Fireman17

February 4, 2008

Thank You for helping with this issue my computer is running alot faster. I am gald there are people still there helping aothers issue like this and teaching what do and what not do and how you got this etc. The world is messing that now days. I belive this tread can be lock now.

February 3, 2008

here is my Panda Scan logs

Incident Status Location

Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.zedo.com/]

Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[c5.zedo.com/]

Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.c5.zedo.com/]

Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.zedo.com/]

Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.tribalfusion.com/]

Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.doubleclick.net/]

Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.realmedia.com/]

Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.fastclick.net/]

Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.apmebf.com/]

Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.fastclick.net/]

Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.trafficmp.com/]

Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.casalemedia.com/]

Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[ad.yieldmanager.com/]

Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.atdmt.com/]

Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.adrevolver.com/]

Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.ads.pointroll.com/]

Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.questionmarket.com/]

Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.advertising.com/]

Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.mediaplex.com/]

Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.bluestreak.com/]

Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.azjmp.com/]

Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[server.iad.liveperson.net/hc/73993052]

Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[server.iad.liveperson.net/]

Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.adtech.de/]

Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.bs.serving-sys.com/]

Spyware:Cookie/WUpd Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.revenue.net/]

Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.serving-sys.com/]

Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.xiti.com/]

Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[searchportal.information.com/]

Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\brook\Cookies\brook@adrevolver[2].txt

Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\brook\Cookies\brook@atdmt[2].txt

Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\brook\Cookies\brook@atdmt[3].txt

Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\brook\Cookies\brook@atdmt[4].txt

Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\brook\Cookies\[email protected][2].txt

Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.com.com/]

Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.trafficmp.com/]

Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.adultfriendfinder.com/]

Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.toplist.cz/]

Spyware:Cookie/onestat.com Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[stat.onestat.com/]

Spyware:Cookie/Yadro Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.yadro.ru/]

Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.xiti.com/]

Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[searchportal.information.com/]

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.go.com/]

Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.bravenet.com/]

Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.serving-sys.com/]

Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.bs.serving-sys.com/]

Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.serving-sys.com/]

Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\Owner\My Documents\My Music\Stuff1\Computer STuff\ComboFix.exe[327882R2FWJFW\nircmd.com]

Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\Owner\My Documents\My Music\Stuff1\Computer STuff\ComboFix.exe[327882R2FWJFW\nircmd.cfexe]

Virus:W32/Virutas.Z Disinfected C:\Documents and Settings\Owner\My Documents\My Music\Stuff1\Xmas-RCPCorp-2007.zip[iDServe.exe]

Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bi1734bm.default\cookies.txt[.atdmt.com/]

Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bi1734bm.default\cookies.txt[.mediaplex.com/]

Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bi1734bm.default\cookies.txt[.doubleclick.net/]

Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bi1734bm.default\cookies.txt[.ads.pointroll.com/]

Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bi1734bm.default\cookies.txt[.advertising.com/]

Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bi1734bm.default\cookies.txt[.bluestreak.com/]

Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bi1734bm.default\cookies.txt[.realmedia.com/]

Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bi1734bm.default\cookies.txt[.trafficmp.com/]

Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Robert\Cookies\robert@advertising[1].txt

Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Robert\Cookies\robert@advertising[3].txt

Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Robert\Cookies\robert@doubleclick[1].txt

Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Robert\Cookies\robert@fastclick[1].txt

Spyware:Cookie/Overture Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.perf.overture.com/]

Spyware:Cookie/Overture Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.overture.com/]

Spyware:Cookie/Atlas DMT Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.atdmt.com/]

Spyware:Cookie/YieldManager Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[ad.yieldmanager.com/]

Spyware:Cookie/Traffic Marketplace Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.trafficmp.com/]

Spyware:Cookie/YieldManager Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[ad.yieldmanager.com/]

Spyware:Cookie/RealMedia Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.realmedia.com/]

Spyware:Cookie/Advertising Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.advertising.com/]

Spyware:Cookie/Doubleclick Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.doubleclick.net/]

Spyware:Cookie/Tribalfusion Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.tribalfusion.com/]

Spyware:Cookie/Bluestreak Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.bluestreak.com/]

Spyware:Cookie/FastClick Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.fastclick.net/]

Spyware:Cookie/Mediaplex Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.mediaplex.com/]

Spyware:Cookie/Atwola Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Cookies\robert@atwola[1].txt

Spyware:Cookie/BurstNet Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Cookies\robert@burstnet[1].txt

Spyware:Cookie/Com.com Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Cookies\robert@com[1].txt

