Maisel59

Members
 View Profile  See their activity

  • Content Count

    5

  • Joined

  • Last visited

 Content Type 

Posts posted by Maisel59

  2. Corrupted Files And I Can't Get Rid Of Them[INACTIVE]

    in Malware Removal

    Posted

    ^_^ I'm sorry it took me so long to do a follow up here.

    The computer is about as fast as it used to be since I followed your instructions in the last post. Also, I can see some images that were only coming up as small red squares before (like the banner in your signature, for instance).

    Here is the final(?) HijackThis Log you requested....

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 8:35:31 PM, on 9/18/2007

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Boot mode: Normal

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

    C:\Program Files\Alwil Software\Avast4\ashServ.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\system32\spoolsv.exe

    C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe

    C:\Program Files\Common Files\Real\Update_OB\realsched.exe

    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

    C:\Program Files\QuickTime\qttask.exe

    C:\Documents and Settings\Compaq_Owner\Desktop\Picasa2\PicasaMediaDetector.exe

    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

    C:\WINDOWS\system32\CTsvcCDA.exe

    C:\Program Files\Creative\Shared Files\CTDevSrv.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe

    C:\Program Files\Messenger\msmsgs.exe

    c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

    C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE

    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

    C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe

    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe

    C:\WINDOWS\system32\wuauclt.exe

    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe

    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

    O2 - BHO: HP Smart Web Printing 1.0 - {AE84A6AA-A333-4B92-B276-C11E2212E4FE} - C:\Program Files\Hewlett-Packard\Smart Web Printing\SmartWebPrinting.dll

    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

    O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run

    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

    O4 - HKLM\..\Run: [Picasa Media Detector] C:\Documents and Settings\Compaq_Owner\Desktop\Picasa2\PicasaMediaDetector.exe

    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

    O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe

    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9

    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

    O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"

    O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

    O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe

    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe

    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html

    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html

    O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm

    O8 - Extra context menu item: Add To Compaq Organize... - C:\PROGRA~1\HEWLET~1\COMPAQ~1\bin/module.main/favorites\ie_add_to.html

    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html

    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html

    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000

    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html

    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html

    O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm

    O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm

    O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

    O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

    O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

    O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab

    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f...p1.0.0.15-3.cab

    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab

    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab

    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab

    O16 - DPF: {F2D35D99-63B1-46D3-970C-6E22320D5DCB} (kSoloCntrlIE Class) - http://www.ksolo.com/playerBase/kSoloIEHDSD.cab

    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe

    O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exe

    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

    O24 - Desktop Component 0: (no name) - http://thumbp2.mail.re2.yahoo.com/tn?sid=1...9&fid=Inbox

    --

    End of file - 11076 bytes

  3. Corrupted Files And I Can't Get Rid Of Them[INACTIVE]

    in Malware Removal

    Posted

    Hi again,

    I couldn't run the Panda Active scan was because Avast would automatically stop the download process (I tried again today). So, thank you very much for the Kaspersky link. That worked out well ^_^

    Below, you'll find the Kaspersky log and a fresh HijackThis log.

    -------------------------------------------------------------------------------

    KASPERSKY ONLINE SCANNER REPORT

    September 12, 2007 12:49:41 AM

    Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)

    Kaspersky Online Scanner version: 5.0.93.1

    Kaspersky Anti-Virus database last update: 12/09/2007

    Kaspersky Anti-Virus database records: 412489

    -------------------------------------------------------------------------------

    Scan Settings:

    Scan using the following antivirus database: extended

    Scan Archives: true

    Scan Mail Bases: true

    Scan Target - My Computer:

    C:\

    D:\

    E:\

    G:\

    H:\

    I:\

    J:\

    K:\

    Scan Statistics:

    Total number of scanned objects: 90219

    Number of viruses found: 3

    Number of infected objects: 4

    Number of suspicious objects: 0

    Duration of the scan process: 01:41:37

    Infected Object Name / Virus Name / Last Action

    C:\Deckard\System Scanner\20070909213704\backup\WINDOWS\Downloaded Program Files\popcaploader.dll Infected: not-a-virus:Downloader.Win32.PopCap.b skipped

    C:\Documents and Settings\Compaq_Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SUPERANTISPYWARE.LOG Object is locked skipped

