Services.exe[RESOLVED]

mntanakd · March 18, 2008

Neighbor asked me to look at his system and upon bootup he gets C:\windows\system32\wowfx.dll is not a valid windows image in a box services.exe you click ok then it gives same message in a lsass.exe box. Then after you click a user name to log on it hangs on a splash screen with out desktop icons.

Andro1d · March 22, 2008

Hello and Welcome to BT.

I am MoNsTeReNeRgY22 and I will be assisting you with your malware problem today.

Click here to download HJTInstall.exe

Save HJTInstall.exe to your desktop.
Double click on the HJTInstall.exe icon on your desktop.
A window will pop up, and simply click Install.
By default it will install to C:\Program Files\Trend Micro\HijackThis.
When it is completed installing HijackThis, it will automatically launch and you will be presented with the License Agreement. Click on the I Accept button.
Once the license agreement is gone, click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
Come back here to this thread and Paste the log in your next reply.
DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.

mntanakd · March 24, 2008

Hello and Welcome to BT.
I am MoNsTeReNeRgY22 and I will be assisting you with your malware problem today.
Click here to download HJTInstall.exe
Save HJTInstall.exe to your desktop.
Double click on the HJTInstall.exe icon on your desktop.
A window will pop up, and simply click Install.
By default it will install to C:\Program Files\Trend Micro\HijackThis.
When it is completed installing HijackThis, it will automatically launch and you will be presented with the License Agreement. Click on the I Accept button.
Once the license agreement is gone, click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
Come back here to this thread and Paste the log in your next reply.
DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.

mntanakd · March 24, 2008

Ok Thank you for your response. I will be in So Calif for a few days but will look into this upon my return, Thanks again.

Andro1d · March 25, 2008

Welcome to Cali!

I will await the log.

mntanakd · April 2, 2008

Here is the log you requested.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 6:46:31 PM, on 4/2/2008

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe

C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

C:\WINDOWS\System32\qwerty12.exe

C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

C:\Program Files\Network Monitor\netmon.exe

C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\WINDOWS\wanmpsvc.exe

C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

C:\WINDOWS\System32\taskmgr.exe

F:\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.youbettersearch.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/...rch/search.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\shell.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\System32\deviceemulator.exe,

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll (file missing)

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll (file missing)

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)

O3 - Toolbar: Mirar - {9A9C9B68-F908-4AAB-8D0C-10EA8997F37E} - C:\WINDOWS\System32\WinNB58.dll

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\System32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe

O4 - HKLM\..\Run: [intelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe

O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [urlLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe

O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe

O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"

O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu72.exe 61A847B5BBF72815308B2B27128065E9C084320161C4661227A755E9C2933154389A284662E902BC

9ED7286138F75F2F0C8D6E84A1EF7F506DCD610837FE13FD97CB77

O4 - HKLM\..\Run: [hoxyjuzu] C:\Program Files\Internet Explorer\hoxyjuzu77798.exe

O4 - HKLM\..\Run: [iESet] IExplorer.dll .dbt

O4 - HKLM\..\Run: [lsass] C:\WINDOWS\lsass.exe

O4 - HKLM\..\Run: [fc53b860] rundll32.exe "C:\WINDOWS\System32\nximcwrj.dll",b

O4 - HKLM\..\Run: [avp] C:\WINDOWS\avp.exe

O4 - HKLM\..\Run: [smgr] mgrs.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [Printer] C:\WINDOWS\System32\printer.exe

O4 - HKLM\..\RunServices: [iESet] IExplorer.dll .dbt

O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [WebBuying] C:\Program Files\Web Buying\v1.8.0\webbuying.exe

O4 - HKCU\..\Run: [Vwec] "C:\Program Files\?racle\c?rss.exe"

O4 - HKCU\..\Run: [WinPop] C:\Program Files\WinPop\winpop.exe

O4 - HKCU\..\Run: [Regscan] C:\WINDOWS\System32\regscan.exe

O4 - HKCU\..\Run: [Aida] "C:\DOCUME~1\ALMARO~1\APPLIC~1\ECURIT~1\cmd.exe" -vt ndrv

O4 - HKCU\..\Run: [insider] C:\Program Files\Insider\Insider.exe

O4 - HKCU\..\Run: [WinTouch] C:\Documents and Settings\Alma Rodriguez\Application Data\WinTouch\WinTouch.exe

O4 - HKCU\..\Run: [sfKg6w] C:\Documents and Settings\Alma Rodriguez\Application Data\Microsoft\Windows\bksdk.exe

O4 - HKUS\S-1-5-18\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\Run: [iESet] IExplorer.dll .dbt (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Default user')

O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe

O4 - Global Startup: autorun.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)

O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll

O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)

O15 - Trusted Zone: *.adgate.info (HKLM)

O15 - Trusted Zone: *.dollarrevenue.com (HKLM)

O15 - Trusted Zone: *.elitemediagroup.net (HKLM)

O15 - Trusted Zone: *.errorsafe.com (HKLM)

O15 - Trusted Zone: http://click.getmirar.com (HKLM)

O15 - Trusted Zone: *.imagesrvr.com (HKLM)

O15 - Trusted Zone: *.matcash.com (HKLM)

O15 - Trusted Zone: *.media-motor.com (HKLM)

O15 - Trusted Zone: *.media-motor.net (HKLM)

O15 - Trusted Zone: *.mediatickets.net (HKLM)

O15 - Trusted Zone: http://click.mirarsearch.com (HKLM)

O15 - Trusted Zone: http://redirect.mirarsearch.com (HKLM)

O15 - Trusted Zone: *.mt-download.com (HKLM)

O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)

O15 - Trusted Zone: *.snipernet.biz (HKLM)

O15 - Trusted Zone: *.snipernet.us (HKLM)

O15 - Trusted Zone: *.systemdoctor.com (HKLM)

O15 - Trusted Zone: *.winantivirus.com (HKLM)

O15 - Trusted Zone: *.winfixer.com (HKLM)

O16 - DPF: {01016526-5E80-11D8-9E86-0007E96C65AE} (SmartAccess Ctl Class) - https://install.charter.com/diskless/bin/ssctlsma.dll

O16 - DPF: {09F1ADAC-76D8-4D0F-99A5-5C907DADB988} - http://cdn.downloadcontrol.com/files/insta...FreeInstall.cab

O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} (CInstall Class) - http://www.spywarestormer.com/files2/Install.cab

O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://drivecleaner.com/.freeware/installd...leanerstart.cab

O16 - DPF: {8A0DCBDB-6E20-489C-9041-C1E8A0352E75} (Mirar_Dummy_ATS1 Class) - http://awbeta.net-nucleus.com/FIX/WinATS.cab

O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} - http://cdn.downloadcontrol.com/files/insta...tector-Free.cab

O20 - AppInit_DLLs: C:\WINDOWS\system32\wowfx.dll

O22 - SharedTaskScheduler: Replay for WindowsXP - {D81E2FC4-B0A2-11D3-21AC-07C04C21A18A} - (no file)

O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\QWxtYSBSb2RyaWd1ZXo\command.exe (file missing)

O23 - Service: DomainService - - C:\WINDOWS\System32\qwerty12.exe

O23 - Service: FCI - Unknown owner - C:\WINDOWS\System32\svchost.exe:ext.exe

O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

O23 - Service: Net Agent - Unknown owner - C:\WINDOWS\dls0523pmw.exe (file missing)

O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe

O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe

O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

O24 - Desktop Component 0: (no name) - C:\Program Files\NetMeeting\prolybu.html

--

End of file - 11008 bytes

Andro1d · April 2, 2008

Hello again,

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

For more information regarding this download, please visit this webpage: http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please, never rename Combofix unless instructed.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
-----------------------------------------------------------
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  -----------------------------------------------------------

Close any open browsers.
WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

-----------------------------------------------------------

[*]Double click on combofix.exe & follow the prompts.

