ C:\WINDOWS\System32\byxxwxy.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E4EDCD5E-0E84-452A-B8B6-6887FF0D43CC}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E9438E2B-A47D-4285-A56F-037A965CA27B}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ECC90355-9BCE-4D55-9F4F-BF69BADA76E3}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EDAE651D-7C91-4759-B160-200CEB8C781E}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EDE8E8B2-28E8-4C6C-9688-F6D1065A59D7}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F6210944-A83B-49EC-9E5E-8E69EFB07E30}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FEB64E52-187A-48C6-87E1-E0C0B1C06014}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"\\Nasir\EPSON Stylus Photo R230 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIP.exe" [09/03/2005 19:00]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [31/08/2007 19:43]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [19/04/2008 15:43]
"KernelFaultCheck"="C:\WINDOWS\system32\dumprep 0 -k" []
"BM0ff3070b"="C:\WINDOWS\System32\anbfwlpt.dll" []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"some"=C:\Program Files\NetProject\scit.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{E2F8F7C7-954D-4336-BA99-27BFBEB73DAF}"= C:\WINDOWS\System32\byxxwxy.dll [29/03/2008 19:51 39424]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"System"="csqgj.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byxxwxy]
byxxwxy.dll 29/03/2008 19:51 39424 C:\WINDOWS\system32\byxxwxy.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\System32\ssqpm
"Notification Packages"= :\WINDOW

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2683804368-1490112732-1395025495-1155\Scripts\Logon\0\0]
"Script"=MHQLOGON.BAT

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator.PPC1^Start Menu^Programs^Startup^ImationFlashDetect.lnk]
path=C:\Documents and Settings\Administrator.PPC1\Start Menu\Programs\Startup\ImationFlashDetect.lnk
backup=C:\WINDOWS\pss\ImationFlashDetect.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
backup=C:\WINDOWS\pss\Acrobat Assistant.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
"C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeVersionCue]
C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio]
RunDll32 cmicnfg.cpl,CMICtrlWnd

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\System32\CTFMON.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTRegRun]
C:\WINDOWS\CTRegRun.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dmsgg.exe]
C:\WINDOWS\System32\dmsgg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\E06ADXRC_2588375]
"C:\Program Files\Microsoft Encarta\Encarta Premium 2006\EDICT.EXE" -m

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstantAccess]
C:\Program Files\TextBridge Pro Millennium\Bin\InstantAccess.exe /h

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\keybdll]
wormexe.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\link part internet bird]
C:\Documents and Settings\All Users\Application Data\amok idle link part\BENDERROR.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsNetHelper]
mozilla-text.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NexusServer]
"C:\Program Files\Common Files\Canopus Shared\ProCoder 2\Kernel\PNXSERVR.exe" -SelfLaunch

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\QTTask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemWindows]
C:\WINDOWS\system32\scvhost.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
"C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vptray]
C:\PROGRA~1\NavNT\vptray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer]
VTTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowsUpdate]
wormexe.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a1a339f2-1716-11dd-8312-005070c81d48}]
AutoRun\command- E:\o9o2u.bat
explore\Command- E:\o9o2u.bat
open\Command- E:\o9o2u.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a1a339f3-1716-11dd-8312-005070c81d48}]
AutoRun\command- F:\o9o2u.bat
explore\Command- F:\o9o2u.bat
open\Command- F:\o9o2u.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a1a339f4-1716-11dd-8312-005070c81d48}]
AutoRun\command- G:\o9o2u.bat
explore\Command- G:\o9o2u.bat
open\Command- G:\o9o2u.bat

-- End of Deckard's System Scanner: finished at 2008-05-01 09:08:59 ------------

**TheBruce1** · 05-01-2008, 03:19 AM

Hello again

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

========

Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear, a lack of symptoms does not mean that it is no longer present.

========

Please print out or copy this page to Notepad in order to assist you when carrying out the following instructions.

=========

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:SDFix)

Please then reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, the Advanced Options Menu should appear;
Select the first option, to run Windows in Safe Mode, then press Enter.
Choose your usual acco

