now my other sons laptop infected heaven help me

[kingdonger]

Gday yet again kind people, thanks for helping me with my other sons laptop especialy you katana much appreciated,my son has had a problem with the wmp not loading running so we did a system restore to an earlier date wmp is now working but unfotunately internet explorer is hijacked multiple pages gambling sites loading offers of anti virus scans pop ups etc really annoying,please help if you can along with stern instructions to my sons on how they can avoid reinfection in the future.
i enclose an hijack this log.
much obliged for your help.
bet regards.
kingdonger Roger...


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:31:52, on 12/07/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Users\David\Program Files\DNA\btdna.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\David\Desktop\kingdongers scanner exe\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.msn.com//
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE= ... &pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE= ... &pf=laptop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\avp.exe"
O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Users\David\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\David\AppData\Local\Temp\yayvUNFy.dll,#1
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\David\AppData\Local\Temp\pmnljHwx.dll,c
O4 - HKCU\..\Run: [08700f95] rundll32.exe "C:\Users\David\AppData\Local\Temp\ldxtmsmc.dll",b
O4 - HKCU\..\Run: [BM0b433c09] Rundll32.exe "C:\Users\David\AppData\Local\Temp\krjthweg.dll",s
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-GB\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\scieplugin.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O20 - AppInit_DLLs: C:\PROGRA~1\PCSECU~1\THESHI~1\r3hook.dll
O23 - Service: The Shield Deluxe 2008 (AVP) - PCSecurityShield - C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\avp.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 6592 bytes

[MikeSwim07]

Hello, and to the Malware Removal forums.
My name is Michael I'll be glad to help you with your computer problems.

HijackThis logs can take some time to research, so please be patient with me. I know that you need
your computer working as quickly as possible, and I will work hard to help see that happen.

Please be patient and I'd be grateful if you would note the following:

• I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for this issue on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.

Please note: All of my posts need to be checked by a teacher, so please be patient while I attempt to remove your malware.

Make an uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

• Start HijackThis
• Click on the Config button
• Click on the Misc Tools button
• Click on the Open Uninstall Manager button.
• Click on the Save list... button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Save the file to your desktop.

Please post this log on your next reply.

Thanks, Michael

[kingdonger]

gday your help is much appreciated here is the log you required.
best regards roger..

Activation Assistant for the 2007 Microsoft Office suites
Adobe Flash Player ActiveX
Adobe Reader 8.1.0
Adobe Shockwave Player
AIM 6
AOL Toolbar 5.0
Atheros Driver Installation Program
Compatibility Pack for the 2007 Office system
Conexant HD Audio
CyberLink YouCam
DVD Suite
EA Link
ESU for Microsoft Vista
HDAUDIO Soft Data Fax Modem with SmartCP
Hewlett-Packard Active Check
Hewlett-Packard Asset Agent for Health Check
HP Customer Experience Enhancements
HP Doc Viewer
HP DVD Play 3.6
HP Easy Setup - Frontend
HP Help and Support
HP Quick Launch Buttons 6.30 D2
HP Total Care Advisor
HP Update
HP User Guides 0091
HP Wireless Assistant
Java(TM) 6 Update 2
LabelPrint
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
MSCU for Microsoft Vista
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
muvee autoProducer 6.1
My HP Games
NetWaiting
NVIDIA Drivers
Power2Go
PowerDirector
QuickPlay SlingPlayer 0.4.4
Revo Uninstaller 1.71
SpywareBlaster 4.1
Synaptics Pointing Device Driver
The Shield Deluxe 2008
The Sims™ Life Stories
Update for Office 2007 (KB934528)
Viewpoint Media Player


ps i'm pretty sure that the shield deluxe is an virus as i have seen refrence to this elseware on this forum,unsure how to get rid though,,,,
awaiting your reply..
best regards Roger

[MikeSwim07]

P2P Software

IMPORTANT I notice there are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer.

Bit Torrent

I'd like you to read the Guidelines for P2P Programs where we explain why it's not a good idea to have them.

Also available here.

Note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

My recommendation is you go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red).

If you wish to keep them, please do not use them until your computer is cleaned.

Download and Run DSS
Download Deckard's System Scanner (DSS) to your Desktop. You must be logged onto an account with administrator privileges.

• Close all applications and windows.
• Double-click on dss.exe to run it, and follow the prompts.
• When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt<- this one will be minimized.
• Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and the extra.txt in your reply.

Please post both DSS logs.

[kingdonger]

Thanks for your help here are the scan results you asked for.
best regards Roger...

Deckard's System Scanner v20071014.68
Run by David on 2008-07-14 20:25:32
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- Last 5 Restore Point(s) --
20: 2008-07-14 19:20:16 UTC - RP28 - Windows Update
19: 2008-07-12 10:47:47 UTC - RP27 - Restore Operation
18: 2008-07-10 19:41:39 UTC - RP26 - Windows Update
17: 2008-07-10 18:01:19 UTC - RP25 - Installed OpenOffice.org Installer 1.0
16: 2008-07-10 17:58:57 UTC - RP24 - Installed Java(TM) 6 Update 7


-- First Restore Point --
1: 2008-07-04 16:20:19 UTC - RP4 - First_User_Boot


Backed up registry hives.
Performed disk cleanup.



-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-07-14 20:29:59
Platform: Windows Vista (6.00.6000)
MSIE: Internet Explorer (7.00.6000.16386)
Boot mode: Normal

Running processes:
C:\Windows\System32\dwm.exe
C:\Windows\System32\taskeng.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Users\David\Program Files\DNA\btdna.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\explorer.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\System32\wuauclt.exe
C:\Users\David\Desktop\dss.exe
C:\Windows\System32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.msn.com//
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE= ... &pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE= ... &pf=laptop
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\avp.exe"
O4 - HKLM\..\Run: [MRT] "C:\Windows\system32\MRT.exe" /R
O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Users\David\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\David\AppData\Local\Temp\ddcYqpoO.dll,#1
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\David\AppData\Local\Temp\pmnljHwx.dll,c
O4 - HKCU\..\Run: [BM0b433c09] Rundll32.exe "C:\Users\David\AppData\Local\Temp\wyfawidu.dll",s
O4 - HKCU\..\Run: [08700f95] rundll32.exe "C:\Users\David\AppData\Local\Temp\pulrbsxm.dll",b
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE')
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-GB\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - (file missing)
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\PCSECU~1\THESHI~1\r3hook.dll
O23 - Service: The Shield Deluxe 2008 (AVP) - PCSecurityShield - C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\avp.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\System32\drivers\XAudio.exe


--
End of file - 7932 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

All drivers whitelisted.