[*]When finished, it will produce a report for you.

[*]Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

mntanakd · April 3, 2008

I had to download the Hijack this onto a different machine and copy to the affected machine via a USB key, as I'm unable to get the affected machine to boot to a desktop.Will this work ok if I do the same but copy and run the combo fix from the desktop?

mntanakd · April 3, 2008

I ran the combo fix and here are the logs you requested. For an fyi I had an error after reboot

MM_Tray.exe Unable to locate component The application faied to start because Coredll.dll was not found. I dont know if this came before the other issue or not and now machine boots to a desktop environment where it didnt before.

Combo fix

ComboFix 08-04-02.1 - Alma Rodriguez 2008-04-03 17:52:24.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1033.18.321 [GMT -6:00]

Running from: C:\Documents and Settings\Alma Rodriguez\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

ADS - svchost.exe: deleted 24064 bytes in 1 streams.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Documents and Settings\Abraham Rodriguez\Application Data\ErrorProtector Free

C:\Documents and Settings\Abraham Rodriguez\Application Data\ErrorProtector Free\Logs\update.log

C:\Documents and Settings\Abraham Rodriguez\Application Data\WinAntiVirus Pro 2007

C:\Documents and Settings\Abraham Rodriguez\Application Data\WinAntiVirus Pro 2007\avtasks.dat

C:\Documents and Settings\Abraham Rodriguez\Application Data\WinAntiVirus Pro 2007\history.db

C:\Documents and Settings\Abraham Rodriguez\Application Data\WinAntiVirus Pro 2007\Logs\update.log

C:\Documents and Settings\Abraham Rodriguez\Application Data\WinAntiVirus Pro 2007\Logs\wa7Support.log

C:\Documents and Settings\Abraham Rodriguez\Application Data\WinAntiVirus Pro 2007\Logs\winav.log

C:\Documents and Settings\Abraham Rodriguez\Application Data\WinAntiVirus Pro 2007\PGE.dat

C:\Documents and Settings\Abraham Rodriguez\err.log

C:\Documents and Settings\Abraham Rodriguez\My Documents\SKS~1

C:\Documents and Settings\Abraham Rodriguez\My Documents\SKS~1\??sks\

C:\Documents and Settings\Abraham Rodriguez\ResErrors.log

C:\Documents and Settings\All Users\Application Data\ErrorProtector Free

C:\Documents and Settings\All Users\Application Data\ErrorProtector Free\Data\Abbr

C:\Documents and Settings\All Users\Application Data\ErrorProtector Free\Data\ActivationCode

C:\Documents and Settings\All Users\Application Data\ErrorProtector Free\Data\HOURS

C:\Documents and Settings\All Users\Application Data\ErrorProtector Free\Data\ProductCode

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

C:\Documents and Settings\All Users\Application Data\salesmonitor

C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007

C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007\Data\Abbr

C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007\Data\ActivationCode

C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007\Data\ProductCode

C:\Documents and Settings\All Users\Desktop\WinAntiVirus Pro 2007.lnk

C:\Documents and Settings\All Users\Start Menu\Programs\ErrorProtector Unregistered Version

C:\Documents and Settings\All Users\Start Menu\Programs\ErrorProtector Unregistered Version\Contact customer support.lnk

C:\Documents and Settings\All Users\Start Menu\Programs\ErrorProtector Unregistered Version\ErrorProtector on the Web.lnk

C:\Documents and Settings\All Users\Start Menu\Programs\ErrorProtector Unregistered Version\ErrorProtector.lnk

C:\Documents and Settings\All Users\Start Menu\Programs\ErrorProtector Unregistered Version\Uninstall ErrorProtector.lnk

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\autorun.exe

C:\Documents and Settings\All Users\Start Menu\Programs\WinAntiVirus Pro 2007

C:\Documents and Settings\All Users\Start Menu\Programs\WinAntiVirus Pro 2007\Reinstall or Uninstall WinAntiVirus Pro 2007.lnk

C:\Documents and Settings\All Users\Start Menu\Programs\WinAntiVirus Pro 2007\WinAntiVirus Pro 2007 Manual.lnk

C:\Documents and Settings\All Users\Start Menu\Programs\WinAntiVirus Pro 2007\WinAntiVirus Pro 2007.lnk

C:\Documents and Settings\Alma Rodriguez\Application Data\ECURIT~1

C:\Documents and Settings\Alma Rodriguez\Application Data\ECURIT~1\?ecurity\

C:\Documents and Settings\Alma Rodriguez\Application Data\ECURIT~1\cmd.exe

C:\Documents and Settings\Alma Rodriguez\Application Data\ErrorProtector Free

C:\Documents and Settings\Alma Rodriguez\Application Data\ErrorProtector Free\Logs\update.log

C:\Documents and Settings\Alma Rodriguez\Application Data\install.dat

C:\Documents and Settings\Alma Rodriguez\Application Data\MCROSO~1

C:\Documents and Settings\Alma Rodriguez\Application Data\SpamBlocker

C:\Documents and Settings\Alma Rodriguez\Application Data\WinTouch

C:\Documents and Settings\Alma Rodriguez\Application Data\WinTouch\wintouch.cfg

C:\Documents and Settings\Alma Rodriguez\Application Data\WinTouch\WinTouch.exe

C:\Documents and Settings\Alma Rodriguez\Application Data\WinTouch\WTUninstaller.exe

C:\Documents and Settings\Alma Rodriguez\Desktop\Find Spyware Remover.lnk

C:\Documents and Settings\Alma Rodriguez\Desktop\Free Online Dating.lnk

C:\Documents and Settings\Alma Rodriguez\Desktop\Go to Casino.lnk

C:\Documents and Settings\Alma Rodriguez\ResErrors.log

C:\Documents and Settings\Alma Rodriguez\Start Menu\Programs\Outerinfo

C:\Documents and Settings\Alma Rodriguez\Start Menu\Programs\Outerinfo\Terms.lnk

C:\Documents and Settings\Alma Rodriguez\Start Menu\Programs\Outerinfo\Uninstall.lnk

C:\Documents and Settings\juan\Application Data\ErrorProtector Free

C:\Documents and Settings\juan\Application Data\ErrorProtector Free\Logs\update.log