04-19-2008, 01:40 AM	#1 (permalink)
cableguy Registered User Join Date: Apr 2008 Posts: 23 OS: xp sp2	Virus Java/ByteVerify, Downloader.Zlob, Trojanhorse & more. Hi Security Team, My pc has been infected for quite some time. I believe there are a lot of viruses and spywares inside this system. AVG's not protecting my system. All programs seem to load very slow. It took ages to just click the Start button. Would appreciate if you could attend this as soon as possible. I've attached the following for your analysis. Deckard's System Scanner v20071014.68 Run by Administrator on 2008-04-19 16:24:37 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 66: 2008-04-19 08:24:54 UTC - RP454 - Deckard's System Scanner Restore Point 65: 2008-04-19 07:49:10 UTC - RP453 - Removed InstallShield Restore Point 64: 2008-04-12 12:25:39 UTC - RP452 - Configured Your Application Name 63: 2008-04-12 12:24:30 UTC - RP451 - Configured Your Application Name 62: 2008-04-12 12:23:37 UTC - RP450 - Removed E-Center -- First Restore Point -- 1: 2008-03-29 11:56:50 UTC - RP389 - Configured VeohTV BETA Backed up registry hives. Performed disk cleanup. Percentage of Memory in Use: 78% (more than 75%). Total Physical Memory: 192 MiB (512 MiB recommended). -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-04-19 16:26:45 Platform: Windows XP Service Pack 1 (5.01.2600) MSIE: Internet Explorer (6.00.2800.1106) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Grisoft\AVG7\avgamsvr.exe C:\Program Files\Grisoft\AVG7\avgupsvc.exe C:\Program Files\Grisoft\AVG7\avgemc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Grisoft\AVG7\avgcc.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Administrator.PPC1\Desktop\dss.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sg.news.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://sg.rd.yahoo.com/customize/ie/...rch.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) F2 - REG:system.ini: UserInit=userinit.exe O2 - BHO: (no name) - {01FE095B-4190-4DBA-B26D-EBB863DF7709} - (no file) O2 - BHO: (no name) - {071B64CC-DE4C-4B08-B602-77F75A025082} - (no file) O2 - BHO: (no name) - {075B14B3-6DE7-4A31-B4F1-342889EBD917} - (no file) O2 - BHO: (no name) - {0C232A58-86E4-47E5-886D-06F32942593B} - (no file) O2 - BHO: (no name) - {0CC1AB92-52E3-4409-9AFF-DF66BECD8016} - (no file) O2 - BHO: e404 helper - {0D574C9F-71F9-4F3C-BA6D-CF9C0E1E3EE8} - (no file) O2 - BHO: (no name) - {10E99DAB-7A56-4B0F-AB3C-EF88F820FC4B} - (no file) O2 - BHO: (no name) - {143588E2-A11A-4D26-B0E4-93AEB570C73B} - (no file) O2 - BHO: (no name) - {19494287-4D36-409F-A390-D20E710F183E} - (no file) O2 - BHO: (no name) - {1F366527-E8E8-415F-8084-35D323B3DEF3} - (no file) O2 - BHO: (no name) - {24D26DEA-79DD-4BB9-852B-1282CDC5883C} - (no file) O2 - BHO: (no name) - {26572950-42D5-4BA0-AB12-952768FE5912} - (no file) O2 - BHO: (no name) - {2A6F87E4-F627-4EA9-B591-3A9761E542A4} - C:\WINDOWS\system32\ssqpm.dll O2 - BHO: (no name) - {2A777FBB-7D94-48E8-8E73-93A34C9BE2C0} - (no file) O2 - BHO: (no name) - {2CE4736D-4A1F-4A93-9461-8FEE22B3AB99} - (no file) O2 - BHO: (no name) - {3725752F-AD3A-4932-9BA1-16AA24A2C6F5} - (no file) O2 - BHO: (no name) - {3CDED179-60A5-4C6F-8342-1C4FEDFEED86} - (no file) O2 - BHO: (no name) - {46A2C00B-8F57-4226-B63F-5DA017A20615} - (no file) O2 - BHO: (no name) - {49EC75A6-40D4-410B-BA49-4B99D9E816D8} - (no file) O2 - BHO: (no name) - {4B473956-D85C-4AE2-B83B-BA3FAC032A4F} - (no file) O2 - BHO: (no name) - {4DBCE191-C000-4550-AC87-88601CA93691} - (no file) O2 - BHO: (no name) - {4E0C3F4B-AE09-4207-AD98-46E4A09FB553} - (no file) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {54E13E07-EEF0-48CB-B9DC-B4120190C3D5} - (no file) O2 - BHO: (no name) - {576E9541-10E7-4FB3-B1E3-DB791DB57F53} - (no file) O2 - BHO: (no name) - {5A9FC9BA-CF40-4BFA-9925-16E9DF194D77} - (no file) O2 - BHO: (no name) - {6346BC9B-5719-402E-80E3-C10D369BF188} - (no file) O2 - BHO: (no name) - {6860A44B-5D3E-433D-A7B5-D517F810D0E7} - (no file) O2 - BHO: (no name) - {6AE8AD21-151E-471D-8A8D-61EE1C0B8586} - (no file) O2 - BHO: (no name) - {71FA1D38-FCBE-4416-A3CD-32E047E8C542} - (no file) O2 - BHO: (no name) - {74E45A97-521B-4CBF-9129-68CB2A1E5914} - (no file) O2 - BHO: (no name) - {7647359E-E67F-417C-8389-CF7BEA5C13B7} - (no file) O2 - BHO: (no name) - {7B34FFD7-AA7E-4355-91E3-DC5DE6E348EC} - (no file) O2 - BHO: (no name) - {83F95AFE-B677-45A8-BDB0-CB12FB98BD1C} - (no file) O2 - BHO: (no name) - {89EFD49D-5D90-4F20-ADED-DA130B4A5BB5} - (no file) O2 - BHO: (no name) - {8D5849C4-93F3-429D-FF34-260A2068897C} - (no file) O2 - BHO: (no name) - {906F1B82-C722-419D-B26C-D9A42A3FBD57} - (no file) O2 - BHO: (no name) - {90B2364C-F844-4069-8293-B151F070994B} - (no file) O2 - BHO: (no name) - {986BC75D-E8A5-43A7-8971-052FC88F5036} - (no file) O2 - BHO: (no name) - {9C166FBD-B031-4811-96F6-4D37F1E824CB} - (no file) O2 - BHO: (no name) - {9ECCAF33-BED5-430D-8FA9-ED1552142CA6} - (no file) O2 - BHO: (no name) - {9ED47DF6-1920-4FAF-B6EF-C795D2D9B66C} - (no file) O2 - BHO: (no name) - {9FDBEF6C-3D64-45CA-A116-5BB97C522D94} - (no file) O2 - BHO: (no name) - {A0AAC1AB-EB9E-4951-B576-F48F26105EE3} - (no file) O2 - BHO: (no name) - {A3752E3C-6641-4F0C-A86B-B11F08CE933C} - (no file) O2 - BHO: (no name) - {AB79E329-7FA2-4B34-813A-3AED19DF6EEB} - (no file) O2 - BHO: (no name) - {AD4A5016-1188-49E9-8E07-C4323D4A2F97} - (no file) O2 - BHO: (no name) - {B55157E8-AE0C-4178-87AA-7250CC69D9C3} - (no file) O2 - BHO: (no name) - {B7D042F5-725B-4E41-8AA2-3508E3BC923B} - (no file) O2 - BHO: (no name) - {C3BBFF18-D9A8-4156-B50E-2270640C59EE} - (no file) O2 - BHO: (no name) - {C657C484-9142-49BA-BB2B-FA6E9C052411} - (no file) O2 - BHO: (no name) - {C79F0C77-A964-4DDA-A503-5580ACB6ED4B} - (no file) O2 - BHO: (no name) - {CEF5D03D-A74B-4D14-B4E4-EC8551695F0E} - (no file) O2 - BHO: (no name) - {D5EF16DE-C074-4F4B-8308-A2241B2DFADE} - (no file) O2 - BHO: (no name) - {D72446DB-8675-4002-81B2-0366CF1EC30E} - (no file) O2 - BHO: (no name) - {D9546BB4-7243-4C63-962F-B80D55D8A443} - (no file) O2 - BHO: (no name) - {DA94A918-1C4A-4437-A758-06759AFEBE96} - (no file) O2 - BHO: (no name) - {DB6CB071-CF57-41DC-A77A-FBEDD535EE93} - (no file) O2 - BHO: (no name) - {E2F8F7C7-954D-4336-BA99-27BFBEB73DAF} - C:\WINDOWS\system32\byxxwxy.dll O2 - BHO: (no name) - {E4EDCD5E-0E84-452A-B8B6-6887FF0D43CC} - (no file) O2 - BHO: (no name) - {E9438E2B-A47D-4285-A56F-037A965CA27B} - C:\WINDOWS\System32\pmkji.dll (file missing) O2 - BHO: (no name) - {ECC90355-9BCE-4D55-9F4F-BF69BADA76E3} - (no file) O2 - BHO: (no name) - {EDAE651D-7C91-4759-B160-200CEB8C781E} - (no file) O2 - BHO: (no name) - {EDE8E8B2-28E8-4C6C-9688-F6D1065A59D7} - (no file) O2 - BHO: (no name) - {F6210944-A83B-49EC-9E5E-8E69EFB07E30} - (no file) O2 - BHO: (no name) - {FEB64E52-187A-48C6-87E1-E0C0B1C06014} - (no file) O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx O3 - Toolbar: (no name) - {DB9FBA9D-AB1B-4CC6-9745-F3B549D64E40} - (no file) O4 - HKLM\..\Run: [\\Nasir\EPSON Stylus Photo R230 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIP.EXE /P38 "\\Nasir\EPSON Stylus Photo R230 Series" /O6 "USB002" /M "Stylus Photo R230" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [BM0ff3070b] Rundll32.exe "C:\WINDOWS\System32\tljjsfmd.dll",s O4 - HKLM\..\Policies\Explorer\Run: [some] C:\Program Files\NetProject\scit.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Ebates - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.iefixgate.com/redirect.php (file missing) O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.iefixgate.com/redirect.php (file missing) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing) O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing) O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} () - http://download.divx.com/player/DivXBrowserPlugin.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} () - http://v4.windowsupdate.microsoft.co...163.1007638889 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab O17 - HKLM\Software\..