    C:\Documents and Settings\Compaq_Owner\Cookies\index.dat Object is locked skipped

    C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

    C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

    C:\Documents and Settings\Compaq_Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped

    C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\WCESCOMM.LOG Object is locked skipped

    C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\~DF906E.tmp Object is locked skipped

    C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\~DFCB01.tmp Object is locked skipped

    C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\~DFD93.tmp Object is locked skipped

    C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\~WRS0000.tmp Object is locked skipped

    C:\Documents and Settings\Compaq_Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

    C:\Documents and Settings\Compaq_Owner\NTUSER.DAT Object is locked skipped

    C:\Documents and Settings\Compaq_Owner\ntuser.dat.LOG Object is locked skipped

    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped

    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

    C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped

    C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped

    C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped

    C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped

    C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped

    C:\Program Files\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped

    C:\Program Files\Compaq Connections\5577497\Users\Default\Data\chandir.dat Object is locked skipped

    C:\Program Files\Compaq Connections\5577497\Users\Default\Data\chandir.idx Object is locked skipped

    C:\Program Files\Compaq Connections\5577497\Users\Default\Data\chn.dat Object is locked skipped

    C:\Program Files\Compaq Connections\5577497\Users\Default\Data\chn.idx Object is locked skipped

    C:\Program Files\Compaq Connections\5577497\Users\Default\Data\D0000000.FCS Object is locked skipped

    C:\Program Files\Compaq Connections\5577497\Users\Default\Data\inuse.txt Object is locked skipped

    C:\Program Files\Compaq Connections\5577497\Users\Default\Data\L0000015.FCS Object is locked skipped

    C:\Program Files\Compaq Connections\5577497\Users\Default\Data\main.log Object is locked skipped

    C:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs.dat Object is locked skipped

    C:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs.idx Object is locked skipped

    C:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs_die.dat Object is locked skipped

    C:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs_die.idx Object is locked skipped

    C:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs_dnd.dat Object is locked skipped

    C:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs_dnd.idx Object is locked skipped

    C:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs_ext.dat Object is locked skipped

    C:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs_ext.idx Object is locked skipped

    C:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs_rcv.dat Object is locked skipped

    C:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs_rcv.idx Object is locked skipped

    C:\Program Files\Compaq Connections\5577497\Users\Default\Data\storydb.dat Object is locked skipped

    C:\Program Files\Compaq Connections\5577497\Users\Default\Data\storydb.idx Object is locked skipped

    C:\Program Files\Internet Explorer\msimg32.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped

    C:\Program Files\Microsoft Office\Templates\Normal.dot Object is locked skipped

    C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped

    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

    C:\System Volume Information\_restore{A2578CBA-012A-4EE9-9E3D-27D3F494A2B6}\RP22\change.log Object is locked skipped

    C:\WINDOWS\$_hpcst$.hpc Object is locked skipped

    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

    C:\WINDOWS\SchedLgU.Txt Object is locked skipped

    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

    C:\WINDOWS\Sti_Trace.log Object is locked skipped

    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

    C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped

    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

    C:\WINDOWS\system32\config\default Object is locked skipped

    C:\WINDOWS\system32\config\default.LOG Object is locked skipped

    C:\WINDOWS\system32\config\SAM Object is locked skipped

    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

    C:\WINDOWS\system32\config\SECURITY Object is locked skipped

    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

    C:\WINDOWS\system32\config\software Object is locked skipped

    C:\WINDOWS\system32\config\software.LOG Object is locked skipped

    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

    C:\WINDOWS\system32\config\system Object is locked skipped

    C:\WINDOWS\system32\config\system.LOG Object is locked skipped

    C:\WINDOWS\system32\f3PSSavr.scr Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped

    C:\WINDOWS\system32\h323log.txt Object is locked skipped

    C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped

    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

    C:\WINDOWS\Temp\Perflib_Perfdata_4bc.dat Object is locked skipped

    C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped

    C:\WINDOWS\wiadebug.log Object is locked skipped

    C:\WINDOWS\wiaservc.log Object is locked skipped

    C:\WINDOWS\WindowsUpdate.log Object is locked skipped

    K:\MISC Writings\~WRL0002.tmp Object is locked skipped

    K:\MISC Writings\Always liked your name.doc Object is locked skipped

    Scan process completed.