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 HP Health Check Service - "c:\program files\hewlett-packard\hp health check\hphc_service.exe" <Not Verified; Hewlett-Packard; HP Health Check Service>

S3 Com4Qlb - "c:\program files\hewlett-packard\hp quick launch buttons\com4qlb.exe" <Not Verified; Hewlett-Packard Development Company, L.P.; HP Quick Launch Buttons>


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Files created between 2008-06-14 and 2008-07-14 -----------------------------

2008-07-12 11:37:11 0 d-------- C:\Users\All Users\HP
2008-07-06 16:35:41 0 d-------- C:\Users\All Users\BOC426
2008-07-06 16:08:29 0 d-------- C:\Program Files\AskSBar
2008-07-06 16:06:34 0 d-------- C:\Users\All Users\comodo
2008-07-06 16:06:30 0 d-------- C:\Program Files\COMODO
2008-07-06 15:57:25 0 d-------- C:\Program Files\Alwil Software
2008-07-06 15:51:43 395296 --ahs---- C:\Windows\system32\drivers\fidbox.dat
2008-07-06 15:34:54 0 d-------- C:\Program Files\VS Revo Group
2008-07-05 01:08:47 0 d--hs---- C:\System Volume Information
2008-07-04 21:45:10 0 d-------- C:\Users\David\Program Files
2008-07-04 21:30:26 96966 --a------ C:\Windows\system32\drivers\klin.dat
2008-07-04 21:30:26 88774 --a------ C:\Windows\system32\drivers\klick.dat
2008-07-04 21:29:24 0 d-------- C:\Users\All Users\PCSecurityShield
2008-07-04 21:29:24 0 d-------- C:\Program Files\PCSecurityShield
2008-07-04 21:26:58 0 d-------- C:\Extracted
2008-07-04 21:19:15 0 -rahs---- C:\MSDOS.SYS
2008-07-04 21:19:15 0 -rahs---- C:\IO.SYS
2008-07-04 20:57:09 0 d-------- C:\Program Files\DNA
2008-07-04 20:52:16 0 d-------- C:\Users\All Users\TEMP
2008-07-04 20:52:11 0 d-------- C:\Program Files\SpywareBlaster
2008-07-04 18:57:04 0 d-------- C:\Program Files\MSXML 4.0
2008-07-04 17:35:29 0 dr------- C:\Users\David\Searches
2008-07-04 17:35:15 0 dr------- C:\Users\David\Contacts
2008-07-04 17:35:06 81 --a------ C:\Windows\system32\LOG
2008-07-04 17:35:03 44 --a------ C:\Windows\system\hpsysdrv.dat
2008-07-04 17:28:56 0 d-------- C:\Users\All Users\Electronic Arts
2008-07-04 17:23:01 0 d-------- C:\Program Files\Electronic Arts
2008-07-04 17:19:20 0 dr------- C:\Users\David\Videos
2008-07-04 17:19:20 0 d--hs---- C:\Users\David\Templates
2008-07-04 17:19:20 0 d--hs---- C:\Users\David\Start Menu
2008-07-04 17:19:20 0 d--hs---- C:\Users\David\SendTo
2008-07-04 17:19:20 0 dr------- C:\Users\David\Saved Games
2008-07-04 17:19:20 0 d--hs---- C:\Users\David\Recent
2008-07-04 17:19:20 0 d--hs---- C:\Users\David\PrintHood
2008-07-04 17:19:20 0 dr------- C:\Users\David\Pictures
2008-07-04 17:19:20 1572864 --ahs---- C:\Users\David\ntuser.dat
2008-07-04 17:19:20 0 d--hs---- C:\Users\David\NetHood
2008-07-04 17:19:20 0 d--hs---- C:\Users\David\My Documents
2008-07-04 17:19:20 0 dr------- C:\Users\David\Music
2008-07-04 17:19:20 0 d--hs---- C:\Users\David\Local Settings
2008-07-04 17:19:20 0 dr------- C:\Users\David\Links
2008-07-04 17:19:20 0 dr------- C:\Users\David\Favorites
2008-07-04 17:19:20 0 dr------- C:\Users\David\Downloads
2008-07-04 17:19:20 0 dr------- C:\Users\David\Documents
2008-07-04 17:19:20 0 dr------- C:\Users\David\Desktop
2008-07-04 17:19:20 0 d--hs---- C:\Users\David\Cookies
2008-07-04 17:19:20 0 d--hs---- C:\Users\David\Application Data
2008-07-04 17:19:20 0 d--h----- C:\Users\David\AppData


-- Find3M Report ---------------------------------------------------------------

2008-07-14 20:25:59 0 d-------- C:\Users\David\AppData\Roaming\DNA
2008-07-14 20:23:38 0 d-------- C:\Program Files\Windows Mail
2008-07-12 13:02:48 0 d-------- C:\Program Files\Common Files
2008-07-12 11:53:00 0 d-------- C:\Program Files\Viewpoint
2008-07-12 11:37:20 0 d-------- C:\Users\David\AppData\Roaming\CyberLink
2008-07-12 11:37:11 0 d-------- C:\Users\David\AppData\Roaming\HP
2008-07-10 19:01:11 0 d-------- C:\Program Files\Java
2008-07-06 16:06:35 0 d-------- C:\Users\David\AppData\Roaming\Comodo
2008-07-06 14:55:57 0 d-------- C:\Program Files\Common Files\Symantec Shared
2008-07-05 11:17:04 0 d-------- C:\Users\David\AppData\Roaming\Adobe
2008-07-04 21:18:28 0 d-------- C:\Users\David\AppData\Roaming\WinRAR
2008-07-04 20:12:44 0 d-------- C:\Program Files\Windows Sidebar
2008-07-04 17:36:19 0 d-------- C:\Users\David\AppData\Roaming\Hewlett-Packard
2008-07-04 17:36:03 0 d-------- C:\Users\David\AppData\Roaming\Symantec
2008-07-04 17:35:19 0 d-------- C:\Users\David\AppData\Roaming\Identities
2008-07-04 17:34:31 0 d-------- C:\Users\David\AppData\Roaming\Macromedia
2008-07-04 17:30:49 0 dr------- C:\Program Files\Online Services
2008-07-04 17:29:22 0 d--h----- C:\Program Files\InstallShield Installation Information


