iexplore? slowing me down

Unknown
edited October 2008 in Spyware & Virus Removal
Alright so lately I have been getting pop ups that just slow my computer right down. Sometimes so slow the webpage wont load...... I also have this thing called iexplore, i dont think i have seen it before but when I look at task manager its running at like 300, 000k not sure why? any help plz

I have dealt with you guys before, very helpful.. I still have hijack this do you want a log?

Comments

  • KatanaKatana
    edited October 2008
    Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.

    If you think you have similar problems, please post a log in the HJT forum and wait for help.
    Hello and welcome to the forums

    My name is Katana and I will be helping you to remove any infection(s) that you may have.

    Please observe these rules while we work:
    1. If you don't know, stop and ask! Don't keep going on.
    2. Please reply to this thread. Do not start a new topic.
    3. Please continue to respond until I give you the "All Clear"
    (Just because you can't see a problem doesn't mean it isn't there)

    If you can do those three things, everything should go smoothly :D

    Please Note, your security programs may give warnings for some of the tools I will ask you to use.
    Be assured, any links I give are safe

    wongger wrote:
    I have dealt with you guys before, very helpful.. I still have hijack this do you want a log?

    Yes please, along with the following.

    Installed Programs

    Please could you give me a list of the programs that are installed.
    • Start HijackThis
    • Click on the Misc Tools button
    • Click on the Open Uninstall Manager button.

    You will see a list with the programs installed in your computer.
    Click on save list button and specify where you would like to save this file.
    When you press Save button a notepad will open with the contents of that file.
    Simply copy and paste the contents of that notepad into your next post.
  • wongger
    edited October 2008
    Alright so here is unistall manager log,

    Adobe Flash Player ActiveX
    Adobe Flash Player Plugin
    Adobe Photoshop 7.0
    Adobe Reader 7.1.0
    Adobe Reader Korean Fonts
    Advanced Video FX Utility
    AnyDVD
    AppCore
    Apple Mobile Device Support
    Apple Software Update
    ArcSoft PhotoImpression 4
    ASIO4ALL
    ATI Display Driver
    AviSynth 2.5
    BitTorrent 3.4.2
    Bonjour
    CA Yahoo! Anti-Spy (remove only)
    CadStd
    ccCommon
    CCleaner (remove only)
    CleanUp!
    Click MusicalKEYS 3.0.214
    Component Framework
    Creative Photo Manager
    Creative WebCam Center
    Creative WebCam Live! Driver (1.02.03.0606)
    Creative WebCam Live! User's Guide (English)
    Digimax Master
    DivX Content Uploader
    DivX Web Player
    DVD Shrink 3.1.6
    DVDFab Platinum 2.9.7.2
    Full Tilt Poker
    GearDrivers
    Google Earth
    Guitar Pro 5.0
    HighMAT Extension to Microsoft Windows XP CD Writing Wizard
    HijackThis 2.0.2
    Hotfix for Windows Internet Explorer 7 (KB947864)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB952287)
    HP Imaging Device Functions 6.0
    HP Photosmart Cameras 6.0
    HP Photosmart Essential
    HP Solution Center and Imaging Support Tools 6.0
    HP Update
    HyperCam 2
    IL Download Manager
    iLiberty+ 1.3.0 Build 113
    Intel(R) Extreme Graphics Driver
    Intel(R) PRO Network Adapters and Drivers
    InterActual Player
    InterVideo WinDVD 4
    IrfanView (remove only)
    iTunes
    Java(TM) 6 Update 7
    Lexmark 2200 Series
    Lexmark Fax Solutions
    LimeWire 4.16.6
    LiveUpdate (Symantec Corporation)
    LiveUpdate (Symantec Corporation)
    Machinist2DLL
    Macromedia Shockwave Player
    Messenger Plus! Live & Sponsor (CiD)
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Hotfix (KB928366)
    Microsoft .NET Framework 2.0 Service Pack 1
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Encarta Encyclopedia Standard 2004
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft National Language Support Downlevel APIs
    Microsoft Office Excel Viewer 2003
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Word 2002
    Microsoft Works
    Microsoft Works 2004 Setup Launcher
    Microsoft Works Suite Add-in for Microsoft Word
    Moving Desktop
    Mozilla Firefox (2.0.0.17)
    MPIO Software Installation
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB936181)
    Neonatal Resuscitation DVD-ROM
    Nero 7
    Nero PhotoShow Express
    Norton AntiVirus
    Norton AntiVirus Help
    Norton Internet Security
    Norton Protection Center
    OpenOffice.org Installer 1.0
    Optex Flash Reader-Writer
    Pokemon Light
    PokerStars
    PokerStars.net
    PowerISO
    Prassi PrimoDVD 2.0 (English)
    QuickTime
    rgcAudio z3ta+ v1.0
    Rogers Self Healing (remove only)
    Rogers Yahoo! Applications
    SAMSUNG CDMA Modem Driver Set
    SAMSUNG Mobile USB Modem 1.0 Software
    SAMSUNG Mobile USB Modem Software
    Samsung PC Studio
    Samsung PC Studio 3 USB Driver Installer
    Security Status
    Security Update for CAPICOM (KB931906)
    Security Update for CAPICOM (KB931906)
    Security Update for Windows Internet Explorer 7 (KB928090)
    Security Update for Windows Internet Explorer 7 (KB929969)
    Security Update for Windows Internet Explorer 7 (KB931768)
    Security Update for Windows Internet Explorer 7 (KB933566)
    Security Update for Windows Internet Explorer 7 (KB937143)
    Security Update for Windows Internet Explorer 7 (KB938127)
    Security Update for Windows Internet Explorer 7 (KB939653)
    Security Update for Windows Internet Explorer 7 (KB942615)
    Security Update for Windows Internet Explorer 7 (KB944533)
    Security Update for Windows Internet Explorer 7 (KB950759)
    Security Update for Windows Internet Explorer 7 (KB953838)
    Security Update for Windows Media Player 10 (KB911565)
    Security Update for Windows Media Player 10 (KB917734)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows XP (KB938464)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB953839)
    Sibelius Scorch (ActiveX Only)
    Smart Audio Converter
    SPBBC 32bit
    StepMania (remove only)
    StepMania CVS (remove only)
    Uninstall JL2005A Toy Camera
    Update for Windows XP (KB951072-v2)
    Update for Windows XP (KB951978)
    URGE
    vanBasco's Karaoke Player
    Videora iPod Converter 3.04
    Viewpoint Manager (Remove Only)
    Viewpoint Media Player
    Vodafone 804SS USB driver Software
    Vuze
    WebCam Live! Product Registration
    Winamp (remove only)
    Windows Genuine Advantage v1.3.0254.0
    Windows Live installer
    Windows Live Messenger
    Windows Live Sign-in Assistant
    Windows Live Toolbar
    Windows Live Toolbar
    Windows Media Format 11 runtime
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows Media Player 11
    Windows XP Service Pack 3
    WinPcap 3.1
    WinRAR archiver
    Wizardbrush 6
    WizardsOverHogwarts
    WorldPokerTour
    Yahoo! Search Protection
    YP-U1

    Here is Hijack this log,

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 1:49:55 PM, on 10/10/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\RunDLL32.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ca.red.clientapps.yahoo.com/customize/rogers/defaults/sb/*http://www.yahoo.com/search/ie.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ca.red.clientapps.yahoo.com/customize/rogers/defaults/sp/*http://www.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ca.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll (file missing)
    O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
    O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: IYBookmarkHO Class - {8B11A219-80C8-4B42-B558-B8C14D1AA8C4} - C:\Program Files\Yahoo!\browser\ybmho.dll (file missing)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
    O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
    O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll (file missing)
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
    O4 - HKLM\..\Run: [PD0630 STISvc] RunDLL32.exe P0630Pin.dll,RunDLL32EP 513
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [Lexmark 2200 Series] "C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe"
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [Fbmxb] C:\Program Files\Lywck\Vtnymt.exe
    O4 - HKLM\..\Run: [BearFlix] "C:\Program Files\BearFlix\BearFlix.exe" /pause
    O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [eggs joy math type] C:\Documents and Settings\All Users\Application Data\Bind army eggs joy\logo curb.exe
    O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe" -quiet
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [Pile Mapi] C:\DOCUME~1\SPENCER\APPLIC~1\AXISLI~1\MP3CHIC.exe
    O4 - S-1-5-18 Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe (User 'SYSTEM')
    O4 - .DEFAULT Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe (User 'Default user')
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab30149.cab
    O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab30149.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.miniclip.com/ricochet/ReflexiveWebGameLoader.cab
    O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
    O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1093383440836
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
    O16 - DPF: {8B95CDB4-7F5F-44FA-803E-1F31963D711F} (FB_OCX Control) - http://download.soribada.com/down/Filebada/OCX/FB_OCX.CAB
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
    O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
    O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

    --
    End of file - 14383 bytes
  • KatanaKatana
    edited October 2008
    IMPORTANT I notice there are signs of one or more P2P (Person to Person) File Sharing Programs on your computer.

    BitTorrent 3.4.2
    LimeWire 4.16.6
    Vuze

    I'd like you to read the Guidelines for P2P Programs where we explain why it's not a good idea to have them.

    Also available here.

    My recommendation is you go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red).
    Please note: you must NOT use this whilst we are cleaning your machine.



    Step 1


    Remove Programs

    Now click Start---Control Panel. Double click Add or Remove Programs (XP) / Programs and Features (Vista) . If any of the following programs are listed there,
    click on the program to highlight it, and click on remove.
    • Full Tilt Poker << Adware Related
    • Adobe Reader 7.1.0 << See note below about Adobe
    Now close the Control Panel.

    Step 2

    You have a LOP infection that often comes together with Messenger Plus. To remove it we will try the simple way first.

    1. Go to Add/Remove programs. Double click on "Messenger Plus! Live & Sponsor (CiD)" (or click on Remove)

    2. The "Messenger Plus! - Setup" is now displayed. Click on the Uninstall button. Note: options displayed on the first screen are not related to the sponsor program.

    3. The sponsor screen is now displayed (if you don't see it, search for it in your Task Bar). To prove that someone is currently reading the screen, you have to type the code that is displayed. Once you enter the code, press Uninstall.

    4. If you entered the code properly, the program will ask you to confirm that you want to uninstall. You must answer "Yes" to this question, else, you won't have another chance of uninstalling.

    5. To complete the uninstallation, follow the instructions that are displayed (the first one is to close all your Internet Explorer windows, that's very important). When everything is complete, restart your computer and, hopefully voila one nasty infection is gone.
    Step 3


    Submit a File For Analysis
    We need to have the files below Scanned by Uploading them/it to Virus Total

    Please visit Virustotal
    Copy/paste the the following file path into the window
    C:\Program Files\Lywck\Vtnymt.exe

    Click Submit/Send File
    Please post back, to let me know the results.

    If Virustotal is too busy please try Jotti
    Step 4


    Malwarebytes' Anti-Malware

    Please download Malwarebytes' Anti-Malware to your desktop.

    • Double-click mbam-setup.exe and follow the prompts to install the program.
    • At the end, be sure a checkmark is placed next to
      • Update Malwarebytes' Anti-Malware
      • and Launch Malwarebytes' Anti-Malware
    • then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select Perform full scan, then click Scan.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Be sure that everything is checked, and click Remove Selected.
    • When completed, a log will open in Notepad. please copy and paste the log into your next reply
      • If you accidently close it, the log file is saved here and will be named like this:
      • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

    Step 5


    Download and Run RSIT
    • Please download Random's System Information Tool by random/random from here and save it to your desktop.
    • Double click on RSIT.exe to run RSIT.
    • Click Continue at the disclaimer screen.
    • Once it has finished, two logs will open:
      • log.txt will be opened maximized.
      • info.txt will be opened minimized.
    • Please post the contents of both log.txt and info.txt.

    Step 6


    Logs/Information to Post in Reply
    Please post the following logs/Information in your reply
    • Virus Total Results
    • MBAM Log
    • RSIT Log




    Your Adobe Acrobat Reader is out of date. Older versions have vulnerabilities that malware can use to infect your system.

    Adobe Reader is a large program and if you prefer a smaller program you can get Foxit 2.0 from http://www.foxitsoftware.com/pdf/rd_intro.php

    There is a newer version of Adobe Acrobat Reader available.
    • Please go to this link Adobe Acrobat Reader Download Link
    • Click Download
    • On the right Untick Adobe Phototshop Album Starter Edition if you do not wish to include this in the installation.
    • Click the Continue button
    • Click Run, and click Run again
    • Next click the Install Now button and follow the on screen prompts


    When the installation is complete go to Add/Remove Programs and uninstall all previous versions.
  • wongger
    edited October 2008
    Alright, so I have deleted those files except for limewire. I couldn't run the scan on virus total or Jotti because my firewall prevents me from doing it and I can't seem to figure out how to turn it off..... Its a Norton Protection center one. Has no options to turn off firewall so I dunno.

    but here are the RSIT logs, First the log.txt

    Logfile of random's system information tool 1.04 (written by random/random)
    Run by SPENCER at 2008-10-13 18:27:36
    Microsoft Windows XP Home Edition Service Pack 3
    System drive C: has 26 GB (17%) free of 153 GB
    Total RAM: 511 MB (22% free)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 6:28:32 PM, on 10/13/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\RunDLL32.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
    C:\WINDOWS\system32\lexpps.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
    C:\Documents and Settings\SPENCER\Desktop\RSIT.exe
    C:\Program Files\Trend Micro\HijackThis\SPENCER.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ca.red.clientapps.yahoo.com/customize/rogers/defaults/sb/*http://www.yahoo.com/search/ie.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ca.red.clientapps.yahoo.com/customize/rogers/defaults/sp/*http://www.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ca.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll (file missing)
    O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
    O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: IYBookmarkHO Class - {8B11A219-80C8-4B42-B558-B8C14D1AA8C4} - C:\Program Files\Yahoo!\browser\ybmho.dll (file missing)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
    O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
    O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll (file missing)
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
    O4 - HKLM\..\Run: [PD0630 STISvc] RunDLL32.exe P0630Pin.dll,RunDLL32EP 513
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [Lexmark 2200 Series] "C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe"
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [Fbmxb] C:\Program Files\Lywck\Vtnymt.exe
    O4 - HKLM\..\Run: [BearFlix] "C:\Program Files\BearFlix\BearFlix.exe" /pause
    O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [eggs joy math type] C:\Documents and Settings\All Users\Application Data\Bind army eggs joy\logo curb.exe
    O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
    O4 - HKLM\..\RunOnce: [MessengerPlusLiveUninstall] "C:\DOCUME~1\SPENCER\LOCALS~1\Temp\MsgPlusUninstall.exe" /Cleanup
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe" -quiet
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [Pile Mapi] C:\DOCUME~1\SPENCER\APPLIC~1\AXISLI~1\MP3CHIC.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab30149.cab
    O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab30149.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.miniclip.com/ricochet/ReflexiveWebGameLoader.cab
    O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
    O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1093383440836
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
    O16 - DPF: {8B95CDB4-7F5F-44FA-803E-1F31963D711F} (FB_OCX Control) - http://download.soribada.com/down/Filebada/OCX/FB_OCX.CAB
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
    O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
    O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

    --
    End of file - 14114 bytes

    ======Scheduled tasks folder======

    C:\WINDOWS\tasks\AFE7816B93B83CE3.job
    C:\WINDOWS\tasks\AppleSoftwareUpdate.job
    C:\WINDOWS\tasks\Norton Security Online - Run Full System Scan - MOE.job

    ======Registry dump======

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
    &Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll [2008-07-28 882416]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
    C:\PROGRA~1\SPYBOT~1\SDHelper.dll []

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
    Symantec Intrusion Prevention - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll [2008-08-29 116088]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
    SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8B11A219-80C8-4B42-B558-B8C14D1AA8C4}]
    IYBookmarkHO Class - C:\Program Files\Yahoo!\browser\ybmho.dll []

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
    Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2007-09-20 328752]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]
    Windows Live Toolbar Helper - C:\Program Files\Windows Live Toolbar\msntb.dll [2007-10-19 546320]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D}]
    SidebarAutoLaunch Class - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll [2004-08-03 124032]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}]
    SingleInstance Class - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll [2008-07-28 160496]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - SnagIt - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll []
    {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - Windows Live Toolbar - C:\Program Files\Windows Live Toolbar\msntb.dll [2007-10-19 546320]
    {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}
    {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll [2008-07-28 882416]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "PWRISOVM.EXE"=C:\Program Files\PowerISO\PWRISOVM.EXE [2006-11-06 200704]
    "PD0630 STISvc"=C:\WINDOWS\system32\P0630Pin.dll [2005-06-05 36864]
    "NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2006-01-12 155648]
    "Lexmark 2200 Series"=C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe [2004-02-13 57344]
    "IMJPMIG8.1"=C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [2004-08-03 208952]
    "HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2005-09-24 49152]
    "Fbmxb"=C:\Program Files\Lywck\Vtnymt.exe []
    "BearFlix"=C:\Program Files\BearFlix\BearFlix.exe /pause []
    "YOP"=C:\PROGRA~1\Yahoo!\YOP\yop.exe [2008-06-03 509224]
    "ccApp"=C:\Program Files\Common Files\Symantec Shared\ccApp.exe [2008-02-14 51048]
    "osCheck"=C:\Program Files\Norton Internet Security\osCheck.exe [2007-08-28 714608]
    "AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2008-07-22 116040]
    "QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-05-27 413696]
    "iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-07-30 289064]
    "SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
    "eggs joy math type"=C:\Documents and Settings\All Users\Application Data\Bind army eggs joy\logo curb.exe [2008-10-13 11523584]
    "YSearchProtection"=C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe [2008-07-11 223984]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "MessengerPlusLiveUninstall"=C:\DOCUME~1\SPENCER\LOCALS~1\Temp\MsgPlusUninstall.exe [2008-08-09 901456]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
    "DAEMON Tools"=C:\Program Files\DAEMON Tools\daemon.exe [2007-09-18 171464]
    "Yahoo! Pager"=C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet []
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2006-11-16 139264]
    "msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2007-10-18 5724184]
    "Pile Mapi"=C:\DOCUME~1\SPENCER\APPLIC~1\AXISLI~1\MP3CHIC.exe []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BestPopUpKiller]
    C:\Program Files\BestPopUpKiller\BestPopupKiller.exe /startup []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eBayToolbar]
    C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
    c:\program files\steam\steam.exe -silent []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YeppStudioAgent]
    C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe []

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup
    Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
    C:\WINDOWS\system32\Ati2evxx.dll [2006-02-21 61440]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
    C:\WINDOWS\system32\igfxsrvc.dll [2003-03-11 315392]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
    C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "dontdisplaylastusername"=0
    "legalnoticecaption"=
    "legalnoticetext"=
    "shutdownwithoutlogon"=1
    "undockwithoutlogon"=1

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    "NoDriveTypeAutoRun"=145
    "NoDrives"=0

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    "NoDriveTypeAutoRun"=
    "NoDriveAutoRun"=
    "NoDrives"=

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
    "C:\WINDOWS\system32\LEXPPS.EXE"="C:\WINDOWS\system32\LEXPPS.EXE:*:Disabled:LEXPPS.EXE"
    "C:\Program Files\WinMX\WinMX.exe"="C:\Program Files\WinMX\WinMX.exe:*:Enabled:WinMX Application"
    "C:\WINDOWS\PCHealth\HelpCtr\Binaries\helpctr.exe"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\helpctr.exe:*:Enabled:Remote Assistance - Windows Messenger and Voice"
    "C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
    "C:\Program Files\Starcraft\StarCraft.exe"="C:\Program Files\Starcraft\StarCraft.exe:*:Disabled:Starcraft"
    "C:\Program Files\Warcraft III\Warcraft III.exe"="C:\Program Files\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III"
    "C:\Program Files\Warcraft III\war3.exe"="C:\Program Files\Warcraft III\war3.exe:*:Enabled:Warcraft III"
    "C:\WINDOWS\system32\rtcshare.exe"="C:\WINDOWS\system32\rtcshare.exe:*:Enabled:RTC App Sharing"
    "C:\Program Files\NetMeeting\conf.exe"="C:\Program Files\NetMeeting\conf.exe:*:Enabled:Windows® NetMeeting®"
    "C:\Program Files\Steam\SteamApps\spwncer\counter-strike\hl.exe"="C:\Program Files\Steam\SteamApps\spwncer\counter-strike\hl.exe:*:Enabled:Half-Life Launcher"
    "C:\Program Files\Steam\SteamApps\spwncer\counter-strike source\hl2.exe"="C:\Program Files\Steam\SteamApps\spwncer\counter-strike source\hl2.exe:*:Enabled:hl2"
    "C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire: The most advanced file sharing program on the planet."
    "C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
    "C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
    "C:\Program Files\uTorrent\utorrent.exe"="C:\Program Files\uTorrent\utorrent.exe:*:Enabled:µTorrent"
    "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
    "C:\Program Files\Full Tilt Poker\FullTiltPoker.exe"="C:\Program Files\Full Tilt Poker\FullTiltPoker.exe:*:Enabled:Full Tilt Poker"
    "C:\Program Files\Valve\Steam\Steam.exe"="C:\Program Files\Valve\Steam\Steam.exe:*:Enabled:Steam"
    "C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
    "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
    "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
    "C:\Documents and Settings\ALBERT\Local Settings\Temp\WZSE0.TMP\SymNRT.exe"="C:\Documents and Settings\ALBERT\Local Settings\Temp\WZSE0.TMP\SymNRT.exe:*:Enabled:Norton Removal Tool"
    "C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
    "C:\Program Files\AIM\aim.exe"="C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger"
    "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
    "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

    ======List of files/folders created in the last 1 months======

    2008-10-13 18:27:36 ----D---- C:\rsit
    2008-10-13 18:25:22 ----D---- C:\Documents and Settings\SPENCER\Application Data\Malwarebytes
    2008-10-13 18:25:16 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-10-13 18:25:15 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
    2008-10-02 16:16:06 ----D---- C:\Program Files\CA Yahoo! Anti-Spy
    2008-09-29 21:58:56 ----D---- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
    2008-09-29 21:55:01 ----D---- C:\Program Files\CCleaner
    2008-09-24 08:31:59 ----A---- C:\FtpCmd.txt
    2008-09-14 19:38:45 ----D---- C:\Documents and Settings\All Users\Application Data\Bind army eggs joy
    2008-09-14 19:38:02 ----D---- C:\Program Files\AXIS LIST SITE
    2008-09-14 19:38:02 ----D---- C:\Documents and Settings\SPENCER\Application Data\AXIS LIST SITE

    ======List of files/folders modified in the last 1 months======

    2008-10-13 18:28:01 ----D---- C:\WINDOWS\Prefetch
    2008-10-13 18:27:39 ----D---- C:\Program Files\Common Files\Symantec Shared
    2008-10-13 18:26:41 ----D---- C:\WINDOWS\system32\drivers
    2008-10-13 18:25:15 ----AD---- C:\Program Files
    2008-10-13 18:21:51 ----D---- C:\WINDOWS\temp
    2008-10-13 18:19:16 ----D---- C:\Program Files\iLiberty
    2008-10-13 18:17:45 ----D---- C:\Program Files\Messenger Plus! Live
    2008-10-13 18:06:56 ----D---- C:\Program Files\Mozilla Firefox
    2008-10-13 18:05:55 ----SHD---- C:\WINDOWS\Installer
    2008-10-13 18:05:54 ----D---- C:\Config.Msi
    2008-10-13 18:01:29 ----D---- C:\Program Files\Common Files\Adobe
    2008-10-13 10:14:39 ----D---- C:\WINDOWS\system32\CatRoot2
    2008-10-13 01:45:50 ----A---- C:\WINDOWS\SchedLgU.Txt
    2008-10-11 18:35:14 ----A---- C:\WINDOWS\lexstat.ini
    2008-10-11 18:33:22 ----D---- C:\WINDOWS\system32
    2008-10-11 10:55:10 ----D---- C:\WINDOWS
    2008-10-11 10:34:55 ----D---- C:\Documents and Settings\SPENCER\Application Data\LimeWire
    2008-10-09 23:29:26 ----D---- C:\Program Files\Full Tilt Poker
    2008-10-09 21:18:25 ----D---- C:\Documents and Settings\All Users\Application Data\DVD Shrink
    2008-10-08 01:22:19 ----A---- C:\WINDOWS\NeroDigital.ini
    2008-10-05 14:53:29 ----D---- C:\Program Files\Internet Explorer
    2008-10-05 10:16:54 ----D---- C:\Documents and Settings\All Users\Application Data\CA-SupportBridge
    2008-10-02 17:13:29 ----D---- C:\Program Files\Ares
    2008-10-01 16:47:31 ----D---- C:\Documents and Settings\All Users\Application Data\Yahoo!
    2008-10-01 16:47:05 ----D---- C:\Program Files\Yahoo!
    2008-09-29 22:10:24 ----D---- C:\WINDOWS\Debug
    2008-09-27 16:57:24 ----A---- C:\WINDOWS\DVDFabGold.INI
    2008-09-26 17:55:21 ----D---- C:\Program Files\DVDFab Platinum
    2008-09-26 17:54:57 ----D---- C:\Documents and Settings\All Users\Application Data\eBay
    2008-09-26 17:54:01 ----D---- C:\Program Files\eBay
    2008-09-26 17:53:12 ----D---- C:\Program Files\321Studios
    2008-09-24 15:47:15 ----D---- C:\DVDFab_Temp
    2008-09-21 11:46:21 ----D---- C:\Documents and Settings\All Users\Application Data\WholeSecurity
    2008-09-21 00:38:02 ----D---- C:\Documents and Settings\SPENCER\Application Data\Adobe
    2008-09-21 00:33:08 ----D---- C:\Program Files\Adobe
    2008-09-18 15:35:41 ----D---- C:\Program Files\PartyGaming
    2008-09-14 20:39:57 ----D---- C:\Program Files\Warcraft III
    2008-09-14 19:38:54 ----SD---- C:\WINDOWS\Tasks

    ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys []
    R1 intelppm;Intel Processor Driver; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2008-04-13 36352]
    R1 oreans32;oreans32; \??\C:\WINDOWS\system32\drivers\oreans32.sys []
    R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2006-11-06 30988]
    R1 sf;SFI Service; C:\WINDOWS\system32\drivers\sf.sys [2003-04-01 33183]
    R1 SPBBCDrv;SPBBCDrv; \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys []
    R1 SRTSP;SRTSP; C:\WINDOWS\System32\Drivers\SRTSP.SYS [2007-11-30 279088]
    R1 SRTSPX;SRTSPX; C:\WINDOWS\System32\Drivers\SRTSPX.SYS [2007-11-30 43696]
    R1 SYMTDI;SYMTDI; C:\WINDOWS\System32\Drivers\SYMTDI.SYS [2008-06-13 184240]
    R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2003-03-31 12032]
    R2 ASPI32;ASPI32; C:\WINDOWS\System32\drivers\aspi32.sys [2002-07-17 16512]
    R2 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2006-04-21 8064]
    R2 tmcomm;tmcomm; \??\C:\WINDOWS\system32\drivers\tmcomm.sys []
    R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2003-02-26 100032]
    R3 AnyDVD;AnyDVD; C:\WINDOWS\System32\Drivers\AnyDVD.sys [2006-10-20 20096]
    R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2006-02-21 1505792]
    R3 BridgeMP;MAC Bridge Miniport; C:\WINDOWS\system32\DRIVERS\bridge.sys [2008-04-13 71552]
    R3 E100B;Intel(R) PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2003-03-04 145408]
    R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys []
    R3 GEARAspiWDM;GEAR CDRom Filter; C:\WINDOWS\SYSTEM32\DRIVERS\GEARAspiWDM.sys [2008-01-29 16168]
    R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2008-04-13 10368]
    R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys []
    R3 mouhid;Mouse HID Driver; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2003-03-31 12160]
    R3 msloop;Microsoft Loopback Adapter Driver; C:\WINDOWS\system32\DRIVERS\loop.sys [2001-08-17 4992]
    R3 NAVENG;NAVENG; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20081013.003\NAVENG.SYS []
    R3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20081013.003\NAVEX15.SYS []
    R3 Pcouffin;Low level access layer for CD devices; C:\WINDOWS\System32\Drivers\Pcouffin.sys [2008-09-26 47360]
    R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2003-03-21 555264]
    R3 SYMDNS;SYMDNS; C:\WINDOWS\System32\Drivers\SYMDNS.SYS [2008-06-13 13616]
    R3 SymEvent;SymEvent; \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS []
    R3 SYMFW;SYMFW; C:\WINDOWS\System32\Drivers\SYMFW.SYS [2008-06-13 96432]
    R3 SYMIDS;SYMIDS; C:\WINDOWS\System32\Drivers\SYMIDS.SYS [2008-06-13 38576]
    R3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\ipsdefs\20081010.002\SymIDSCo.sys []
    R3 SymIMMP;SymIMMP; C:\WINDOWS\system32\DRIVERS\SymIM.sys [2008-06-13 31280]
    R3 SYMNDIS;SYMNDIS; C:\WINDOWS\System32\Drivers\SYMNDIS.SYS [2008-06-13 37424]
    R3 SYMREDRV;SYMREDRV; C:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2008-06-13 22320]
    R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
    R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-13 30208]
    R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
    R3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
    R3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
    R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608]
    S2 npkcrypt;npkcrypt; \??\C:\Nexon\MapleStory\npkcrypt.sys []
    S3 {6080A529-897E-4629-A488-ABA0C29B635E};Intel(R) Graphics Platform (SoftBIOS) Driver; C:\WINDOWS\system32\drivers\ialmsbw.sys [2003-03-13 112288]
    S3 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91};Intel(R) Graphics Chipset (KCH) Driver; C:\WINDOWS\system32\drivers\ialmkchw.sys [2003-03-13 78496]
    S3 axoc97ws;axoc97ws; C:\WINDOWS\system32\drivers\axoc97ws.sys []
    S3 Bridge;MAC Bridge; C:\WINDOWS\system32\DRIVERS\bridge.sys [2008-04-13 71552]
    S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
    S3 COH_Mon;COH_Mon; \??\C:\WINDOWS\system32\Drivers\COH_Mon.sys []
    S3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2003-03-13 90395]
    S3 JL2005;JL2005A Toy Camera; C:\WINDOWS\System32\Drivers\toywdm.sys [2004-06-04 70888]
    S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
    S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
    S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
    S3 nm;Network Monitor Driver; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2008-04-13 40320]
    S3 NPF;NetGroup Packet Filter Driver; C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 32512]
    S3 P0630VID;Creative WebCam Live!; C:\WINDOWS\system32\DRIVERS\P0630Vid.sys [2005-06-05 91841]
    S3 Revolution1;Revolution1; \??\C:\Documents and Settings\SPENCER\Desktop\Revolution Engine 6.2\SHAK3.sys []
    S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
    S3 SRTSPL;SRTSPL; C:\WINDOWS\System32\Drivers\SRTSPL.SYS [2007-11-30 317616]
    S3 sscdbus;SAMSUNG USB Composite Device driver (WDM); C:\WINDOWS\system32\DRIVERS\sscdbus.sys [2005-12-22 80272]
    S3 sscdmdfl;SAMSUNG CDMA Modem Filter; C:\WINDOWS\system32\DRIVERS\sscdmdfl.sys [2005-12-22 10864]
    S3 sscdmdm;SAMSUNG CDMA Modem Drivers; C:\WINDOWS\system32\DRIVERS\sscdmdm.sys [2005-12-22 137884]
    S3 ssm_bus;SAMSUNG Mobile USB Device II 1.0 driver (WDM); C:\WINDOWS\system32\DRIVERS\ssm_bus.sys [2005-08-30 58320]
    S3 ssm_mdfl;SAMSUNG Mobile USB Modem II 1.0 Filter; C:\WINDOWS\system32\DRIVERS\ssm_mdfl.sys [2005-08-30 8336]
    S3 ssm_mdm;SAMSUNG Mobile USB Modem II 1.0 Drivers; C:\WINDOWS\system32\DRIVERS\ssm_mdm.sys [2005-08-30 94000]
    S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
    S3 SymIM;Symantec Network Security Intermediate Filter Service; C:\WINDOWS\system32\DRIVERS\SymIM.sys [2008-06-13 31280]
    S3 UfasoftSnifDriver4;Ufasoft Snif Driver v4; \??\C:\Program Files\Ufasoft\IcqSnif\usft_sn4.sys []
    S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2008-07-22 32000]
    S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
    S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
    S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
    S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
    S4 sr;System Restore Filter Driver; C:\WINDOWS\System32\DRIVERS\sr.sys [2008-04-13 73472]

    ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-07-22 116040]
    R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2006-02-21 405504]
    R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe [2007-08-28 243064]
    R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2007-07-24 229376]
    R2 ccEvtMgr;Symantec Event Manager; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-02-14 149864]
    R2 ccSetMgr;Symantec Settings Manager; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-02-14 149864]
    R2 CLTNetCnService;Symantec Lic NetConnect service; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-02-14 149864]
    R2 LexBceS;LexBce Server; C:\WINDOWS\system32\LEXBCES.EXE [2004-01-14 311296]
    R2 LiveUpdate Notice;LiveUpdate Notice; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-02-14 149864]
    R2 Viewpoint Manager Service;Viewpoint Manager Service; C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
    R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
    R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-07-30 532264]
    R3 Symantec Core LC;Symantec Core LC; C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe [2008-08-29 1251720]
    R3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
    S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
    S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
    S3 comHost;COM Host; C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe [2007-08-28 55640]
    S3 LiveUpdate;LiveUpdate; C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE [2007-08-28 3192184]
    S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2006-11-10 774144]
    S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
    S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe [2005-08-02 86016]
    S3 usprserv;User Privilege Service; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
    S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
    S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
    S3 YPCService;YPCService; C:\WINDOWS\system32\YPCSER~1.EXE [2003-05-19 86016]
    EOF
  • wongger
    edited October 2008
    Now the Info.txt

    info.txt logfile of random's system information tool 1.04 2008-10-13 18:28:43

    ======Uninstall list======

    -->"C:\Program Files\Common Files\Symantec Shared\SymSetup\{C1C185CA-C531-49F5-A6FA-B838405A049D}_15_0_0_60\Setup.exe" /X
    -->"C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
    -->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE
    -->C:\Program Files\Nero\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL
    -->C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
    -->C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
    -->C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
    -->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
    -->C:\WINDOWS\UNRecode.exe /UNINSTALL
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4D0803DB-8FC8-4C97-AE1F-1C3DCA357B01}\setup.exe" -l0x9
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{513D9FB1-27A2-44E4-8F2D-77A6737921A5}\setup.exe" -l0x9
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{80426743-0CC7-4967-BFEC-10DE08D1B6F3}\setup.exe" -l0x9
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{80426743-0CC7-4967-BFEC-10DE08D1B6F3}\setup.exe" -l0x9 /remove
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{93CC99FD-FCFC-4BAB-BCB0-3814826DF93D}\SETUP.EXE" -l0x9
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A82F10CB-18B5-4EAC-AEF2-FA49CD565626}\setup.exe" -l0x9
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E5ABA5FD-EE3D-4F15-895D-B32321E6C96B}\setup.exe" -l0x9
    -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
    Adobe Flash Player ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
    Adobe Flash Player Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
    Adobe Photoshop 7.0-->C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Adobe\Photoshop 7.0\Uninst.isu" -c"C:\Program Files\Adobe\Photoshop 7.0\Uninst.dll"
    Advanced Video FX Utility-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4D0803DB-8FC8-4C97-AE1F-1C3DCA357B01}\setup.exe" -l0x9 /remove
    AnyDVD-->"C:\Program Files\SlySoft\AnyDVD\AnyDVD-uninst.exe" /D="C:\Program Files\SlySoft\AnyDVD"
    AppCore-->MsiExec.exe /I{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}
    Apple Mobile Device Support-->MsiExec.exe /I{49C88E44-1B38-4FC6-824E-2BDA3063B0E3}
    Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
    ArcSoft PhotoImpression 4-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{68D5CEF9-0DA8-47FE-B0EB-4CBFB5AAF662}\setup.exe" -l0x9
    ASIO4ALL-->C:\Program Files\ASIO4ALL v2\uninstall.exe
    ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
    AviSynth 2.5-->"C:\Program Files\AviSynth 2.5\Uninstall.exe"
    Bonjour-->MsiExec.exe /I{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}
    CA Yahoo! Anti-Spy (remove only)-->"C:\Program Files\CA Yahoo! Anti-Spy\uninstall.exe"
    CadStd-->C:\Program Files\Apperson\CadStd\uninst.exe
    ccCommon-->MsiExec.exe /I{B24E05CC-46FF-4787-BBB8-5CD516AFB118}
    CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
    CleanUp!-->C:\Program Files\CleanUp!\uninstall.exe
    Click MusicalKEYS 3.0.214-->"C:\midi\unins000.exe"
    Component Framework-->MsiExec.exe /I{31478BE1-CDE5-4753-A8B2-F6D4BC1FBE09}
    Creative Photo Manager-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{513D9FB1-27A2-44E4-8F2D-77A6737921A5}\setup.exe" -l0x9 /remove
    Creative WebCam Center-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E5ABA5FD-EE3D-4F15-895D-B32321E6C96B}\setup.exe" -l0x9 /remove
    Creative WebCam Live! Driver (1.02.03.0606)-->C:\WINDOWS\CtDrvIns.exe -uninstall -script Pd0630.uns -unsext NT -plugin P0630Pin.dll -pluginres P0630Pin.crl
    Creative WebCam Live! User's Guide (English)-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\Creative WebCam\Creative WebCam Live! User's Guide\English\CTManual.isu"
    Digimax Master-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AEC0CEBC-0FC7-4716-8222-1C4A742719B1}\setup.exe" -l0x9 -removeonly
    DivX Content Uploader-->C:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
    DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
    DVD Shrink 3.1.6-->"C:\Program Files\DVD Shrink\unins000.exe"
    DVDFab Platinum 2.9.7.2-->"C:\Program Files\DVDFab Platinum\unins000.exe"
    Full Tilt Poker-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}\setup.exe" -l0x9 -removeonly
    GearDrivers-->rundll32.exe C:\WINDOWS\system32\UNINSTALL\UninstWDM.dll,UninstInitialize
    Google Earth-->MsiExec.exe /I{407B9B5C-DAC5-4F44-A756-B57CAB4E6A8B}
    Guitar Pro 5.0-->"C:\Program Files\Guitar Pro 5\unins000.exe"
    HighMAT Extension to Microsoft Windows XP CD Writing Wizard-->MsiExec.exe /X{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}
    HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
    Hotfix for Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
    Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
    Hotfix for Windows Media Player 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
    Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
    HP Imaging Device Functions 6.0-->C:\Program Files\HP\Digital Imaging\DigitalImagingMonitor\hpzscr01.exe -datfile hpqbud01.dat
    HP Photosmart Cameras 6.0-->C:\Program Files\HP\Digital Imaging\{E13AF122-FEB8-4d7b-8C66-C11F805539B1}\setup\hpzscr01.exe -datfile hpiscr01.dat
    HP Photosmart Essential-->MsiExec.exe /X{6994491D-D491-48F1-AE1F-E179C1FFFC2F}
    HP Solution Center and Imaging Support Tools 6.0-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
    HP Update-->MsiExec.exe /X{8C6027FD-53DC-446D-BB75-CACD7028A134}
    HyperCam 2-->Desktop\UnHyCam2.exe
    IL Download Manager-->C:\Program Files\Image-Line\Downloader\uninstall.exe
    Intel(R) Extreme Graphics Driver-->RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx PCI\VEN_8086&DEV_2572
    Intel(R) PRO Network Adapters and Drivers-->Prounstl.exe
    InterActual Player-->C:\Program Files\InterActual\InterActual Player\inuninst.exe
    InterVideo WinDVD 4-->"C:\Program Files\InstallShield Installation Information\{98E8A2EF-4EAE-43B8-A172-74842B764777}\setup.exe" REMOVEALL
    IrfanView (remove only)-->C:\Documents and Settings\SPENCER\Desktop\iv_uninstall.exe
    iTunes-->MsiExec.exe /I{3DE0053C-FD9A-483E-B7C9-B06E4392206E}
    Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
    Lexmark 2200 Series-->C:\WINDOWS\system32\spool\drivers\w32x86\3\LXBVUN5C.EXE -dLexmark 2200 Series
    Lexmark Fax Solutions-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\8\INTEL3~1\IDriver.exe /M{764C0C8F-B1B1-49BF-AEDC-4E48E857A667} /l1033 /z/U
    LimeWire 4.16.6-->"C:\Program Files\LimeWire\uninstall.exe"
    LiveUpdate (Symantec Corporation)-->MsiExec.exe /x {E80F62FF-5D3C-4A19-8409-9721F2928206} /l*v "C:\Documents and Settings\All Users\Application Data\LuUninstall.LiveUpdate"
    LiveUpdate (Symantec Corporation)-->MsiExec.exe /X{E80F62FF-5D3C-4A19-8409-9721F2928206}
    Machinist2DLL-->C:\Program Files\Machinist2DLL\uninstall.exe
    Macromedia Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~2\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~2\Install.log
    Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
    Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
    Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
    Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
    Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
    Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
    Microsoft Encarta Encyclopedia Standard 2004-->MsiExec.exe /I{04410044-9149-45C6-A806-F2BF9CFCE762}
    Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
    Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
    Microsoft Office Excel Viewer 2003-->MsiExec.exe /I{90840409-6000-11D3-8CFE-0150048383C9}
    Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
    Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
    Microsoft Word 2002-->MsiExec.exe /I{911B0409-6000-11D3-8CFE-0050048383C9}
    Microsoft Works 2004 Setup Launcher-->C:\Program Files\Microsoft Works Suite 2004\Setup\Launcher.exe /ARP D:\
    Microsoft Works Suite Add-in for Microsoft Word-->MsiExec.exe /I{33BEE6F3-9987-4F98-A069-97A64EC8321A}
    Microsoft Works-->MsiExec.exe /I{B9966F27-9678-4620-9579-925E3084647E}
    Moving Desktop-->MsiExec.exe /X{60753B31-5423-4BF1-BE63-5BFBE177F240}
    Mozilla Firefox (2.0.0.17)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
    MPIO Software Installation-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4D6AE5DB-7B19-493B-AFF6-0EC9F62E481C}\SETUP.EXE" -l0x9
    MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
    MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
    Neonatal Resuscitation DVD-ROM-->C:\PROGRA~1\AAP\NRP2006\UNWISE.EXE C:\PROGRA~1\AAP\NRP2006\INSTALL.LOG
    Nero 7-->MsiExec.exe /I{2D7D9D86-923A-41A8-919F-437332AB1033}
    Nero PhotoShow Express-->"C:\Program Files\Nero\data\Xtras\Uninstall.exe"
    Norton AntiVirus Help-->MsiExec.exe /I{E3EFA461-EB83-4C3B-9C47-2C1D58A01555}
    Norton AntiVirus-->MsiExec.exe /X{77FFBA7E-0973-4F39-BBDB-AC2F537578D2}
    Norton Internet Security-->MsiExec.exe /I{C1C185CA-C531-49F5-A6FA-B838405A049D}
    Norton Protection Center-->MsiExec.exe /I{62120008-8E1E-4807-860D-A8B48F8552DB}
    OpenOffice.org Installer 1.0-->MsiExec.exe /X{0D499481-22C6-4B25-8AC2-6D3F6C885FB9}
    Optex Flash Reader-Writer-->C:\WINDOWS\ISUNINST.EXE -fC:\PROGRA~1\Optex\FLASHR~1\OPUSBPDR.ISU -cC:\PROGRA~1\Optex\FLASHR~1\ONUNINST.DLL
    Pokemon Light-->MsiExec.exe /I{5A0C4270-DFDB-4B68-A442-B66941815306}
    PokerStars.net-->"C:\Program Files\PokerStars.NET\PokerStarsUninstall.exe" /u:PokerStars.net
    PokerStars-->"C:\Program Files\PokerStars\PokerStarsUninstall.exe" /u:PokerStars
    PowerISO-->"C:\Program Files\PowerISO\uninstall.exe"
    Prassi PrimoDVD 2.0 (English)-->C:\WINDOWS\Unin.exe /U:C:\Program Files\Prassi PrimoDVD 2.0 (English)\Unin01.in
    QuickTime-->MsiExec.exe /I{08CA9554-B5FE-4313-938F-D4A417B81175}
    rgcAudio z3ta+ v1.0-->C:\PROGRA~1\IMAGE-~1\FLSTUD~1\Plugins\VST\Z3TA_~1\UNINST~1\UNWISE.EXE C:\PROGRA~1\IMAGE-~1\FLSTUD~1\Plugins\VST\Z3TA_~1\UNINST~1\INSTALL.LOG
    Rogers Self Healing (remove only)-->"C:\Program Files\Rogers\SelfHealing\uninst.exe"
    Rogers Yahoo! Applications-->C:\PROGRA~1\Yahoo!\common\uninstall.exe
    SAMSUNG CDMA Modem Driver Set-->C:\WINDOWS\system32\Samsung_USB_Drivers\3\SSCDUninstall.exe
    SAMSUNG Mobile USB Modem 1.0 Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\1\SS_Uninstall.exe
    SAMSUNG Mobile USB Modem Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\2\SSM_Uninstall.exe
    Samsung PC Studio 3 USB Driver Installer-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}\setup.exe" -l0x9 -removeonly
    Samsung PC Studio-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C4A4722E-79F9-417C-BD72-8D359A090C97}\setup.exe" -l0x9 -removeonly
    Security Status-->MsiExec.exe /I{FE9BA992-FCAE-49E7-97F4-EF9D97DB67A3}
    Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
    Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
    Security Update for Windows Internet Explorer 7 (KB928090)-->"C:\WINDOWS\ie7updates\KB928090-IE7\spuninst\spuninst.exe"
    Security Update for Windows Internet Explorer 7 (KB929969)-->"C:\WINDOWS\ie7updates\KB929969\spuninst\spuninst.exe"
    Security Update for Windows Internet Explorer 7 (KB931768)-->"C:\WINDOWS\ie7updates\KB931768-IE7\spuninst\spuninst.exe"
    Security Update for Windows Internet Explorer 7 (KB933566)-->"C:\WINDOWS\ie7updates\KB933566-IE7\spuninst\spuninst.exe"
    Security Update for Windows Internet Explorer 7 (KB937143)-->"C:\WINDOWS\ie7updates\KB937143-IE7\spuninst\spuninst.exe"
    Security Update for Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
    Security Update for Windows Internet Explorer 7 (KB939653)-->"C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe"
    Security Update for Windows Internet Explorer 7 (KB942615)-->"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
    Security Update for Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
    Security Update for Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
    Security Update for Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
    Security Update for Windows Media Player 10 (KB911565)-->"C:\WINDOWS\$NtUninstallKB911565$\spuninst\spuninst.exe"
    Security Update for Windows Media Player 10 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe"
    Security Update for Windows Media Player 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
    Security Update for Windows Media Player 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
    Sibelius Scorch (ActiveX Only)-->MsiExec.exe /I{15CCBC5D-66A7-4131-8D36-E05F27B0E68F}
    Smart Audio Converter-->"C:\Program Files\SmartAudioConverter\unins000.exe"
    SPBBC 32bit-->MsiExec.exe /I{77772678-817F-4401-9301-ED1D01A8DA56}
    StepMania (remove only)-->"C:\Program Files\StepMania\uninstall.exe"
    StepMania CVS (remove only)-->"C:\Program Files\StepMania CVS\uninstall.exe"
    Uninstall JL2005A Toy Camera-->"C:\Program Files\JL2005A\unins000.exe"
    Update for Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
    Update for Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
    URGE-->MsiExec.exe /I{8BBF6DFD-0AD9-43A7-9FBD-BF065E3866AF}
    vanBasco's Karaoke Player-->C:\Program Files\vanBasco's Karaoke Player\uninst.exe
    Videora iPod Converter 3.04-->C:\Program Files\Red Kawa\Video Converter 3\uninstaller.exe
    Viewpoint Manager (Remove Only)-->C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgrInstaller.exe /u /k
    Viewpoint Media Player-->C:\Program Files\Viewpoint\Viewpoint Media Player\mtsAxInstaller.exe /u
    Vodafone 804SS USB driver Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\4\SSVDUninstall.exe
    WebCam Live! Product Registration-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{93CC99FD-FCFC-4BAB-BCB0-3814826DF93D}\SETUP.EXE" -l0x9 /remove
    Winamp (remove only)-->"C:\Program Files\Winamp\UninstWA.exe"
    Windows Genuine Advantage v1.3.0254.0-->MsiExec.exe /I{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}
    Windows Live installer-->MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}
    Windows Live Messenger-->MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0}
    Windows Live Sign-in Assistant-->MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
    Windows Live Toolbar-->"C:\Program Files\Windows Live Toolbar\UnInstall.exe" {D5A145FC-D00C-4F1A-9119-EB4D9D659750}
    Windows Live Toolbar-->MsiExec.exe /X{D5A145FC-D00C-4F1A-9119-EB4D9D659750}
    Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
    Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
    Windows Media Player 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
    Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
    Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
    WinPcap 3.1-->C:\Program Files\WinPcap\uninstall.exe
    WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
    Wizardbrush 6-->Rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\PROGRA~1\WIZARD~1\wizardc.inf
    WizardsOverHogwarts-->C:\WINDOWS\DWUninst.exe "WizardsOverHogwarts"
    WorldPokerTour-->C:\WINDOWS\system32\UnPoker.exe WorldPokerTour
    Yahoo! Search Protection-->C:\PROGRA~1\Yahoo!\SEARCH~1\UNINST~1.EXE
    YP-U1-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E4A0225B-A975-416C-8CF7-C1C025FD32D6}\Setup.exe" -l0x9

    =====HijackThis Backups=====

    O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNfox000
    O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
    R3 - URLSearchHook: ScriptInocUI Class - - (no file)
    O4 - HKLM\..\Run: [NI.UWFX5] "C:\Documents and Settings\SPENCER\Local Settings\Temporary Internet Files\Content.IE5\UFJI6IFA\WinFixer2005ScannerInstall[1].exe"
    O4 - HKLM\..\Run: [AutomatedSurfer] C:\WINDOWS\system32\SurferClient.exe
    O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
    O4 - HKLM\..\Run: [SurfNavigator] C:\WINDOWS\system32\SurferClient.exe
    O4 - HKCU\..\Run: [AutomatedSurfer] C:\WINDOWS\system32\SurferClient.exe
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ca.red.clientapps.yahoo.com/customize/rogers/defaults/sb/*http://www.yahoo.com/search/ie.html

    ======Hosts File======

    127.0.0.1 localhost

    ======Security center information======

    AV: Norton Security Online
    FW: Norton Security Online

    ======Environment variables======

    "ComSpec"=%SystemRoot%\system32\cmd.exe
    "Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\QuickTime\QTSystem;C:\Program Files\QuickTime\QTSystem\
    "windir"=%SystemRoot%
    "OS"=Windows_NT
    "PROCESSOR_ARCHITECTURE"=x86
    "PROCESSOR_LEVEL"=15
    "PROCESSOR_IDENTIFIER"=x86 Family 15 Model 3 Stepping 4, GenuineIntel
    "PROCESSOR_REVISION"=0304
    "NUMBER_OF_PROCESSORS"=2
    "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
    "TEMP"=%SystemRoot%\TEMP
    "TMP"=%SystemRoot%\TEMP
    "FP_NO_HOST_CHECK"=NO
    "CLASSPATH"=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip
    "QTJAVA"=C:\Program Files\QuickTime\QTSystem\QTJava.zip
    EOF

    Now the Malwarebytes log,

    Malwarebytes' Anti-Malware 1.28
    Database version: 1266
    Windows 5.1.2600 Service Pack 3

    10/13/2008 6:53:15 PM
    mbam-log-2008-10-13 (18-53-15).txt

    Scan type: Quick Scan
    Objects scanned: 85679
    Time elapsed: 25 minute(s), 31 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 47
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 3

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CLASSES_ROOT\funwebproducts.browseroverlaybarbutton (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\funwebproducts.browseroverlaybarbutton.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\funwebproducts.browseroverlayembed (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\funwebproducts.browseroverlayembed.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\funwebproducts.datacontrol.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\funwebproducts.shellviewcontrol (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\funwebproducts.shellviewcontrol.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\mywebsearch.chatsessionplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\mywebsearch.chatsessionplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\mywebsearch.htmlpanel (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\mywebsearch.htmlpanel.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\mywebsearchtoolbar.toolbarplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\mywebsearchtoolbar.toolbarplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{17de5e5e-bfe3-4e83-8e1f-8755795359ec} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{1f52a5fa-a705-4415-b975-88503b291728} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{2763e333-b168-41a0-a112-d35f96f410c0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{38a7c9da-8db7-4d0f-a7b1-c4b1a305bddb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{3e720451-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{3e720453-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{72ee7f04-15bd-4845-a005-d6711144d86a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{7473d293-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{7473d295-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{7473d297-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{8d292ec0-6792-4a38-82ed-73a087e41ba6} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{a626cdbd-3d13-4f78-b819-440a28d7e8fc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25f} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{e79dfbc9-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{e79dfbcb-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{f87d7fb5-9dc5-4c8c-b998-d8dfe02e2978} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{a6573479-9075-4a65-98a6-19fd29cf7374} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{d778513b-1c40-4819-b0c5-49e40b39afd0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{0d26bc71-a633-4e71-ad31-eadc3a1b6a3a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{3e720450-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{621feacd-8857-43a6-ae26-451d670d5370} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{98635087-3f5d-418f-990c-b1efe0797a3b} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{c8cecde3-1ae1-4c4a-ad82-6d5b00212144} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{e79dfbc0-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{a6573479-9075-4a65-98a6-19fd29cf7374} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-f3embed (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Ares Gold (Adware.WhenUSave) -> Quarantined and deleted successfully.

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    C:\Documents and Settings\ALBERT\Local Settings\Temp\1423_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
    C:\Documents and Settings\ALBERT\Local Settings\Temp\Norton_SA_Log.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
    C:\Documents and Settings\ALBERT\Local Settings\Temp\Servicestate.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
  • KatanaKatana
    edited October 2008
    Step 1



    Upload a File
    Download suspicious file packer from here

    Unzip it to desktop, open it & paste in the list of files below, press next & it will create an archive (zip/cab file) on desktop

    C:\Program Files\Lywck\Vtnymt.exe

    Go to spykiller

    Please start a new thread Titled File/s for Katana and give the following information
    • Name:-- Your name
    • E-mail:-- Your E-mail (this is confidential and will not be displayed)
    • Subject:-- File for Katana

    In the main text window please put the following link 
    [B][URL]http://icrontic.com/forum/showthread.php?p=645977#post645977[/URL][/B]
    you may also add any comments you wish
    then press attach and upload the zip/cab file that was created.

    Files can be uploaded by anybody but not downloaded at all except for those users that have been given special permissions.
    You DO NOT need to be a member to upload, anybody can upload the files


    Step 2

    Download Lop S&D by Eric_71 and save it to your desktop.

    Disable your antivirus and antimalware programs so they do not interfere with the running of Lop S&D.

    (list here)
    • Double-click Lop S&D.exe
    • Choose the language by typing of the corresponding letter and press Enter
    • Click OK at the informative window
    • Type 1, to choose Option 1 (Search) then press Enter
    • Wait until the end of the scan
    • A report will be generated, post the contents of it in your next reply.

    (Copy of the report can be found at this location: %systemdrive%\lopR.txt, in most cases C:\lopR.txt)
    Logs/Information to Post in Reply
    Please post the following logs/Information in your reply
    • Link To Your SpyKiller Topic
    • Lop S&D Log
  • wongger
    edited October 2008
    heres the link: http://thespykiller.co.uk/index.php/topic,7149.0.html

    Here is the S&D log

    \\ Lop S&D 4.2.4-5 XP/Vista

    Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 3
    X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 3.00GHz )
    BIOS : BIOS Date: 01/22/04 09:53:47 Ver: 08.00.10
    USER : SPENCER ( Administrator )
    BOOT : Normal boot
    Antivirus : Norton Security Online 15.0.0.60 (Activated)
    Firewall : Norton Security Online 15.0.0.60 (Activated)
    A:\ (USB)
    C:\ (Local Disk) - NTFS - Total : 149 Go Free : 23 Go
    D:\ (CD or DVD)
    E:\ (CD or DVD)
    F:\ (CD or DVD)
    G:\ (CD or DVD)

    "C:\Lop SD" ( MAJ : 02-10-2008|23:42 )
    Option : [1] ( Wed 10/15/2008|13:42 )
    \\ Listing folders in APPLIC~1


    [08/25/2004|04:44] C:\DOCUME~1\ADMINI~1.WON\APPLIC~1\<DIR> Identities
    [08/24/2004|06:32] C:\DOCUME~1\ADMINI~1.WON\APPLIC~1\<DIR> Microsoft


    [01/30/2007|03:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Ahead
    [06/08/2004|09:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> amoksendmfcdsurf
    [07/14/2007|04:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Apple
    [09/25/2006|09:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Apple Computer
    [06/23/2008|01:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Azureus
    [09/14/2008|07:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Bind army eggs joy
    [10/05/2008|10:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> CA-SupportBridge
    [10/14/2008|01:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> DVD Shrink
    [09/26/2008|05:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> eBay
    [09/08/2004|08:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> FaxCtr
    [12/27/2006|05:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> HP
    [07/24/2008|12:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Lavasoft
    [10/13/2008|06:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Malwarebytes
    [03/16/2004|11:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> McAfee.com
    [03/29/2008|06:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Microsoft
    [09/08/2004|05:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> MSN6
    [07/09/2007|08:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Musicnotes
    [01/30/2007|02:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Nero
    [08/29/2008|05:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> NortonInstaller
    [07/17/2005|03:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> QuickTime
    [07/24/2008|11:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Spybot - Search & Destroy
    [08/29/2008|09:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Symantec
    [04/16/2004|05:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> TechSmith
    [07/09/2008|09:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> TEMP
    [03/02/2007|06:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Trymedia
    [11/21/2005|04:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Viewpoint
    [09/21/2008|11:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> WholeSecurity
    [06/13/2006|08:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Windows Genuine Advantage
    [12/19/2006|10:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Windows Live Toolbar
    [03/03/2008|03:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> WLInstaller
    [08/29/2008|06:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> YAHOO
    [10/01/2008|04:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Yahoo!
    [10/01/2008|04:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Yahoo! Companion

    [08/25/2004|04:44] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Identities
    [08/24/2004|06:32] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Microsoft

    [01/31/2007|12:51] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> Ahead
    [12/23/2006|08:20] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> FaxCtr
    [09/18/2006|07:52] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> Help
    [09/16/2004|09:01] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> Macromedia
    [04/07/2007|08:10] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> Microsoft

    [12/31/2007|04:54] C:\DOCUME~1\MOE\APPLIC~1\<DIR> Adobe
    [07/12/2005|10:30] C:\DOCUME~1\MOE\APPLIC~1\<DIR> AdobeUM
    [07/18/2006|08:05] C:\DOCUME~1\MOE\APPLIC~1\<DIR> Ahead
    [07/04/2006|03:44] C:\DOCUME~1\MOE\APPLIC~1\<DIR> Aim
    [06/10/2007|10:41] C:\DOCUME~1\MOE\APPLIC~1\<DIR> Apple Computer
    [10/27/2004|08:45] C:\DOCUME~1\MOE\APPLIC~1\<DIR> ArcSoft
    [01/08/2008|07:12] C:\DOCUME~1\MOE\APPLIC~1\<DIR> DivX
    [11/05/2007|03:31] C:\DOCUME~1\MOE\APPLIC~1\<DIR> eBay
    [07/25/2008|09:48] C:\DOCUME~1\MOE\APPLIC~1\<DIR> FaxCtr
    [02/01/2005|08:43] C:\DOCUME~1\MOE\APPLIC~1\<DIR> Help
    [08/25/2004|04:44] C:\DOCUME~1\MOE\APPLIC~1\<DIR> Identities
    [09/20/2004|09:35] C:\DOCUME~1\MOE\APPLIC~1\<DIR> InterVideo
    [09/14/2004|05:13] C:\DOCUME~1\MOE\APPLIC~1\<DIR> Leadertech
    [11/25/2004|09:13] C:\DOCUME~1\MOE\APPLIC~1\<DIR> Macromedia
    [01/08/2008|07:12] C:\DOCUME~1\MOE\APPLIC~1\<DIR> Media Player Classic
    [02/20/2007|11:12] C:\DOCUME~1\MOE\APPLIC~1\<DIR> Microsoft
    [10/23/2005|12:13] C:\DOCUME~1\MOE\APPLIC~1\<DIR> Mozilla
    [03/26/2004|05:18] C:\DOCUME~1\MOE\APPLIC~1\<DIR> MSN6
    [11/25/2004|09:21] C:\DOCUME~1\MOE\APPLIC~1\<DIR> Raptisoft
    [05/08/2004|05:20] C:\DOCUME~1\MOE\APPLIC~1\<DIR> Real
    [02/01/2004|10:26] C:\DOCUME~1\MOE\APPLIC~1\<DIR> SlySoft
    [05/11/2004|09:51] C:\DOCUME~1\MOE\APPLIC~1\<DIR> Snapfish
    [09/14/2004|05:19] C:\DOCUME~1\MOE\APPLIC~1\<DIR> Sonic
    [09/18/2005|08:32] C:\DOCUME~1\MOE\APPLIC~1\<DIR> Sun
    [12/19/2006|12:02] C:\DOCUME~1\MOE\APPLIC~1\<DIR> WholeSecurity
    [08/28/2008|05:07] C:\DOCUME~1\MOE\APPLIC~1\<DIR> Yahoo!

    [12/13/2005|09:09] C:\DOCUME~1\NETWOR~1\APPLIC~1\<DIR> Azureus
    [12/13/2005|09:09] C:\DOCUME~1\NETWOR~1\APPLIC~1\<DIR> Microsoft

    [09/21/2008|12:38] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> Adobe
    [05/31/2008|05:30] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> AdobeUM
    [03/26/2007|08:16] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> Ahead
    [06/08/2004|10:06] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> Aim
    [09/09/2008|08:04] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> Apple Computer
    [07/04/2005|04:15] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> ArcSoft
    [07/29/2008|06:58] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> Atari
    [10/09/2008|06:38] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> AXIS LIST SITE
    [12/01/2005|09:31] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> Azureus
    [12/14/2006|10:01] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> Creative
    [01/08/2008|06:30] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> DivX
    [11/05/2007|04:05] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> eBay
    [01/03/2008|03:57] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> FaxCtr
    [10/21/2005|10:25] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> Google
    [09/10/2004|05:51] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> Help
    [02/23/2008|09:06] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> HP
    [03/17/2004|07:34] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> Identities
    [03/25/2008|04:13] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> ijjigame
    [10/09/2004|02:51] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> InterVideo
    [08/19/2007|03:03] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> Lavasoft
    [09/15/2004|07:00] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> Leadertech
    [10/11/2008|10:34] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> LimeWire
    [05/18/2005|04:19] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> Macromedia
    [10/13/2008|06:25] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> Malwarebytes
    [01/08/2008|06:50] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> Media Player Classic
    [12/20/2006|04:52] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> Microsoft
    [01/08/2008|06:26] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> Moyea
    [05/18/2005|07:01] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> Mozilla
    [03/09/2008|12:28] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> NPLUTO Corporation
    [11/23/2004|05:57] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> Raptisoft
    [11/06/2005|12:35] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> Real
    [09/10/2008|04:17] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> Sibelius Software
    [02/07/2004|06:48] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> SlySoft
    [09/15/2004|07:00] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> Sonic
    [10/11/2004|09:33] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> Sun
    [10/16/2006|07:36] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> U3
    [02/11/2005|08:48] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> Ufasoft
    [09/02/2008|07:28] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> uTorrent
    [12/18/2006|04:07] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> WholeSecurity
    [08/29/2008|12:04] C:\DOCUME~1\SPENCER\APPLIC~1\<DIR> Yahoo!
    \\ Scheduled Tasks located in C:\WINDOWS\Tasks

    [10/15/2008 01:00 PM] C:\WINDOWS\tasks\AFE7816B93B83CE3.job
    [10/09/2008 10:51 PM] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
    [10/13/2008 08:00 PM] C:\WINDOWS\tasks\Norton Security Online - Run Full System Scan - MOE.job
    [10/15/2008 03:09 AM] C:\WINDOWS\tasks\SA.DAT
    [03/31/2003 08:00 AM][-r-h-----] C:\WINDOWS\tasks\desktop.ini

    ( AFE7816B93B83CE3.job )=( c:\docume~1\spencer\applic~1\axisli~1\fordsaverule.exe )
    \\ Listing Folders in C:\Program Files

    [09/26/2008|05:53] C:\Program Files\<DIR> 321Studios
    [08/21/2007|07:22] C:\Program Files\<DIR> AAP
    [10/07/2005|12:20] C:\Program Files\<DIR> Activision Value
    [09/21/2008|12:33] C:\Program Files\<DIR> Adobe
    [01/30/2007|02:31] C:\Program Files\<DIR> Ahead
    [09/20/2004|10:41] C:\Program Files\<DIR> AlbumWrap_Extractor
    [01/27/2005|12:47] C:\Program Files\<DIR> Alcohol Soft
    [12/27/2007|09:36] C:\Program Files\<DIR> anyMania
    [04/16/2004|09:50] C:\Program Files\<DIR> Apperson
    [09/06/2008|09:21] C:\Program Files\<DIR> Apple Software Update
    [12/05/2005|04:15] C:\Program Files\<DIR> ArcSoft
    [10/02/2008|05:13] C:\Program Files\<DIR> Ares
    [02/22/2007|06:39] C:\Program Files\<DIR> ASIO4ALL v2
    [07/30/2007|02:43] C:\Program Files\<DIR> Atari
    [07/26/2008|07:23] C:\Program Files\<DIR> ATI Technologies
    [10/17/2007|05:28] C:\Program Files\<DIR> AviSynth 2.5
    [09/14/2008|07:38] C:\Program Files\<DIR> AXIS LIST SITE
    [09/04/2007|01:31] C:\Program Files\<DIR> Azureus
    [12/14/2006|09:17] C:\Program Files\<DIR> BitComet
    [06/01/2008|10:55] C:\Program Files\<DIR> Bonjour
    [01/27/2005|12:27] C:\Program Files\<DIR> Burning
    [10/02/2008|05:13] C:\Program Files\<DIR> CA Yahoo! Anti-Spy
    [09/29/2008|09:56] C:\Program Files\<DIR> CCleaner
    [11/14/2005|02:58] C:\Program Files\<DIR> CleanUp!
    [09/08/2008|02:46] C:\Program Files\<DIR> Common Files
    [08/25/2004|04:38] C:\Program Files\<DIR> ComPlus Applications
    [05/17/2007|09:26] C:\Program Files\<DIR> Copy of Warcraft III
    [01/04/2007|09:34] C:\Program Files\<DIR> Counterstrike sprays
    [10/15/2006|01:03] C:\Program Files\<DIR> Creative
    [10/14/2007|07:21] C:\Program Files\<DIR> DAEMON Tools
    [11/08/2005|07:33] C:\Program Files\<DIR> Data Caching
    [05/07/2008|04:47] C:\Program Files\<DIR> directx
    [12/27/2007|09:36] C:\Program Files\<DIR> DivX
    [02/07/2004|10:10] C:\Program Files\<DIR> DVD Shrink
    [09/26/2008|05:55] C:\Program Files\<DIR> DVDFab Platinum
    [07/26/2008|07:37] C:\Program Files\<DIR> DVDneXtCOPY
    [08/05/2008|09:40] C:\Program Files\<DIR> dvdSanta
    [09/26/2008|05:54] C:\Program Files\<DIR> eBay
    [02/06/2004|11:26] C:\Program Files\<DIR> Elaborate Bytes
    [09/11/2004|04:23] C:\Program Files\<DIR> Electronic Arts
    [10/25/2005|07:22] C:\Program Files\<DIR> Format Shell
    [10/14/2008|04:33] C:\Program Files\<DIR> Full Tilt Poker
    [06/13/2008|11:09] C:\Program Files\<DIR> Guitar Pro 5
    [03/17/2004|06:19] C:\Program Files\<DIR> HighMAT CD Writing Wizard
    [05/27/2007|08:50] C:\Program Files\<DIR> HP
    [10/13/2008|06:19] C:\Program Files\<DIR> iLiberty
    [09/08/2008|01:50] C:\Program Files\<DIR> InstallShield Installation Information
    [08/25/2004|04:57] C:\Program Files\<DIR> Intel
    [12/25/2005|09:46] C:\Program Files\<DIR> InterActual
    [10/15/2008|03:05] C:\Program Files\<DIR> Internet Explorer
    [09/19/2004|04:48] C:\Program Files\<DIR> InterVideo
    [05/12/2007|09:11] C:\Program Files\<DIR> inXile entertainment
    [09/08/2008|02:14] C:\Program Files\<DIR> iPod
    [09/08/2008|02:15] C:\Program Files\<DIR> iTunes
    [09/08/2008|02:49] C:\Program Files\<DIR> Java
    [10/27/2004|09:01] C:\Program Files\<DIR> JL2005A
    [01/22/2008|09:43] C:\Program Files\<DIR> K-Lite Codec Pack
    [03/17/2004|06:23] C:\Program Files\<DIR> Lexmark 2200 Series
    [09/08/2004|08:22] C:\Program Files\<DIR> Lexmark Fax Solutions
    [10/14/2006|12:16] C:\Program Files\<DIR> LG Software Innovations
    [02/29/2008|06:48] C:\Program Files\<DIR> LimeWire
    [09/25/2006|03:27] C:\Program Files\<DIR> Machinist2DLL
    [10/13/2008|06:26] C:\Program Files\<DIR> Malwarebytes' Anti-Malware
    [08/28/2008|02:44] C:\Program Files\<DIR> Messenger
    [10/13/2008|06:17] C:\Program Files\<DIR> Messenger Plus! Live
    [09/08/2004|07:54] C:\Program Files\<DIR> Microsoft ActiveSync
    [05/09/2007|01:55] C:\Program Files\<DIR> Microsoft CAPICOM 2.1.0.2
    [09/08/2004|08:00] C:\Program Files\<DIR> Microsoft Encarta
    [08/25/2004|04:41] C:\Program Files\<DIR> microsoft frontpage
    [08/07/2008|08:50] C:\Program Files\<DIR> Microsoft Office
    [12/27/2007|09:36] C:\Program Files\<DIR> Microsoft Works
    [09/08/2004|07:50] C:\Program Files\<DIR> Microsoft Works Suite 2004
    [08/28/2008|02:39] C:\Program Files\<DIR> Movie Maker
    [12/04/2007|05:30] C:\Program Files\<DIR> Moving Desktop
    [10/15/2008|01:36] C:\Program Files\<DIR> Mozilla Firefox
    [08/31/2008|10:31] C:\Program Files\<DIR> MSN
    [08/25/2004|04:38] C:\Program Files\<DIR> MSN Gaming Zone
    [04/19/2008|09:28] C:\Program Files\<DIR> MSN Messenger
    [08/15/2007|10:28] C:\Program Files\<DIR> MSXML 4.0
    [04/20/2007|03:54] C:\Program Files\<DIR> MTV Networks
    [01/30/2007|02:34] C:\Program Files\<DIR> Nero
    [08/28/2008|02:37] C:\Program Files\<DIR> NetMeeting
    [08/29/2008|10:18] C:\Program Files\<DIR> Norton Internet Security
    [08/25/2004|04:40] C:\Program Files\<DIR> Online Services
    [10/25/2005|07:22] C:\Program Files\<DIR> Optex
    [08/28/2008|02:37] C:\Program Files\<DIR> Outlook Express
    [09/18/2008|03:35] C:\Program Files\<DIR> PartyGaming
    [12/27/2007|09:36] C:\Program Files\<DIR> PokerStars
    [07/26/2008|07:37] C:\Program Files\<DIR> PokerStars.NET
    [01/09/2007|09:52] C:\Program Files\<DIR> PowerISO
    [09/08/2008|02:12] C:\Program Files\<DIR> QuickTime
    [11/06/2005|12:34] C:\Program Files\<DIR> Real
    [08/29/2008|05:10] C:\Program Files\<DIR> Rogers
    [07/24/2008|11:58] C:\Program Files\<DIR> Samsung
    [06/09/2007|05:52] C:\Program Files\<DIR> Sibelius Software
    [10/27/2006|10:08] C:\Program Files\<DIR> SlySoft
    [12/16/2006|01:41] C:\Program Files\<DIR> SmartAudioConverter
    [09/08/2008|01:50] C:\Program Files\<DIR> Starcraft
    [06/09/2008|09:25] C:\Program Files\<DIR> StepMania
    [09/08/2008|02:49] C:\Program Files\<DIR> Sun
    [08/29/2008|10:06] C:\Program Files\<DIR> Symantec
    [11/03/2006|08:42] C:\Program Files\<DIR> Teufl.Net
    [07/25/2008|06:50] C:\Program Files\<DIR> Trend Micro
    [07/06/2006|11:07] C:\Program Files\<DIR> Trymedia
    [02/11/2005|08:48] C:\Program Files\<DIR> Ufasoft
    [08/25/2004|04:43] C:\Program Files\<DIR> Uninstall Information
    [08/01/2007|07:49] C:\Program Files\<DIR> uTorrent
    [08/11/2008|03:46] C:\Program Files\<DIR> vanBasco's Karaoke Player
    [01/10/2007|05:45] C:\Program Files\<DIR> Viewpoint
    [09/06/2008|08:50] C:\Program Files\<DIR> vso
    [09/14/2008|08:39] C:\Program Files\<DIR> Warcraft III
    [12/11/2006|08:44] C:\Program Files\<DIR> Winamp
    [03/03/2008|04:00] C:\Program Files\<DIR> Windows Live
    [12/27/2007|09:36] C:\Program Files\<DIR> Windows Live Toolbar
    [12/27/2007|09:36] C:\Program Files\<DIR> Windows Media Connect 2
    [08/28/2008|02:37] C:\Program Files\<DIR> Windows Media Player
    [08/28/2008|02:37] C:\Program Files\<DIR> Windows NT
    [08/29/2008|09:34] C:\Program Files\<DIR> Windows Sidebar
    [08/25/2004|04:38] C:\Program Files\<DIR> WindowsUpdate
    [10/07/2005|07:00] C:\Program Files\<DIR> WinMX
    [05/07/2004|08:21] C:\Program Files\<DIR> WinPcap
    [03/17/2004|06:38] C:\Program Files\<DIR> WinRAR
    [07/26/2008|07:38] C:\Program Files\<DIR> WorldPokerTour
    [08/25/2004|04:41] C:\Program Files\<DIR> xerox
    [10/01/2008|04:47] C:\Program Files\<DIR> Yahoo!
    \\ Listing Folders in C:\Program Files\Common Files

    [01/25/2007|05:49] C:\Program Files\Common Files\<DIR> 3DO Shared
    [10/13/2008|06:01] C:\Program Files\Common Files\<DIR> Adobe
    [01/30/2007|02:39] C:\Program Files\Common Files\<DIR> Ahead
    [07/14/2007|04:33] C:\Program Files\Common Files\<DIR> Apple
    [12/26/2004|11:35] C:\Program Files\Common Files\<DIR> Blizzard Entertainment
    [09/08/2004|07:54] C:\Program Files\Common Files\<DIR> Designer
    [10/17/2007|05:17] C:\Program Files\Common Files\<DIR> Download Manager
    [05/27/2007|08:54] C:\Program Files\Common Files\<DIR> HP
    [11/04/2005|04:38] C:\Program Files\Common Files\<DIR> InstallShield
    [09/08/2008|02:46] C:\Program Files\Common Files\<DIR> Java
    [08/29/2008|09:27] C:\Program Files\Common Files\<DIR> Microsoft Shared
    [08/25/2004|04:39] C:\Program Files\Common Files\<DIR> MSSoap
    [02/06/2004|03:16] C:\Program Files\Common Files\<DIR> Nero
    [09/28/2005|07:39] C:\Program Files\Common Files\<DIR> NSV
    [08/25/2004|12:35] C:\Program Files\Common Files\<DIR> ODBC
    [12/29/2007|11:03] C:\Program Files\Common Files\<DIR> Real
    [08/28/2008|11:57] C:\Program Files\Common Files\<DIR> Scanner
    [08/25/2004|04:39] C:\Program Files\Common Files\<DIR> Services
    [08/25/2004|12:34] C:\Program Files\Common Files\<DIR> SpeechEngines
    [10/15/2008|07:16] C:\Program Files\Common Files\<DIR> Symantec Shared
    [08/28/2008|02:37] C:\Program Files\Common Files\<DIR> System
    [03/03/2008|03:59] C:\Program Files\Common Files\<DIR> WindowsLiveInstaller
    [07/09/2008|09:19] C:\Program Files\Common Files\<DIR> Wise Installation Wizard
    \\ Process

    ( 45 Processes )

    IEXPLORE.EXE ~ [PID:5324]
    \\ Searching with S_Lop

    No Lop folder found !
    \\ Searching for Lop Files - Folders

    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Bind army eggs joy
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Bind army eggs joy\logo curb.exe
    C:\DOCUME~1\SPENCER\APPLIC~1\axisli~1
    C:\DOCUME~1\SPENCER\APPLIC~1\axisli~1\bhlbbwns.exe
    C:\DOCUME~1\SPENCER\APPLIC~1\axisli~1\Data Tick Support Flag.exe
    C:\DOCUME~1\SPENCER\APPLIC~1\axisli~1\ford save rule.exe
    C:\Program Files\axisli~1
    C:\DOCUME~1\SPENCER\Cookies\spencer@advertising.marketnetwork[1].txt
    C:\DOCUME~1\SPENCER\Cookies\spencer@adopt.euroclick[1].txt
    C:\DOCUME~1\SPENCER\Cookies\spencer@partypoker[1].txt
    C:\WINDOWS\Tasks\AFE7816B93B83CE3.job
    \\ Searching within the Registry

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Pile Mapi"="C:\\DOCUME~1\\SPENCER\\APPLIC~1\\AXISLI~1\\MP3CHIC.exe"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "eggs joy math type"="C:\\Documents and Settings\\All Users\\Application Data\\Bind army eggs joy\\logo curb.exe"
    \\ Checking the Hosts file

    Hosts file CLEAN

    \\ Searching for hidden files with Catchme

    catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-10-15 13:47:11
    Windows 5.1.2600 Service Pack 3 NTFS
    scanning hidden processes ...
    scanning hidden files ...
    scan completed successfully
    hidden processes: 0
    hidden files: 26
    \\ Searching for other infections


    No other infections found !

    [F:1745][D:23]-> C:\DOCUME~1\SPENCER\LOCALS~1\Temp
    [F:63][D:0]-> C:\DOCUME~1\SPENCER\Cookies
    [F:7447][D:17]-> C:\DOCUME~1\SPENCER\LOCALS~1\TEMPOR~1\content.IE5

    1 - "C:\Lop SD\LopR_1.txt" - Wed 10/15/2008|13:51 - Option : [1]
    \\ Scan completed at 13:51:32
  • KatanaKatana
    edited October 2008
    Step 1


    Fix With HJT

    Close all other windows and then start HiJack This
    Click Do A System Scan Only
    When it has finished scanning put a check next to the following lines IF still present
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ca.red.clientapps.yahoo.com/c...search/ie.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ca.red.clientapps.yahoo.com/c.../www.yahoo.com

    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll (file missing)
    O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: IYBookmarkHO Class - {8B11A219-80C8-4B42-B558-B8C14D1AA8C4} - C:\Program Files\Yahoo!\browser\ybmho.dll (file missing)

    O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll (file missing)
    O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
    O4 - HKLM\..\Run: [Fbmxb] C:\Program Files\Lywck\Vtnymt.exe
    O4 - HKLM\..\Run: [BearFlix] "C:\Program Files\BearFlix\BearFlix.exe" /pause
    O4 - HKLM\..\Run: [eggs joy math type] C:\Documents and Settings\All Users\Application Data\Bind army eggs joy\logo curb.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe" -quiet
    O4 - HKCU\..\Run: [Pile Mapi] C:\DOCUME~1\SPENCER\APPLIC~1\AXISLI~1\MP3CHIC.exe
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
    - Close ALL open windows (especially Internet Explorer!)-
    Now click Fix checked
    Click yes to any prompts
    Close HijackThis

    Step 2



    OTMoveIt
    Please download OTMoveIt3 by OldTimer and save it to your desktop
    • Double-click OTMoveIt3.exe to run it.
    • Copy the lines in the codebox below.
    :Files
C:\WINDOWS\tasks\AFE7816B93B83CE3.job
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Bind army eggs joy
C:\DOCUME~1\SPENCER\APPLIC~1\AXIS LIST SITE
C:\Program Files\AXIS LIST SITE
C:\DOCUME~1\SPENCER\Cookies\spencer@advertising.marketnetwork[1].txt
C:\DOCUME~1\SPENCER\Cookies\spencer@adopt.euroclick[1].txt
C:\DOCUME~1\SPENCER\Cookies\spencer@partypoker[1].txt
:reg
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BestPopUpKiller]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eBayToolbar]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YeppStudioAgent]
    • Return to OTMoveIt3, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.

    • Click the red Moveit! button.
    • Copy everything in the Results window (under the green bar), and paste it in your next reply.
    • Close OTMoveIt3


    If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

    Step 3

    Please download DirLook by jpshortstuff from here.
    • Double-click DirLook.exe to run it.
    • Ensure that Show Hidden Files/Folders and BBCode Ouput are both checked.
    • Copy the content of the following codebox into the main textfield:
      C:\Program Files\Lywck
C:\Documents and Settings\All Users\Application Data\Amoksendmfcdsurf
    • Click the DirLook button to start the scan.
    • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply. (Note: The log can also be found at C:\dl_log.txt)
    Note: Scanning may take longer for large folders.
    Step 4


    Kaspersky Online Scanner .
    Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
    NOTE:- This scan is best done from IE (Internet Explorer)
    NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
    Go Here http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html

    Read the Requirements and limitations before you click Accept.
    Once the database has downloaded, click My Computer in the left pane
    Now go and put the kettle on !
    When the scan has completed, click Save Report As...
    Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
    Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.


    **Note**

    To optimize scanning time and produce a more sensible report for review:
    • Close any open programs.
    • Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

    Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.




    If the previous step did not automatically reboot your machine, Please reboot now


    Step 5


    Logs/Information to Post in Reply
    Please post the following logs/Information in your reply
    • OTMI Log
    • DirLook Log
    • Kaspersky Log
    • A Fresh HJT Log
    • How are things running now ?
  • KatanaKatana
    edited October 2008
    Whilst we appreciate that you may be busy, it has been 5 days or more since we heard from you. This topic is now closed.

    Infections can change and fresh instructions will now need to be given. If you wish to reopen your topic, please send a Private Message (PM) to Trogan with a link to your thread.

    If you are not the user who started this thread, you must start your own Thread instead :)
This discussion has been closed.