    ************************

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 12:52:52 AM, on 9/12/2007

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Boot mode: Normal

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

    C:\Program Files\Alwil Software\Avast4\ashServ.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\system32\spoolsv.exe

    C:\WINDOWS\system32\CTsvcCDA.exe

    C:\Program Files\Creative\Shared Files\CTDevSrv.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

    C:\WINDOWS\system32\svchost.exe

    C:\Program Files\Common Files\Real\Update_OB\realsched.exe

    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

    C:\Program Files\QuickTime\qttask.exe

    c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

    C:\Documents and Settings\Compaq_Owner\Desktop\Picasa2\PicasaMediaDetector.exe

    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe

    C:\Program Files\Messenger\msmsgs.exe

    C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE

    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

    C:\Program Files\Internet Explorer\IEXPLORE.EXE

    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

    C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe

    C:\Program Files\Microsoft Office\Office\WINWORD.EXE

    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe

    C:\Program Files\Microsoft Office\Office\OSA.EXE

    C:\WINDOWS\ALCXMNTR.EXE

    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

    c:\windows\system\hpsysdrv.exe

    C:\Program Files\iTunes\iTunesHelper.exe

    C:\Program Files\iPod\bin\iPodService.exe

    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe

    C:\WINDOWS\system32\NOTEPAD.EXE

    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

    O2 - BHO: HP Smart Web Printing 1.0 - {AE84A6AA-A333-4B92-B276-C11E2212E4FE} - C:\Program Files\Hewlett-Packard\Smart Web Printing\SmartWebPrinting.dll

    O2 - BHO: (no name) - {fd52bc30-fb90-4b8f-bcae-77b3906e9600} - C:\WINDOWS\system32\fonnth.dll (file missing)

    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

    O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run

    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

    O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"

    O4 - HKLM\..\Run: [Picasa Media Detector] C:\Documents and Settings\Compaq_Owner\Desktop\Picasa2\PicasaMediaDetector.exe

    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

    O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe

    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9

    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

    O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"

    O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

    O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe

    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe

    O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE

    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

    O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE

    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html

    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html

    O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm

    O8 - Extra context menu item: Add To Compaq Organize... - C:\PROGRA~1\HEWLET~1\COMPAQ~1\bin/module.main/favorites\ie_add_to.html

    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html

    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html

    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000

    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html

    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html

    O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm

    O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm

    O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

    O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

    O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

    O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab

    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f...p1.0.0.15-3.cab

    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab

    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab

    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab

    O16 - DPF: {F2D35D99-63B1-46D3-970C-6E22320D5DCB} (kSoloCntrlIE Class) - http://www.ksolo.com/playerBase/kSoloIEHDSD.cab

    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

    O20 - Winlogon Notify: fonnth - fonnth.dll (file missing)

    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe

    O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exe

    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

    O24 - Desktop Component 0: (no name) - http://thumbp2.mail.re2.yahoo.com/tn?sid=1...9&fid=Inbox

    --

    End of file - 11863 bytes

  4. Corrupted Files And I Can't Get Rid Of Them[INACTIVE]

    in Malware Removal

    Posted

    Hello again,

    Thank you very much for your response Jwbirdsong! Glad to hear about the decompression bombs not being malicious. The approximate locations of the decompression bombs (now there are 3) from my last Avast! scan: C:\DocumentsAndSettings\...\konalibBaseRM[1], D:\SystemVolumeInformation\..\nsis1.bin, D:\1386\Apps25990\src\install\...\nsis1.bins.

    I was able to follow your directions until I got to Panda's Active Scan. My computer told me that the download contained samples of Win32:CTX and refused to finish the download process. I retried that numerous times but no luck :unsure: So I have included in this reply theSuperAntiSpyware log and a fresh HijackThis log, as per your request. :)