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [28/09/2007 09:06]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [28/09/2007 09:06]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [28/09/2007 09:06]
"SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [15/09/2007 09:29]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [03/10/2007 05:00]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [06/09/2007 21:46]
"UCam_Menu"="C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [17/08/2007 07:13]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [21/10/2007 18:55]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [11/05/2007 11:06]
"HP Health Check Scheduler"="[ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" []
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [09/05/2007 00:24]
"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [13/09/2007 16:47]
"WAWifiMessage"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [08/01/2007 23:53]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [12/07/2007 12:00]
"AVP"="C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\avp.exe" [23/08/2007 14:16]
"MRT"="C:\Windows\system32\MRT.exe" [25/06/2008 17:15]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPAdvisor"="C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [02/10/2007 00:10]
"WindowsWelcomeCenter"="oobefldr.dll,ShowWelcomeCenter" []
"BitTorrent DNA"="C:\Users\David\Program Files\DNA\btdna.exe" [04/07/2008 21:45]
"MSServer"="C:\Users\David\AppData\Local\Temp\ddcYqpoO.dll,#1" []
"cmds"="C:\Users\David\AppData\Local\Temp\pmnljHwx.dll,c" []
"BM0b433c09"="C:\Users\David\AppData\Local\Temp\wyfawidu.dll,s" []
"08700f95"="C:\Users\David\AppData\Local\Temp\pulrbsxm.dll,b" []

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\PCSECU~1\THESHI~1\r3hook.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]
@="IEEE 1394 Bus host controllers"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]
@="SBP2 IEEE 1394 Devices"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]
@="SecurityDevices"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc EMDMgmt TabletInputService wlansvc WPDBusEnum


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
C:\Windows\system32\unregmp2.exe /ShowWMP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
%SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI



-- End of Deckard's System Scanner: finished at 2008-07-14 20:31:07 ------------




Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft® Windows Vista™ Home Premium (build 6000)
Architecture: X86; Language: English

CPU 0: AMD Athlon(tm) 64 X2 Dual-Core Processor TK-53
Percentage of Memory in Use: 42%
Physical Memory (total/avail): 1982.31 MiB / 1133.61 MiB
Pagefile Memory (total/avail): 4186.19 MiB / 3260.13 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1917.45 MiB

C: is Fixed (NTFS) - 174.77 GiB total, 126.02 GiB free.
D: is Fixed (NTFS) - 11.54 GiB total, 2.04 GiB free.
E: is CDROM (No Media)

\\.\PHYSICALDRIVE0 - FUJITSU MHY2200BH ATA Device - 186.31 GiB - 2 partitions
\PARTITION0 (bootable) - Installable File System - 174.77 GiB - C:
\PARTITION1 - Installable File System - 11.54 GiB - D:



-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is enabled.

AS: Windows Defender v1.1.1505.0 (Microsoft Corporation) Outdated

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent"


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\David\AppData\Roaming
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=DAVID-LAPTOP
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\David
LOCALAPPDATA=C:\Users\David\AppData\Local
LOGONSERVER=\\DAVID-LAPTOP
NUMBER_OF_PROCESSORS=2
OnlineServices=Online Services
OS=Windows_NT
Path=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Program Files\CyberLink\Power2Go\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PCBRAND=Presario
PLATFORM=MCD
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 104 Stepping 1, AuthenticAMD
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=6801
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
PROMPT=$P$G
PUBLIC=C:\Users\Public
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\David\AppData\Local\Temp
TMP=C:\Users\David\AppData\Local\Temp
USERDOMAIN=David-Laptop
USERNAME=David
USERPART=E:
USERPROFILE=C:\Users\David
windir=C:\Windows