C:\Documents and Settings\juan\Application Data\ICROSO~1.NET

C:\Documents and Settings\juan\Application Data\ICROSO~1.NET\w?wexec.exe

C:\Documents and Settings\juan\Application Data\printer.exe

C:\Documents and Settings\juan\Application Data\WinAntiVirus Pro 2007

C:\Documents and Settings\juan\Application Data\WinAntiVirus Pro 2007\avtasks.dat

C:\Documents and Settings\juan\Application Data\WinAntiVirus Pro 2007\history.db

C:\Documents and Settings\juan\Application Data\WinAntiVirus Pro 2007\Logs\update.log

C:\Documents and Settings\juan\Application Data\WinAntiVirus Pro 2007\Logs\wa7Support.log

C:\Documents and Settings\juan\Application Data\WinAntiVirus Pro 2007\Logs\winav.log

C:\Documents and Settings\juan\Application Data\WinAntiVirus Pro 2007\PGE.dat

C:\Documents and Settings\juan\Desktop\Find Spyware Remover.lnk

C:\Documents and Settings\juan\Desktop\Free Online Dating.lnk

C:\Documents and Settings\juan\Desktop\Go to Casino.lnk

C:\Documents and Settings\juan\err.log

C:\Documents and Settings\juan\ResErrors.log

C:\Documents and Settings\juan\Start Menu\Programs\Internet Speed Monitor

C:\Documents and Settings\juan\Start Menu\Programs\Internet Speed Monitor\Check Now.lnk

C:\Documents and Settings\juan\Start Menu\Programs\Internet Speed Monitor\Uninstall.lnk

C:\Documents and Settings\juan\Start Menu\Programs\Outerinfo

C:\Documents and Settings\juan\Start Menu\Programs\Outerinfo\Terms.lnk

C:\Documents and Settings\juan\Start Menu\Programs\Outerinfo\Uninstall.lnk

C:\Documents and Settings\juan\Start Menu\Programs\Startup\findfast.exe

C:\Documents and Settings\LocalService\Application Data\NetMon

C:\Documents and Settings\LocalService\Application Data\NetMon\domains.txt

C:\Documents and Settings\LocalService\Application Data\NetMon\log.txt

C:\Documents and Settings\Rosa Rodriguez\err.log

C:\Documents and Settings\Rosa Rodriguez\ResErrors.log

C:\Documents and Settings\Yvette Rodriguez\Application Data\ErrorProtector Free

C:\Documents and Settings\Yvette Rodriguez\Application Data\ErrorProtector Free\Logs\update.log

C:\Documents and Settings\Yvette Rodriguez\Application Data\FNTS~1

C:\Documents and Settings\Yvette Rodriguez\Application Data\FNTS~1\msconfig.exe

C:\Documents and Settings\Yvette Rodriguez\Application Data\macromedia\Flash Player\#SharedObjects\NWE75AY8\www.broadcaster.com

C:\Documents and Settings\Yvette Rodriguez\Application Data\macromedia\Flash Player\#SharedObjects\NWE75AY8\www.broadcaster.com\bc_video_vars.sol

C:\Documents and Settings\Yvette Rodriguez\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com

C:\Documents and Settings\Yvette Rodriguez\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol

C:\Documents and Settings\Yvette Rodriguez\Application Data\WinAntiVirus Pro 2007

C:\Documents and Settings\Yvette Rodriguez\Application Data\WinAntiVirus Pro 2007\avtasks.dat

C:\Documents and Settings\Yvette Rodriguez\Application Data\WinAntiVirus Pro 2007\history.db

C:\Documents and Settings\Yvette Rodriguez\Application Data\WinAntiVirus Pro 2007\Logs\update.log

C:\Documents and Settings\Yvette Rodriguez\Application Data\WinAntiVirus Pro 2007\Logs\wa7Support.log

C:\Documents and Settings\Yvette Rodriguez\Application Data\WinAntiVirus Pro 2007\Logs\winav.log

C:\Documents and Settings\Yvette Rodriguez\Application Data\WinAntiVirus Pro 2007\PGE.dat

C:\Documents and Settings\Yvette Rodriguez\Application Data\WinTouch

C:\Documents and Settings\Yvette Rodriguez\Application Data\WinTouch\config.cfg.402cc2cb351e15ed2a777dfb2cfdf5a7

C:\Documents and Settings\Yvette Rodriguez\Application Data\WinTouch\wintouch.cfg

C:\Documents and Settings\Yvette Rodriguez\Application Data\WinTouch\WinTouch.exe

C:\Documents and Settings\Yvette Rodriguez\Application Data\WinTouch\WTUninstaller.exe

C:\Documents and Settings\Yvette Rodriguez\err.log

C:\Documents and Settings\Yvette Rodriguez\My Documents\FNTS~1

C:\Documents and Settings\Yvette Rodriguez\My Documents\RACLE~1

C:\Documents and Settings\Yvette Rodriguez\ResErrors.log

C:\Documents and Settings\Yvette Rodriguez\Start Menu\Programs\Outerinfo

C:\Documents and Settings\Yvette Rodriguez\Start Menu\Programs\Outerinfo\Terms.lnk

C:\Documents and Settings\Yvette Rodriguez\Start Menu\Programs\Outerinfo\Uninstall.lnk

C:\Program Files\3269.exe

C:\Program Files\Common Files\{3C53B~1

C:\Program Files\Common Files\{3C53B~1\Uninst.exe

C:\Program Files\Common Files\{FC53B~1

C:\Program Files\Common Files\companion wizard

C:\Program Files\Common Files\companion wizard\CompWiz.xml

C:\Program Files\Common Files\sembly~1

C:\Program Files\Common Files\sembly~1\?explore.exe

C:\Program Files\Common Files\ssembl~1

C:\Program Files\Common Files\winantivirus pro 2007

C:\Program Files\Common Files\winantivirus pro 2007\err.log

C:\Program Files\Common Files\winantivirus pro 2007\WAPChk.dll

C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe

C:\Program Files\Common Files\Yazzle1552OinAdmin.exe

C:\Program Files\Common Files\Yazzle1552OinUninstaller.exe

C:\Program Files\cowabanga

C:\Program Files\cowabanga\License.txt

C:\Program Files\cowabanga\uninstaller.exe

C:\Program Files\errorprotector free

C:\Program Files\errorprotector free\Activate.dat

C:\Program Files\errorprotector free\atl71.dll

C:\Program Files\errorprotector free\bnlink.dat

C:\Program Files\errorprotector free\DataBase.sav

C:\Program Files\errorprotector free\diagnosis.dat

C:\Program Files\errorprotector free\ertmain.exe

C:\Program Files\errorprotector free\hmlink.dat

C:\Program Files\errorprotector free\lapv.dat

C:\Program Files\errorprotector free\License.rtf

C:\Program Files\errorprotector free\mfc71.dll

C:\Program Files\errorprotector free\msvcp71.dll

C:\Program Files\errorprotector free\msvcr71.dll

C:\Program Files\errorprotector free\pv.dat

C:\Program Files\errorprotector free\readme.rtf

C:\Program Files\errorprotector free\ReportListFile.dat

C:\Program Files\errorprotector free\ResErrors.log

C:\Program Files\errorprotector free\sr.log

C:\Program Files\errorprotector free\st.dat

C:\Program Files\errorprotector free\support.url

C:\Program Files\errorprotector free\uertcookiemon.exe

C:\Program Files\errorprotector free\uerturl.url

C:\Program Files\errorprotector free\umain.xml

C:\Program Files\errorprotector free\unins000.dat

C:\Program Files\errorprotector free\unins000.exe

C:\Program Files\errorprotector free\up.dat

C:\Program Files\errorprotector free\updater.dat

C:\Program Files\Helper

C:\Program Files\Helper\Helper6.dll

C:\Program Files\inetget2

C:\Program Files\Insider

C:\Program Files\Insider\Insider.exe

C:\Program Files\Insider\UnInstall.exe

C:\Program Files\ISM

C:\Program Files\ISM\ism.exe

C:\Program Files\ISM\Uninstall.exe

C:\Program Files\lsass.exe

C:\Program Files\MyWay

C:\Program Files\MyWay\myBar\1.bin\MY2NS.EXE

C:\Program Files\MyWay\myBar\1.bin\MYWAYPLUGINPROXY.CLASS

C:\Program Files\MyWay\myBar\1.bin\NPMYWAY.DLL

C:\Program Files\MyWay\myBar\1.bin\PARTNER.BMP

C:\Program Files\MyWay\myBar\1.bin\PARTNER.DAT

C:\Program Files\MyWay\myBar\1.bin\PARTNER2.DAT

C:\Program Files\MyWay\myBar\1.bin\PARTNER3.DAT

C:\Program Files\MyWay\myBar\1.bin\PARTNER4.DAT

C:\Program Files\MyWay\myBar\1.bin\PARTNER5.DAT

C:\Program Files\MyWay\myBar\1.bin\PARTNER6.DAT

C:\Program Files\MyWay\myBar\Cache\0002459A

C:\Program Files\MyWay\myBar\Cache\00024A7C

C:\Program Files\MyWay\myBar\Cache\0005E70C

C:\Program Files\MyWay\myBar\Cache\003B89F1.bin

C:\Program Files\MyWay\myBar\Cache\003B9DA8.bin

C:\Program Files\MyWay\myBar\Cache\003BA9ED.bin

C:\Program Files\MyWay\myBar\Cache\004A83CE

C:\Program Files\MyWay\myBar\Cache\03F8CF48

C:\Program Files\MyWay\myBar\Cache\files.ini

C:\Program Files\MyWay\myBar\History\search

C:\Program Files\MyWay\myBar\Settings\prevcfg.htm

C:\Program Files\NetMeeting\prolybu.html

C:\Program Files\network monitor

C:\Program Files\network monitor\netmon.exe

C:\Program Files\outerinfo

C:\Program Files\outerinfo\FF\chrome.manifest

C:\Program Files\outerinfo\FF\components\FF.dll

C:\Program Files\outerinfo\FF\components\OuterinfoAds.xpt

C:\Program Files\outerinfo\FF\install.rdf

C:\Program Files\outerinfo\Terms.rtf

C:\Program Files\QdrDrive

C:\Program Files\QdrDrive\QdrDrive8.dll

C:\Program Files\QdrDrive\qdrloader.exe

C:\Program Files\QdrModule

C:\Program Files\QdrModule\dic.gz

C:\Program Files\QdrModule\kwd.gz

C:\Program Files\QdrModule\QdrModule9.exe

C:\Program Files\QdrPack

C:\Program Files\QdrPack\dicts.gz

C:\Program Files\QdrPack\QdrPack10.exe

C:\Program Files\QdrPack\trgts.gz

C:\Program Files\racle~1

C:\Program Files\racle~1\c?rss.exe

C:\Program Files\sembly~1

C:\Program Files\spoolsv.exe

C:\Program Files\stem32~1

C:\Program Files\stem32~1\??stem32\

C:\Program Files\stem32~1\javaw.exe

C:\Program Files\Temporary

C:\Program Files\Temporary\wininstall.exe

C:\Program Files\ucleaner_setup.exe

C:\Program Files\Ultimate Cleaner

C:\Program Files\WinAble

C:\Program Files\WinAble\winable.exe

C:\Program Files\winantivirus pro 2007

C:\Program Files\winantivirus pro 2007\Activate.dat

