jamal6008

Hi
Recently something happened to my computer and it was affected with viruses and spywares which triggered win xp alert system. I managed to get rid of most of them using different softwares but my system is still behaving weird. Some of the programs don't work or crash. While others are just slow. Using internet by certain browsers is very slow. Please help


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:58:30:AM, on 27/06/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\system32\CNAB4RPK.EXE
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\WINDOWS\444.471
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\portsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\Program Files\Safari\Safari.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\iftuyszv.exe,
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ulutil2.dll,SetWriteBack
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [80a1956d] rundll32.exe "C:\WINDOWS\system32\nnacookw.dll",b
O4 - HKLM\..\Run: [BM8392a6f1] Rundll32.exe "C:\WINDOWS\system32\vkvmjjwt.dll",s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Add to VideoGet - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - C:\PROGRA~1\NUCLEA~1\VideoGet\Plugins\VIDEOG~1.DLL
O9 - Extra 'Tools' menuitem: Add to &VideoGet - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - C:\PROGRA~1\NUCLEA~1\VideoGet\Plugins\VIDEOG~1.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {BF6BBE9A-0656-4598-A0CD-32DAC03959B5} (Image Uploader 3.0 Control) - http://www.bootsphoto.com/wpp/boots/app/opcuploader.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: rotovark - {0b4b1868-17f4-42cd-94b0-e2cd1657d657} - C:\Documents and Settings\All Users\Application Data\rotovark.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: MsSecurity Updated (MsSecurity1.209.4) - Unknown owner - C:\WINDOWS\444.471.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Plug and Play (RPC) (PlugPlayRPC) - Unknown owner - C:\WINDOWS\portsv.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 11925 bytes

Hello

I just did DSS Scan so Ill post those logs aswell :)

Deckard's System Scanner v20071014.68
Run by Jamal on 2008-06-27 09:12:13
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
42: 2008-06-27 08:12:25 UTC - RP81 - Deckard's System Scanner Restore Point
41: 2008-06-26 21:15:56 UTC - RP80 - System Checkpoint
40: 2008-06-25 20:57:08 UTC - RP79 - Last known good configuration
39: 2008-06-25 20:56:55 UTC - RP78 - Software Distribution Service 3.0
38: 2008-06-25 20:56:54 UTC - RP77 - System Checkpoint


-- First Restore Point --
1: 2008-06-25 20:56:47 UTC - RP40 - Software Distribution Service 3.0


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as Jamal.exe) -----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:13:44:AM, on 27/06/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\system32\CNAB4RPK.EXE
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\WINDOWS\444.471
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\portsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\Documents and Settings\Jamal\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Jamal.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\iftuyszv.exe,
O2 - BHO: Anonymizer Proxy - {0DB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} - C:\Program Files\IP Address Shield\ProxyNew.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {43F43DED-A5F6-4320-B97A-E8BD98A0E41E} - C:\WINDOWS\system32\tuvSliJd.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: {92a1da2d-0e72-851a-2fa4-6362b3c3d35b} - {b53d3c3b-2636-4af2-a158-27e0d2ad1a29} - C:\WINDOWS\system32\sfeddggs.dll
O2 - BHO: (no name) - {F6725EDC-93FF-479B-A98B-C5B9E3C44864} - C:\WINDOWS\system32\byXQKExW.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ulutil2.dll,SetWriteBack
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [80a1956d] rundll32.exe "C:\WINDOWS\system32\nnacookw.dll",b
O4 - HKLM\..\Run: [BM8392a6f1] Rundll32.exe "C:\WINDOWS\system32\vkvmjjwt.dll",s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Add to VideoGet - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - C:\PROGRA~1\NUCLEA~1\VideoGet\Plugins\VIDEOG~1.DLL
O9 - Extra 'Tools' menuitem: Add to &VideoGet - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - C:\PROGRA~1\NUCLEA~1\VideoGet\Plugins\VIDEOG~1.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {BF6BBE9A-0656-4598-A0CD-32DAC03959B5} (Image Uploader 3.0 Control) - http://www.bootsphoto.com/wpp/boots/app/opcuploader.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: byXQKExW - C:\WINDOWS\SYSTEM32\byXQKExW.dll
O21 - SSODL: rotovark - {0b4b1868-17f4-42cd-94b0-e2cd1657d657} - C:\Documents and Settings\All Users\Application Data\rotovark.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: MsSecurity Updated (MsSecurity1.209.4) - Unknown owner - C:\WINDOWS\444.471.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Plug and Play (RPC) (PlugPlayRPC) - Unknown owner - C:\WINDOWS\portsv.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 12926 bytes

-- File Associations -----------------------------------------------------------

.cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R0 giveio - c:\windows\system32\giveio.sys
R0 speedfan - c:\windows\system32\speedfan.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver>
R3 pcouffin (VSO Software pcouffin) - c:\windows\system32\drivers\pcouffin.sys <Not Verified; VSO Software; Patin couffin engine>

S3 Ad-Watch Connect Filter (Ad-Watch Connect Kernel Filter) - c:\windows\system32\drivers\nsdriver.sys <Not Verified; Lavasoft AB; Ad-Watch Connections>
S3 Ad-Watch Real-Time Scanner (AW Real-Time Scanner) - c:\windows\system32\drivers\awrtpd.sys <Not Verified; Lavasoft AB; Ad-Watch Beta>
S3 Ad-Watch Registry Filter (Ad-Watch Registry Kernel Filter) - c:\windows\system32\drivers\awrtrd.sys <Not Verified; Lavasoft AB; Ad-Watch Registry Protection>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 aawservice (Ad-Aware 2007 Service) - "c:\program files\lavasoft\ad-aware 2007\aawservice.exe" <Not Verified; Lavasoft AB; Ad-Aware 2007 Service>
R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service>
R2 Bonjour Service - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Inc.; Bonjour>
R2 MsSecurity1.209.4 (MsSecurity Updated) - c:\windows\444.471 service
R2 Nero BackItUp Scheduler 3 - c:\program files\nero\nero8\nero backitup\nbservice.exe
R2 PlugPlayRPC (Plug and Play (RPC)) - c:\windows\portsv.exe service
R3 ServiceLayer - "c:\program files\pc connectivity solution\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution>


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: System Interrupt Controller
Device ID: PCI\VEN_1106&DEV_5364&SUBSYS_00000000&REV_00\3&2411E6FE&0&05
Manufacturer:
Name: System Interrupt Controller
PNP Device ID: PCI\VEN_1106&DEV_5364&SUBSYS_00000000&REV_00\3&2411E6FE&0&05
Service:

Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A}
Description: Nokia N73
Device ID: ROOT\WPD\0000
Manufacturer: Nokia
Name: Nokia N73
PNP Device ID: ROOT\WPD\0000
Service: WUDFRd


-- Scheduled Tasks -------------------------------------------------------------




2008-06-21 20:53:01 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
2008-06-15 01:17:33 264 --a------ C:\WINDOWS\Tasks\McDefragTask.job
2008-06-01 01:00:57 356 --a------ C:\WINDOWS\Tasks\McQcTask.job


-- Files created between 2008-05-27 and 2008-06-27 -----------------------------

2008-06-27 08:58:20 0 d-------- C:\Program Files\Trend Micro
2008-06-26 10:03:53 94272 --a------ C:\WINDOWS\system32\nnacookw.dll
2008-06-26 10:03:06 113216 --a------ C:\WINDOWS\system32\sfeddggs.dll
2008-06-26 10:00:06 104000 --a------ C:\WINDOWS\system32\vkvmjjwt.dll
2008-06-25 22:51:24 0 d-------- C:\WINDOWS\system32\7922
2008-06-25 22:51:22 55808 --a------ C:\WINDOWS\portsv.exe
2008-06-25 22:06:39 12288 --a------ C:\WINDOWS\y.exe
2008-06-25 22:06:39 11520 --a------ C:\WINDOWS\xplugin.dll
2008-06-25 22:06:38 16896 --a------ C:\WINDOWS\x.exe
2008-06-25 22:06:38 24064 --a------ C:\WINDOWS\winmgnt.exe
2008-06-25 22:06:38 12288 --a------ C:\WINDOWS\window.exe
2008-06-25 22:06:38 27648 --a------ C:\WINDOWS\winajbm.dll
2008-06-25 22:06:38 27136 --a------ C:\WINDOWS\win64.exe
2008-06-25 22:06:37 20736 --a------ C:\WINDOWS\win32e.exe
2008-06-25 22:06:37 22016 --a------ C:\WINDOWS\waol.exe
2008-06-25 22:06:37 20992 --a------ C:\WINDOWS\users32.exe
2008-06-25 22:06:36 31232 --a------ C:\WINDOWS\time.exe
2008-06-25 22:06:36 8448 --a------ C:\WINDOWS\systemcritical.exe
2008-06-25 22:06:36 22784 --a------ C:\WINDOWS\systeem.exe
2008-06-25 22:06:35 28160 --a------ C:\WINDOWS\svcinit.exe
2008-06-25 22:06:35 28672 --a------ C:\WINDOWS\svchost32.exe
2008-06-25 22:06:35 14336 --a------ C:\WINDOWS\sistem.exe
2008-06-25 22:06:34 14080 --a------ C:\WINDOWS\searchword.dll
2008-06-25 22:06:34 16128 --a------ C:\WINDOWS\rundll16.exe
2008-06-25 22:06:34 30976 --a------ C:\WINDOWS\quicken.exe
2008-06-25 22:06:33 29696 --a------ C:\WINDOWS\qttasks.exe
2008-06-25 22:06:33 12032 --a------ C:\WINDOWS\olehelp.exe
2008-06-25 22:06:33 13824 --a------ C:\WINDOWS\notepad32.exe
2008-06-25 22:06:32 15104 --a------ C:\WINDOWS\mtwirl32.dll
2008-06-25 22:06:32 23040 --a------ C:\WINDOWS\mswsc20.dll
2008-06-25 22:06:32 23040 --a------ C:\WINDOWS\mswsc10.dll
2008-06-25 22:06:32 12288 --a------ C:\WINDOWS\msupdate.exe
2008-06-25 22:06:31 13312 --a------ C:\WINDOWS\msspi.dll
2008-06-25 22:06:31 15616 --a------ C:\WINDOWS\msconfd.dll
2008-06-25 22:06:31 14080 --a------ C:\WINDOWS\loader.exe
2008-06-25 22:06:31 13824 --a------ C:\WINDOWS\internet.exe
2008-06-25 22:06:31 26880 --a------ C:\WINDOWS\inetinf.exe
2008-06-25 22:06:30 16384 --a------ C:\WINDOWS\iexplorer.exe
2008-06-25 22:06:30 22016 --a------ C:\WINDOWS\iedll.exe
2008-06-25 22:06:30 17408 --a------ C:\WINDOWS\helpcvs.exe
2008-06-25 22:06:30 17152 --a------ C:\WINDOWS\gfmnaaa.dll
2008-06-25 22:06:29 26880 --a------ C:\WINDOWS\funny.exe
2008-06-25 22:06:29 31232 --a------ C:\WINDOWS\funniest.exe
2008-06-25 22:06:28 26880 --a------ C:\WINDOWS\explorer32.exe
2008-06-25 22:06:28 23808 --a------ C:\WINDOWS\explore.exe
2008-06-25 22:06:28 16384 --a------ C:\WINDOWS\editpad.exe
2008-06-25 22:06:28 24576 --a------ C:\WINDOWS\dnsrelay.dll
2008-06-25 22:06:27 19968 --a------ C:\WINDOWS\directx32.exe
2008-06-25 22:06:27 16384 --a------ C:\WINDOWS\ctrlpan.dll
2008-06-25 22:06:27 23040 --a------ C:\WINDOWS\ctfmon32.exe
2008-06-25 22:06:27 24320 --a------ C:\WINDOWS\cpan.dll
2008-06-25 22:06:26 16128 --a------ C:\WINDOWS\clrssn.exe
2008-06-25 22:06:26 16128 --a------ C:\WINDOWS\avpcc.dll
2008-06-25 22:06:25 23808 --a------ C:\WINDOWS\accesss.exe
2008-06-25 21:56:37 619213 --ahs---- C:\WINDOWS\system32\dJilSvut.ini2
2008-06-25 21:56:32 279552 --a------ C:\WINDOWS\system32\tuvSliJd.dll
2008-06-25 21:51:35 0 d-------- C:\Documents and Settings\LocalService\Application Data\Macromedia
2008-06-25 21:51:34 0 d-------- C:\Documents and Settings\LocalService\Application Data\Adobe
2008-06-25 21:51:31 110592 --a------ C:\Documents and Settings\All Users\Application Data\rotovark.dll
2008-06-25 21:51:28 42496 --a------ C:\WINDOWS\system32\byXQKExW.dll
2008-06-25 21:51:20 0 dr------- C:\Documents and Settings\LocalService\Favorites
2008-06-25 21:51:18 88537 --a------ C:\WINDOWS\lfn.exe <Not Verified; Microsoft; XML Media>
2008-06-25 21:51:04 0 d-------- C:\Documents and Settings\Jamal\Application Data\Thinstall
2008-06-25 17:01:18 0 d-------- C:\Program Files\MSXML 4.0
2008-06-19 17:33:01 0 d-------- C:\Temp
2008-06-19 17:32:22 0 d-------- C:\Program Files\Xilisoft
2008-06-15 01:17:51 0 d-------- C:\Program Files\Steam
2008-06-10 19:11:38 0 d-------- C:\Program Files\IP Address Shield
2008-06-08 18:39:50 0 d-------- C:\Program Files\DAEMON Tools Lite
2008-06-08 18:27:55 717296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-06-08 18:27:42 0 d-------- C:\Documents and Settings\Jamal\Application Data\DAEMON Tools
2008-06-07 11:33:45 0 d-------- C:\Documents and Settings\Jamal\Application Data\Help
2008-06-06 18:43:35 0 d-------- C:\Documents and Settings\All Users\Application Data\RoboForm
2008-06-06 18:43:01 0 d-------- C:\Program Files\Siber Systems
2008-06-03 12:24:37 0 d-------- C:\Program Files\Common Files\xing shared
2008-06-03 12:24:15 0 d-------- C:\Program Files\Real
2008-06-03 12:24:11 0 d-------- C:\Program Files\Common Files\Real
2008-06-03 12:24:10 0 d-------- C:\Documents and Settings\Jamal\Application Data\Real
2008-06-01 21:38:21 0 d-------- C:\Documents and Settings\Jamal\Application Data\Google
2008-06-01 21:37:52 0 d-------- C:\Program Files\Google
2008-05-31 17:55:01 0 d-------- C:\Documents and Settings\Jamal\Application Data\vlc
2008-05-31 17:53:38 0 d-------- C:\Documents and Settings\Jamal\Application Data\dvdcss
2008-05-31 17:53:07 0 d-------- C:\Program Files\VideoLAN
2008-05-31 14:53:51 0 d-------- C:\Program Files\Canon
2008-05-31 11:25:33 34 --a------ C:\WINDOWS\system32\BD2040.DAT
2008-05-31 08:59:33 0 d-------- C:\WINDOWS\%DownloadedProgramFiles%
2008-05-31 08:59:22 20480 --a------ C:\WINDOWS\system32\normaliz.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-31 08:56:55 110549 --a------ C:\normaliz.exe
2008-05-31 07:05:32 0 d-------- C:\Documents and Settings\Jamal\Application Data\RTPlayer
2008-05-31 07:02:52 0 d-------- C:\Program Files\PixiePack Codec Pack
2008-05-31 07:02:09 0 d-------- C:\Documents and Settings\Jamal\Application Data\Tunebite
2008-05-31 07:01:35 0 d-------- C:\Program Files\RapidSolution
2008-05-31 07:01:35 0 d-------- C:\Documents and Settings\All Users\Application Data\RapidSolution
2008-05-31 06:48:57 0 d-------- C:\Program Files\iPod
2008-05-31 06:48:53 0 d-------- C:\Program Files\iTunes
2008-05-31 06:48:37 0 d-------- C:\Program Files\Bonjour
2008-05-31 06:48:12 0 d-------- C:\Program Files\Common Files\Apple
2008-05-29 02:34:01 0 d-------- C:\Program Files\Nuclear Coffee
2008-05-28 16:16:01 0 d-------- C:\Documents and Settings\Jamal\Application Data\LimeWire
2008-05-28 16:15:46 0 d-------- C:\Program Files\LimeWire
2008-05-28 02:38:14 0 d-------- C:\WINDOWS\system32\PreInstall
2008-05-28 02:38:12 0 d--h----- C:\WINDOWS\$hf_mig$
2008-05-27 23:00:22 0 d-------- C:\Documents and Settings\Jamal\Application Data\Nokia Multimedia Player


-- Find3M Report ---------------------------------------------------------------

2008-06-27 08:27:47 0 d-------- C:\Program Files\McAfee
2008-06-27 07:58:19 0 d-------- C:\Documents and Settings\Jamal\Application Data\Skype
2008-06-27 04:43:00 0 d-------- C:\Documents and Settings\Jamal\Application Data\skypePM
2008-06-26 10:07:16 0 d-------- C:\Documents and Settings\Jamal\Application Data\uTorrent
2008-06-24 16:54:22 0 d-------- C:\Program Files\Safari
2008-06-20 17:56:31 0 d-------- C:\Documents and Settings\Jamal\Application Data\FileZilla
2008-06-20 11:07:23 0 d-------- C:\Documents and Settings\Jamal\Application Data\Nokia
2008-06-03 12:24:37 0 d-------- C:\Program Files\Common Files
2008-05-31 09:27:39 0 d-------- C:\Program Files\K-Lite Codec Pack
2008-05-31 09:16:53 0 d-------- C:\Program Files\Windows Media Connect 2
2008-05-31 06:58:10 0 d-------- C:\Documents and Settings\Jamal\Application Data\Apple Computer
2008-05-27 23:02:16 668 --a------ C:\Documents and Settings\Jamal\Application Data\vso_ts_preview.xml
2008-05-27 23:02:16 0 d-------- C:\Documents and Settings\Jamal\Application Data\Vso
2008-05-27 19:34:06 0 d-------- C:\Program Files\SpeedFan
2008-05-26 12:35:29 0 d-------- C:\Program Files\BearShare
2008-05-26 10:25:06 0 d-------- C:\Documents and Settings\Jamal\Application Data\Sun
2008-05-25 18:21:07 0 d-------- C:\Documents and Settings\Jamal\Application Data\Nero
2008-05-25 18:20:16 0 d-------- C:\Program Files\Common Files\Nero
2008-05-25 18:19:14 0 d-------- C:\Program Files\Nero
2008-05-25 12:50:16 0 d-------- C:\Program Files\Red Kawa
2008-05-22 01:30:34 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-05-20 13:07:34 0 d-------- C:\Program Files\Common Files\McAfee
2008-05-18 12:55:00 75656 --ah----- C:\WINDOWS\system32\mlfcache.dat
2008-05-17 18:59:31 34 --a------ C:\Documents and Settings\Jamal\Application Data\pcouffin.log
2008-05-17 18:59:26 47360 --a------ C:\Documents and Settings\Jamal\Application Data\pcouffin.sys <Not Verified; VSO Software; Patin couffin engine>
2008-05-17 18:59:26 1144 --a------ C:\Documents and Settings\Jamal\Application Data\pcouffin.inf
2008-05-17 18:59:26 7887 --a------ C:\Documents and Settings\Jamal\Application Data\pcouffin.cat
2008-05-17 18:59:20 0 d-------- C:\Program Files\VSO
2008-05-15 00:35:44 0 d-------- C:\Program Files\QuickTime
2008-05-13 18:46:24 0 d-------- C:\Program Files\Lavasoft
2008-05-13 18:44:08 0 d-------- C:\Documents and Settings\Jamal\Application Data\GlobalSCAPE
2008-05-13 18:44:01 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-05-13 18:44:01 0 d-------- C:\Program Files\GlobalSCAPE
2008-05-13 18:43:52 0 d-------- C:\Program Files\Common Files\InstallShield
2008-05-13 18:39:47 0 d-------- C:\Program Files\FileZilla FTP Client
2008-05-13 18:27:20 684 --a------ C:\WINDOWS\mozver.dat
2008-05-13 18:27:18 0 d-------- C:\Program Files\DivX
2008-05-12 07:20:37 0 d-------- C:\Documents and Settings\Jamal\Application Data\Adobe
2008-05-12 07:19:02 0 d-------- C:\Program Files\Common Files\Adobe
2008-05-11 11:11:03 0 d-------- C:\Documents and Settings\Jamal\Application Data\PC Suite
2008-05-11 11:07:14 0 d-------- C:\Program Files\Common Files\Nokia
2008-05-11 11:07:13 0 d-------- C:\Program Files\Common Files\PCSuite
2008-05-11 11:07:11 0 d-------- C:\Program Files\Nokia
2008-05-11 11:07:01 0 d-------- C:\Program Files\DIFX
2008-05-11 11:06:55 0 d-------- C:\Program Files\PC Connectivity Solution
2008-05-11 00:53:39 0 d-------- C:\Program Files\Common Files\Adobe Systems Shared
2008-05-11 00:49:46 0 d-------- C:\Program Files\Alchemy Mindworks
2008-05-11 00:25:47 0 d-------- C:\Program Files\Temp
2008-05-10 23:38:08 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat
2008-05-10 23:35:12 0 d-------- C:\Program Files\Skype
2008-05-10 23:35:10 0 d-------- C:\Program Files\Common Files\Skype
2008-05-10 20:39:02 0 d-------- C:\Program Files\Promise
2008-05-10 20:38:59 0 d-------- C:\Program Files\Promise Technology, Inc
2008-05-10 18:48:45 0 d-------- C:\Documents and Settings\Jamal\Application Data\Media Player Classic <MEDIAP~1>
2008-05-10 18:40:39 0 d-------- C:\Documents and Settings\Jamal\Application Data\WinRAR
2008-05-10 17:22:23 0 d-------- C:\Program Files\McAfee.com
2008-05-10 17:16:27 0 d-------- C:\Documents and Settings\Jamal\Application Data\.BitTornado
2008-05-10 17:02:35 0 d-------- C:\Program Files\Microsoft Works
2008-05-10 17:02:30 0 d-------- C:\Program Files\MSBuild
2008-05-10 16:56:24 0 d-------- C:\Program Files\VIA
2008-05-10 16:51:49 0 d-------- C:\Program Files\Messenger Plus! Live
2008-05-10 16:50:46 0 d-------- C:\Program Files\Windows Live
2008-05-10 16:48:35 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller
2008-05-10 16:45:49 0 d-------- C:\Program Files\uTorrent
2008-05-10 16:45:33 0 d-------- C:\Program Files\Apple Software Update
2008-05-10 16:42:49 0 d-------- C:\Program Files\BitTornado
2008-05-10 16:31:01 0 d-------- C:\Program Files\Java
2008-05-10 16:30:07 0 d-------- C:\Program Files\Common Files\Java
2008-05-10 16:29:16 0 d-------- C:\Program Files\Yahoo!
2008-05-10 16:24:47 0 --a------ C:\WINDOWS\nsreg.dat
2008-05-10 16:24:46 0 d-------- C:\Documents and Settings\Jamal\Application Data\Mozilla
2008-05-10 15:54:00 0 d-------- C:\Documents and Settings\Jamal\Application Data\Macromedia
2008-05-10 15:48:55 0 d-------- C:\Program Files\Common Files\ODBC
2008-05-10 15:48:53 0 d-------- C:\Program Files\Common Files\SpeechEngines
2008-05-10 15:48:26 62 --ahs---- C:\Documents and Settings\Jamal\Application Data\desktop.ini
2008-05-10 15:06:10 0 d-------- C:\Documents and Settings\Jamal\Application Data\Identities
2008-05-10 15:01:25 0 d-------- C:\Program Files\microsoft frontpage
2008-05-10 15:01:02 0 -rahs---- C:\MSDOS.SYS
2008-05-10 15:01:02 0 -rahs---- C:\IO.SYS
2008-05-10 14:59:55 0 d--h----- C:\Program Files\WindowsUpdate
2008-05-10 14:59:16 0 d-------- C:\Program Files\Common Files\MSSoap
2008-05-10 14:59:07 0 d-------- C:\Program Files\Movie Maker
2008-05-10 14:58:05 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat
2008-05-10 14:57:45 0 d-------- C:\Program Files\Online Services
2008-05-10 14:57:39 0 d-------- C:\Program Files\Messenger
2008-05-10 14:57:34 0 d-------- C:\Program Files\MSN Gaming Zone
2008-05-10 14:57:24 0 d-------- C:\Program Files\Windows NT
2008-04-01 23:28:48 2102272 --a------ C:\WINDOWS\system32\x264vfw.dll
2008-03-31 22:25:46 682496 --a------ C:\WINDOWS\system32\divx.dll <Not Verified; DivX, Inc.; DivX®>
2008-03-28 18:41:32 7680 --a------ C:\WINDOWS\system32\ff_vfw.dll