-- User Profiles ---------------------------------------------------------------

David


-- Add/Remove Programs ---------------------------------------------------------

--> "C:\Program Files\HP Games\3D Ultra Minigolf Adventures\Uninstall.exe"
--> "C:\Program Files\HP Games\7 Wonders of the Ancient World\Uninstall.exe"
--> "C:\Program Files\HP Games\Bejeweled 2 Deluxe\Uninstall.exe"
--> "C:\Program Files\HP Games\Blasterball 2 Revolution\Uninstall.exe"
--> "C:\Program Files\HP Games\Blasterball 3\Uninstall.exe"
--> "C:\Program Files\HP Games\Chuzzle Deluxe\Uninstall.exe"
--> "C:\Program Files\HP Games\Crystal Maze\Uninstall.exe"
--> "C:\Program Files\HP Games\Diner Dash\Uninstall.exe"
--> "C:\Program Files\HP Games\FATE\Uninstall.exe"
--> "C:\Program Files\HP Games\Final Drive Nitro\Uninstall.exe"
--> "C:\Program Files\HP Games\Fish Tycoon\Uninstall.exe"
--> "C:\Program Files\HP Games\Insaniquarium Deluxe\Uninstall.exe"
--> "C:\Program Files\HP Games\Jewel Quest Solitaire\Uninstall.exe"
--> "C:\Program Files\HP Games\Jewel Quest\Uninstall.exe"
--> "C:\Program Files\HP Games\Magic Academy\Uninstall.exe"
--> "C:\Program Files\HP Games\Mah Jong Quest\Uninstall.exe"
--> "C:\Program Files\HP Games\My HP Game Console\Uninstall.exe"
--> "C:\Program Files\HP Games\Otto's Magic Blocks\Uninstall.exe"
--> "C:\Program Files\HP Games\Peggle\Uninstall.exe"
--> "C:\Program Files\HP Games\Penguins!\Uninstall.exe"
--> "C:\Program Files\HP Games\Polar Bowler\Uninstall.exe"
--> "C:\Program Files\HP Games\Polar Golfer Pineapple Cup\Uninstall.exe"
--> "C:\Program Files\HP Games\Polar Golfer\Uninstall.exe"
--> "C:\Program Files\HP Games\Ricochet Lost Worlds\Uninstall.exe"
--> "C:\Program Files\HP Games\Shooting Stars Pool\Uninstall.exe"
--> "C:\Program Files\HP Games\Slingo Deluxe\Uninstall.exe"
--> "C:\Program Files\HP Games\Super Granny\Uninstall.exe"
--> "C:\Program Files\HP Games\Tradewinds\Uninstall.exe"
--> "C:\Program Files\HP Games\Virtual Villagers - A New Home\Uninstall.exe"
--> "C:\Program Files\HP Games\Virtual Villagers - Chapter 2 - The Lost Children\Uninstall.exe"
--> "C:\Program Files\HP Games\Zuma Deluxe\Uninstall.exe"
--> C:\Program Files\Conexant\SmartAudio\SETUP.EXE -U -ISmartAudio -SM=SMAUDIO.EXE,1801
Activation Assistant for the 2007 Microsoft Office suites --> "C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}\Microsoft Office Activation Assistant.exe" REMOVE=TRUE MODIFY=FALSE
Adobe Flash Player ActiveX --> C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8.1.0 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81000000003}
Adobe Shockwave Player --> MsiExec.exe /X{1BDC9633-895B-4842-BCB6-8FA1EC2A3C5A}
AIM 6 --> C:\Program Files\AIM6\uninst.exe
AOL Toolbar 5.0 --> "C:\Program Files\AOL\AOL Toolbar 5.0\uninstall.exe"
Atheros Driver Installation Program --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{28006915-2739-4EBE-B5E8-49B25D32EB33}\setup.exe" -l0x9 -removeonly
Compatibility Pack for the 2007 Office system --> MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE}
Conexant HD Audio --> C:\Program Files\CONEXANT\CNXT_AUDIO_HDA\UIU32a.exe -U -IQh30CFza.INF
CyberLink YouCam --> "C:\Program Files\InstallShield Installation Information\{01FB4998-33C4-4431-85ED-079E3EEFE75D}\setup.exe" /z-uninstall
DNA --> "C:\Users\David\Program Files\DNA\btdna.exe" /UNINSTALL
DVD Suite --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\setup.exe" -uninstall
EA Link --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{F5577101-33CC-4711-8235-3A95BCD49DB0} /l1033
ESU for Microsoft Vista --> MsiExec.exe /I{68471BF2-F1F7-4C89-BBBA-400B94996596}
HDAUDIO Soft Data Fax Modem with SmartCP --> C:\Program Files\CONEXANT\CNXT_MODEM_HDA_HSF\UIU32m.exe -U -I*.INF
Hewlett-Packard Active Check --> MsiExec.exe /X{254C37AA-6B72-4300-84F6-98A82419187E}
Hewlett-Packard Asset Agent for Health Check --> MsiExec.exe /X{669D4A35-146B-4314-89F1-1AC3D7B88367}
HP Customer Experience Enhancements --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BD0E2B92-3814-46F0-893B-4612EA010C7E}\setup.exe" -l0x9 -removeonly
HP Doc Viewer --> MsiExec.exe /I{082702D5-5DD8-4600-BCE5-48B15174687F}
HP DVD Play 3.6 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{45D707E9-F3C4-11D9-A373-0050BAE317E1}\Setup.exe" -uninstall
HP Easy Setup - Frontend --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9885A11E-60E4-417C-B58B-8B31B21C0B8A}\setup.exe" -l0x9 -removeonly
HP Help and Support --> MsiExec.exe /I{28EDCE9C-3304-4331-8AB3-F3EBE94C35B4}
HP Quick Launch Buttons 6.30 D2 --> C:\Program Files\InstallShield Installation Information\{34D2AB40-150D-475D-AE32-BD23FB5EE355}\setup.exe -runfromtemp -l0x0009 uninst
HP Total Care Advisor --> MsiExec.exe /X{b02df929-29a7-4fd2-9a70-81a644b635f7}
HP Update --> MsiExec.exe /X{11B83AD3-7A46-4C2E-A568-9505981D4C6F}
HP User Guides 0091 --> MsiExec.exe /I{E6D3A461-8DDE-45C9-8C34-A33436FCC0B4}
HP Wireless Assistant --> MsiExec.exe /I{CBAE4F50-9FC9-4557-AB36-9826DF3C103C}
Java(TM) 6 Update 2 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
LabelPrint --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C59C179C-668D-49A9-B6EA-0121CCFC1243}\setup.exe" -uninstall
Microsoft Office Excel MUI (English) 2007 --> MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Home and Student 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL
Microsoft Office Home and Student 2007 --> MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE}
Microsoft Office OneNote MUI (English) 2007 --> MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007 --> MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint Viewer 2007 (English) --> MsiExec.exe /X{95120000-00AF-0409-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007 --> MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007 --> MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007 --> MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007 --> MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007 --> MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007 --> MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Works --> MsiExec.exe /I{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}
MSCU for Microsoft Vista --> MsiExec.exe /I{F7F3B252-E772-48AA-93EB-7964BC326067}
MSXML 4.0 SP2 (KB936181) --> MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833) --> MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
muvee autoProducer 6.1 --> C:\Program Files\InstallShield Installation Information\{250E9609-E830-43EB-B379-DAB7546A2422}\muveesetup.exe -removeonly -runfromtemp
My HP Games --> "C:\Program Files\HP Games\Uninstall.exe"
NetWaiting --> C:\Program Files\InstallShield Installation Information\{3F92ABBB-6BBF-11D5-B229-002078017FBF}\setup.exe -runfromtemp -l0x0009 -removeonly
NVIDIA Drivers --> C:\Windows\system32\NVUNINST.EXE UninstallGUI
Power2Go --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{40BF1E83-20EB-11D8-97C5-0009C5020658}\setup.exe" -uninstall
PowerDirector --> "C:\Program Files\InstallShield Installation Information\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}\setup.exe" /z-uninstall
QuickPlay SlingPlayer 0.4.4 --> "C:\Program Files\HP\QuickPlay\unins000.exe"
Revo Uninstaller 1.71 --> C:\Program Files\VS Revo Group\Revo Uninstaller\uninst.exe
SpywareBlaster 4.1 --> "C:\Program Files\SpywareBlaster\unins000.exe"
Synaptics Pointing Device Driver --> rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
The Shield Deluxe 2008 --> MsiExec.exe /I{75193929-9A52-4CA4-98DE-8C7296940920}
The Sims™ Life Stories --> MsiExec.exe /I{2284D904-C138-4B58-93EC-5C362AB5130A}
Update for Office 2007 (KB934528) --> msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {2B939677-2FFD-48F6-9075-7BF48CB87C80}
Viewpoint Media Player --> C:\Program Files\Viewpoint\Viewpoint Experience Technology\mtsAxInstaller.exe /u


-- Application Event Log -------------------------------------------------------

Event Record #/Type1324 / Error
Event Submitted/Written: 07/14/2008 08:21:28 PM
Event ID/Source: 5007 / WerSvc
Event Description:
The target file for the Windows Feedback Platform (a DLL file containing the list of problems on this computer that require additional data collection for diagnosis) could not be parsed. The error code was 8014FFF9.

Event Record #/Type1321 / Error
Event Submitted/Written: 07/14/2008 08:19:29 PM
Event ID/Source: 1002 / Application Hang
Event Description:
The program Explorer.EXE version 6.0.6000.16549 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel.
Process ID: 718
Start Time: 01c8e5e60608cc08
Termination Time: 0

Event Record #/Type1318 / Error
Event Submitted/Written: 07/14/2008 08:18:29 PM
Event ID/Source: 1002 / Application Hang
Event Description:
The program WinMail.exe version 6.0.6000.16480 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel.
Process ID: 134
Start Time: 01c8e5e637533488
Termination Time: 6

Event Record #/Type1306 / Success
Event Submitted/Written: 07/14/2008 08:16:34 PM
Event ID/Source: 5617 / WinMgmt
Event Description:


Event Record #/Type1305 / Success
Event Submitted/Written: 07/14/2008 08:16:33 PM
Event ID/Source: 5615 / WinMgmt
Event Description:




-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type9874 / Warning
Event Submitted/Written: 07/14/2008 08:30:16 PM
Event ID/Source: 3004 / WinDefend
Event Description:
%David-Laptop27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %David-Laptop27 can't undo changes that you allow.