C:\Program Files\winantivirus pro 2007\asmngr.dll

C:\Program Files\winantivirus pro 2007\ASupdater.dat

C:\Program Files\winantivirus pro 2007\AWBase\database\enemies.dat

C:\Program Files\winantivirus pro 2007\AWBase\vbpv.dat

C:\Program Files\winantivirus pro 2007\BkSites.dat

C:\Program Files\winantivirus pro 2007\bnlink.dat

C:\Program Files\winantivirus pro 2007\bpupdater.dat

C:\Program Files\winantivirus pro 2007\CompWiz.exe

C:\Program Files\winantivirus pro 2007\CompWiz.xml

C:\Program Files\winantivirus pro 2007\fat.exe

C:\Program Files\winantivirus pro 2007\forum.dat

C:\Program Files\winantivirus pro 2007\FWSettings.bin

C:\Program Files\winantivirus pro 2007\IEFWBHO.dll

C:\Program Files\winantivirus pro 2007\integrity.dat

C:\Program Files\winantivirus pro 2007\kb.url

C:\Program Files\winantivirus pro 2007\lapv.dat

C:\Program Files\winantivirus pro 2007\License.rtf

C:\Program Files\winantivirus pro 2007\Online.url

C:\Program Files\winantivirus pro 2007\PGBase\vbpv.dat

C:\Program Files\winantivirus pro 2007\PGE.dat

C:\Program Files\winantivirus pro 2007\PGupdater.dat

C:\Program Files\winantivirus pro 2007\plugins\BORLNDMM.DLL

C:\Program Files\winantivirus pro 2007\plugins\SCANADWR.DLL

C:\Program Files\winantivirus pro 2007\plugins\SCANBCDR.DLL

C:\Program Files\winantivirus pro 2007\plugins\SCANDLDR.DLL

C:\Program Files\winantivirus pro 2007\plugins\SCANDOS1.DLL

C:\Program Files\winantivirus pro 2007\plugins\SCANEMUL.DLL

C:\Program Files\winantivirus pro 2007\plugins\SCANFUNC.DLL

C:\Program Files\winantivirus pro 2007\plugins\SCANMCR1.DLL

C:\Program Files\winantivirus pro 2007\plugins\SCANOTHR.DLL

C:\Program Files\winantivirus pro 2007\plugins\SCANSCR.DLL

C:\Program Files\winantivirus pro 2007\plugins\SCANTOOL.DLL

C:\Program Files\winantivirus pro 2007\plugins\SCANTROJ.DLL

C:\Program Files\winantivirus pro 2007\plugins\SCANWIN1.DLL

C:\Program Files\winantivirus pro 2007\plugins\UNACPU.DLL

C:\Program Files\winantivirus pro 2007\plugins\UNADBX.DLL

C:\Program Files\winantivirus pro 2007\plugins\unamscan.dll

C:\Program Files\winantivirus pro 2007\plugins\UNMIME.DLL

C:\Program Files\winantivirus pro 2007\plugins\UNPACK.DLL

C:\Program Files\winantivirus pro 2007\plugins\UNPACKS.DLL

C:\Program Files\winantivirus pro 2007\plugins\UNPACKS2.DLL

C:\Program Files\winantivirus pro 2007\plugins\UNPEPACK.DLL

C:\Program Files\winantivirus pro 2007\plugins\UpDate\UA27601.DLL

C:\Program Files\winantivirus pro 2007\plugins\UpDate\UA27602.DLL

C:\Program Files\winantivirus pro 2007\plugins\UpDate\UA27603.DLL

C:\Program Files\winantivirus pro 2007\plugins\UpDate\UA27604.DLL

C:\Program Files\winantivirus pro 2007\plugins\UpDate\UADAILY.DLL

C:\Program Files\winantivirus pro 2007\plugins\vbpv.dat

C:\Program Files\winantivirus pro 2007\pv.dat

C:\Program Files\winantivirus pro 2007\pv.exe

C:\Program Files\winantivirus pro 2007\rbho.dat

C:\Program Files\winantivirus pro 2007\reform.exe

C:\Program Files\winantivirus pro 2007\res\cross.gif

C:\Program Files\winantivirus pro 2007\res\wa7p.gif

C:\Program Files\winantivirus pro 2007\ResErrors.log

C:\Program Files\winantivirus pro 2007\Restart.exe

C:\Program Files\winantivirus pro 2007\rpt.dll

C:\Program Files\winantivirus pro 2007\scnkrnl.dll

C:\Program Files\winantivirus pro 2007\Settings.ini

C:\Program Files\winantivirus pro 2007\sqlite3.dll

C:\Program Files\winantivirus pro 2007\sr.log

C:\Program Files\winantivirus pro 2007\st.dat

C:\Program Files\winantivirus pro 2007\Support.url

C:\Program Files\winantivirus pro 2007\UBUpdater.dat

C:\Program Files\winantivirus pro 2007\unins000.dat

C:\Program Files\winantivirus pro 2007\unins000.exe

C:\Program Files\winantivirus pro 2007\uninstall.ico

C:\Program Files\winantivirus pro 2007\up.dat

C:\Program Files\winantivirus pro 2007\updater.dat

C:\Program Files\winantivirus pro 2007\WAV6COM.dll

C:\Program Files\winantivirus pro 2007\WinAV.exe

C:\Program Files\winantivirus pro 2007\WinAV.xml

C:\Program Files\winantivirus pro 2007\winpgi.dll

C:\Program Files\winantivirus pro 2007\worldmap.swf

C:\Program Files\wnsxs~1

C:\Program Files\Words

C:\Program Files\Words\list.txt

C:\Program Files\Words\UnInstall.exe

C:\Program Files\Words\Words.exe

C:\Program Files\ystem~1

C:\Redemption.ECF

C:\temp\0c2

C:\temp\0c2\tmpFF.log

C:\Temp\1cb

C:\Temp\1cb\syscheck.log

C:\temp\brr

C:\temp\brr\tmpZTF.log

C:\Temp\fse

C:\Temp\fse\tmpZTF.log

C:\U.exe

C:\UWA7P

C:\WINDOWS\avp.exe

C:\WINDOWS\b103.exe

C:\WINDOWS\b104.exe

C:\WINDOWS\b111.exe

C:\WINDOWS\b122.exe

C:\WINDOWS\b128.exe

C:\WINDOWS\b138.exe

C:\WINDOWS\b143.exe

C:\WINDOWS\b147.exe

C:\WINDOWS\b148.exe

C:\WINDOWS\Casino.ico

C:\WINDOWS\cookies.ini

C:\WINDOWS\dobe~1

C:\WINDOWS\dobe~2

C:\WINDOWS\dobe~2\w?auclt.exe

C:\WINDOWS\Downloaded Program Files\UERS_9999_N91S1502NetInstaller.exe

C:\WINDOWS\Downloaded Program Files\USDR6_0001_D19M2108NetInstaller.exe

C:\WINDOWS\Downloaded Program Files\UWA7P_0001_N99M2908NetInstaller.exe

C:\WINDOWS\Fonts\acrsecB.fon

C:\WINDOWS\Fonts\acrsecI.fon

C:\WINDOWS\Free Online Dating.ico

C:\WINDOWS\lsass.exe

C:\WINDOWS\mgrs.exe

C:\WINDOWS\notedad.exe

C:\WINDOWS\QWxtYSBSb2RyaWd1ZXo\

C:\WINDOWS\QWxtYSBSb2RyaWd1ZXo\\asappsrv.dll

C:\WINDOWS\QWxtYSBSb2RyaWd1ZXo\\kqUQsm1mvZlVuqxYtrC.vbs

C:\WINDOWS\rau001978.exe

C:\WINDOWS\shell.exe

C:\WINDOWS\smdat32a.sys

C:\WINDOWS\smdat32m.sys

C:\WINDOWS\Spyware Remover.ico

C:\WINDOWS\system32\aahjjetp.dll

C:\WINDOWS\SYSTEM32\adjuhtgw.ini

C:\WINDOWS\system32\agdhecvt.dll

C:\WINDOWS\SYSTEM32\agtwcjdt.ini

C:\WINDOWS\system32\aoonyixl.dll

C:\WINDOWS\SYSTEM32\aqtdegxh.ini

C:\WINDOWS\SYSTEM32\arrwhgth.ini

C:\WINDOWS\system32\asks~1

C:\WINDOWS\system32\atmtd.dll

C:\WINDOWS\system32\atmtd.dll._

C:\WINDOWS\system32\atuoukiu.dll

C:\WINDOWS\system32\av.cpl

C:\WINDOWS\system32\b02FdUe

C:\WINDOWS\system32\b02FdUe\b02FdUe1065.exe

C:\WINDOWS\system32\bbwyeawu.dll

C:\WINDOWS\system32\bcrwcwrc.dll

C:\WINDOWS\system32\bcsygqyi.dll

C:\WINDOWS\system32\bctcleow.dll

C:\WINDOWS\SYSTEM32\bjbalyge.ini

C:\WINDOWS\system32\bksbpuvq.dll

C:\WINDOWS\system32\bksyntsy.dll

C:\WINDOWS\SYSTEM32\bmknikyc.ini

C:\WINDOWS\SYSTEM32\bodiexvv.ini

C:\WINDOWS\SYSTEM32\brxudjkg.ini

C:\WINDOWS\system32\C1

C:\WINDOWS\system32\C1\kmhp83122.exe

C:\WINDOWS\system32\C3

C:\WINDOWS\system32\C5

C:\WINDOWS\system32\C9

C:\WINDOWS\SYSTEM32\cbegpsjy.ini

C:\WINDOWS\SYSTEM32\cbffdckr.ini

C:\WINDOWS\SYSTEM32\ccdpcgxd.ini

C:\WINDOWS\SYSTEM32\chiexbjy.ini

C:\WINDOWS\system32\chkconfig

C:\WINDOWS\SYSTEM32\crltrnxk.ini

C:\WINDOWS\SYSTEM32\crwcwrcb.ini

C:\WINDOWS\SYSTEM32\cvdidakr.ini

C:\WINDOWS\system32\cykinkmb.dll

C:\WINDOWS\SYSTEM32\daaagoet.ini

C:\WINDOWS\system32\dcldykrw.dll

C:\WINDOWS\system32\DefLib.sys

C:\WINDOWS\system32\dixjywfi.dll

C:\WINDOWS\SYSTEM32\dmhrnrum.ini

C:\WINDOWS\system32\dmsynt.dll

C:\WINDOWS\SYSTEM32\dnyxtjgi.ini

C:\WINDOWS\system32\doagqvun.dll

C:\WINDOWS\system32\dpnadd.dll

C:\WINDOWS\system32\drivers\protect.sys

C:\WINDOWS\SYSTEM32\dublxqsr.ini

C:\WINDOWS\SYSTEM32\dvwbrhts.ini

C:\WINDOWS\system32\dwdsrngt.exe

C:\WINDOWS\system32\dwydhokk.dll

C:\WINDOWS\system32\dxgcpdcc.dll

C:\WINDOWS\system32\dyrwxrbg.dll

C:\WINDOWS\system32\E5

C:\WINDOWS\SYSTEM32\efdlyfgj.ini

C:\WINDOWS\system32\egylabjb.dll

C:\WINDOWS\system32\emiysgmr.dll

C:\WINDOWS\SYSTEM32\eqkilyug.ini

C:\WINDOWS\SYSTEM32\evsoyhkg.ini

C:\WINDOWS\system32\evxqfaxl.dll

C:\WINDOWS\system32\explorer.exe

C:\WINDOWS\system32\eyamxgkw.dll

C:\WINDOWS\system32\f02WtR

C:\WINDOWS\system32\f02WtR\f02WtR1065.exe

C:\WINDOWS\SYSTEM32\fsedpqst.ini

C:\WINDOWS\system32\fueavblk.dll

C:\WINDOWS\SYSTEM32\fuupaygq.ini

C:\WINDOWS\SYSTEM32\fvrefvir.ini

C:\WINDOWS\SYSTEM32\gbrxwryd.ini

C:\WINDOWS\system32\gcxximpw.dll

C:\WINDOWS\system32\gkhyosve.dll

C:\WINDOWS\system32\gkjduxrb.dll

C:\WINDOWS\SYSTEM32\gknmjcrt.ini

C:\WINDOWS\system32\gpujxkmv.dll

C:\WINDOWS\SYSTEM32\grftoenw.ini

C:\WINDOWS\system32\grwcwhbu.dll

C:\WINDOWS\system32\guylikqe.dll

C:\WINDOWS\system32\gvyhxkuk.dll

C:\WINDOWS\system32\gwpdutdv.dll

C:\WINDOWS\system32\H1

C:\WINDOWS\system32\H1\dl22011.exe

C:\WINDOWS\system32\hbnissdr.dll

C:\WINDOWS\system32\hmpkjlqs.dll

C:\WINDOWS\system32\htghwrra.dll

C:\WINDOWS\system32\hwlexweo.dll

C:\WINDOWS\system32\hxgedtqa.dll

C:\WINDOWS\system32\hxiu.dll

C:\WINDOWS\system32\icenuwas.dll

C:\WINDOWS\system32\iexplorer.dll .dbt

C:\WINDOWS\system32\ifbfuqrv.dll

C:\WINDOWS\SYSTEM32\ifwyjxid.ini

C:\WINDOWS\system32\igjtxynd.dll

C:\WINDOWS\SYSTEM32\iingwfvy.ini

C:\WINDOWS\system32\ikqossum.dll

C:\WINDOWS\SYSTEM32\iyqgyscb.ini

C:\WINDOWS\system32\iytsbttx.dll

C:\WINDOWS\system32\jewekmyl.dll

C:\WINDOWS\system32\jgfyldfe.dll

C:\WINDOWS\SYSTEM32\jrwcmixn.ini

C:\WINDOWS\SYSTEM32\jveskjwl.ini

C:\WINDOWS\system32\khnfuakm.dll

C:\WINDOWS\SYSTEM32\kkohdywd.ini

C:\WINDOWS\SYSTEM32\klbvaeuf.ini

C:\WINDOWS\system32\kmvxyvyn.dll

C:\WINDOWS\SYSTEM32\kodwnyxs.ini

C:\WINDOWS\SYSTEM32\kssdxnas.ini

C:\WINDOWS\SYSTEM32\kukxhyvg.ini

C:\WINDOWS\System32\kvhumijw.dll

C:\WINDOWS\system32\kxnrtlrc.dll

C:\WINDOWS\system32\kybawjhw.dll

C:\WINDOWS\SYSTEM32\lhdwwkrr.ini

C:\WINDOWS\system32\lwjksevj.dll

C:\WINDOWS\SYSTEM32\lxafqxve.ini

C:\WINDOWS\SYSTEM32\lxiynooa.ini

C:\WINDOWS\SYSTEM32\lxxkvycv.ini

C:\WINDOWS\SYSTEM32\lymkewej.ini

C:\WINDOWS\system32\lyvawpqm.dll

C:\WINDOWS\SYSTEM32\mkaufnhk.ini

C:\WINDOWS\SYSTEM32\mkdfpqwn.ini

C:\WINDOWS\system32\mmxuovrn.dll

C:\WINDOWS\system32\mp43.exe

C:\WINDOWS\SYSTEM32\mqpwavyl.ini

C:\WINDOWS\system32\mumgjgur.dll

C:\WINDOWS\system32\murnrhmd.dll

C:\WINDOWS\SYSTEM32\mussoqki.ini

C:\WINDOWS\system32\noxgynin.dll

C:\WINDOWS\SYSTEM32\nrvouxmm.ini

C:\WINDOWS\system32\nullvaos.dll

C:\WINDOWS\SYSTEM32\nuvqgaod.ini

C:\WINDOWS\system32\nwqpfdkm.dll

C:\WINDOWS\system32\nximcwrj.dll

C:\WINDOWS\system32\nyfmwlyu.dll

C:\WINDOWS\SYSTEM32\nyvyxvmk.ini

C:\WINDOWS\SYSTEM32\oewxelwh.ini

C:\WINDOWS\SYSTEM32\onokoavq.ini

C:\WINDOWS\system32\ooafccpt.dll

C:\WINDOWS\system32\oovxkvnw.dll

C:\WINDOWS\system32\osmubffu.dll

C:\WINDOWS\system32\ovddtjqu.dll

C:\WINDOWS\SYSTEM32\oxftpfsp.ini

C:\WINDOWS\system32\plhxjpiw.dll

C:\WINDOWS\system32\pppatc~1

C:\WINDOWS\system32\printer.exe

C:\WINDOWS\system32\psfptfxo.dll

C:\WINDOWS\system32\ptanroir.dll

C:\WINDOWS\SYSTEM32\pumvlwgv.ini

C:\WINDOWS\system32\qgyapuuf.dll

C:\WINDOWS\system32\qlunwxyv.dll

C:\WINDOWS\system32\qmqvsyfu.dll

C:\WINDOWS\system32\quyetwot.dll

C:\WINDOWS\system32\qvaokono.dll

C:\WINDOWS\SYSTEM32\qvupbskb.ini

C:\WINDOWS\system32\qwerty12.exe

C:\WINDOWS\SYSTEM32\rbontiqt.ini

C:\WINDOWS\SYSTEM32\rdssinbh.ini

C:\WINDOWS\SYSTEM32\riornatp.ini

C:\WINDOWS\system32\rivfervf.dll

C:\WINDOWS\system32\rkadidvc.dll

C:\WINDOWS\system32\rkcdffbc.dll

C:\WINDOWS\SYSTEM32\rmgsyime.ini

C:\WINDOWS\system32\rrkwwdhl.dll

C:\WINDOWS\system32\rrmjhqkx.dll

C:\WINDOWS\system32\rsqxlbud.dll

C:\WINDOWS\SYSTEM32\rugjgmum.ini

C:\WINDOWS\SYSTEM32\rvkyssus.ini

C:\WINDOWS\system32\rwotvqit.dll

C:\WINDOWS\system32\sanxdssk.dll

C:\WINDOWS\SYSTEM32\sawuneci.ini

C:\WINDOWS\SYSTEM32\siowrgnt.ini

C:\WINDOWS\SYSTEM32\soavllun.ini

C:\WINDOWS\system32\spoolvs.exe

C:\WINDOWS\SYSTEM32\sqljkpmh.ini

C:\WINDOWS\system32\srixyswt.dll

C:\WINDOWS\system32\srwavldu.dll

C:\WINDOWS\system32\stem32~1

C:\WINDOWS\system32\stera.exe

C:\WINDOWS\system32\stera.log

C:\WINDOWS\system32\sthrbwvd.dll

C:\WINDOWS\system32\sussykvr.dll

C:\WINDOWS\system32\sxynwdok.dll

C:\WINDOWS\SYSTEM32\tbkfreuu.ini

C:\WINDOWS\system32\tdjcwtga.dll

C:\WINDOWS\system32\teogaaad.dll

C:\WINDOWS\system32\tmps9

C:\WINDOWS\system32\tngrwois.dll

C:\WINDOWS\SYSTEM32\towteyuq.ini

C:\WINDOWS\SYSTEM32\tpccfaoo.ini

C:\WINDOWS\SYSTEM32\tqbkqttw.ini

C:\WINDOWS\system32\tqitnobr.dll

C:\WINDOWS\system32\trcjmnkg.dll

C:\WINDOWS\system32\tsqpdesf.dll

C:\WINDOWS\system32\tsuninst.exe

C:\WINDOWS\SYSTEM32\tvcehdga.ini

C:\WINDOWS\SYSTEM32\twsyxirs.ini

C:\WINDOWS\SYSTEM32\ubhwcwrg.ini

C:\WINDOWS\SYSTEM32\udlvawrs.ini

C:\WINDOWS\SYSTEM32\uffbumso.ini

C:\WINDOWS\SYSTEM32\ufysvqmq.ini

C:\WINDOWS\SYSTEM32\uikuouta.ini

C:\WINDOWS\system32\unsvchosts.lzma

C:\WINDOWS\SYSTEM32\uqjtddvo.ini

C:\WINDOWS\SYSTEM32\usugewrx.ini

C:\WINDOWS\system32\uuerfkbt.dll

C:\WINDOWS\SYSTEM32\uwaeywbb.ini

C:\WINDOWS\SYSTEM32\uylwmfyn.ini

C:\WINDOWS\system32\V1

C:\WINDOWS\system32\vcyvkxxl.dll

C:\WINDOWS\SYSTEM32\vdtudpwg.ini

C:\WINDOWS\SYSTEM32\vfwbdniw.ini

C:\WINDOWS\system32\vgwlvmup.dll

C:\WINDOWS\SYSTEM32\vmkxjupg.ini

C:\WINDOWS\SYSTEM32\vrqufbfi.ini

C:\WINDOWS\system32\vvxeidob.dll

C:\WINDOWS\SYSTEM32\vyxwnulq.ini

C:\WINDOWS\system32\wapicc.exe

C:\WINDOWS\system32\wapisvcc.exe

C:\WINDOWS\system32\wgthujda.dll

C:\WINDOWS\SYSTEM32\whjwabyk.ini

C:\WINDOWS\SYSTEM32\whjwabyk.ini2

C:\WINDOWS\SYSTEM32\whjwabyk.tmp

C:\WINDOWS\system32\win

C:\WINDOWS\system32\windbwfv.dll

C:\WINDOWS\system32\winnb58.dll

C:\WINDOWS\system32\winpfz32.sys

C:\WINDOWS\SYSTEM32\wipjxhlp.ini

C:\WINDOWS\system32\wixkibqo.dll

C:\WINDOWS\SYSTEM32\wjimuhvk.ini

C:\WINDOWS\SYSTEM32\wjimuhvk.ini2

C:\WINDOWS\SYSTEM32\wkgxmaye.ini

C:\WINDOWS\system32\wneotfrg.dll

C:\WINDOWS\system32\wnsxs~1

C:\WINDOWS\SYSTEM32\wnvkxvoo.ini

C:\WINDOWS\SYSTEM32\woelctcb.ini

C:\WINDOWS\system32\wowfx.dll

C:\WINDOWS\SYSTEM32\wpmixxcg.ini

C:\WINDOWS\SYSTEM32\wrkydlcd.ini

C:\WINDOWS\system32\wttqkbqt.dll

C:\WINDOWS\system32\xkpkplig.dll

C:\WINDOWS\SYSTEM32\xkqhjmrr.ini

C:\WINDOWS\system32\xrwegusu.dll

C:\WINDOWS\SYSTEM32\xttbstyi.ini

C:\WINDOWS\system32\yjbxeihc.dll

C:\WINDOWS\system32\yjspgebc.dll

C:\WINDOWS\SYSTEM32\ystnyskb.ini

C:\WINDOWS\system32\yvfwgnii.dll

C:\WINDOWS\TTC-4444.exe

C:\WINDOWS\uninstall_nmon.vbs

C:\WINDOWS\wbun.exe

C:\WINDOWS\wr.txt

C:\WINDOWS\ymbols~1

----- BITS: Possible infected sites -----

hxxp://80.93.48.74

hxxp://eservicesupport.us.dell.com

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_CMDSERVICE

-------\Legacy_DOMAINSERVICE

-------\Legacy_FCI

-------\Legacy_NETWORK_MONITOR

-------\Legacy_NET_AGENT

-------\Legacy_PROTECT

-------\Legacy_SYSLIBRARY

-------\Legacy_WINDOWS_OVERLAY_COMPONENTS

-------\Service_cmdService

-------\Service_DomainService

-------\Service_FCI

-------\Service_Net Agent

-------\Service_Network Monitor

-------\Service_protect

-------\Service_SysLibrary

((((((((((((((((((((((((( Files Created from 2008-03-04 to 2008-04-04 )))))))))))))))))))))))))))))))

.

2008-03-18 15:39 . 2004-07-29 06:26 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Symantec

2008-03-18 15:39 . 2004-07-29 06:22 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Sonic

2008-03-18 15:39 . 2004-07-29 06:26 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Jasc Software Inc

2008-03-18 15:39 . 2005-06-11 21:22 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Gtek

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-04-03 23:57 17,408 ----a-w C:\WINDOWS\system32\drivers\uwgrlumj.sys

2007-12-12 22:29 6,876 ----a-w C:\Documents and Settings\Alma Rodriguez\Application Data\wklnhst.dat

2007-10-28 01:36 216 ----a-w C:\Documents and Settings\Abraham Rodriguez\Application Data\wklnhst.dat

2007-10-22 15:58 5,736 ----a-w C:\Documents and Settings\Yvette Rodriguez\Application Data\wklnhst.dat

2007-04-04 18:03 0 ----a-w C:\Documents and Settings\juan\Application Data\wklnhst.dat

2004-11-15 22:15 8 --sh--r C:\WINDOWS\SYSTEM32\EF827FEDBF.sys

2004-11-24 17:54 3,350 --sha-w C:\WINDOWS\SYSTEM32\KGyGaAvL.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{312EA1F8-4415-6A94-42E7-4791FFA2889A}]

C:\WINDOWS\System32\youz.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{543981F6-F80A-4D61-358B-517D2F223B82}]

C:\Program Files\NetMeeting\lacumy.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{69C92709-0FC5-4757-A5FA-1ACB7C4EB957}]

2002-08-29 04:00 106752 --a------ C:\WINDOWS\System32\DPWSOC.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B1FDDB3C-6DDB-4A5A-D22E-3BE677F75EC4}]

2007-11-01 07:44 60928 --a------ C:\WINDOWS\System32\vqt.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B2FCDD3C-68DF-4E0C-8F2E-3BE677F65C98}]

2007-11-01 07:44 60928 --a------ C:\WINDOWS\System32\jst.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D8CA75C4-C17E-BAF2-2904-C9891E2D64C8}]

C:\WINDOWS\System32\cefzad.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}"= "C:\WINDOWS\System32\WinNB58.dll" [ ]

[HKEY_CLASSES_ROOT\clsid\{9a9c9b68-f908-4aab-8d0c-10ea8997f37e}]

[HKEY_CLASSES_ROOT\TypeLib\{566DEDE9-9ED8-45DA-9BE6-9B2EEAB17F49}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]

"{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}"= C:\WINDOWS\System32\WinNB58.dll [ ]

[HKEY_CLASSES_ROOT\clsid\{9a9c9b68-f908-4aab-8d0c-10ea8997f37e}]

[HKEY_CLASSES_ROOT\TypeLib\{566DEDE9-9ED8-45DA-9BE6-9B2EEAB17F49}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DellSupport"="C:\Program Files\Dell Support\DSAgnt.exe" [2004-07-19 07:51 306688]

"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2006-07-29 18:34 5354792]

"Vwec"="C:\Program Files\?racle\c?rss.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2004-02-10 10:55 155648]

"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2004-02-10 10:51 118784]

"IntelMeM"="C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 19:12 221184]

"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 19:15 290816]

"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2003-11-10 12:30 70816]

"URLLSTCK.exe"="C:\Program Files\Norton Internet Security\UrlLstCk.exe" [2003-12-11 18:35 70800]

"MMTray"="C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe" [2004-04-19 13:45 131072]

"Dell AIO Printer A920"="C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe" [2003-06-02 12:25 270336]

"hoxyjuzu"="C:\Program Files\Internet Explorer\hoxyjuzu77798.exe" [2007-08-07 14:30 163840]

"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 18:58 282624]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2002-08-20 14:08 1511453]

C:\Documents and Settings\Rosa Rodriguez\Start Menu\Programs\Startup\

LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2007-01-29 15:33:41 122880]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\

America Online 9.0 Tray Icon.lnk - C:\Program Files\America Online 9.0\aoltray.exe [2004-07-29 06:17:34 36953]

Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 00:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebcd]

C:\WINDOWS\System32\gebcd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wvuursr]

wvuursr.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ntoskrnl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"AntivirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\winav.exe"=

"C:\\WINDOWS\\System32\\svchost.exe"=

R0 SSI;SSI;C:\WINDOWS\System32\Drivers\SSI.SYS [2006-01-25 10:54]

R0 vhgxqhav;vhgxqhav;C:\WINDOWS\System32\drivers\uwgrlumj.sys []

R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 15:38]

*Newly Created Service* - ALG

*Newly Created Service* - IPNAT

.

Contents of the 'Scheduled Tasks' folder

"2007-05-23 13:32:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"

- C:\Program Files\Apple Software Update\SoftwareUpdate.exe

"2007-11-24 20:32:11 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer - Yvette Rodriguez.job"

- C:\PROGRA~1\NORTON~1\NORTON~1\NAVW32.EXEh/task:

"2008-04-04 00:02:12 C:\WINDOWS\Tasks\Symantec NetDetect.job"

- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE

.

**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-04-03 18:02:43

Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

------------------------ Other Running Processes ------------------------

.

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\LEXPPS.EXE

C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe

C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

C:\WINDOWS\wanmpsvc.exe

C:\WINDOWS\System32\rundll32.exe

C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

.

**************************************************************************

.

Completion time: 2008-04-03 18:06:36 - machine was rebooted

ComboFix-quarantined-files.txt 2008-04-04 00:06:31

Pre-Run: 36,200,071,168 bytes free

Post-Run: 38,134,644,736 bytes free

Hijack this after combo fix

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 6:08:20 PM, on 4/3/2008

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe

C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\WINDOWS\wanmpsvc.exe

C:\WINDOWS\System32\hkcmd.exe

C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe

C:\Program Files\Dell\Media Experience\PCMService.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Internet Explorer\iexplore.exe

F:\Juans PC\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.youbettersearch.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/...rch/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway

O2 - BHO: (no name) - {312EA1F8-4415-6A94-42E7-4791FFA2889A} - C:\WINDOWS\System32\youz.dll (file missing)

O2 - BHO: 0 - {543981F6-F80A-4D61-358B-517D2F223B82} - C:\Program Files\NetMeeting\lacumy.dll (file missing)

O2 - BHO: (no name) - {69C92709-0FC5-4757-A5FA-1ACB7C4EB957} - C:\WINDOWS\System32\DPWSOC.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: (no name) - {B1FDDB3C-6DDB-4A5A-D22E-3BE677F75EC4} - C:\WINDOWS\System32\vqt.dll

O2 - BHO: (no name) - {B2FCDD3C-68DF-4E0C-8F2E-3BE677F65C98} - C:\WINDOWS\System32\jst.dll

O2 - BHO: (no name) - {D8CA75C4-C17E-BAF2-2904-C9891E2D64C8} - C:\WINDOWS\System32\cefzad.dll (file missing)

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll (file missing)

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll (file missing)

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)

O3 - Toolbar: Mirar - {9A9C9B68-F908-4AAB-8D0C-10EA8997F37E} - C:\WINDOWS\System32\WinNB58.dll (file missing)