\Telephony: DomainName = sg.muhammadiyah.intra O17 - HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: Domain = sg.muhammadiyah.intra O17 - HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: Domain = sg.muhammadiyah.intra O17 - HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: Domain = sg.muhammadiyah.intra O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL O18 - Protocol: lid - {5C135180-9973-46D9-ABF4-148267CBB8BF} - C:\WINDOWS\system32\msvidctl.dll O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL O20 - Winlogon Notify: byxxwxy - C:\WINDOWS\System32\byxxwxy.dll O22 - SharedTaskScheduler: Hex port setting - {8D5849C4-93F3-429D-FF34-260A2068897C} - (no file) O22 - SharedTaskScheduler: hyperproduction - {9d19a1a9-3cdf-4f15-a5ca-ea3905febded} - (no file) O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgemc.exe -- End of file - 12496 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R2 hardlock - c:\windows\system32\drivers\hardlock.sys <Not Verified; Aladdin Knowledge Systems; Hardlock Device Driver for Windows NT> R2 Haspnt - c:\windows\system32\drivers\haspnt.sys <Not Verified; Aladdin Knowledge Systems; Windows NT HASP Kernel Device Driver> R4 PxHelp20 - c:\windows\system32\drivers\pxhelp20.sys (file missing) S1 intelppm (Intel Processor Driver) - c:\windows\system32\drivers\intelppm.sys (file missing) S2 PfModNT - c:\windows\system32\drivers\pfmodnt.sys (file missing) S3 HTTP - c:\windows\system32\drivers\http.sys (file missing) S3 NTSIM - c:\windows\system32\ntsim.sys <Not Verified; VIA Networking, Inc.; Network Device Monitor Utility> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- S3 AdobeVersionCue - c:\program files\adobe\adobe version cue\service\versioncue.exe <Not Verified; Adobe Sytems; Adobe Version Cue™> -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-04-19 16:00:16 240 --ah----- C:\WINDOWS\Tasks\AD5A09BE9181BD2A.job 2008-03-21 17:15:00 406 --a------ C:\WINDOWS\Tasks\1-Click Maintenance.job -- Files created between 2008-03-19 and 2008-04-19 ----------------------------- 2008-04-19 16:16:52 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-04-19 16:16:46 0 d-------- C:\WINDOWS\System32\Kaspersky Lab 2008-04-19 16:16:41 0 d-------- C:\WINDOWS\LastGood 2008-04-19 16:12:38 0 d-------- C:\Program Files\Panda Security 2008-04-19 16:02:47 0 dr-h----- C:\Documents and Settings\Administrator.PPC1\Recent 2008-04-19 15:45:45 96320 --a------ C:\WINDOWS\System32\tljjsfmd.dll 2008-04-19 15:43:51 96320 --a------ C:\WINDOWS\System32\fpccbpxr.dll 2008-04-19 15:42:49 405 --ahs---- C:\WINDOWS\System32\mpqss.ini2 2008-04-19 15:42:17 274432 -----n--- C:\WINDOWS\System32\ssqpm.dll 2008-04-12 19:50:53 94272 --a------ C:\WINDOWS\System32\hbqftmhd.dll 2008-04-12 19:04:03 94272 --a------ C:\WINDOWS\System32\iufsfevy.dll 2008-04-12 19:02:36 175837 --ahs---- C:\WINDOWS\System32\ijkmp.ini2 2008-04-12 18:28:21 94272 --a------ C:\WINDOWS\System32\hkofauay.dll 2008-04-12 18:18:02 94272 --a------ C:\WINDOWS\System32\vsiintqj.dll 2008-03-29 19:56:25 267776 --a------ C:\WINDOWS\System32\jkhhf.dll 2008-03-29 19:51:12 39424 --a------ C:\WINDOWS\System32\byxxwxy.dll 2008-03-21 18:48:52 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-03-21 18:47:21 0 d-------- C:\Program Files\Helper 2008-03-21 18:47:06 0 d-------- C:\Program Files\NetProject 2008-03-21 12:50:27 2567 --a------ C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache -- Find3M Report --------------------------------------------------------------- 2008-04-19 16:12:45 2483 --a------ C:\WINDOWS\mozver.dat 2008-04-19 16:00:07 0 d-------- C:\Program Files\DivX 2008-04-19 15:39:11 0 d-------- C:\Documents and Settings\Administrator.PPC1\Application Data\AVG7 2008-04-12 20:26:04 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-04-12 20:25:57 0 d-------- C:\Program Files\Creative 2008-04-12 20:20:40 0 d-------- C:\Program Files\Google 2008-04-12 20:13:30 0 d-------- C:\Program Files\Java 2008-04-12 20:13:29 0 d-------- C:\Program Files\Common Files 2008-04-12 18:24:59 0 d-------- C:\Program Files\Common Files\Real 2008-04-12 18:22:44 0 d-------- C:\Documents and Settings\Administrator.PPC1\Application Data\Real 2008-03-22 18:49:20 0 d-------- C:\Program Files\TextBridge Pro Millennium 2008-03-22 18:48:50 0 d-------- C:\Program Files\Common Files\ScanSoft Shared 2008-03-21 12:45:16 0 d-------- C:\Program Files\Yahoo! -- Registry Dump --------------------------------------------------------------- Note empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{01FE095B-4190-4DBA-B26D-EBB863DF7709}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{071B64CC-DE4C-4B08-B602-77F75A025082}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{075B14B3-6DE7-4A31-B4F1-342889EBD917}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0C232A58-86E4-47E5-886D-06F32942593B}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0CC1AB92-52E3-4409-9AFF-DF66BECD8016}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0D574C9F-71F9-4F3C-BA6D-CF9C0E1E3EE8}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{10E99DAB-7A56-4B0F-AB3C-EF88F820FC4B}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{143588E2-A11A-4D26-B0E4-93AEB570C73B}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{19494287-4D36-409F-A390-D20E710F183E}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1F366527-E8E8-415F-8084-35D323B3DEF3}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{24D26DEA-79DD-4BB9-852B-1282CDC5883C}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{26572950-42D5-4BA0-AB12-952768FE5912}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2A6F87E4-F627-4EA9-B591-3A9761E542A4}] 19/04/2008 15:42 274432 --------- C:\WINDOWS\System32\ssqpm.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2A777FBB-7D94-48E8-8E73-93A34C9BE2C0}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2CE4736D-4A1F-4A93-9461-8FEE22B3AB99}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3725752F-AD3A-4932-9BA1-16AA24A2C6F5}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3CDED179-60A5-4C6F-8342-1C4FEDFEED86}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{46A2C00B-8F57-4226-B63F-5DA017A20615}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{49EC75A6-40D4-410B-BA49-4B99D9E816D8}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4B473956-D85C-4AE2-B83B-BA3FAC032A4F}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4DBCE191-C000-4550-AC87-88601CA93691}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E0C3F4B-AE09-4207-AD98-46E4A09FB553}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54E13E07-EEF0-48CB-B9DC-B4120190C3D5}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{576E9541-10E7-4FB3-B1E3-DB791DB57F53}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5A9FC9BA-CF40-4BFA-9925-16E9DF194D77}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6346BC9B-5719-402E-80E3-C10D369BF188}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6860A44B-5D3E-433D-A7B5-D517F810D0E7}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6AE8AD21-151E-471D-8A8D-61EE1C0B8586}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{71FA1D38-FCBE-4416-A3CD-32E047E8C542}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74E45A97-521B-4CBF-9129-68CB2A1E5914}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7647359E-E67F-417C-8389-CF7BEA5C13B7}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7B34FFD7-AA7E-4355-91E3-DC5DE6E348EC}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{83F95AFE-B677-45A8-BDB0-CB12FB98BD1C}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{89EFD49D-5D90-4F20-ADED-DA130B4A5BB5}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8D5849C4-93F3-429D-FF34-260A2068897C}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{906F1B82-C722-419D-B26C-D9A42A3FBD57}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{90B2364C-F844-4069-8293-B151F070994B}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{986BC75D-E8A5-43A7-8971-052FC88F5036}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9C166FBD-B031-4811-96F6-4D37F1E824CB}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9ECCAF33-BED5-430D-8FA9-ED1552142CA6}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9ED47DF6-1920-4FAF-B6EF-C795D2D9B66C}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9FDBEF6C-3D64-45CA-A116-5BB97C522D94}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A0AAC1AB-EB9E-4951-B576-F48F26105EE3}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3752E3C-6641-4F0C-A86B-B11F08CE933C}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AB79E329-7FA2-4B34-813A-3AED19DF6EEB}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AD4A5016-1188-49E9-8E07-C4323D4A2F97}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B55157E8-AE0C-4178-87AA-7250CC69D9C3}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B7D042F5-725B-4E41-8AA2-3508E3BC923B}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C3BBFF18-D9A8-4156-B50E-2270640C59EE}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C657C484-9142-49BA-BB2B-FA6E9C052411}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C79F0C77-A964-4DDA-A503-5580ACB6ED4B}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CEF5D03D-A74B-4D14-B4E4-EC8551695F0E}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D5EF16DE-C074-4F4B-8308-A2241B2DFADE}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D72446DB-8675-4002-81B2-0366CF1EC30E}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D9546BB4-7243-4C63-962F-B80D55D8A443}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DA94A918-1C4A-4437-A758-06759AFEBE96}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DB6CB071-CF57-41DC-A77A-FBEDD535EE93}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E2F8F7C7-954D-4336-BA99-27BFBEB73DAF}] 29/03/2008 19:51 39424 --a------ C:\WINDOWS\System32\byxxwxy.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E4EDCD5E-0E84-452A-B8B6-6887FF0D43CC}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E9438E2B-A47D-4285-A56F-037A965CA27B}] C:\WINDOWS\System32\pmkji.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ECC90355-9BCE-4D55-9F4F-BF69BADA76E3}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EDAE651D-7C91-4759-B160-200CEB8C781E}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EDE8E8B2-28E8-4C6C-9688-F6D1065A59D7}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F6210944-A83B-49EC-9E5E-8E69EFB07E30}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FEB64E52-187A-48C6-87E1-E0C0B1C06014}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "\\Nasir\EPSON Stylus Photo R230 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIP.exe" [09/03/2005 19:00] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [31/08/2007 19:43] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [19/04/2008 15:43] "KernelFaultCheck"="C:\WINDOWS\system32\dumprep 0 -k" [] "BM0ff3070b"="C:\WINDOWS\System32\tljjsfmd.dll" [19/04/2008 15:45] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] "some"=C:\Program Files\NetProject\scit.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{E2F8F7C7-954D-4336-BA99-27BFBEB73DAF}"= C:\WINDOWS\System32\byxxwxy.dll [29/03/2008 19:51 39424] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "System"="csqgj.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byxxwxy] byxxwxy.dll 29/03/2008 19:51 39424 C:\WINDOWS\system32\byxxwxy.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\System32\ssqpm "Notification Packages"= :\WINDOW [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2683804368-1490112732-1395025495-1155\Scripts\Logon\0\0] "Script"=MHQLOGON.BAT [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator.PPC1^Start Menu^Programs^Startup^ImationFlashDetect.lnk] path=C:\Documents and Settings\Administrator.PPC1\Start Menu\Programs\Startup\ImationFlashDetect.lnk backup=C:\WINDOWS\pss\ImationFlashDetect.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk backup=C:\WINDOWS\pss\Acrobat Assistant.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTRegRun] C:\WINDOWS\CTRegRun.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dmsgg.exe] C:\WINDOWS\System32\dmsgg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\E06ADXRC_2588375] "C:\Program Files\Microsoft Encarta\Encarta Premium 2006\EDICT.EXE" -m [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstantAccess] C:\Program Files\TextBridge Pro Millennium\Bin\InstantAccess.exe /h [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\keybdll] wormexe.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\link part internet bird] C:\Documents and Settings\All Users\Application Data\amok idle link part\BENDERROR.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsNetHelper] mozilla-text.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NexusServer] "C:\Program Files\Common Files\Canopus Shared\ProCoder 2\Kernel\PNXSERVR.exe" -SelfLaunch [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemWindows] C:\WINDOWS\system32\scvhost.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vptray] C:\PROGRA~1\NavNT\vptray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer] VTTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowsUpdate] wormexe.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp -- Hosts ----------------------------------------------------------------------- 127.0.0.1 www.007guard.com 127.0.0.1 007guard.com 127.0.0.1 008i.com 127.0.0.1 www.008k.com 127.0.0.1 008k.com 127.0.0.1 www.00hq.com 127.0.0.1 00hq.com 127.0.0.1 010402.com 127.0.0.1 www.032439.com 127.0.0.1 032439.com 8120 more entries in hosts file. -- End of Deckard's System Scanner: finished at 2008-04-19 16:28:16 ------------ Deckard's System Scanner v20071014.68 Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft Windows XP Professional (build 2600) SP 1.0 Architecture: X86; Language: English CPU 0: Intel(R) Pentium(R) 4 CPU 2.80GHz CPU 1: Intel(R) Pentium(R) 4 CPU 2.80GHz Percentage of Memory in Use: 70% Physical Memory (total/avail): 191.48 MiB / 55.76 MiB Pagefile Memory (total/avail): 1379.25 MiB / 978.95 MiB Virtual Memory (total/avail): 2047.88 MiB / 1946.75 MiB A: is Removable (No Media) C: is Fixed (NTFS) - 76.68 GiB total, 53.74 GiB free. D: is CDROM (No Media) \\.\PHYSICALDRIVE0 - HDS722580VLAT20 - 76.69 GiB - 1 partition \PARTITION0 (bootable) - Installable File System - 76.68 GiB - C: -- Security Center ------------------------------------------------------------- AUOptions is set to notify before install. AUState says computer has updates disabled. -- Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\Administrator.PPC1\Application Data CLASSPATH=.;C:\Program Files\Java\jre1.5.0_06\lib\ext\QTJava.zip CLIENTNAME=Console CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=PPC1 ComSpec=C:\WINDOWS\system32\cmd.exe HOMEDRIVE=C: HOMEPATH=\Documents and Settings\Administrator.PPC1 LOGONSERVER=\\PPC1 NUMBER_OF_PROCESSORS=2 OS=Windows_NT Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Microsoft SQL Server\80\Tools\Binn\ PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 15 Model 3 Stepping 3, GenuineIntel PROCESSOR_LEVEL=15 PROCESSOR_REVISION=0303 ProgramFiles=C:\Program Files PROMPT=$P$G QTJAVA=C:\Program Files\Java\jre1.5.0_06\lib\ext\QTJava.zip SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\ADMINI~1.PPC\LOCALS~1\Temp TMP=C:\DOCUME~1\ADMINI~1.PPC\LOCALS~1\Temp USERDOMAIN=PPC1 USERNAME=Administrator USERPROFILE=C:\Documents and Settings\Administrator.PPC1 windir=C:\WINDOWS -- User Profiles --------------------------------------------------------------- adib (new local) Administrator.PPC1 (admin) pendep0 (admin) Administrator.MUHAMMADIYAH (admin) adihermawan (new local, net ready) penerangan (admin) Administrator (admin) -- Add/Remove Programs --------------------------------------------------------- --> RunDll32 "C:\Program Files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll",LaunchSetup "C:\Program Files\InstallShield Installation Information\{416DFEDD-9F1B-4EFC-AF70-FCA891AE0251}\zidxp.exe" --> RunDll32 "C:\Program Files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll",LaunchSetup "C:\Program Files\InstallShield Installation Information\{91A4AD99-69CE-4745-97B7-0E0DFBECFDE5}\setup.exe" --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5CDDF96A-BC34-4D72-9ABA-E1FFF0C39977}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{01958032-9877-4118-B87F-9EFA74B3F15F}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D3E4251D-8364-4698-B0E0-A7C799384403}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EFB21DE7-8C19-4A88-BB28-A766E16493BC}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{63A317D0-60A6-43FC-848A-9FE4A53B29CE}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{88B1984E-36F0-47B8-B8DC-728966807A9C}\SETUP.EXE" -l0x9 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A82F10CB-18B5-4EAC-AEF2-FA49CD565626}\setup.exe" -l0x9 --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf Adobe Acrobat 6.0.1 Professional --> MsiExec.exe /I{AC76BA86-1033-0000-7760-000000000001} Adobe Creative Suite --> C:\PROGRA~1\INSTAL~1\{D52EC~1\setup.exe /Relaunched=yes /Uninstall /Relaunched=yes Adobe Flash Player ActiveX --> C:\WINDOWS\System32\Macromed\Flash\uninstall_activeX.exe Adobe PageMaker 7.0 --> C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Adobe\PageMaker 7.0\Uninst.isu" -c"C:\Program Files\Adobe\PageMaker 7.0\Uninst.dll" Adobe PageMaker Plug-in Pack --> RunDll32 "C:\Program Files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll",LaunchSetup "C:\Program Files\InstallShield Installation Information\{12345678-1234-1234-1234-123456789ABC}\zidxp.exe" Adobe SVG Viewer 3.0 --> C:\Program Files\Common Files\Adobe\SVG Viewer 3.0\Uninstall\Winstall.exe -u -fC:\Program Files\Common Files\Adobe\SVG Viewer 3.0\Uninstall\Install.log Advanced Networking Pack for Windows XP --> C:\WINDOWS\$NtUninstallKB817778$\spuninst\spuninst.exe Ahead Nero Burning ROM --> C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL Ahead NeroVision Express --> C:\WINDOWS\UNNeroVision.exe /UNINSTALL AVG 7.5 --> C:\Program Files\Grisoft\AVG7\setup.exe /UNINSTALL AVG Anti-Spyware 7.5 --> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe C-Media 3D Audio --> C:\WINDOWS\CMIUnInstall.exe C-Media WDM Audio Driver --> C:\WINDOWS\system32\cmirmdrv.exe CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe" CD-LabelPrint --> "C:\Program Files\CD-LabelPrint\Uninstal.exe" Canon.CDLabelPrint.Application Creative Live! Cam Vista IM User's Guide (English) --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\Creative Live! Cam Vista IM\Creative Live! Cam Vista IM User's Guide\English\CTManual.isu" Creative Software AutoUpdate --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{88B1984E-36F0-47B8-B8DC-728966807A9C}\SETUP.EXE" -l0x9 /remove Creative System Information --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{63A317D0-60A6-43FC-848A-9FE4A53B29CE}\setup.exe" -l0x9 /remove Ebates Moe Money Maker --> "C:\Program Files\EbatesMoeMoneyMaker4\EbatesMoeMoneyMaker.exe" unebmm10350 FLV Player 1.3.2 --> "C:\Program Files\FLVPlayer\uninstall.exe" HighMAT Extension to Microsoft Windows XP CD Writing Wizard --> MsiExec.exe /X{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F} Kaspersky Online Scanner --> C:\WINDOWS\System32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe LiveUpdate 1.6 (Symantec Corporation) --> C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE /U Macromedia Shockwave Player --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log Microsoft Data Access Components KB870669 --> C:\WINDOWS\muninst.exe C:\WINDOWS\INF\KB870669.inf Microsoft Office XP Professional with FrontPage --> MsiExec.exe /I{90280409-6000-11D3-8CFE-0050048383C9} Microsoft SQL Server Desktop Engine (SONY_MEDIAMGR) --> MsiExec.exe /X{E09B48B5-E141-427A-AB0C-D3605127224A} Microsoft Text-to-Speech Engine 4.0 (English) --> RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\msTTSf22.inf, Uninstall Mozilla Firefox (2.0.0.12) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe Outlook Express Q823353 --> C:\WINDOWS\oeuninst.exe C:\WINDOWS\INF\Q823353.inf QuickTime --> MsiExec.exe /I{E0D51394-1D45-460A-B62D-383BC4F8B335} S3 S3Display --> vtuninst.exe -reg 5 'HKLM\Software\S3\VT\S3Uninst\S3Display' S3 S3Gamma2 --> vtuninst.exe -reg 5 'HKLM\Software\S3\VT\S3Uninst\S3Gamma2' S3 S3Info2 --> vtuninst.exe -reg 5 'HKLM\Software\S3\VT\S3Uninst\S3Info2' S3 S3Overlay --> vtuninst.exe -reg 5 'HKLM\Software\S3\VT\S3Uninst\S3Overlay' Sony Media Manager 2.2 --> MsiExec.exe /X{71A41426-C7A4-4DCF-A9ED-C5B4B105ED1D} Sony Vegas 7.0 --> MsiExec.exe /X{251C3815-7A55-4607-A82D-C3B98F0FBAB8} Spybot - Search & Destroy --> "C:\Program Files\Spybot - Search & Destroy\unins000.exe" UniChrome II Graphics Display Driver and Utilities --> C:\PROGRA~1\S3\S3\s3setvga.exe -s -fC:\PROGRA~1\S3\S3\S3.uns VIA Rhine Family Fast Ethernet Adapter --> Rundll32.exe vuins32.dll,vuins32Ex Rhine -- Application Event Log ------------------------------------------------------- Event Record #/Type1640 / Warning Event Submitted/Written: 04/19/2008 03:58:40 PM Event ID/Source: 19011 / MSSQL$SONY_MEDIAMGR Event Description: (SpnRegister) : Error 1359 Event Record #/Type1639 / Error Event Submitted/Written: 04/19/2008 03:55:33 PM Event ID/Source: 15 / AutoEnrollment Event Description: Automatic certificate enrollment for local system failed to contact the active directory (0x80072095). A directory service error has occurred. Enrollment will not be performed. Event Record #/Type1622 / Error Event Submitted/Written: 04/19/2008 03:54:30 PM Event ID/Source: 1053 / Userenv Event Description: Windows cannot determine the user or computer name. (An internal error occurred. ). Group Policy processing aborted. Event Record #/Type1606 / Error Event Submitted/Written: 04/19/2008 03:37:56 PM Event ID/Source: 15 / AutoEnrollment Event Description: Automatic certificate enrollment for local system failed to contact the active directory (0x80072095). A directory service error has occurred. Enrollment will not be performed. Event Record #/Type1599 / Error Event Submitted/Written: 04/19/2008 03:36:47 PM Event ID/Source: 1053 / Userenv Event Description: Windows cannot determine the user or computer name. (An internal error occurred. ). Group Policy processing aborted. -- Security Event Log ---------------------------------------------------------- No Errors/Warnings found. -- System Event Log ------------------------------------------------------------ Event Record #/Type675 / Warning Event Submitted/Written: 04/19/2008 03:58:40 PM Event ID/Source: 8193 / LSASRV Event Description: The Security System could not establish a secured connection with the server LDAP/pusatad01.Madiyah.intra/Madiyah.intra. No authentication protocol was available. Event Record #/Type674 / Warning Event Submitted/Written: 04/19/2008 03:58:40 PM Event ID/Source: 8192 / LSASRV Event Description: The Security System detected an attempted downgrade attack for server LDAP/pusatad01.Madiyah.intra/Madiyah.intra. The failure code from authentication protocol Kerberos was "There are currently no logon servers available to service the logon request. (0xc000005e)". Event Record #/Type672 / Warning Event Submitted/Written: 04/19/2008 03:55:33 PM Event ID/Source: 8193 / LSASRV Event Description: The Security System could not establish a secured connection with the server ldap/pusatad01.Madiyah.intra. No authentication protocol was available. Event Record #/Type671 / Warning Event Submitted/Written: 04/19/2008 03:55:33 PM Event ID/Source: 8192 / LSASRV Event Description: The Security System detected an attempted downgrade attack for server ldap/pusatad01.Madiyah.intra. The failure code from authentication protocol Kerberos was "There are currently no logon servers available to service the logon request. (0xc000005e)". Event Record #/Type666 / Warning Event Submitted/Written: 04/19/2008 03:54:15 PM Event ID/Source: 8193 / LSASRV Event Description: The Security System could not establish a secured connection with the server LDAP/pusatad01.Madiyah.intra. No authentication protocol was available. -- End of Deckard's System Scanner: finished at 2008-04-19 16:28:16 ------------ Last edited by cableguy : 04-19-2008 at 01:50 AM. Reason: forgot to give an intro

04-28-2008, 08:30 AM	#2 (permalink)
cableguy Registered User Join Date: Apr 2008 Posts: 23 OS: xp sp2	Re: Virus Java/ByteVerify, Downloader.Zlob, Trojanhorse & more. reposting. Been 9 days already.

04-28-2008, 02:21 PM	#3 (permalink)
TheBruce1 Moderator, Analyst, Security Team Join Date: Oct 2006 Location: Dùn Èideann,Scotland. Posts: 2,790 OS: XP	Re: Virus Java/ByteVerify, Downloader.Zlob, Trojanhorse & more. Hello and welcome to TSF Apologises for the delay getting to your log. The helpers here are all volunteers and we have been very busy lately. If you are still having malware problems, follow instructions below. Please run Deckard System Scanner(DSS)and post the main.txt. __________________ Member of ASAP since 2007 Member of UNITE since 2008 Notice to BT customers Trial of BT-Phorm spyware to start 30th September, 2008- for more information please visit No DPI website for more information. Phorm, previously known as 121Media were responsible for the Apropos rootkit, see Here for more information on said rootkit. If we have helped you in anyway,please consider Donating

04-30-2008, 06:09 PM	#4 (permalink)
cableguy Registered User Join Date: Apr 2008 Posts: 23 OS: xp sp2	Re: Virus Java/ByteVerify, Downloader.Zlob, Trojanhorse & more. Ok...here goes... Deckard's System Scanner v20071014.68 Run by Administrator on 2008-05-01 09:04:48 Computer is in Normal Mode. -------------------------------------------------------------------------------- Percentage of Memory in Use: 87% (more than 75%). Total Physical Memory: 192 MiB (512 MiB recommended). -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-05-01 09:05:57 Platform: Windows XP Service Pack 1 (5.01.2600) MSIE: Internet Explorer (6.00.2800.1106) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Grisoft\AVG7\avgamsvr.exe C:\Program Files\Grisoft\AVG7\avgupsvc.exe C:\Program Files\Grisoft\AVG7\avgemc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\explorer.exe C:\Program Files\Grisoft\AVG7\avgcc.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Administrator.PPC1\Desktop\dss.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sg.news.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm F2 - REG:system.ini: UserInit=userinit.exe O2 - BHO: (no name) - {01FE095B-4190-4DBA-B26D-EBB863DF7709} - (no file) O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: (no name) - {071B64CC-DE4C-4B08-B602-77F75A025082} - (no file) O2 - BHO: (no name) - {075B14B3-6DE7-4A31-B4F1-342889EBD917} - (no file) O2 - BHO: (no name) - {0C232A58-86E4-47E5-886D-06F32942593B} - (no file) O2 - BHO: (no name) - {0CC1AB92-52E3-4409-9AFF-DF66BECD8016} - (no file) O2 - BHO: e404 helper - {0D574C9F-71F9-4F3C-BA6D-CF9C0E1E3EE8} - (no file) O2 - BHO: (no name) - {10E99DAB-7A56-4B0F-AB3C-EF88F820FC4B} - (no file) O2 - BHO: (no name) - {143588E2-A11A-4D26-B0E4-93AEB570C73B} - (no file) O2 - BHO: (no name) - {19494287-4D36-409F-A390-D20E710F183E} - (no file) O2 - BHO: (no name) - {1F366527-E8E8-415F-8084-35D323B3DEF3} - (no file) O2 - BHO: (no name) - {24D26DEA-79DD-4BB9-852B-1282CDC5883C} - (no file) O2 - BHO: (no name) - {26572950-42D5-4BA0-AB12-952768FE5912} - (no file) O2 - BHO: (no name) - {2A777FBB-7D94-48E8-8E73-93A34C9BE2C0} - (no file) O2 - BHO: (no name) - {2CE4736D-4A1F-4A93-9461-8FEE22B3AB99} - (no file) O2 - BHO: (no name) - {3725752F-AD3A-4932-9BA1-16AA24A2C6F5} - (no file) O2 - BHO: (no name) - {3CDED179-60A5-4C6F-8342-1C4FEDFEED86} - (no file) O2 - BHO: (no name) - {46A2C00B-8F57-4226-B63F-5DA017A20615} - (no file) O2 - BHO: (no name) - {49EC75A6-40D4-410B-BA49-4B99D9E816D8} - (no file) O2 - BHO: (no name) - {4B473956-D85C-4AE2-B83B-BA3FAC032A4F} - (no file) O2 - BHO: (no name) - {4DBCE191-C000-4550-AC87-88601CA93691} - (no file) O2 - BHO: (no name) - {4E0C3F4B-AE09-4207-AD98-46E4A09FB553} - (no file) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {54E13E07-EEF0-48CB-B9DC-B4120190C3D5} - (no file) O2 - BHO: (no name) - {576E9541-10E7-4FB3-B1E3-DB791DB57F53} - (no file) O2 - BHO: (no name) - {5A9FC9BA-CF40-4BFA-9925-16E9DF194D77} - (no file) O2 - BHO: (no name) - {5C50F12D-ECB1-4726-9D6F-56C5F96A87E4} - C:\WINDOWS\System32\ssqpm.dll (file missing) O2 - BHO: (no name) - {6346BC9B-5719-402E-80E3-C10D369BF188} - (no file) O2 - BHO: (no name) - {6860A44B-5D3E-433D-A7B5-D517F810D0E7} - (no file) O2 - BHO: (no name) - {6AE8AD21-151E-471D-8A8D-61EE1C0B8586} - (no file) O2 - BHO: (no name) - {71FA1D38-FCBE-4416-A3CD-32E047E8C542} - (no file) O2 - BHO: (no name) - {74E45A97-521B-4CBF-9129-68CB2A1E5914} - (no file) O2 - BHO: (no name) - {7647359E-E67F-417C-8389-CF7BEA5C13B7} - (no file) O2 - BHO: (no name) - {7B34FFD7-AA7E-4355-91E3-DC5DE6E348EC} - (no file) O2 - BHO: (no name) - {83F95AFE-B677-45A8-BDB0-CB12FB98BD1C} - (no file) O2 - BHO: (no name) - {89EFD49D-5D90-4F20-ADED-DA130B4A5BB5} - (no file) O2 - BHO: (no name) - {8D5849C4-93F3-429D-FF34-260A2068897C} - (no file) O2 - BHO: (no name) - {906F1B82-C722-419D-B26C-D9A42A3FBD57} - (no file) O2 - BHO: (no name) - {90B2364C-F844-4069-8293-B151F070994B} - (no file) O2 - BHO: (no name) - {986BC75D-E8A5-43A7-8971-052FC88F5036} - (no file) O2 - BHO: (no name) - {9C166FBD-B031-4811-96F6-4D37F1E824CB} - (no file) O2 - BHO: (no name) - {9ECCAF33-BED5-430D-8FA9-ED1552142CA6} - (no file) O2 - BHO: (no name) - {9ED47DF6-1920-4FAF-B6EF-C795D2D9B66C} - (no file) O2 - BHO: (no name) - {9FDBEF6C-3D64-45CA-A116-5BB97C522D94} - (no file) O2 - BHO: (no name) - {A0AAC1AB-EB9E-4951-B576-F48F26105EE3} - (no file) O2 - BHO: (no name) - {A3752E3C-6641-4F0C-A86B-B11F08CE933C} - (no file) O2 - BHO: (no name) - {AB79E329-7FA2-4B34-813A-3AED19DF6EEB} - (no file) O2 - BHO: (no name) - {AD4A5016-1188-49E9-8E07-C4323D4A2F97} - (no file) O2 - BHO: (no name) - {B55157E8-AE0C-4178-87AA-7250CC69D9C3} - (no file) O2 - BHO: (no name) - {B7D042F5-725B-4E41-8AA2-3508E3BC923B} - (no file) O2 - BHO: (no name) - {C3BBFF18-D9A8-4156-B50E-2270640C59EE} - (no file) O2 - BHO: (no name) - {C657C484-9142-49BA-BB2B-FA6E9C052411} - (no file) O2 - BHO: (no name) - {C79F0C77-A964-4DDA-A503-5580ACB6ED4B} - (no file) O2 - BHO: (no name) - {CEF5D03D-A74B-4D14-B4E4-EC8551695F0E} - (no file) O2 - BHO: (no name) - {D5EF16DE-C074-4F4B-8308-A2241B2DFADE} - (no file) O2 - BHO: (no name) - {D72446DB-8675-4002-81B2-0366CF1EC30E} - (no file) O2 - BHO: (no name) - {D9546BB4-7243-4C63-962F-B80D55D8A443} - (no file) O2 - BHO: (no name) - {DA94A918-1C4A-4437-A758-06759AFEBE96} - (no file) O2 - BHO: (no name) - {DB6CB071-CF57-41DC-A77A-FBEDD535EE93} - (no file) O2 - BHO: (no name) - {E2F8F7C7-954D-4336-BA99-27BFBEB73DAF} - C:\WINDOWS\system32\byxxwxy.dll O2 - BHO: (no name) - {E4EDCD5E-0E84-452A-B8B6-6887FF0D43CC} - (no file) O2 - BHO: (no name) - {E9438E2B-A47D-4285-A56F-037A965CA27B} - (no file) O2 - BHO: (no name) - {ECC90355-9BCE-4D55-9F4F-BF69BADA76E3} - (no file) O2 - BHO: (no name) - {EDAE651D-7C91-4759-B160-200CEB8C781E} - (no file) O2 - BHO: (no name) - {EDE8E8B2-28E8-4C6C-9688-F6D1065A59D7} - (no file) O2 - BHO: (no name) - {F6210944-A83B-49EC-9E5E-8E69EFB07E30} - (no file) O2 - BHO: (no name) - {FEB64E52-187A-48C6-87E1-E0C0B1C06014} - (no file) O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx O3 - Toolbar: (no name) - {DB9FBA9D-AB1B-4CC6-9745-F3B549D64E40} - (no file) O4 - HKLM\..\Run: [\\Nasir\EPSON Stylus Photo R230 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIP.EXE /P38 "\\Nasir\EPSON Stylus Photo R230 Series" /O6 "USB002" /M "Stylus Photo R230" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [BM0ff3070b] Rundll32.exe "C:\WINDOWS\System32\anbfwlpt.dll",s O4 - HKLM\..\Policies\Explorer\Run: [some] C:\Program Files\NetProject\scit.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.iefixgate.com/redirect.php (file missing) O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.iefixgate.com/redirect.php (file missing) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing) O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing) O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} () - http://download.divx.com/player/DivXBrowserPlugin.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} () - http://v4.windowsupdate.microsoft.co...163.1007638889 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} () - http://download.macromedia.com/pub/s...sh/swflash.cab O17 - HKLM\Software\..\Telephony: DomainName = sg.muhammadiyah.intra O17 - HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: Domain = sg.muhammadiyah.intra O17 - HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: Domain = sg.muhammadiyah.intra O17 - HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: Domain = sg.muhammadiyah.intra O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL O18 - Protocol: lid - {5C135180-9973-46D9-ABF4-148267CBB8BF} - C:\WINDOWS\system32\msvidctl.dll O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL O20 - Winlogon Notify: byxxwxy - C:\WINDOWS\System32\byxxwxy.dll O22 - SharedTaskScheduler: Hex port setting - {8D5849C4-93F3-429D-FF34-260A2068897C} - (no file) O22 - SharedTaskScheduler: hyperproduction - {9d19a1a9-3cdf-4f15-a5ca-ea3905febded} - (no file) O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgemc.exe -- End of file - 12640 bytes -- Files created between 2008-04-01 and 2008-05-01 ----------------------------- 2008-04-26 18:07:10 0 dr-h----- C:\Documents and Settings\Administrator.PPC1\Application Data\yahoo! 2008-04-20 07:59:02 95296 --a------ C:\WINDOWS\System32\whxnnvjh.dll 2008-04-19 23:10:53 95296 --a------ C:\WINDOWS\System32\sxwbldlu.dll 2008-04-19 16:16:52 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-04-19 16:16:46 0 d-------- C:\WINDOWS\System32\Kaspersky Lab 2008-04-19 16:16:41 0 d-------- C:\WINDOWS\LastGood 2008-04-19 16:12:38 0 d-------- C:\Program Files\Panda Security 2008-04-19 16:02:47 0 dr-h----- C:\Documents and Settings\Administrator.PPC1\Recent 2008-04-19 15:45:45 96320 --a------ C:\WINDOWS\System32\tljjsfmd.dll 2008-04-19 15:43:51 96320 --a------ C:\WINDOWS\System32\fpccbpxr.dll 2008-04-19 15:42:49 593 --ahs---- C:\WINDOWS\System32\mpqss.ini2 2008-04-12 19:02:36 175837 --ahs---- C:\WINDOWS\System32\ijkmp.ini2 -- Find3M Report --------------------------------------------------------------- 2008-05-01 08:36:57 0 d-------- C:\Documents and Settings\Administrator.PPC1\Application Data\AVG7 2008-04-26 18:09:29 0 d-------- C:\Program Files\Sony 2008-04-26 1831 0 d-------- C:\Program Files\Yahoo! 2008-04-20 09:40:17 0 d-------- C:\Program Files\Helper 2008-04-20 08:01:27 0 d-------- C:\Program Files\Creative 2008-04-19 16:12:45 2483 --a------ C:\WINDOWS\mozver.dat 2008-04-19 16:00:07 0 d-------- C:\Program Files\DivX 2008-04-12 20:26:04 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-04-12 20:20:40 0 d-------- C:\Program Files\Google 2008-04-12 20:13:30 0 d-------- C:\Program Files\Java 2008-04-12 20:13:29 0 d-------- C:\Program Files\Common Files 2008-04-12 18:24:59 0 d-------- C:\Program Files\Common Files\Real 2008-04-12 18:22:44 0 d-------- C:\Documents and Settings\Administrator.PPC1\Application Data\Real 2008-03-29 19:56:36 267776 --a------ C:\WINDOWS\System32\jkhhf.dll 2008-03-29 19:51:21 0 d-------- C:\Program Files\NetProject 2008-03-29 19:51:12 39424 --a------ C:\WINDOWS\System32\byxxwxy.dll 2008-03-22 18:49:20 0 d-------- C:\Program Files\TextBridge Pro Millennium 2008-03-22 18:48:50 0 d-------- C:\Program Files\Common Files\ScanSoft Shared -- Registry Dump --------------------------------------------------------------- Note empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{01FE095B-4190-4DBA-B26D-EBB863DF7709}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{071B64CC-DE4C-4B08-B602-77F75A025082}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{075B14B3-6DE7-4A31-B4F1-342889EBD917}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0C232A58-86E4-47E5-886D-06F32942593B}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0CC1AB92-52E3-4409-9AFF-DF66BECD8016}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0D574C9F-71F9-4F3C-BA6D-CF9C0E1E3EE8}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{10E99DAB-7A56-4B0F-AB3C-EF88F820FC4B}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{143588E2-A11A-4D26-B0E4-93AEB570C73B}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{19494287-4D36-409F-A390-D20E710F183E}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1F366527-E8E8-415F-8084-35D323B3DEF3}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{24D26DEA-79DD-4BB9-852B-1282CDC5883C}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{26572950-42D5-4BA0-AB12-952768FE5912}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2A777FBB-7D94-48E8-8E73-93A34C9BE2C0}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2CE4736D-4A1F-4A93-9461-8FEE22B3AB99}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3725752F-AD3A-4932-9BA1-16AA24A2C6F5}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3CDED179-60A5-4C6F-8342-1C4FEDFEED86}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{46A2C00B-8F57-4226-B63F-5DA017A20615}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{49EC75A6-40D4-410B-BA49-4B99D9E816D8}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4B473956-D85C-4AE2-B83B-BA3FAC032A4F}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4DBCE191-C000-4550-AC87-88601CA93691}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E0C3F4B-AE09-4207-AD98-46E4A09FB553}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54E13E07-EEF0-48CB-B9DC-B4120190C3D5}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{576E9541-10E7-4FB3-B1E3-DB791DB57F53}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5A9FC9BA-CF40-4BFA-9925-16E9DF194D77}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5C50F12D-ECB1-4726-9D6F-56C5F96A87E4}] C:\WINDOWS\System32\ssqpm.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6346BC9B-5719-402E-80E3-C10D369BF188}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6860A44B-5D3E-433D-A7B5-D517F810D0E7}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6AE8AD21-151E-471D-8A8D-61EE1C0B8586}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{71FA1D38-FCBE-4416-A3CD-32E047E8C542}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74E45A97-521B-4CBF-9129-68CB2A1E5914}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7647359E-E67F-417C-8389-CF7BEA5C13B7}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7B34FFD7-AA7E-4355-91E3-DC5DE6E348EC}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{83F95AFE-B677-45A8-BDB0-CB12FB98BD1C}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{89EFD49D-5D90-4F20-ADED-DA130B4A5BB5}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8D5849C4-93F3-429D-FF34-260A2068897C}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{906F1B82-C722-419D-B26C-D9A42A3FBD57}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{90B2364C-F844-4069-8293-B151F070994B}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{986BC75D-E8A5-43A7-8971-052FC88F5036}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9C166FBD-B031-4811-96F6-4D37F1E824CB}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9ECCAF33-BED5-430D-8FA9-ED1552142CA6}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9ED47DF6-1920-4FAF-B6EF-C795D2D9B66C}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9FDBEF6C-3D64-45CA-A116-5BB97C522D94}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A0AAC1AB-EB9E-4951-B576-F48F26105EE3}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3752E3C-6641-4F0C-A86B-B11F08CE933C}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AB79E329-7FA2-4B34-813A-3AED19DF6EEB}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AD4A5016-1188-49E9-8E07-C4323D4A2F97}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B55157E8-AE0C-4178-87AA-7250CC69D9C3}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B7D042F5-725B-4E41-8AA2-3508E3BC923B}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C3BBFF18-D9A8-4156-B50E-2270640C59EE}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C657C484-9142-49BA-BB2B-FA6E9C052411}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C79F0C77-A964-4DDA-A503-5580ACB6ED4B}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CEF5D03D-A74B-4D14-B4E4-EC8551695F0E}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D5EF16DE-C074-4F4B-8308-A2241B2DFADE}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D72446DB-8675-4002-81B2-0366CF1EC30E}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D9546BB4-7243-4C63-962F-B80D55D8A443}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DA94A918-1C4A-4437-A758-06759AFEBE96}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DB6CB071-CF57-41DC-A77A-FBEDD535EE93}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E2F8F7C7-954D-4336-BA99-27BFBEB73DAF}] 29/03/2008 19:51 39424 --a------ C:\WINDOWS\System32\byxxwxy.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E4EDCD5E-0E84-452A-B8B6-6887FF0D43CC}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E9438E2B-A47D-4285-A56F-037A965CA27B}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ECC90355-9BCE-4D55-9F4F-BF69BADA76E3}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EDAE651D-7C91-4759-B160-200CEB8C781E}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EDE8E8B2-28E8-4C6C-9688-F6D1065A59D7}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F6210944-A83B-49EC-9E5E-8E69EFB07E30}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FEB64E52-187A-48C6-87E1-E0C0B1C06014}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "\\Nasir\EPSON Stylus Photo R230 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIP.exe" [09/03/2005 19:00] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [31/08/2007 19:43] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [19/04/2008 15:43] "KernelFaultCheck"="C:\WINDOWS\system32\dumprep 0 -k" [] "BM0ff3070b"="C:\WINDOWS\System32\anbfwlpt.dll" [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] "some"=C:\Program Files\NetProject\scit.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{E2F8F7C7-954D-4336-BA99-27BFBEB73DAF}"= C:\WINDOWS\System32\byxxwxy.dll [29/03/2008 19:51 39424] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "System"="csqgj.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byxxwxy] byxxwxy.dll 29/03/2008 19:51 39424 C:\WINDOWS\system32\byxxwxy.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\System32\ssqpm "Notification Packages"= :\WINDOW [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2683804368-1490112732-1395025495-1155\Scripts\Logon\0\0] "Script"=MHQLOGON.BAT [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator.PPC1^Start Menu^Programs^Startup^ImationFlashDetect.lnk] path=C:\Documents and Settings\Administrator.PPC1\Start Menu\Programs\Startup\ImationFlashDetect.lnk backup=C:\WINDOWS\pss\ImationFlashDetect.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk backup=C:\WINDOWS\pss\Acrobat Assistant.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTRegRun] C:\WINDOWS\CTRegRun.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dmsgg.exe] C:\WINDOWS\System32\dmsgg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\E06ADXRC_2588375] "C:\Program Files\Microsoft Encarta\Encarta Premium 2006\EDICT.EXE" -m [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstantAccess] C:\Program Files\TextBridge Pro Millennium\Bin\InstantAccess.exe /h [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\keybdll] wormexe.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\link part internet bird] C:\Documents and Settings\All Users\Application Data\amok idle link part\BENDERROR.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsNetHelper] mozilla-text.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NexusServer] "C:\Program Files\Common Files\Canopus Shared\ProCoder 2\Kernel\PNXSERVR.exe" -SelfLaunch [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemWindows] C:\WINDOWS\system32\scvhost.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vptray] C:\PROGRA~1\NavNT\vptray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer] VTTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowsUpdate] wormexe.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a1a339f2-1716-11dd-8312-005070c81d48}] AutoRun\command- E:\o9o2u.bat explore\Command- E:\o9o2u.bat open\Command- E:\o9o2u.bat [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a1a339f3-1716-11dd-8312-005070c81d48}] AutoRun\command- F:\o9o2u.bat explore\Command- F:\o9o2u.bat open\Command- F:\o9o2u.bat [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a1a339f4-1716-11dd-8312-005070c81d48}] AutoRun\command- G:\o9o2u.bat explore\Command- G:\o9o2u.bat open\Command- G:\o9o2u.bat -- End of Deckard's System Scanner: finished at 2008-05-01 09:08:59 ------------