For more information please see the following:
%David-Laptop275

Scan ID: {AB46BEF5-5DE9-48A9-B10E-78F77D14A178}

User: David-Laptop\David

Name: %David-Laptop271

ID: %David-Laptop272

Severity ID: %David-Laptop273

Category ID: %David-Laptop274

Path Found: %David-Laptop276

Alert Type: %David-Laptop278

Detection Type: 1.1.1505.02

Event Record #/Type9873 / Warning
Event Submitted/Written: 07/14/2008 08:30:16 PM
Event ID/Source: 3004 / WinDefend
Event Description:
%David-Laptop27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %David-Laptop27 can't undo changes that you allow.

For more information please see the following:
%David-Laptop275

Scan ID: {3243D8CC-F7EC-43C7-A95E-A286B832BEF2}

User: David-Laptop\David

Name: %David-Laptop271

ID: %David-Laptop272

Severity ID: %David-Laptop273

Category ID: %David-Laptop274

Path Found: %David-Laptop276

Alert Type: %David-Laptop278

Detection Type: 1.1.1505.02

Event Record #/Type9872 / Warning
Event Submitted/Written: 07/14/2008 08:30:16 PM
Event ID/Source: 3004 / WinDefend
Event Description:
%David-Laptop27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %David-Laptop27 can't undo changes that you allow.

For more information please see the following:
%David-Laptop275

Scan ID: {BCC2926F-DA08-4938-A7F1-A6E0E87C04BB}

User: David-Laptop\David

Name: %David-Laptop271

ID: %David-Laptop272

Severity ID: %David-Laptop273

Category ID: %David-Laptop274

Path Found: %David-Laptop276

Alert Type: %David-Laptop278

Detection Type: 1.1.1505.02

Event Record #/Type9871 / Warning
Event Submitted/Written: 07/14/2008 08:30:14 PM
Event ID/Source: 3004 / WinDefend
Event Description:
%David-Laptop27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %David-Laptop27 can't undo changes that you allow.

For more information please see the following:
%David-Laptop275

Scan ID: {54CB5ACD-3CC1-44F3-BA00-6A024B99BDAF}

User: David-Laptop\David

Name: %David-Laptop271

ID: %David-Laptop272

Severity ID: %David-Laptop273

Category ID: %David-Laptop274

Path Found: %David-Laptop276

Alert Type: %David-Laptop278

Detection Type: 1.1.1505.02

Event Record #/Type9870 / Warning
Event Submitted/Written: 07/14/2008 08:30:14 PM
Event ID/Source: 3004 / WinDefend
Event Description:
%David-Laptop27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %David-Laptop27 can't undo changes that you allow.

For more information please see the following:
%David-Laptop275

Scan ID: {76669C32-EC2B-47C4-89BC-281481D4D64B}

User: David-Laptop\David

Name: %David-Laptop271

ID: %David-Laptop272

Severity ID: %David-Laptop273

Category ID: %David-Laptop274

Path Found: %David-Laptop276

Alert Type: %David-Laptop278

Detection Type: 1.1.1505.02



-- End of Deckard's System Scanner: finished at 2008-07-14 20:31:07 ------------

[MikeSwim07]

Download and Run: OTMoveIt2
Please download OTMoveIt2 by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
• Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  

  Code: Select all

  C:\Users\David\AppData\Local\Temp\ddcYqpoO.dll
  C:\Users\David\AppData\Local\Temp\pmnljHwx.dll
  C:\Users\David\AppData\Local\Temp\wyfawidu.dll
  C:\Users\David\AppData\Local\Temp\pulrbsxm.dll
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\MSServer
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\cmds
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\BM0b433c09
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\08700f95
  

• Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the yellow bar) and choose Paste.
• Click the red Moveit! button.
• If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
• If you are not asked to reboot close OTMoveIt2.
• A log C:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log will be created (where mmddyyyy_hhmmss are numbers giving date and time the log was created).

Malwarebytes' Anti-Malware

Please download Malwarebytes' Anti-Malware and save to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to:
  
  Update Malwarebytes' Anti-Malware
  Launch Malwarebytes' Anti-Malware
  
• Then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform Full scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. Please copy and paste the log back into your next reply
  
  Note:
• The log can also be found here:
  C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
• Or via the Logs tab when Malwarebytes' Anti-Malware is started.

Run Kaspersky Online Scan

Please go to Kaspersky website and perform an online antivirus scan.

1. Read through the requirements and privacy statement and click on Accept button.
2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
3. When the downloads have finished, click on Settings.
4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
   Spyware, Adware, Dialers, and other potentially dangerous programs
   Archives
   Mail databases
5. Click on My Computer under Scan.
6. Once the scan is complete, it will display the results. Click on View Scan Report.
7. You will see a list of infected items there. Click on Save Report As....
8. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
9. Please post this log in your next reply.

Please post the OTMoveIt2 log, the MBAM log, and the Kaspersky online scan log.

[kingdonger]

once again many thanks for your help.
i have done everything you have recommended including the kaspersky online scan this showed i was infected but when i clicked on save report as it would not save i was logged on ie as administrator etc but the saved file showed up through kaspersky save pane but will not in explorer i have now done 4 scans and been unable to save them taking into account that each scan takes in excess of 1 and a half hours this is annoying,will try again here are the other logs you requested.
best regards-Roger..


File/Folder C:\Users\David\AppData\Local\Temp\ddcYqpoO.dll not found.
File/Folder C:\Users\David\AppData\Local\Temp\pmnljHwx.dll not found.
File/Folder C:\Users\David\AppData\Local\Temp\wyfawidu.dll not found.
File/Folder C:\Users\David\AppData\Local\Temp\pulrbsxm.dll not found.
< HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\MSServer >
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\MSServer not found.
< HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\cmds >
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\cmds not found.
< HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\BM0b433c09 >
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\BM0b433c09 not found.
< HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\08700f95 >
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\08700f95 not found.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 07152008_142731

Malwarebytes' Anti-Malware 1.20
Database version: 951
Windows 6.0.6000

15:07:33 15/07/2008
mbam-log-7-15-2008 (15-07-33).txt

Scan type: Full Scan (C:\|)
Objects scanned: 146602
Time elapsed: 22 minute(s), 14 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 8
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 13

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\bhonew.bho (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bhonew.bho.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8ae578e0-6df5-41e0-869f-f65a32d2f6bd} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{4937d5d1-2039-409a-bd83-fec9b39b2356} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{caf9d798-c659-4b9b-8e19-ee27c3d04ee7} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{15c7d7ad-a87a-4c0d-9d8b-637fcd3488ef} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\MS Juan (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Deckard\System Scanner\backup\Users\David\AppData\Local\Temp\ddcYqpoO.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Deckard\System Scanner\backup\Users\David\AppData\Local\Temp\khfDsrrS.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Deckard\System Scanner\backup\Users\David\AppData\Local\Temp\mlJYqPgf.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Deckard\System Scanner\backup\Users\David\AppData\Local\Temp\pmnljHwx.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Deckard\System Scanner\backup\Users\David\AppData\Local\Temp\pulrbsxm.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Deckard\System Scanner\backup\Users\David\AppData\Local\Temp\tmp0000db41 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Deckard\System Scanner\backup\Users\David\AppData\Local\Temp\tmp0000ea9c (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Deckard\System Scanner\backup\Users\David\AppData\Local\Temp\tmp000110d1 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Deckard\System Scanner\backup\Users\David\AppData\Local\Temp\wyfawidu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\David\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1FZ0E2B5\css4[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\David\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1FZ0E2B5\log[1].zip (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Users\David\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U1R4XFFS\kb456456[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\David\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U1R4XFFS\kb671231[2] (Trojan.Vundo) -> Quarantined and deleted successfully.

[kingdonger]

gday again eventualy managed to get the report off kaspersky doesnt make very good reading does it.
regards-Roger...

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Tuesday, July 15, 2008
Operating System: Microsoft Windows Vista Home Premium Edition, 32-bit (build 6000)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Tuesday, July 15, 2008 19:30:26
Records in database: 957023
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Files scanned: 124075
Threat name: 7
Infected objects: 23
Suspicious objects: 0
Duration of the scan: 01:34:14


File name / Threat name / Threats count
C:\Deckard\System Scanner\backup\Users\David\AppData\Local\Temp\eceywurk.dll Infected: Trojan.Win32.Obfuscated.auw 1
C:\Deckard\System Scanner\backup\Users\David\AppData\Local\Temp\krjthweg.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Deckard\System Scanner\backup\Users\David\AppData\Local\Temp\ldxtmsmc.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Deckard\System Scanner\backup\Users\David\AppData\Local\Temp\mcgfdahx.dll Infected: Trojan.Win32.Obfuscated.auw 1
C:\Deckard\System Scanner\backup\Users\David\AppData\Local\Temp\obtetiuu.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Deckard\System Scanner\backup\Users\David\AppData\Local\Temp\yiohyeyk.dll Infected: Trojan.Win32.Monderc.gen 1
C:\ProgramData\BOC426\evidence.boc Infected: Trojan.Win32.Monderc.gen 1
C:\Users\All Users\BOC426\evidence.boc Infected: Trojan.Win32.Monderc.gen 1
C:\Users\David\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CE37VL6A\kb111653[1] Infected: Trojan.Win32.Obfuscated.auw 1
C:\Users\David\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IDV31B0M\kb767887[1] Infected: Trojan.Win32.Monderc.gen 1
C:\Users\David\Desktop\BitDefender Pro Total Security 2008 [(Antivirus & Antispyware) + Key]\bitdefender_totalsecurity_2008_32b.exe Infected: Trojan.Win32.Monder.gen 1
C:\Users\David\Desktop\BitDefender Pro Total Security 2008 [(Antivirus & Antispyware) + Key]\bitdefender_totalsecurity_2008_32b.exe Infected: Trojan-Downloader.MSIL.Agent.ax 1
C:\Users\David\Desktop\BitDefender Pro Total Security 2008 [(Antivirus & Antispyware) + Key]\patch + keygen\key.exe Infected: Trojan-Downloader.MSIL.Agent.ax 1
C:\Users\David\Desktop\BitDefender Pro Total Security 2008 [(Antivirus & Antispyware) + Key]\patch + keygen\patch.exe Infected: Trojan-Downloader.MSIL.Agent.ax 1
C:\Users\David\Desktop\downloads bit torrent etc\BitDefender Pro Total Security 2008 [(Antivirus & Antispyware) + Key].rar Infected: Trojan.Win32.Monder.gen 1
C:\Users\David\Desktop\downloads bit torrent etc\BitDefender Pro Total Security 2008 [(Antivirus & Antispyware) + Key].rar Infected: Trojan-Downloader.MSIL.Agent.ax 3
C:\Users\David\Desktop\downloads bit torrent etc\WinRAR v3.80.1-Full Cracked\WinRAR v3.80.1-Full Cracked\setup.exe Infected: Trojan-Downloader.Win32.Tiny.bqh 1
C:\Users\David\Desktop\downloads bit torrent etc\WinRAR v3.80.1-Full Cracked\WinRAR v3.80.1-Full Cracked\setup.exe Infected: Trojan-Downloader.Win32.Agent.utw 1
C:\Users\David\Desktop\downloads bit torrent etc\WinRAR v3.80.1-Full Cracked.zip Infected: Trojan-Downloader.Win32.Tiny.bqh 1
C:\Users\David\Desktop\downloads bit torrent etc\WinRAR v3.80.1-Full Cracked.zip Infected: Trojan-Downloader.Win32.Agent.utw 1
C:\Users\David\Desktop\downloads bit torrent etc\WORKING Shield Deluxe 2008 Cracked\ShieldDeluxe2008Setup.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.tso 1

The selected area was scanned.

[MikeSwim07]

I notice that you have some cracked programs on your computer, which is illegal. If you want me to continue helping you get clean, you need to remove them.

Remove Cracked Programs

Now we will uninstall some programs

click on start
then to settings
then to control panel
in control panel find add/remove programs and double click it
now search for and remove the programs below



BitDefender Pro Total Security 2008
WinRAR v3.80.1
Shield Deluxe 2008


Run: OTMoveIt2

• Please double-click OTMoveIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
• Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  

  Code: Select all

  C:\ProgramData\BOC426\evidence.boc
  C:\Users\All Users\BOC426\evidence.boc
  C:\Users\David\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CE37VL6A\kb111653[1]
  C:\Users\David\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IDV31B0M\kb767887[1]
  C:\Users\David\Desktop\BitDefender Pro Total Security 2008 [(Antivirus & Antispyware) + Key]\bitdefender_totalsecurity_2008_32b.exe
  C:\Users\David\Desktop\BitDefender Pro Total Security 2008 [(Antivirus & Antispyware) + Key]\patch + keygen\key.exe
  C:\Users\David\Desktop\BitDefender Pro Total Security 2008 [(Antivirus & Antispyware) + Key]\patch + keygen\patch.exe
  C:\Users\David\Desktop\downloads bit torrent etc\BitDefender Pro Total Security 2008 [(Antivirus & Antispyware) + Key].rar
  C:\Users\David\Desktop\downloads bit torrent etc\WinRAR v3.80.1-Full Cracked\WinRAR v3.80.1-Full Cracked\setup.exe
  C:\Users\David\Desktop\downloads bit torrent etc\WinRAR v3.80.1-Full Cracked.zip
  C:\Users\David\Desktop\downloads bit torrent etc\WORKING Shield Deluxe 2008 Cracked\ShieldDeluxe2008Setup.exe
  

• Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the yellow bar) and choose Paste.
• Click the red Moveit! button.
• If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
• If you are not asked to reboot close OTMoveIt2.
• A log C:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log will be created (where mmddyyyy_hhmmss are numbers giving date and time the log was created).

Please then re-run the Kaspersky online scan following the instruction in the previous post.

Please then post the OTMoveIt2 log and the Kaspersky log.

[kingdonger]

the cracked prorams you asked me to remove do not showw in add and remove programs but the shield deluxe shows in program files and i cannot delete here are the latest logs.
regards Roger..


--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Wednesday, July 16, 2008
Operating System: Microsoft Windows Vista Home Premium Edition, 32-bit (build 6000)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Wednesday, July 16, 2008 20:05:06
Records in database: 960465
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Files scanned: 124213
Threat name: 7
Infected objects: 22
Suspicious objects: 0
Duration of the scan: 01:23:32


File name / Threat name / Threats count
C:\$RECYCLE.BIN\S-1-5-21-2204711546-1568723499-2695397413-1000\$R1EGOPT\bitdefender_totalsecurity_2008_32b.exe Infected: Trojan.Win32.Monder.gen 1
C:\$RECYCLE.BIN\S-1-5-21-2204711546-1568723499-2695397413-1000\$R1EGOPT\bitdefender_totalsecurity_2008_32b.exe Infected: Trojan-Downloader.MSIL.Agent.ax 1
C:\$RECYCLE.BIN\S-1-5-21-2204711546-1568723499-2695397413-1000\$R1EGOPT\patch + keygen\key.exe Infected: Trojan-Downloader.MSIL.Agent.ax 1
C:\$RECYCLE.BIN\S-1-5-21-2204711546-1568723499-2695397413-1000\$R1EGOPT\patch + keygen\patch.exe Infected: Trojan-Downloader.MSIL.Agent.ax 1
C:\$RECYCLE.BIN\S-1-5-21-2204711546-1568723499-2695397413-1000\$R1KW88X.rar Infected: Trojan.Win32.Monder.gen 1
C:\$RECYCLE.BIN\S-1-5-21-2204711546-1568723499-2695397413-1000\$R1KW88X.rar Infected: Trojan-Downloader.MSIL.Agent.ax 3
C:\$RECYCLE.BIN\S-1-5-21-2204711546-1568723499-2695397413-1000\$R59P8EE.zip Infected: Trojan-Downloader.Win32.Tiny.bqh 1
C:\$RECYCLE.BIN\S-1-5-21-2204711546-1568723499-2695397413-1000\$R59P8EE.zip Infected: Trojan-Downloader.Win32.Agent.utw 1
C:\$RECYCLE.BIN\S-1-5-21-2204711546-1568723499-2695397413-1000\$ROKNJ8G\WinRAR v3.80.1-Full Cracked\setup.exe Infected: Trojan-Downloader.Win32.Tiny.bqh 1
C:\$RECYCLE.BIN\S-1-5-21-2204711546-1568723499-2695397413-1000\$ROKNJ8G\WinRAR v3.80.1-Full Cracked\setup.exe Infected: Trojan-Downloader.Win32.Agent.utw 1
C:\$RECYCLE.BIN\S-1-5-21-2204711546-1568723499-2695397413-1000\$RSKVT0Y\ShieldDeluxe2008Setup.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.tso 1
C:\Deckard\System Scanner\backup\Users\David\AppData\Local\Temp\eceywurk.dll Infected: Trojan.Win32.Obfuscated.auw 1
C:\Deckard\System Scanner\backup\Users\David\AppData\Local\Temp\krjthweg.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Deckard\System Scanner\backup\Users\David\AppData\Local\Temp\ldxtmsmc.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Deckard\System Scanner\backup\Users\David\AppData\Local\Temp\mcgfdahx.dll Infected: Trojan.Win32.Obfuscated.auw 1
C:\Deckard\System Scanner\backup\Users\David\AppData\Local\Temp\obtetiuu.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Deckard\System Scanner\backup\Users\David\AppData\Local\Temp\yiohyeyk.dll Infected: Trojan.Win32.Monderc.gen 1
C:\_OTMoveIt\MovedFiles\07162008_201416\ProgramData\BOC426\evidence.boc Infected: Trojan.Win32.Monderc.gen 1
C:\_OTMoveIt\MovedFiles\07162008_201416\Users\David\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CE37VL6A\kb111653[1] Infected: Trojan.Win32.Obfuscated.auw 1
C:\_OTMoveIt\MovedFiles\07162008_201416\Users\David\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IDV31B0M\kb767887[1] Infected: Trojan.Win32.Monderc.gen 1

The selected area was scanned.



File/Folder C:\ProgramData\BOC426\evidence.boc not found.
File/Folder C:\Users\All Users\BOC426\evidence.boc not found.
< C:\Users\David\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CE37VL6A\kb111653[1] >
File/Folder C:\Users\David\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CE37VL6A\kb111653[1] not found.
< C:\Users\David\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IDV31B0M\kb767887[1] >
File/Folder C:\Users\David\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IDV31B0M\kb767887[1] not found.
< C:\Users\David\Desktop\BitDefender Pro Total Security 2008 [(Antivirus & Antispyware) + Key]\bitdefender_totalsecurity_2008_32b.exe >
File/Folder C:\Users\David\Desktop\BitDefender Pro Total Security 2008 [(Antivirus & Antispyware) + Key]\bitdefender_totalsecurity_2008_32b.exe not found.
< C:\Users\David\Desktop\BitDefender Pro Total Security 2008 [(Antivirus & Antispyware) + Key]\patch + keygen\key.exe >
File/Folder C:\Users\David\Desktop\BitDefender Pro Total Security 2008 [(Antivirus & Antispyware) + Key]\patch + keygen\key.exe not found.
< C:\Users\David\Desktop\BitDefender Pro Total Security 2008 [(Antivirus & Antispyware) + Key]\patch + keygen\patch.exe >
File/Folder C:\Users\David\Desktop\BitDefender Pro Total Security 2008 [(Antivirus & Antispyware) + Key]\patch + keygen\patch.exe not found.
< C:\Users\David\Desktop\downloads bit torrent etc\BitDefender Pro Total Security 2008 [(Antivirus & Antispyware) + Key].rar >
File/Folder C:\Users\David\Desktop\downloads bit torrent etc\BitDefender Pro Total Security 2008 [(Antivirus & Antispyware) + Key].rar not found.
File/Folder C:\Users\David\Desktop\downloads bit torrent etc\WinRAR v3.80.1-Full Cracked\WinRAR v3.80.1-Full Cracked\setup.exe not found.
File/Folder C:\Users\David\Desktop\downloads bit torrent etc\WinRAR v3.80.1-Full Cracked.zip not found.
File/Folder C:\Users\David\Desktop\downloads bit torrent etc\WORKING Shield Deluxe 2008 Cracked\ShieldDeluxe2008Setup.exe not found.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 07162008_201614

[MikeSwim07]

Please empty your recycle bin.

This is my normal post for when you are clear - which you now are - or seem to be.
Please advise of any problems you still have. If you think you're clean please give one more reply so that I can archive this topic.

Now that you are clean, I have some tips & tricks for you to keep your computer clean and secure. The first few (like removing dangerous tools and Windows Update) have to be done, the others are optional (beginning with Spybot S &D).

It may seem like your system will be too much protected with all these things installed, but a lot of programs aren't running always on the background so don't slow down your computer. Please take a look at the following things:

Delete Harmful tools with OTMoveIt2


• Start OTMoveIt.exe
  
• Click on CleanUp!
• A list of tools will be downloaded from the internet
• When a box pops up click Yes
• You may delete any logs that any of the tools produced.
  
  
• Clear Old System Restore Points
  
  • Turn System Restore off
  • On the Desktop, right click on the My Computer icon.
  • Click Properties.
  • Click the System Restore tab.
  • Check Turn off System Restore.
  • Click Apply, and then click OK.
    
  • Turn System Restore on
  • On the Desktop, right click on the My Computer icon.
  • Click Properties.
  • Click the System Restore tab.
  • Uncheck *Turn off System Restore*.
  • Click Apply, and then click OK.
  Note: only do this once,and not on a regular basis
  
• Make your Internet Explorer more secure - This can be done by following these simple instructions:
  
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
    
    • Change the Download signed ActiveX controls to Prompt
    • Change the Download unsigned ActiveX controls to Disable
    • Change the Initialise and script ActiveX controls not marked as safe to Disable
    • Change the Installation of desktop items to Prompt
    • Change the Launching programs and files in an IFRAME to Prompt
    • Change the Navigate sub-frames across different domains to Prompt
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
• Update your Anti Virus Software - It is imperitive that you update your Anti virus software at least once a week (Even more if you wish). If you do not update your anti virus software then it will not be able to catch any of the new variants that may come out.
  
• Visit Microsoft's Update Site Frequently - It is important that you visit http://update.microsoft.com/ regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  
• Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option.
  This will provide real-time spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an anti virus software. A tutorial on installing & using this product can be found here:
  Tutorail for Spybot S & D
  
• Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs. You can download it here:
  SpywareBlaster
  
• Install WinPatrol - As a robust security monitor, WinPatrol will alert you to hijackings, malware attacks and critical changes made to your computer without your permission. WinPatrol takes snapshot of your critical system resources and alerts you to any changes that may occur without your knowledge. You can download it from this website:
  WinPatrol
  The developer is a well-known man in the MalWare Removal business. If you really like WinPatrol think about upgrading to the PLUS version. It will give you additional features and you will only have to pay once, for your whole malware-free life.
  
• Install MVPS HOSTS - This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
  For information on how to download and install, please read this tutorial here:
  WinHelp2002
  Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.
  
• Use an alternative Internet Browser - Many of the exploits are directed to users of Internet Explorer. Try using a different browser instead:
  Firefox << Most used, I use this one myself.
  Opera
  
• Bookmark general cleanup links - It could be that your computer is becoming slower and slower. This is not always the cause of malware. Most of the times it's malware when you're computer is suddenly getting slow or doing strange. When the slowdown increases slowly check (so now bookmark) these links for tips & tricks:
  Help! My computer is slow
  Slow Computer? Check here first; it may not be malware
  
• Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.

Stand Up and Be Counted!
Please take the time to tell us what you would like to be done about the people who are behind all the problems you have had. We can only get something done about this if the people that we help, like you, are prepared to complain. We have a dedicated forum for collecting these complaints called Malware Complaints.

>> Here << you can see how you can help us.

[kingdonger]

Gday sir unable to delete pc security the shield 2008 i have reason to believe this is a virus as i have seen refrence to it elseware in your forum program is still starting up but is not shown in add and remove programs the program files are there and i cannot delete them program is showing in msconfig.
awaiting your reply...
Roger...

[MikeSwim07]

Download and Run Avenger
Download Avenger by Swandog46 from here.

• Unzip/extract it to a folder on your desktop.
• Double click on avenger.exe to run it.
• Click OK.
• Make sure that the box next to Scan for rootkits has a tick in it and that the box next to Automatically disable any rootkits found does not have a tick in it.
• Copy all of the text in the below textbox to the clibpboard by highlighting it and then pressing Ctrl+C.
  

  Code: Select all

  Drivers to delete:
  AVP
  
  Folders to delete:
  C:\Program Files\PCSecurityShield\
  

• In the avenger window, click the Paste Script from Clipboard, button.
• Click the Execute button.
• You will be asked Are you sure you want to execute the current script?.
• Click Yes.
• You will now be asked First step completed --- The Avenger has been successfully set up to run on next boot. Reboot now?.
• Click Yes.
• Your PC will now be rebooted.
• Note: If the above script contains Drivers to delete: or Drivers to disable:, then Avenger will require two reboots to complete its operation. If that is the case, it will force a BSOD on the first reboot. This is normal & expected behaviour.
• After your PC has completed the necessary reboots, a log should automatically open. If it does not automatically open, then the log can be found at %systemdrive%\avenger.txt (typically C:\avenger.txt).
• Close the log for now.

Please post this log and a new Hijackthis log on your next reply.

[kingdonger]

Gday many thanks for your help here are the logs you requested.
regards
roger..

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:55:14, on 18/07/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
C:\Users\David\Program Files\DNA\btdna.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\David\Desktop\kingdongers scanner exe\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.msn.com//
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE= ... &pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE= ... &pf=laptop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\avp.exe"
O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Users\David\Program Files\DNA\btdna.exe"
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-GB\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\scieplugin.dll (file missing)
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O20 - AppInit_DLLs: C:\PROGRA~1\PCSECU~1\THESHI~1\r3hook.dll
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 6675 bytes


Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Driver "AVP" deleted successfully.
Folder "C:\Program Files\PCSecurityShield" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

[MikeSwim07]

Remove bad HijackThis entries

• Run HijackThis
• Click on the Scan button
• Put a check beside all of the items listed below (if present):
  
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE= ... &pf=laptop
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE= ... &pf=laptop
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
  O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
  O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
  O4 - HKLM\..\Run: [AVP] "C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\avp.exe"
  O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\scieplugin.dll (file missing)
  O20 - AppInit_DLLs: C:\PROGRA~1\PCSECU~1\THESHI~1\r3hook.dll
  
  
  
  
• Close all open windows and browsers/email, etc...
• Click on the "Fix Checked" button
• When completed, close the application.

How is everything running now?