Spyware:Cookie/Belnk Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Cookies\[email protected][2].txt

Spyware:Cookie/Com.com Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Cookies\[email protected][1].txt

Spyware:Cookie/Kmpads Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Cookies\robert@kmpads[1].txt

Spyware:Cookie/BurstBeacon Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Cookies\[email protected][1].txt

Adware:Adware/Yazzle Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Local Settings\Temp\b116.exe

Adware:Adware/PurityScan Not disinfected C:\My Backup -- 22-03-05 2002\Program Files\Common Files\W?nSxS\regsvr32.exe

Adware:Adware/DeluxeComunications Not disinfected C:\QooBox\Quarantine\C\WINDOWS\b136.exe.vir

Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\WINDOWS\Nircmd.exe

Adware:Adware/Yazzle Not disinfected C:\_OTMoveIt\MovedFiles1312008_181220\My Backup -- 22-03-05 2002\Program Files\Common Files\Yazzle1122OinUninstaller.exe

Adware:Adware/Yazzle Not disinfected C:\_OTMoveIt\MovedFiles1312008_181220\My Backup -- 22-03-05 2002\Program Files\Common Files\Yazzle1396OinUninstaller.exe

Spyware:Spyware/MarketScore Not disinfected C:\_OTMoveIt\MovedFiles1312008_181220\My Backup -- 22-03-05 2002\WINDOWS\system32\rlxf.dll

February 3, 2008

I am haveing trouble posting the Kaspersky WebScanner logs that i done it did come up finding stuff on my computer but i know i need get the log on here so you can go over it but its not showing up when copy and paste it. For some reason the log is in a html file is that seems to be a problem when copying the stuff from it and pasteing it.

February 2, 2008

January 31, 2008

I run the Step one and got the logs here. Running the notron removeing tool it does not run all the way tru it says i have remove programs before i can use in the add/remove but i dont see them in there.

OTmoveit Log

LoadLibrary failed for C:\My Backup -- 22-03-05 2002\WINDOWS\system32\rlxf.dll

C:\My Backup -- 22-03-05 2002\WINDOWS\system32\rlxf.dll NOT unregistered.

C:\My Backup -- 22-03-05 2002\WINDOWS\system32\rlxf.dll moved successfully.

File/Folder C:\My Backup -- 22-03-05 2002\Program Files\Common Files\W?nSxS not found.

C:\My Backup -- 22-03-05 2002\Program Files\Common Files\Yazzle1122OinUninstaller.exe moved successfully.

C:\My Backup -- 22-03-05 2002\Program Files\Common Files\Yazzle1396OinUninstaller.exe moved successfully.

[Custom Input]

< EmptyTemp >

File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_354.dat scheduled to be deleted on reboot.

File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_a94.dat scheduled to be deleted on reboot.

Temp folders emptied.

IE temp folders emptied.

< purity >

OTMoveIt2 v1.0.17 log created on 01312008_181220

January 31, 2008

Here ComboFix , HijackThis after i ran Combofix the way you ask me and Panda Logs. Right now im Running AVG 7.5 Anti Virus Free Version.

ComboFix 08-01-30.1 - Owner 2008-01-31 3:20:47.2 - NTFSx86

Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe

Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt

FILE

c:\windows\system32\awvvuvu.dll

.

((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-31 )))))))))))))))))))))))))))))))

.

2008-01-30 12:17 . 2004-08-03 23:00 260,272 --a------ C:\cmldr

2008-01-30 12:17 . 2007-10-07 19:40 211 --a------ C:\Boot.bak

2008-01-29 07:57 . 2008-01-29 08:07 <DIR> d-------- C:\Program Files\Paint.NET

2008-01-23 22:42 . 2008-01-23 22:42 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\PownceDesktop.1A618255CEB975BFC863E47CA16BCF2DEB687FD9.1

2008-01-21 20:01 . 2008-01-21 20:01 <DIR> d-------- C:\Program Files\twhirl - a twitter client

2008-01-20 21:56 . 2008-01-20 21:56 <DIR> d-------- C:\Program Files\PuTTY

2008-01-19 06:12 . 2008-01-19 06:14 <DIR> d-------- C:\Program Files\WebcamMax

2008-01-18 20:56 . 2008-01-18 20:56 0 --a------ C:\Documents

2008-01-16 04:50 . 2008-01-16 04:50 1,158 --a------ C:\WINDOWS\mozver.dat

2008-01-10 10:21 . 2008-01-10 10:21 <DIR> d-------- C:\Program Files\CCleaner

2008-01-07 03:32 . 2008-01-07 03:36 <DIR> d-------- C:\ERDNT

2008-01-05 09:52 . 2004-08-03 22:58 14,848 --a--c--- C:\WINDOWS\system32\drivers\kbdhid.sys

2008-01-05 09:52 . 2004-08-03 22:58 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys

2008-01-02 17:44 . 2008-01-02 17:44 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\de.makesoft.twhirl.0EA062BC275E7ED1E6EC3762EFFD73C7158ADF33.1

2007-12-26 22:36 . 2007-12-26 22:37 <DIR> d-------- C:\Program Files\TalkShoe

2007-12-24 23:45 . 2007-12-24 23:46 <DIR> d-------- C:\Program Files\Pidgin

2007-12-24 19:11 . 2007-12-24 19:11 <DIR> d-------- C:\Documents and Settings\brook\Application Data\Thunderbird

2007-12-21 23:02 . 2008-01-31 02:20 54,156 --ah----- C:\WINDOWS\QTFont.qfn

2007-12-21 23:02 . 2007-12-21 23:02 1,409 --a------ C:\WINDOWS\QTFont.for

2007-12-18 01:14 . 2007-12-18 01:14 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Snitter.88C687E32FFE9452F058A6F4E67005F998FC3136.1

2007-12-10 19:49 . 2007-12-10 19:50 <DIR> d-------- C:\Program Files\Ventrilo

2007-12-06 18:57 . 2007-12-06 18:57 <DIR> d-------- C:\Documents and Settings\Owner\dwhelper

2007-12-03 23:07 . 2007-12-03 23:07 <DIR> d-------- C:\Program Files\Pure Networks

2007-12-03 23:02 . 2007-09-20 10:16 23,864 --a------ C:\WINDOWS\system32\drivers\pnarp.sys

2007-12-03 23:01 . 2007-12-03 23:01 <DIR> d-------- C:\Program Files\Common Files\Pure Networks Shared

2007-12-03 23:01 . 2007-09-20 10:16 24,888 --a------ C:\WINDOWS\system32\drivers\purendis.sys

2007-12-03 21:21 . 2008-01-06 16:33 <DIR> d-------- C:\Program Files\VisualRoute 2008

2007-12-03 20:38 . 2007-12-03 21:23 <DIR> d-------- C:\Program Files\VisualRoute Lite Edition

2007-12-03 20:38 . 2007-12-03 21:18 <DIR> d-------- C:\Documents and Settings\Owner\vw

2007-12-02 23:33 . 2008-01-30 13:00 <DIR> d-------- C:\Program Files\mIRC

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-01-31 09:22 --------- d-----w C:\Documents and Settings\Owner\Application Data\Skype

2008-01-31 09:20 --------- d-----w C:\Documents and Settings\Owner\Application Data\X-Chat 2

2008-01-31 09:20 --------- d-----w C:\Documents and Settings\Owner\Application Data\mIRC

2008-01-31 09:20 --------- d-----w C:\Documents and Settings\Owner\Application Data\.purple

2008-01-31 08:04 --------- d-----w C:\Program Files\Mozilla Thunderbird

2008-01-31 06:40 --------- d-----w C:\Documents and Settings\Owner\Application Data\skypePM

2008-01-26 04:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7

2008-01-25 22:46 --------- d-----w C:\Documents and Settings\Owner\Application Data\LimeWire

2008-01-13 06:15 --------- d-----w C:\Documents and Settings\Owner\Application Data\AVG7

2008-01-08 18:36 --------- d-----w C:\Program Files\Common Files\Symantec Shared

2008-01-04 23:23 --------- d-----w C:\Documents and Settings\brook\Application Data\LimeWire

2008-01-02 20:43 --------- d-----w C:\Program Files\LimeWire

2007-12-25 01:09 --------- d-----w C:\Program Files\Imikimi

2007-12-24 20:52 --------- d-----w C:\Documents and Settings\brook\Application Data\AVG7

2007-12-18 07:10 --------- d-----w C:\Program Files\Common Files\Adobe AIR

2007-12-18 02:00 --------- d-----w C:\Documents and Settings\Owner\Application Data\gtk-2.0

2007-12-17 17:19 --------- d--h--w C:\Program Files\InstallShield Installation Information

2007-12-11 01:47 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard

2007-12-04 05:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Pure Networks

2007-11-17 07:33 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat

2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll

2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll

2007-10-27 23:40 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll

2007-10-24 07:47 96,760 ----a-w C:\WINDOWS\system32\dfshim.dll

2007-10-24 07:47 84,480 ----a-w C:\WINDOWS\system32\mscories.dll

2007-10-24 07:47 282,112 ----a-w C:\WINDOWS\system32\mscoree.dll

2007-10-24 07:47 158,720 ----a-w C:\WINDOWS\system32\mscorier.dll

2007-10-10 23:56 824,832 ----a-w C:\WINDOWS\system32\wininet.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 15360]

"Free Ram Optimizer"="C:\Program Files\AceLogix\Free Ram Optimizer\fro.exe" [2003-08-22 08:19 57344]

"WinMem"="C:\Program Files\WinCleaner Memory Optimizer\WinMemOpt.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 22:24 32768]

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 13:50 155648]

"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-06-02 11:21 48752]

"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe" [2005-08-18 19:22 85696]

"HPHUPD06"="C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-06 22:53 49152]

"GSM"="C:\Program Files\Gateway\GSM\bin\usm.exe" [2005-05-31 23:05 9216]

"BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 20:26 368706]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]

"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 05:24 286720]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06 40048]

"itype"="c:\Program Files\Microsoft IntelliType Pro\itype.exe" [2007-08-31 11:13 988584]

"IntelliPoint"="c:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 11:01 1037736]

"SoundMan"="SOUNDMAN.EXE" [2007-04-16 14:28 577536 C:\WINDOWS\soundman.exe]

"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-21 08:34 579072]

"nmctxth"="C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2007-10-01 20:08 451896]

"nmapp"="C:\Program Files\Pure Networks\Network Magic\nmapp.exe" [2007-10-29 22:04 451896]

"WebcamMaxMoniter"="C:\Program Files\WebcamMax\CAMTHINS.exe" [2007-03-07 05:46 81920]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-11-15 16:19 219136]

C:\Documents and Settings\brook\Start Menu\Programs\Startup\

LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2006-08-16 13:16:24 159744]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\

Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]

path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk

backup=C:\WINDOWS\pss\HP Image Zone Fast Start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]

--a--c--- 2004-05-12 15:18 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

--a--c--- 2004-02-12 13:38 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon06]

--a--c--- 2004-06-06 22:42 659456 C:\WINDOWS\system32\hphmon06.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]

C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]

%WINDIR%\SMINST\RECGUARD.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]

--a------ 2007-08-31 15:46 1460560 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]

--a--c--- 2006-11-10 11:35 90112 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]

C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WebcamMaxMoniter]

--a------ 2007-03-07 05:46 81920 C:\Program Files\WebcamMax\CAMTHINS.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winlog]

R2 CamthWDM;WebcamMax, WDM Video Capture;C:\WINDOWS\system32\DRIVERS\CamthWDM.sys [2007-01-10 23:39]

R2 CBA8;LANDeskÂ® Management Agent;"C:\Program Files\LANDesk\Shared Files\residentagent.exe" [2005-04-28 14:05]

R2 CISMBIOS;CiSMBios Driver;C:\WINDOWS\system32\Drivers\CISMBIOS.SYS [2005-05-31 22:53]

R2 ModemView;LANDesk Message Handler Service;C:\Program Files\Gateway\GSM\BIN\modemview.exe [2005-05-31 23:13]

R3 ICFWDM;ICFWDM;C:\WINDOWS\system32\drivers\icfwdm.sys [2002-06-20 11:35]

S2 LSM_SSM;LANDeskÂ® System Manager System Space Manager;C:\Program Files\Gateway\GSM\BIN\ssm.exe [2005-05-31 23:04]

S3 el575nd5;3Com Megahertz 10/100 LAN CardBus PC Card Driver;C:\WINDOWS\system32\DRIVERS\el575nd5.sys [2001-08-17 20:10]

S3 NTPASp50;NTPASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\NTPASp50.sys [2004-08-10 08:57]

S3 SUPERWEBCAM;SuperWebcam, WDM Virtual Video Capture Device;C:\WINDOWS\system32\DRIVERS\superwebcam.sys [2006-06-27 07:56]

S3 SWLD23U;Netopia 802.11b WLAN USB Adapter;C:\WINDOWS\system32\DRIVERS\SWLD23U.sys [2003-12-17 11:58]

S3 swlubtl;WLAN USB Boot Device;C:\WINDOWS\system32\Drivers\swlubtl.sys [2003-05-02 16:26]

.

Contents of the 'Scheduled Tasks' folder

"2005-03-23 04:05:05 C:\WINDOWS\Tasks\ISP signup reminder 1.job"

- C:\WINDOWS\system32\OOBE\oobebaln.exe

"2005-03-23 04:05:05 C:\WINDOWS\Tasks\ISP signup reminder 2.job"

- C:\WINDOWS\system32\OOBE\oobebaln.exe

"2005-03-23 04:05:05 C:\WINDOWS\Tasks\ISP signup reminder 3.job"

- C:\WINDOWS\system32\OOBE\oobebaln.exe

"2007-10-04 09:34:47 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_IPoint_exe.job"

- c:\Program Files\Microsoft IntelliPoint\ipoint.exe

"2007-10-04 09:34:47 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_IType_exe.job"

- c:\Program Files\Microsoft IntelliType Pro\itype.exe

"2005-03-23 04:04:30 C:\WINDOWS\Tasks\Symantec NetDetect.job"

- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE

.

**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-01-31 03:25:38

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2008-01-31 3:27:00

ComboFix-quarantined-files.txt 2008-01-31 09:26:50

ComboFix2.txt 2008-01-30 06:04:37

.

2008-01-23 08:37:09 --- E O F ---

Logfile of HijackThis v1.99.1

Scan saved at 3:29:19 AM, on 1/31/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe

C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe

C:\Program Files\Gateway\GSM\bin\usm.exe

C:\Program Files\BroadJump\Client Foundation\CFD.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Microsoft IntelliType Pro\itype.exe

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

C:\Program Files\Microsoft IntelliPoint\ipoint.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

C:\Program Files\WebcamMax\CAMTHINS.exe

C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

c:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Gizmo Project\mDNSResponder.exe

C:\Program Files\LANDesk\Shared Files\residentagent.exe

C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\Program Files\Gateway\GSM\BIN\modemview.exe

C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe

C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe

C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

C:\Program Files\AceLogix\Free Ram Optimizer\fro.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Documents and Settings\Owner\My Documents\My Music\Stuff1\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: VirtualCamera IEMenu Class - {0246A1A7-820A-469A-85A7-7B7F01EB808C} - (no file)

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe

O4 - HKLM\..\Run: [HPHUPD06] C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe

O4 - HKLM\..\Run: [GSM] C:\Program Files\Gateway\GSM\bin\usm.exe

O4 - HKLM\..\Run: [bJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"

O4 - HKLM\..\Run: [intelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"

O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash

O4 - HKLM\..\Run: [WebcamMaxMoniter] "C:\Program Files\WebcamMax\CAMTHINS.exe" /m

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Free Ram Optimizer] C:\Program Files\AceLogix\Free Ram Optimizer\fro.exe

O4 - HKCU\..\Run: [WinMem] C:\Program Files\WinCleaner Memory Optimizer\WinMemOpt.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000

O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\Program Files\VisualRoute 2008\vrie.dll (file missing)

O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\Program Files\VisualRoute 2008\vrie.dll (file missing)

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1104556665484

O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m...,26/mcgdmgr.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O18 - Protocol: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp3.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Gizmo Project\mDNSResponder.exe

O23 - Service: LANDeskÂ® Management Agent (CBA8) - LANDesk Software, Ltd. - C:\Program Files\LANDesk\Shared Files\residentagent.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: IS Service (ISSVC) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe

O23 - Service: LANDeskÂ® System Manager System Space Manager (LSM_SSM) - LANDeskÂ® Software Ltd. - C:\Program Files\Gateway\GSM\BIN\ssm.exe

O23 - Service: LANDesk Message Handler Service (ModemView) - LANDeskÂ® Software Ltd. - C:\Program Files\Gateway\GSM\BIN\modemview.exe

O23 - Service: Pure Networks Net2Go Service (nmraapache) - Unknown owner - C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe" -k runservice (file missing)

O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe

O23 - Service: Symantec SecurePort (SymSecurePort) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe

Panda's ActiveScan Log for Jan 31 5:44am done after all the aothers.