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{43F43DED-A5F6-4320-B97A-E8BD98A0E41E}]
25/06/2008 09:56PM 279552 --a------ C:\WINDOWS\system32\tuvSliJd.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b53d3c3b-2636-4af2-a158-27e0d2ad1a29}]
26/06/2008 10:03AM 113216 --a------ C:\WINDOWS\system32\sfeddggs.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F6725EDC-93FF-479B-A98B-C5B9E3C44864}]
25/06/2008 09:51PM 42496 --a------ C:\WINDOWS\system32\byXQKExW.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [14/04/2008 01:00PM]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [14/04/2008 01:00PM]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [14/04/2008 01:00PM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [22/02/2008 04:25AM]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [05/12/2007 01:41AM]
"nwiz"="nwiz.exe" [05/12/2007 01:41AM C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [05/12/2007 01:41AM]
"HDAudDeck"="C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe" [11/05/2007 03:47PM]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [27/10/2006 12:47AM]
"PtiuPbmd"="ulutil2.dll" [05/11/2003 06:06PM C:\WINDOWS\system32\ulutil2.dll]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [11/01/2008 10:16PM]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [28/03/2008 11:37PM]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [01/11/2007 07:12PM]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [01/03/2007 03:57PM]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [20/09/2007 09:51AM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [30/03/2008 10:36AM]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [03/06/2008 12:24PM]
"80a1956d"="C:\WINDOWS\system32\nnacookw.dll" [26/06/2008 10:03AM]
"BM8392a6f1"="C:\WINDOWS\system32\vkvmjjwt.dll" [26/06/2008 10:00AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [14/04/2008 01:00PM]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [30/08/2007 05:43PM]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" [26/03/2008 06:41PM]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [16/04/2008 12:53PM]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [20/09/2007 03:35PM]
"RoboForm"="C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [06/06/2008 06:43PM]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [01/04/2008 10:39AM]
"Steam"="C:\Program Files\Steam\Steam.exe" [15/06/2008 01:18AM]

C:\Documents and Settings\Jamal\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [3/16/2005 7:16:50 PM]
OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [10/26/2006 8:24:54 PM]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{F6725EDC-93FF-479B-A98B-C5B9E3C44864}"= C:\WINDOWS\system32\byXQKExW.dll [25/06/2008 09:51PM 42496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"rotovark"= {0b4b1868-17f4-42cd-94b0-e2cd1657d657} - C:\Documents and Settings\All Users\Application Data\rotovark.dll [25/06/2008 09:51PM 110592]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\iftuyszv.exe,"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byXQKExW]
byXQKExW.dll 25/06/2008 09:51PM 42496 C:\WINDOWS\system32\byXQKExW.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
C:\WINDOWS\System32\dimsntfy.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\tuvSliJd

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
eapsvcs eaphost
dot3svc dot3svc

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
napagent
hkmsvc


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{61E3FE32-07B9-4563-A3E0-2DE2D620FE10}]
C:\Program Files\PixiePack Codec Pack\InstallerHelper.exe



-- End of Deckard's System Scanner: finished at 2008-06-27 09:16:45 ------------




Moderators Message

Please note that this section of the forum is very busy, and re-familiarize yourself with the Bumping Rules found in Step 5 of our sticky topic Important - Please Read This Before Posting for Malware Removal Help, which you should have read before posting. We ask that no one bump a thread before 72 hrs have passed, and then, only once. Early bump posts will be deleted.

Thanks for understanding.

Attached Files

extra.txt (17.0 KB, 1 views)

tetonbob

Hello, and Welcome to TSF.

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------


Download ComboFix from Here:


* IMPORTANT !!! Place combofix.exe on your Desktop

We will first use ComboFix to install the Microsoft Windows Recovery Console.

The Windows Recovery Console will allow you to boot up into a special recovery mode if needed. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

• Next, download the Microsoft file from this link:
  
  http://www.microsoft.com/downloads/d...displaylang=en
  
  Though this setup package is for SP2, it will work for your Service Pack 3 machine.
  
  
  
• Save the file as it's originally named, next to ComboFix.exe.
  
• Now close all open windows and programs, including all anti virus and anti malware programs so they do not interfere with the running of ComboFix . See this link for help if needed.
  
  
• Drag the setup package onto ComboFix.exe and drop it.
  
  
  
  
• Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console.
  
  ComboFix will now automatically install the Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Windows Recovery Console option when you start your computer unless requested to by a helper.
  
  As part of installing the Recovery Console, ComboFix will begin to run. Follow the prompts to install the Recovery Console. Your desktop may disappear. This is normal. It will return.
  
  Once the Recovery Console is installed using ComboFix, you should see a message that says:
  
  The Recovery Console was successfully installed.
  
  
  
  
  
• Click Yes to allow ComboFix to continue scanning for malware.
  

When the tool is finished, it will produce a report for you.

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.

If you have any questions along the way, STOP and ask them before proceeding.

__________________

** PC Safety and Security--What Do I Need? **

Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

jamal6008

Thanks alot for your help. Ive done what you said. When my computer restarted it gave me two Run DLL error messages. Logs are shown below

ComboFix 08-06-30.2 - Jamal 2008-07-01 17:32:19.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1383 [GMT 1:00]
Running from: C:\Documents and Settings\Jamal\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jamal\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
* Created a new restore point
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\444.471
C:\WINDOWS\accesss.exe
C:\WINDOWS\astctl32.ocx
C:\WINDOWS\avpcc.dll
C:\WINDOWS\BM8392a6f1.txt
C:\WINDOWS\clrssn.exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\cpan.dll
C:\WINDOWS\ctfmon32.exe
C:\WINDOWS\ctrlpan.dll
C:\WINDOWS\directx32.exe
C:\WINDOWS\dnsrelay.dll
C:\WINDOWS\editpad.exe
C:\WINDOWS\explore.exe
C:\WINDOWS\explorer32.exe
C:\WINDOWS\funniest.exe
C:\WINDOWS\funny.exe
C:\WINDOWS\gfmnaaa.dll
C:\WINDOWS\helpcvs.exe
C:\WINDOWS\iedll.exe
C:\WINDOWS\iexplorer.exe
C:\WINDOWS\inetinf.exe
C:\WINDOWS\internet.exe
C:\WINDOWS\lfn.exe
C:\WINDOWS\loader.exe
C:\WINDOWS\mainms.vpi
C:\WINDOWS\megavid.cdt
C:\WINDOWS\msconfd.dll
C:\WINDOWS\msspi.dll
C:\WINDOWS\msupdate.exe
C:\WINDOWS\mswsc10.dll
C:\WINDOWS\mswsc20.dll
C:\WINDOWS\mtwirl32.dll
C:\WINDOWS\muotr.so
C:\WINDOWS\notepad32.exe
C:\WINDOWS\olehelp.exe
C:\WINDOWS\portsv.exe
C:\WINDOWS\pskt.ini
C:\WINDOWS\qttasks.exe
C:\WINDOWS\quicken.exe
C:\WINDOWS\rundll16.exe
C:\WINDOWS\rundll32.vbe
C:\WINDOWS\searchword.dll
C:\WINDOWS\sistem.exe
C:\WINDOWS\svchost32.exe
C:\WINDOWS\svcinit.exe
C:\WINDOWS\systeem.exe
C:\WINDOWS\system32\adabnaig.dll
C:\WINDOWS\system32\byXQKExW.dll
C:\WINDOWS\system32\cmasenhe.ini
C:\WINDOWS\system32\culgyccc.dll
C:\WINDOWS\system32\dJilSvut.ini
C:\WINDOWS\system32\dJilSvut.ini2
C:\WINDOWS\system32\dkkjbjfe.dll
C:\WINDOWS\system32\dmkqdenu.dll
C:\WINDOWS\system32\fpizep.dll
C:\WINDOWS\system32\gdfmpg.dll
C:\WINDOWS\system32\gianbada.ini
C:\WINDOWS\system32\gragmnce.dll
C:\WINDOWS\system32\jeepetxx.ini
C:\WINDOWS\system32\jgmsrhnj.dll
C:\WINDOWS\system32\kwlrcxho.dll
C:\WINDOWS\system32\laniggex.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\nnacookw.dll
C:\WINDOWS\system32\owkfki.dll
C:\WINDOWS\system32\oyspnpbq.ini
C:\WINDOWS\system32\pmmdjgwa.dll
C:\WINDOWS\system32\qececnbr.dll
C:\WINDOWS\system32\sfeddggs.dll
C:\WINDOWS\system32\slnopx.dll
C:\WINDOWS\system32\tuvSliJd.dll
C:\WINDOWS\system32\tviqlqsh.dll
C:\WINDOWS\system32\ujbdpgcm.dll
C:\WINDOWS\system32\unedqkmd.ini
C:\WINDOWS\system32\vkvmjjwt.dll
C:\WINDOWS\system32\vnvrbmtm.ini
C:\WINDOWS\system32\wkoocann.ini
C:\WINDOWS\system32\yqynslay.dll
C:\WINDOWS\systemcritical.exe
C:\WINDOWS\time.exe
C:\WINDOWS\users32.exe
C:\WINDOWS\waol.exe
C:\WINDOWS\win32e.exe
C:\WINDOWS\win64.exe
C:\WINDOWS\winajbm.dll
C:\WINDOWS\window.exe
C:\WINDOWS\winmgnt.exe
C:\WINDOWS\x.exe
C:\WINDOWS\xplugin.dll
C:\WINDOWS\xxxvideo.hta
C:\WINDOWS\y.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MSSECURITY1.209.4
-------\Service_MsSecurity1.209.4
-------\Legacy_PlugPlayRPC
-------\Service_PlugPlayRPC


((((((((((((((((((((((((( Files Created from 2008-06-01 to 2008-07-01 )))))))))))))))))))))))))))))))
.

2008-06-28 12:47 . 2008-06-30 16:59 <DIR> d-------- C:\Program Files\GameSpy Arcade
2008-06-28 12:47 . 2008-06-28 12:47 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-06-28 10:14 . 2008-06-28 10:14 670 --a------ C:\WINDOWS\ST6UNST.002
2008-06-28 10:13 . 2008-06-28 10:14 670 --a------ C:\WINDOWS\ST6UNST.001
2008-06-28 10:13 . 2008-06-28 10:13 670 --a------ C:\WINDOWS\ST6UNST.000
2008-06-28 10:13 . 2008-06-28 10:14 0 --a------ C:\WINDOWS\SETUP.LST
2008-06-28 10:08 . 2008-06-28 10:08 <DIR> d-------- C:\Documents and Settings\Jamal\Application Data\Symantec
2008-06-28 10:00 . 2008-06-28 10:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2008-06-28 09:59 . 2008-06-30 16:59 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2008-06-28 01:18 . 2008-06-28 01:18 <DIR> d-------- C:\Program Files\CleanMyPC Popup Blocker
2008-06-27 20:12 . 2008-06-27 20:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Firefly Studios
2008-06-27 20:12 . 2008-05-30 14:11 1,491,992 --a------ C:\WINDOWS\system32\D3DCompiler_38.dll
2008-06-27 20:12 . 2008-05-30 14:19 507,400 --a------ C:\WINDOWS\system32\XAudio2_1.dll
2008-06-27 20:12 . 2008-05-30 14:11 467,984 --a------ C:\WINDOWS\system32\d3dx10_38.dll
2008-06-27 20:12 . 2008-05-30 14:18 238,088 --a------ C:\WINDOWS\system32\xactengine3_1.dll
2008-06-27 20:12 . 2008-05-30 14:17 65,032 --a------ C:\WINDOWS\system32\XAPOFX1_0.dll
2008-06-27 20:12 . 2008-05-30 14:17 25,608 --a------ C:\WINDOWS\system32\X3DAudio1_4.dll
2008-06-27 15:40 . 2007-10-12 15:14 3,734,536 --a------ C:\WINDOWS\system32\d3dx9_36.dll
2008-06-27 09:11 . 2008-06-27 09:11 <DIR> d-------- C:\Deckard
2008-06-27 08:58 . 2008-06-27 08:58 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-26 10:00 . 2008-07-01 10:05 110,321 --a------ C:\WINDOWS\BM8392a6f1.xml
2008-06-25 22:51 . 2008-06-30 17:02 <DIR> d-------- C:\WINDOWS\system32\7922
2008-06-25 21:51 . 2008-06-25 21:51 <DIR> d-------- C:\Documents and Settings\Jamal\Application Data\Thinstall
2008-06-25 21:51 . 2008-06-25 21:51 110,592 --a------ C:\Documents and Settings\All Users\Application Data\rotovark.dll
2008-06-25 17:01 . 2008-06-25 17:01 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-06-19 17:33 . 2008-06-20 16:38 <DIR> d-------- C:\Temp
2008-06-19 17:32 . 2008-06-19 17:32 <DIR> d-------- C:\Program Files\Xilisoft
2008-06-15 01:17 . 2008-07-01 17:39 <DIR> d-------- C:\Program Files\Steam
2008-06-10 22:17 . 2008-06-13 12:05 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-10 22:17 . 2008-06-13 12:05 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-10 19:11 . 2008-06-13 17:32 <DIR> d-------- C:\Program Files\IP Address Shield
2008-06-10 19:11 . 2008-06-13 17:31 125 --a------ C:\ioSpecial.ini
2008-06-09 00:26 . 2008-06-09 00:26 38 --a------ C:\WINDOWS\avisplitter.INI
2008-06-08 18:39 . 2008-06-08 18:39 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
2008-06-08 18:27 . 2008-06-08 18:27 <DIR> d-------- C:\Documents and Settings\Jamal\Application Data\DAEMON Tools
2008-06-08 18:27 . 2008-06-08 18:27 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-06-06 18:43 . 2008-06-06 18:43 <DIR> d-------- C:\Program Files\Siber Systems
2008-06-06 18:43 . 2008-06-06 18:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\RoboForm
2008-06-03 12:24 . 2008-06-03 12:24 <DIR> d-------- C:\Program Files\Real
2008-06-03 12:24 . 2008-06-03 12:24 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-06-03 12:24 . 2008-06-03 12:24 <DIR> d-------- C:\Program Files\Common Files\Real
2008-06-01 21:37 . 2008-06-01 21:37 <DIR> d-------- C:\Program Files\Google
2008-06-01 08:04 . 2008-06-01 08:05 6,384,832 --a------ C:\output.avi
2008-06-01 04:45 . 2008-04-23 05:16 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-06-01 04:45 . 2007-04-17 10:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-06-01 04:45 . 2007-03-08 06:10 991,232 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-06-01 04:45 . 2008-04-23 05:16 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-06-01 04:45 . 2008-04-23 05:16 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-06-01 04:45 . 2008-04-23 05:16 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-06-01 04:45 . 2008-04-23 05:16 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-06-01 04:45 . 2008-04-23 05:16 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-06-01 04:45 . 2008-04-22 08:39 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-01 16:29 --------- d-----w C:\Documents and Settings\Jamal\Application Data\uTorrent
2008-07-01 08:49 --------- d-----w C:\Program Files\Safari
2008-07-01 04:23 --------- d-----w C:\Documents and Settings\Jamal\Application Data\Skype
2008-07-01 02:22 --------- d-----w C:\Documents and Settings\Jamal\Application Data\skypePM
2008-06-30 15:59 --------- d-----w C:\Program Files\McAfee
2008-06-28 11:45 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-20 16:56 --------- d-----w C:\Documents and Settings\Jamal\Application Data\FileZilla
2008-06-20 10:07 --------- d-----w C:\Documents and Settings\Jamal\Application Data\Nokia
2008-06-10 06:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-06-03 11:24 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-05-31 16:55 --------- d-----w C:\Documents and Settings\Jamal\Application Data\vlc
2008-05-31 16:53 --------- d-----w C:\Program Files\VideoLAN
2008-05-31 16:53 --------- d-----w C:\Documents and Settings\Jamal\Application Data\dvdcss
2008-05-31 13:53 --------- d-----w C:\Program Files\Canon
2008-05-31 08:27 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-05-31 08:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\RapidSolution
2008-05-31 08:16 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-05-31 08:12 --------- d-----w C:\Documents and Settings\Jamal\Application Data\LimeWire
2008-05-31 08:05 --------- d-----w C:\Documents and Settings\Jamal\Application Data\Tunebite
2008-05-31 07:59 20,480 ----a-w C:\WINDOWS\system32\normaliz.dll
2008-05-31 07:56 110,549 ----a-w C:\normaliz.exe
2008-05-31 06:05 --------- d-----w C:\Documents and Settings\Jamal\Application Data\RTPlayer
2008-05-31 06:02 --------- d-----w C:\Program Files\PixiePack Codec Pack
2008-05-31 06:01 --------- d-----w C:\Program Files\RapidSolution
2008-05-31 05:58 --------- d-----w C:\Documents and Settings\Jamal\Application Data\Apple Computer
2008-05-31 05:49 --------- d-----w C:\Program Files\iTunes
2008-05-31 05:48 --------- d-----w C:\Program Files\iPod
2008-05-31 05:48 --------- d-----w C:\Program Files\Common Files\Apple
2008-05-31 05:48 --------- d-----w C:\Program Files\Bonjour
2008-05-30 13:11 3,850,760 ----a-w C:\WINDOWS\system32\D3DX9_38.dll
2008-05-29 01:34 --------- d-----w C:\Program Files\Nuclear Coffee
2008-05-28 15:15 --------- d-----w C:\Program Files\LimeWire
2008-05-27 22:02 --------- d-----w C:\Documents and Settings\Jamal\Application Data\Vso
2008-05-27 22:00 --------- d-----w C:\Documents and Settings\Jamal\Application Data\Nokia Multimedia Player
2008-05-27 18:34 --------- d-----w C:\Program Files\SpeedFan
2008-05-26 11:35 --------- d-----w C:\Program Files\BearShare
2008-05-25 17:21 --------- d-----w C:\Documents and Settings\Jamal\Application Data\Nero
2008-05-25 17:20 --------- d-----w C:\Program Files\Common Files\Nero
2008-05-25 17:19 --------- d-----w C:\Program Files\Nero
2008-05-25 17:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-05-25 11:50 --------- d-----w C:\Program Files\Red Kawa
2008-05-22 00:30 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-20 12:07 --------- d-----w C:\Program Files\Common Files\McAfee
2008-05-17 17:59 87,608 ----a-w C:\Documents and Settings\Jamal\Application Data\inst.exe
2008-05-17 17:59 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys
2008-05-17 17:59 47,360 ----a-w C:\Documents and Settings\Jamal\Application Data\pcouffin.sys
2008-05-17 17:59 --------- d-----w C:\Program Files\VSO
2008-05-14 23:35 --------- d-----w C:\Program Files\QuickTime
2008-05-14 23:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-05-13 17:46 --------- d-----w C:\Program Files\Lavasoft
2008-05-13 17:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-05-13 17:44 --------- d-----w C:\Program Files\GlobalSCAPE
2008-05-13 17:44 --------- d-----w C:\Documents and Settings\Jamal\Application Data\GlobalSCAPE
2008-05-13 17:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\GlobalSCAPE
2008-05-13 17:43 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-05-13 17:39 --------- d-----w C:\Program Files\FileZilla FTP Client
2008-05-13 17:27 --------- d-----w C:\Program Files\DivX
2008-05-12 06:19 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-11 10:11 --------- d-----w C:\Documents and Settings\Jamal\Application Data\PC Suite
2008-05-11 10:10 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-05-11 10:10 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-05-11 10:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\PC Suite
2008-05-11 10:07 --------- d-----w C:\Program Files\Nokia
2008-05-11 10:07 --------- d-----w C:\Program Files\DIFX
2008-05-11 10:07 --------- d-----w C:\Program Files\Common Files\PCSuite
2008-05-11 10:07 --------- d-----w C:\Program Files\Common Files\Nokia
2008-05-11 10:06 --------- d-----w C:\Program Files\PC Connectivity Solution
2008-05-11 10:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Installations
2008-05-10 23:53 --------- d-----w C:\Program Files\Common Files\Adobe Systems Shared
2008-05-10 23:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Adobe Systems
2008-05-10 23:49 --------- d-----w C:\Program Files\Alchemy Mindworks
2008-05-10 23:25 --------- d-----w C:\Program Files\Temp
2008-05-10 22:35 --------- d-----w C:\Program Files\Skype
2008-05-10 22:35 --------- d-----w C:\Program Files\Common Files\Skype
2008-05-10 22:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-05-10 19:39 --------- d-----w C:\Program Files\Promise
2008-05-10 19:38 --------- d-----w C:\Program Files\Promise Technology, Inc
2008-05-10 18:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-05-10 17:48 --------- d-----w C:\Documents and Settings\Jamal\Application Data\Media Player Classic
2008-05-10 16:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2008-05-10 16:22 --------- d-----w C:\Program Files\McAfee.com
2008-05-10 16:16 --------- d-----w C:\Documents and Settings\Jamal\Application Data\.BitTornado
2008-05-10 16:02 --------- d-----w C:\Program Files\MSBuild
2008-05-10 16:02 --------- d-----w C:\Program Files\Microsoft Works
2008-05-10 15:56 --------- d-----w C:\Program Files\VIA
2008-05-10 15:51 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-05-10 15:50 --------- d-----w C:\Program Files\Windows Live
2008-05-10 15:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-10 15:48 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-05-10 15:45 --------- d-----w C:\Program Files\uTorrent
2008-05-10 15:45 --------- d-----w C:\Program Files\Apple Software Update
2008-05-10 15:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-05-10 15:42 --------- d-----w C:\Program Files\BitTornado
2008-05-10 15:31 --------- d-----w C:\Program Files\Java
2008-05-10 15:30 --------- d-----w C:\Program Files\Common Files\Java
2008-05-10 15:29 --------- d-----w C:\Program Files\Yahoo!
2008-05-10 15:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-05-10 14:01 --------- d-----w C:\Program Files\microsoft frontpage
2008-05-08 14:02 203,136 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:12 1,288,192 ----a-w C:\WINDOWS\system32\quartz.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 13:00 15360]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-26 18:41 1232896]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-04-16 12:53 1079808]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-09-20 15:35 202024]
"RoboForm"="C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-06-06 18:43 160592]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 10:39 486856]
"Steam"="C:\Program Files\Steam\Steam.exe" [2008-06-15 01:18 1271032]
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 10:37 2321600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 13:00 208952]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 13:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 13:00 455168]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"HDAudDeck"="C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe" [2007-05-11 15:47 790528]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-11-01 19:12 582992]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 09:51 1836328]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-06-03 12:24 185896]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"PtiuPbmd"="ulutil2.dll" [2003-11-05 18:06 110592 C:\WINDOWS\system32\ulutil2.dll]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 13:00 15360]

C:\Documents and Settings\Jamal\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [3/16/2005 7:16:50 PM 113664]
OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [10/26/2006 8:24:54 PM 98632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"rotovark"= {0b4b1868-17f4-42cd-94b0-e2cd1657d657} - C:\Documents and Settings\All Users\Application Data\rotovark.dll [2008-06-25 21:51 110592]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\BitTornado\\btdownloadgui.exe"=
"C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"C:\\Program Files\\BearShare\\BearShare.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\Steam\\steamapps\\killer_6008\\counter-strike source\\hl2.exe"=
"D:\\Stronghold 2\\Stronghold2.exe"=
"D:\\Stronghold Crusader\\Stronghold_Crusader_Extreme.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 dontgo;Promise Removable Disk Control Driver;C:\WINDOWS\system32\DRIVERS\DontGo.sys [2004-06-29 14:25]
R0 ulsata2;ulsata2;C:\WINDOWS\system32\DRIVERS\ulsata2.sys [2006-04-06 17:52]
R3 S6U12BScanner;MUSTEK 1200 UB Still Image Device Service;C:\WINDOWS\system32\drivers\usbscan.sys [2008-04-14 00:15]


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{61E3FE32-07B9-4563-A3E0-2DE2D620FE10}]
C:\Program Files\PixiePack Codec Pack\InstallerHelper.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-06-28 19:53:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-06-15 00:17:33 C:\WINDOWS\Tasks\McDefragTask.job"
- C:\WINDOWS\system32\defrag.exe
"2008-07-01 00:01:23 C:\WINDOWS\Tasks\McQcTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe.4158 0
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-BM8392a6f1 - C:\WINDOWS\system32\pmmdjgwa.dll
HKLM-Run-80a1956d - C:\WINDOWS\system32\adabnaig.dll


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-01 17:39:24
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
C:\WINDOWS\system32\CNAB4RPK.EXE
C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\McAfee\VIRUSS~1\Mcshield.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\McAfee\MPF\MpfSrv.exe
C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe
C:\Program Files\McAfee\MSK\msksrver.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
.
**************************************************************************
.
Completion time: 2008-07-01 17:41:27 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-01 16:41:22

Pre-Run: 71,085,731,840 bytes free
Post-Run: 71,250,669,568 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

414 --- E O F --- 2008-06-25 16:01:34

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 05:45:25:PM, on 01/07/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\WINDOWS\system32\CNAB4RPK.EXE
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Safari\Safari.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: CleanMyPC Toolbar - {04164EC4-1E48-4279-818E-3721931E7636} - C:\Program Files\CleanMyPC Popup Blocker\CleanBar.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ulutil2.dll,SetWriteBack
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Add to VideoGet - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - C:\PROGRA~1\NUCLEA~1\VideoGet\Plugins\VIDEOG~1.DLL
O9 - Extra 'Tools' menuitem: Add to &VideoGet - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - C:\PROGRA~1\NUCLEA~1\VideoGet\Plugins\VIDEOG~1.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {BF6BBE9A-0656-4598-A0CD-32DAC03959B5} (Image Uploader 3.0 Control) - http://www.bootsphoto.com/wpp/boots/app/opcuploader.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL