The computer is running much better... yea! Will I ever get to the point I can do this on my own??????
Here are the logs
ComboFix 08-04-20.5 - jhilliard 2008-04-21 21:32:03.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1509 [GMT -4:00]
Running from: C:\Documents and Settings\jhilliard\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\jhilliard\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\jhilliard\My Documents\ICROSO~1.NET
C:\Documents and Settings\jhilliard\My Documents\ICROSO~1.NET\?icrosoft.NET\
C:\Documents and Settings\jhilliard\Start Menu\Programs\Outerinfo
C:\Documents and Settings\jhilliard\Start Menu\Programs\Outerinfo\Terms.lnk
C:\Documents and Settings\jhilliard\Start Menu\Programs\Outerinfo\Uninstall.lnk
C:\Program Files\Common Files\dobe~1
C:\Program Files\Common Files\dobe~1\m?config.exe
C:\Program Files\outerinfo
C:\Program Files\outerinfo\FF\chrome.manifest
C:\Program Files\outerinfo\FF\components\FF.dll
C:\Program Files\outerinfo\FF\components\OuterinfoAds.xpt
C:\Program Files\outerinfo\FF\install.rdf
C:\Program Files\outerinfo\Terms.rtf
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\{b8d6bd18-3d40-d42c-5ffc-00afabe7ffe4}.dll
C:\WINDOWS\system32\boofqov.dll
C:\WINDOWS\system32\eddmdigs.dll
C:\WINDOWS\system32\hgGyaabx.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\opnLeBqn.dll
C:\WINDOWS\system32\oqtvuwxx.ini
C:\WINDOWS\system32\oqtvuwxx.ini2
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\picocbyy.dll
C:\WINDOWS\system32\uninstall.exe
C:\WINDOWS\system32\voykxysw.dll
C:\WINDOWS\system32\xbaayGgh.ini
C:\WINDOWS\system32\xbaayGgh.ini2
.
((((((((((((((((((((((((( Files Created from 2008-03-22 to 2008-04-22 )))))))))))))))))))))))))))))))
.
30044-07-10 06:13 . 30044-07-10 06:13 3,120 --a------ C:\WINDOWS\system32\SSQ.ocx
30044-07-10 06:13 . 30044-07-10 06:13 3,120 --a--c--- C:\WINDOWS\rimage.lf
2008-04-21 21:32 . 2008-04-21 21:32 0 --a------ C:\WINDOWS\BMcb2846c0.xml
2008-04-20 20:57 . 2008-04-20 20:57 <DIR> d-------- C:\WINDOWS\ERUNT
2008-04-20 19:18 . 2008-04-20 21:25 <DIR> d----c--- C:\SDFix
2008-04-20 13:46 . 2008-04-20 13:46 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-18 17:47 . 2008-04-18 17:47 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2008-04-18 17:38 . 2008-04-21 21:03 <DIR> dr-h-c--- C:\$VAULT$.AVG
2008-04-18 17:37 . 2008-04-18 17:37 <DIR> d-------- C:\Documents and Settings\NetworkService\Application Data\AVG7
2008-04-18 17:37 . 2008-04-21 20:47 <DIR> d-------- C:\Documents and Settings\jhilliard\Application Data\AVG7
2008-04-18 17:37 . 2008-04-18 17:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-04-18 17:37 . 2008-04-21 21:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
2008-04-18 17:36 . 2008-04-18 17:37 8,192 --a------ C:\Documents and Settings\tgoyette
2008-04-18 17:11 . 2008-04-18 17:11 <DIR> d----c--- C:\VundoFix Backups
2008-04-17 22:34 . 2008-04-17 22:34 89,070 --a------ C:\WINDOWS\system32\myss_sb_uninstall.exe
2008-04-17 22:33 . 2008-04-17 22:33 298,305 --a------ C:\WINDOWS\system32\gside.exe
2008-04-17 22:33 . 2008-04-17 22:33 200,779 --a------ C:\WINDOWS\system32\rcntlkdn.exe
2008-04-17 22:33 . 2008-04-17 22:33 88,961 --a------ C:\WINDOWS\system32\mysidesearch_sidebar_uninstall.exe
2008-04-17 21:55 . 2008-04-18 17:01 354 --ahs---- C:\WINDOWS\system32\yltlkxwt.ini
2008-04-17 16:34 . 2008-04-17 16:34 <DIR> d-------- C:\Program Files\Lavasoft
2008-04-17 16:34 . 2008-04-17 16:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-04-17 15:15 . 2008-04-17 15:15 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-17 15:08 . 2008-04-17 15:08 <DIR> d-------- C:\Program Files\Opera
2008-04-17 13:03 . 2008-04-17 13:03 401,020 --a------ C:\WINDOWS\system32\g91.exe
2008-04-16 21:51 . 2008-04-17 21:48 534 --ahs---- C:\WINDOWS\system32\ahnjocsi.ini
2008-04-16 21:45 . 2008-04-20 13:41 861 --a------ C:\WINDOWS\system32\winpfz33.sys
2008-04-16 21:44 . 2008-04-21 20:58 <DIR> d-------- C:\WINDOWS\system32\xcsDd01
2008-04-16 21:44 . 2008-04-18 19:23 <DIR> d-------- C:\WINDOWS\system32\trcTMP
2008-04-16 21:44 . 2008-04-16 21:44 <DIR> d-------- C:\WINDOWS\system32\slNew
2008-04-16 21:44 . 2008-04-16 21:44 <DIR> d-------- C:\WINDOWS\system32\NFi
2008-04-16 21:44 . 2008-04-17 20:33 <DIR> d-------- C:\WINDOWS\system32\iTmp
2008-04-16 21:44 . 2008-04-16 21:44 <DIR> d----c--- C:\temp\berDrv11
2008-04-16 21:44 . 2008-04-21 20:58 63,890 --a------ C:\WINDOWS\system32\{b8d6bd18-3d40-d42c-5ffc-00afabe7ffe4}.dll-uninst.exe
2008-04-16 15:00 . 2008-04-16 15:00 <DIR> d-------- C:\Documents and Settings\jhilliard\System
2008-04-16 15:00 . 2008-04-16 15:00 <DIR> d-------- C:\Documents and Settings\jhilliard\Application Data\SmartDraw
2008-04-11 11:46 . 2008-04-11 11:46 334,848 --a------ C:\WINDOWS\system32\myss_sb.dll
2008-04-07 08:15 . 2008-04-19 00:48 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-04-07 08:15 . 2008-04-07 08:15 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-25 14:24 . 2008-03-25 14:24 <DIR> d-------- C:\Program Files\Walgreens
2008-03-25 14:24 . 2008-03-25 14:24 <DIR> d-------- C:\Program Files\Common Files\HP
2008-03-25 14:24 . 2008-03-25 14:24 <DIR> d-------- C:\Documents and Settings\jhilliard\Application Data\Walgreens
2008-03-25 14:24 . 2008-03-25 14:24 <DIR> d-------- C:\Documents and Settings\jhilliard\Application Data\W Photo Studio
2008-03-25 14:24 . 2008-03-25 14:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Walgreens
2008-03-25 14:20 . 2008-03-25 14:37 <DIR> d-------- C:\Documents and Settings\jhilliard\Application Data\W Photo Studio Viewer
2008-03-25 13:03 . 2008-04-15 20:20 <DIR> d----c--- C:\C Video Projects
2008-03-24 20:30 . 2008-04-18 00:13 <DIR> d-------- C:\Documents and Settings\jhilliard\Video Capture
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-17 17:04 --------- d-----w C:\Program Files\eMusic Download Manager
2008-03-21 20:31 --------- d-----w C:\Program Files\Napster
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-19 09:47 1,845,248 ------w C:\WINDOWS\system32\dllcache\win32k.sys
2008-03-13 22:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-13 20:21 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-03-13 20:05 --------- d-----w C:\Program Files\SureThing
2008-03-13 20:05 --------- d-----w C:\Program Files\Prassi Zulu2 (E)
2008-03-13 20:05 --------- d-----w C:\Program Files\Common Files\SureThing Shared
2008-03-13 20:04 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-13 19:58 --------- d-----w C:\Program Files\Registrar Registry Manager
2008-03-07 15:51 --------- d-----w C:\Program Files\QuickTime
2008-03-07 15:50 --------- d-----w C:\Program Files\Apple Software Update
2008-03-07 15:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-03-07 15:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-03-06 15:04 --------- d-----w C:\Program Files\Motorola
2008-03-01 22:36 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-02-29 08:55 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-02-29 08:55 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-02-22 10:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 06:51 282,624 ------w C:\WINDOWS\system32\dllcache\gdi32.dll
2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-20 05:32 45,568 ------w C:\WINDOWS\system32\dllcache\dnsrslvr.dll
2008-02-20 05:32 148,992 ------w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-02-15 05:44 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{15033f3a-37b2-42c5-9b42-e791a282cdc7}]
C:\WINDOWS\system32\ququgsmb.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6156A32A-C512-4e23-AA9A-2315F4265681}]
2008-04-11 11:46 334848 --a------ C:\WINDOWS\system32\myss_sb.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{69214B5C-DDBE-4654-8562-60794DF57041}]
C:\WINDOWS\system32\xxwuvtqo.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-06-26 17:13 1207080]
"Ucuwr"="C:\Program Files\Common Files\?dobe\m?config.exe" [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 18:48 32881]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-23 00:20 339968 C:\WINDOWS\stsystra.exe]
"RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe" [2005-11-22 09:34 163840]
"RoxioDragToDisc"="C:\Program Files\Roxio\Easy Media Creator 8\Drag to Disc\DrgToDsc.exe" [2005-11-21 21:47 1687552]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-01 00:13 385024]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-06-15 22:25 5926912]
"NapsterShell"="C:\Program Files\Napster\napster.exe" [2007-12-10 15:35 323216]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2002-07-16 17:21 28672]
"Lexmark X6100 Series"="C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe" [2003-09-23 02:01 57344]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 17:50 81920]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 17:50 221184]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-04-25 09:50 139264]
"c81b755c"="C:\WINDOWS\system32\twxkltly.dll" [ ]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-18 17:37 579584]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-04-18 17:37 219136]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 0 (0x0)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{F50B3F5E-856E-4757-9BB1-B35D46CA7719}"= C:\WINDOWS\system32\opnLeBqn.dll [ ]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkkhfcbx]
jkkhfcbx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\opnLeBqn]
opnLeBqn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.CFHD"= CFHD.dll
"MSVIDEO"= vtool.dll
"vidc.BW10"= bw10.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"RoxWatch"=2 (0x2)
"RoxUpnpServer"=2 (0x2)
"RoxUPnPRenderer"=3 (0x3)
"RoxMediaDB"=3 (0x3)
"RoxLiveShare"=2 (0x2)
"NVSvc"=2 (0x2)
"LexBceS"=2 (0x2)
"IDriverT"=3 (0x3)
"Iap"=2 (0x2)
"IAANTMon"=2 (0x2)
"Adobe LM Service"=3 (0x3)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\LEXPPS.EXE"=
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"C:\\Program Files\\Roxio\\Easy Media Creator 8\\Digital Home\\RoxUpnpServer.exe"=
"C:\\Program Files\\Common Files\\Roxio Shared\\SharedCom\\RoxUpnpRenderer.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
R0 PzWDM;PzWDM;C:\WINDOWS\system32\Drivers\PzWDM.sys [2005-06-28 20:38]
R1 Vtool;Broadway MPEG Capture/Compression;C:\WINDOWS\system32\Drivers\vtool.sys [2006-08-29 13:05]
S1 intelppmm;intelppmm;C:\WINDOWS\system32\drivers\intelppmm.sys []
S3 MotDev;Motorola Inc. USB Device;C:\WINDOWS\system32\DRIVERS\motodrv.sys [2007-05-07 16:11]
S3 NPF;WinPcap Packet Driver (NPF);C:\WINDOWS\system32\drivers\NPF.sys []
S3 WLAN_USB;Wireless LAN USB Driver;C:\WINDOWS\system32\DRIVERS\MA111nd5.sys []
S3 WlanUIB;NETGEAR 802.11b USB Driver;C:\WINDOWS\system32\DRIVERS\MA111nd5.sys []
.
Contents of the 'Scheduled Tasks' folder
"2008-04-08 18:49:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-04-21 21:39:41
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\netdde.exe
C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
C:\Program Files\Common Files\Roxio Shared\SharedCom\RoxUpnpRenderer.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\vssvc.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\msdtc.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\CPSHelpRunner.exe
C:\PROGRA~1\MICROS~4\wcescomm.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
.
**************************************************************************
.
Completion time: 2008-04-21 21:49:06 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-22 01:49:03
Pre-Run: 42,155,552,768 bytes free
Post-Run: 43,691,671,552 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
245 --- E O F --- 2008-04-11 16:19:59
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:59, on 2008-04-21
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\netdde.exe
C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
C:\Program Files\Common Files\Roxio Shared\SharedCom\RoxUpnpRenderer.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\System32\dmadmin.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe
C:\Program Files\Roxio\Easy Media Creator 8\Drag to Disc\DrgToDsc.exe
C:\Program Files\Napster\napster.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\CPSHelpRunner.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL =
http://www.google.com/ig/dell?hl=en&cli ... channel=usR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = OlanMills-PortraitViewer
O2 - BHO: {7cdc282a-197e-24b9-5c24-2b73a3f33051} - {15033f3a-37b2-42c5-9b42-e791a282cdc7} - C:\WINDOWS\system32\ququgsmb.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Search Assistant MySidesearch - {6156A32A-C512-4e23-AA9A-2315F4265681} - C:\WINDOWS\system32\myss_sb.dll
O2 - BHO: (no name) - {69214B5C-DDBE-4654-8562-60794DF57041} - C:\WINDOWS\system32\xxwuvtqo.dll (file missing)
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 8\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Lexmark X6100 Series] "C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [c81b755c] rundll32.exe "C:\WINDOWS\system32\twxkltly.dll",b
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [Ucuwr] "C:\Program Files\Common Files\?dobe\m?config.exe"
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: MA111 Configuration Utility.lnk = C:\Program Files\NETGEAR\MA111 Configuration Utility\wlancfg4.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search -
res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word -
res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links -
res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page -
res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages -
res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English -
res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://acvillage.net
O15 - Trusted Zone: *.amaena.com
O15 - Trusted Zone: *.avsystemcare.com
O15 - Trusted Zone: *.onerateld.com
O15 - Trusted Zone: *.safetydownload.com
O15 - Trusted Zone: *.trustedantivirus.com
O15 - Trusted Zone: *.virusschlacht.com
O15 - Trusted Zone: *.amaena.com (HKLM)
O15 - Trusted Zone: *.avsystemcare.com (HKLM)
O15 - Trusted Zone: *.onerateld.com (HKLM)
O15 - Trusted Zone: *.safetydownload.com (HKLM)
O15 - Trusted Zone: *.trustedantivirus.com (HKLM)
O15 - Trusted Zone: *.virusschlacht.com (HKLM)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
http://go.microsoft.com/fwlink/?linkid=39204O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) -
http://network-monitor/NmConsole/CoreNm/Tools/msrdp.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
http://fpdownload2.macromedia.com/get/s ... wflash.cabO17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = acvillage.net
O17 - HKLM\Software\..\Telephony: DomainName = acvillage.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = acvillage.net
O20 - Winlogon Notify: jkkhfcbx - jkkhfcbx.dll (file missing)
O20 - Winlogon Notify: opnLeBqn - opnLeBqn.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: LiveShare P2P Server (RoxLiveShare) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxLiveShare.exe
O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
O23 - Service: RoxUpnpRenderer (RoxUPnPRenderer) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCom\RoxUpnpRenderer.exe
O23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
--
End of file - 10887 bytes