    ****************************************

    SUPERAntiSpyware Scan Log

    http://www.superantispyware.com

    Generated 09/11/2007 at 00:48 AM

    Application Version : 3.9.1008

    Core Rules Database Version : 3303

    Trace Rules Database Version: 1309

    Scan type : Quick Scan

    Total Scan Time : 02:25:46

    Memory items scanned : 496

    Memory threats detected : 0

    Registry items scanned : 680

    Registry threats detected : 4

    File items scanned : 42167

    File threats detected : 241

    Adware.Tracking Cookie

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@statcounter[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@redorbit[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@cgi-bin[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@soundtrack[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@cgi-bin[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@serving-sys[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@direct[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@adbrite[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@fastclick[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@valueclick[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@xiti[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@23818417[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@r[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@event[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@nextag[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@trafficmp[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@2o7[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@adserver[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@adrevolver[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@adrevolver[3].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@mediachannel[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@apmebf[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@adinterax[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@atwola[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@porntube[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@revsci[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@tribalfusion[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@jamster[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@39162387[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@youporn[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@burstnet[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@questionmarket[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@kmpads[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@casalemedia[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@enhance[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@atdmt[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@sextracker[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@pornotube[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@optimost[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@realmedia[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@bluestreak[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@tacoda[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@overture[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@bannerads[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@56597277[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@20070607021435[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@tradedoubler[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@zedo[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@doubleclick[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@mediaplex[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@specificclick[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@ad[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@hitbox[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@fortunecity[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@247realmedia[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@LPBofA1[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@advertising[3].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@s[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@adultadworld[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@adultdating-reviews[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@handbag[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@exitexchange[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@caloriecounterr[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@porninspector[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@adtech[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@mediaonenetwork[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@cgi-bin[4].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@cgi-bin[3].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@drivecleaner[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@smileycentral[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@adultfriendfinder[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@handbag[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@pornfidelity[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@direct;wi.728;hi[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@goclick[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@azjmp[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@gostats[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@mediabistro[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@cpvfeed[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@adlegend[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@nextstat[2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@20070707033418[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@revenue[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@nandomedia[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@tripod[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@a[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@findwhat[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@keywordmax[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@1068010739[1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt

    C:\Deckard\System Scanner\20070909213704\backup\WINDOWS\temp\Cookies\compaq_owner@advertising[2].txt

    C:\Deckard\System Scanner\20070909213704\backup\WINDOWS\temp\Cookies\compaq_owner@atdmt[1].txt

    Adware.MyWebSearch

    HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}

    HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}\InprocServer32

    HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}\InprocServer32#ThreadingModel

    HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}\Programmable

    ***********************************

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 9:15:11 AM, on 9/11/2007

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Boot mode: Normal

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

    C:\Program Files\Alwil Software\Avast4\ashServ.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\system32\spoolsv.exe

    C:\Program Files\Common Files\Real\Update_OB\realsched.exe

    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

    C:\Program Files\QuickTime\qttask.exe

    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

    C:\WINDOWS\system32\CTsvcCDA.exe

    C:\Program Files\Creative\Shared Files\CTDevSrv.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Documents and Settings\Compaq_Owner\Desktop\Picasa2\PicasaMediaDetector.exe

    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe

    C:\Program Files\Messenger\msmsgs.exe

    c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

    C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE

    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

    C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe

    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe

    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe

    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe

    C:\Program Files\Microsoft Office\Office\OSA.EXE

    C:\WINDOWS\system32\msiexec.exe

    C:\WINDOWS\ALCXMNTR.EXE

    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

    c:\windows\system\hpsysdrv.exe

    C:\Program Files\iTunes\iTunesHelper.exe

    C:\Program Files\iPod\bin\iPodService.exe

    C:\WINDOWS\system32\notepad.exe

    C:\Program Files\Internet Explorer\IEXPLORE.EXE

    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

    O2 - BHO: HP Smart Web Printing 1.0 - {AE84A6AA-A333-4B92-B276-C11E2212E4FE} - C:\Program Files\Hewlett-Packard\Smart Web Printing\SmartWebPrinting.dll

    O2 - BHO: (no name) - {fd52bc30-fb90-4b8f-bcae-77b3906e9600} - C:\WINDOWS\system32\fonnth.dll (file missing)

    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

    O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run

    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

    O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"

    O4 - HKLM\..\Run: [Picasa Media Detector] C:\Documents and Settings\Compaq_Owner\Desktop\Picasa2\PicasaMediaDetector.exe

    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

    O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe

    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9

    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

    O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"

    O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

    O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe

    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe

    O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE

    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

    O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE

    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html

    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html

    O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm

    O8 - Extra context menu item: Add To Compaq Organize... - C:\PROGRA~1\HEWLET~1\COMPAQ~1\bin/module.main/favorites\ie_add_to.html

    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html

    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html

    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000

    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html

    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html

    O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm

    O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm

    O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

    O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

    O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

    O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f...p1.0.0.15-3.cab

    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab

    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab

    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab

    O16 - DPF: {F2D35D99-63B1-46D3-970C-6E22320D5DCB} (kSoloCntrlIE Class) - http://www.ksolo.com/playerBase/kSoloIEHDSD.cab

    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

    O20 - Winlogon Notify: fonnth - fonnth.dll (file missing)

    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe

    O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exe

    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

    O24 - Desktop Component 0: (no name) - http://thumbp2.mail.re2.yahoo.com/tn?sid=1...9&fid=Inbox

    --

    End of file - 11810 bytes

  5. Corrupted Files And I Can't Get Rid Of Them[INACTIVE]

    in Malware Removal

    Posted · Edited by Maisel59

    Hello :blink:

    Lately, I have been having issues with my Avast! scan. The list of files that it can not scan is growing in length. My computer is about 50% slower than it used to be. And today I found 2 files that Avast! said it couldn't read, but noted as a "Decompression Bombs". I can't imagine that that's a good thing :( I'm very nervous about this discovery. I'm trying to find out how to get rid of these bad files from my computer. Below is a copy of the HJT log from notepad. Please let me know if this is not enough information to provide aid in my situation.

    Any help that you can offer would be wonderful. Thank you. ^_^

    Logfile of HijackThis v1.99.1

    Scan saved at 9:51:06 PM, on 9/9/2007

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

    C:\Program Files\Alwil Software\Avast4\ashServ.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\system32\spoolsv.exe

    C:\Program Files\Common Files\Real\Update_OB\realsched.exe

    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

    C:\Program Files\QuickTime\qttask.exe

    C:\WINDOWS\system32\CTsvcCDA.exe

    C:\Program Files\Creative\Shared Files\CTDevSrv.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

    C:\WINDOWS\system32\svchost.exe

    c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

    C:\Documents and Settings\Compaq_Owner\Desktop\Picasa2\PicasaMediaDetector.exe

    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe

    C:\Program Files\Messenger\msmsgs.exe

    C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE

    C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe

    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe

    C:\Program Files\Microsoft Office\Office\OSA.EXE

    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe

    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe

    C:\WINDOWS\ALCXMNTR.EXE

    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

    c:\windows\system\hpsysdrv.exe

    C:\Program Files\iTunes\iTunesHelper.exe

    C:\Program Files\iPod\bin\iPodService.exe

    C:\Program Files\Alwil Software\Avast4\ashSimpl.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\Internet Explorer\IEXPLORE.EXE

    C:\Documents and Settings\Compaq_Owner\My Documents\HiJackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

    O2 - BHO: HP Smart Web Printing 1.0 - {AE84A6AA-A333-4B92-B276-C11E2212E4FE} - C:\Program Files\Hewlett-Packard\Smart Web Printing\SmartWebPrinting.dll

    O2 - BHO: (no name) - {fd52bc30-fb90-4b8f-bcae-77b3906e9600} - C:\WINDOWS\system32\fonnth.dll (file missing)

    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

    O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run

    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

    O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"

    O4 - HKLM\..\Run: [Picasa Media Detector] C:\Documents and Settings\Compaq_Owner\Desktop\Picasa2\PicasaMediaDetector.exe

    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

    O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe

    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9

    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

    O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"

    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

    O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe

    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe

    O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE

    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

    O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE

    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html

    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html

    O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm

    O8 - Extra context menu item: Add To Compaq Organize... - C:\PROGRA~1\HEWLET~1\COMPAQ~1\bin/module.main/favorites\ie_add_to.html

    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html

    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html

    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000

    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html

    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html

    O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm

    O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm

    O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

    O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

    O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

    O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f...p1.0.0.15-3.cab

    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab

    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab

    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab

    O16 - DPF: {F2D35D99-63B1-46D3-970C-6E22320D5DCB} (kSoloCntrlIE Class) - http://www.ksolo.com/playerBase/kSoloIEHDSD.cab

    O20 - Winlogon Notify: fonnth - fonnth.dll (file missing)

    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe

    O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exe

    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe