Friends PC

ShadowFeonix · August 7, 2008

So my buddy moved in with me and i was playing games on his computer (this one) and all these pop-ups came up I ran spybot and 2 files will not go away i am attaching the specified logs, any help would be greatly appreciated

Malwarebytes' Anti-Malware 1.24

Database version: 1031

Windows 5.1.2600 Service Pack 2

5:46:19 PM 8/7/2008

mbam-log-8-7-2008 (17-46-14).txt

Scan type: Quick Scan

Objects scanned: 52991

Time elapsed: 12 minute(s), 16 second(s)

Memory Processes Infected: 2

Memory Modules Infected: 0

Registry Keys Infected: 26

Registry Values Infected: 5

Registry Data Items Infected: 0

Folders Infected: 27

Files Infected: 88

Memory Processes Infected:

C:\Program Files\GetModule\GetModule20.exe (Trojan.Agent) -> No action taken.

C:\Program Files\GetPack\GetPack20.exe (Trojan.Agent) -> No action taken.

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CLASSES_ROOT\Interface\{71493218-e553-4fa8-85e2-e6d18fa75509} (Rogue.SpyMaxx) -> No action taken.

HKEY_CLASSES_ROOT\Typelib\{f4f41439-82fc-4681-acb0-7d3798f685c0} (Rogue.SpyMaxx) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{1e33f406-ab8f-4153-a5c8-089aeff5cc87} (Rogue.SpyMaxx) -> No action taken.

HKEY_CLASSES_ROOT\mdreg.clsreg (Rogue.SpyMaxx) -> No action taken.

HKEY_CLASSES_ROOT\bndaero6.band (Adware.SearchAid) -> No action taken.

HKEY_CLASSES_ROOT\TypeLib\{ddbc293e-52e4-45e8-a684-2c3c96efc069} (Adware.SearchAid) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{15f56b17-a0f8-4288-a24c-0f913b34d67b} (Adware.SearchAid) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{15f56b17-a0f8-4288-a24c-0f913b34d67b} (Adware.SearchAid) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{82e5e2ff-9260-4d88-b0c6-7cc358c5d418} (Adware.SearchAid) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{82e5e2ff-9260-4d88-b0c6-7cc358c5d418} (Adware.SearchAid) -> No action taken.

HKEY_CLASSES_ROOT\bndaero6.band.1 (Adware.SearchAid) -> No action taken.

HKEY_CLASSES_ROOT\bndaero6.bho (Adware.SearchAid) -> No action taken.

HKEY_CLASSES_ROOT\bndaero6.bho.1 (Adware.SearchAid) -> No action taken.

HKEY_CLASSES_ROOT\AppID\{5c9da244-a571-4fe7-ab8c-ca47703c686b} (Adware.ISM) -> No action taken.

HKEY_CLASSES_ROOT\TypeLib\{4ebd21a2-8ce0-47dd-8eb6-c902333d582c} (Rogue.SpyAway) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{4698d99d-ca8f-438a-ac82-96495a2de714} (Rogue.SpyAway) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{548e1154-fa99-4b77-9fc5-02c9d8c9d24d} (Rogue.SpyAway) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ism (Adware.ISM) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\icheck (Trojan.Agent) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\GetModule (Adware.Agent) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\GetPack (Adware.Agent) -> No action taken.

HKEY_CLASSES_ROOT\AppID\BndAero6.DLL (Adware.ISM) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\QdrPack (Adware.ISM) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\QdrModule (Adware.ISM) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\QdrDrive (Adware.ISM) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\spyaway (Rogue.SpyAway) -> No action taken.

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\getmodule20 (Trojan.Agent) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\getpack20 (Trojan.Agent) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{d49e9d35-254c-4c6a-9d17-95018d228ff5} (Adware.Starware) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spyaway (Rogue.SpyAway) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\searchassistant (Adware.Starware) -> No action taken.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

C:\Program Files\SpyAway (Rogue.SpyAway) -> No action taken.

C:\Documents and Settings\All Users\Start Menu\Programs\SpyAway (Rogue.SpyAway) -> No action taken.

C:\Program Files\Starware (Adware.Starware) -> No action taken.

C:\Program Files\Starware\bin (Adware.Starware) -> No action taken.

C:\Program Files\Starware\icons (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\buttons (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\contexts (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\images (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\SimpleUpdate (Adware.Starware) -> No action taken.

C:\Program Files\3721 (Fake.Dropped.Malware) -> No action taken.

C:\Program Files\3721\assist (Fake.Dropped.Malware) -> No action taken.

C:\Program Files\QdrDrive (Adware.AdBand) -> No action taken.

C:\Program Files\ISM (Adware.ISM) -> No action taken.

C:\Program Files\QdrModule (Adware.ISM) -> No action taken.

C:\Program Files\QdrPack (Adware.ISM) -> No action taken.

C:\Program Files\GetPack (Trojan.Agent) -> No action taken.

C:\Program Files\iCheck (Trojan.Agent) -> No action taken.

C:\Program Files\GetModule (Trojan.Agent) -> No action taken.

C:\Documents and Settings\GS\Start Menu\Programs\Internet Speed Monitor (Adware.AdSponsor) -> No action taken.

C:\Documents and Settings\GS\Application Data\Starware (Adware.Starware) -> No action taken.

C:\Documents and Settings\GS\Application Data\Starware\Games (Adware.Starware) -> No action taken.

C:\Documents and Settings\GS\Application Data\Starware\Movies (Adware.Starware) -> No action taken.

C:\Documents and Settings\GS\Application Data\Starware\Screensavers (Adware.Starware) -> No action taken.

C:\Documents and Settings\GS\Application Data\Starware\ScreensaversMarketingSitePager (Adware.Starware) -> No action taken.

C:\Documents and Settings\GS\Application Data\Starware\SearchMatch (Adware.Starware) -> No action taken.

C:\Documents and Settings\GS\Application Data\Starware\SearchMatch\searchMatchPages (Adware.Starware) -> No action taken.

Files Infected:

C:\Program Files\GetModule\GetModule20.exe (Trojan.Agent) -> No action taken.

C:\Program Files\GetPack\GetPack20.exe (Trojan.Agent) -> No action taken.

C:\Program Files\SpyAway\clsReg.dll (Rogue.SpyMaxx) -> No action taken.

C:\Program Files\QdrDrive\QdrDrive11.dll (Adware.SearchAid) -> No action taken.

C:\Documents and Settings\GS\Local Settings\Temporary Internet Files\Content.IE5\3JV1GD1K\gettpa120[1].exe (Trojan.Downloader) -> No action taken.

C:\Program Files\SpyAway\config.dat (Rogue.SpyAway) -> No action taken.

C:\Program Files\SpyAway\filesbase.bin (Rogue.SpyAway) -> No action taken.

C:\Program Files\SpyAway\global_virus_table.bin (Rogue.SpyAway) -> No action taken.

C:\Program Files\SpyAway\hosts.dat (Rogue.SpyAway) -> No action taken.

C:\Program Files\SpyAway\ignoredomainsbase.bin (Rogue.SpyAway) -> No action taken.

C:\Program Files\SpyAway\ignorefilesbase.bin (Rogue.SpyAway) -> No action taken.

C:\Program Files\SpyAway\ignoreregsbase.bin (Rogue.SpyAway) -> No action taken.

C:\Program Files\SpyAway\regbase.bin (Rogue.SpyAway) -> No action taken.

C:\Program Files\SpyAway\sa_ie_monitor.dll (Rogue.SpyAway) -> No action taken.

C:\Program Files\SpyAway\spy.dat (Rogue.SpyAway) -> No action taken.

C:\Program Files\SpyAway\SpyAway.exe (Rogue.SpyAway) -> No action taken.

C:\Program Files\SpyAway\stat.bin (Rogue.SpyAway) -> No action taken.

C:\Program Files\SpyAway\uninstall.exe (Rogue.SpyAway) -> No action taken.

C:\Program Files\SpyAway\uninstall.log (Rogue.SpyAway) -> No action taken.

C:\Program Files\SpyAway\urlbase.bin (Rogue.SpyAway) -> No action taken.

C:\Documents and Settings\All Users\Start Menu\Programs\SpyAway\SpyAway.lnk (Rogue.SpyAway) -> No action taken.

C:\Documents and Settings\All Users\Start Menu\Programs\SpyAway\Uninstall SpyAway.lnk (Rogue.SpyAway) -> No action taken.

C:\Program Files\Starware\bin\Starware.dll (Adware.Starware) -> No action taken.

C:\Program Files\Starware\icons\star_16.ico (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\cursorcafe.bmp (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\cursorcafeA.bmp (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\FindIt.bmp (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\FindItHot.bmp (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\findithotxp.png (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\finditxp.png (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\games.bmp (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\gamesA.bmp (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\Highlight.bmp (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\HighlightHot.bmp (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\highlighthotxp.png (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\highlightxp.png (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\logo.bmp (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\logoxp.bmp (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\moviesA.bmp (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\Reference.bmp (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\ReferenceHot.bmp (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\referencehotxp.png (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\referencexp.png (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\screensaver.bmp (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\screensaverA.bmp (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\Weather.bmp (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\weatherhotxp.png (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\weatherxp.png (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\contexts\error.xml (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\contexts\Related.xml (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\contexts\Travel.xml (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\images\walertXP.bmp (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\SimpleUpdate\ProductMessagingConfig.xml (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\SimpleUpdate\ProductMessagingConfig.xml.backup (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\SimpleUpdate\SimpleUpdateConfig.xml (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\SimpleUpdate\SimpleUpdateConfig.xml.backup (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\SimpleUpdate\TimerManagerConfig.xml (Adware.Starware) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Starware\SimpleUpdate\TimerManagerConfig.xml.backup (Adware.Starware) -> No action taken.

C:\Program Files\3721\assist\asbar.dll (Fake.Dropped.Malware) -> No action taken.

C:\Program Files\QdrDrive\qdrloader.exe (Adware.AdBand) -> No action taken.

C:\Program Files\ISM\ism.exe (Adware.ISM) -> No action taken.

C:\Program Files\ISM\Uninstall.exe (Adware.ISM) -> No action taken.

C:\Program Files\QdrModule\dicy.gz (Adware.ISM) -> No action taken.

C:\Program Files\QdrModule\kwdy.gz (Adware.ISM) -> No action taken.

C:\Program Files\QdrModule\pckr.dat (Adware.ISM) -> No action taken.

C:\Program Files\QdrModule\softyadsupdate.exe (Adware.ISM) -> No action taken.

C:\Program Files\QdrPack\dicts.gz (Adware.ISM) -> No action taken.

C:\Program Files\QdrPack\dsmupd.exe (Adware.ISM) -> No action taken.

C:\Program Files\QdrPack\trgts.gz (Adware.ISM) -> No action taken.

C:\Program Files\GetPack\dictame.gz (Trojan.Agent) -> No action taken.

C:\Program Files\GetPack\trgtame.gz (Trojan.Agent) -> No action taken.

C:\Program Files\iCheck\Uninstall.exe (Trojan.Agent) -> No action taken.

C:\Program Files\GetModule\dicik.gz (Trojan.Agent) -> No action taken.

C:\Program Files\GetModule\kwdik.gz (Trojan.Agent) -> No action taken.

C:\Documents and Settings\GS\Start Menu\Programs\Internet Speed Monitor\Check Now.lnk (Adware.AdSponsor) -> No action taken.

C:\Documents and Settings\GS\Start Menu\Programs\Internet Speed Monitor\Uninstall.lnk (Adware.AdSponsor) -> No action taken.

C:\Documents and Settings\GS\Application Data\Starware\Games\GamesOptions.xml (Adware.Starware) -> No action taken.

C:\Documents and Settings\GS\Application Data\Starware\Games\GamesOptions.xml.backup (Adware.Starware) -> No action taken.

C:\Documents and Settings\GS\Application Data\Starware\Movies\MoviesOptions.xml (Adware.Starware) -> No action taken.

C:\Documents and Settings\GS\Application Data\Starware\Movies\MoviesOptions.xml.backup (Adware.Starware) -> No action taken.

C:\Documents and Settings\GS\Application Data\Starware\Screensavers\ScreensaversOptions.xml (Adware.Starware) -> No action taken.

C:\Documents and Settings\GS\Application Data\Starware\Screensavers\ScreensaversOptions.xml.backup (Adware.Starware) -> No action taken.

C:\Documents and Settings\GS\Application Data\Starware\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml (Adware.Starware) -> No action taken.

C:\Documents and Settings\GS\Application Data\Starware\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup (Adware.Starware) -> No action taken.

C:\WINDOWS\system32\winfrun32.bin (Malware.Trace) -> No action taken.

C:\WINDOWS\system32\ESHOPEE.exe (Fake.Dropped.Malware) -> No action taken.

C:\WINDOWS\aconti.exe (Fake.Dropped.Malware) -> No action taken.

C:\WINDOWS\hotporn.exe (Fake.Dropped.Malware) -> No action taken.

;*******************************************************************************

********************************************************************************

*

*******************

ANALYSIS: 2008-08-07 19:57:25

PROTECTIONS: 1

MALWARE: 70

SUSPECTS: 1

;*******************************************************************************

********************************************************************************

*

*******************

PROTECTIONS

Description Version Active Updated

;===============================================================================

================================================================================

=

===================

Zone Alarm Security Suite 7.0.408.000 No No

;===============================================================================

================================================================================

=

===================

MALWARE

Id Description Type Active Severity Disinfectable Disinfected Location

;===============================================================================

================================================================================

=

===================

00020994 W32/Bagle.pwdzip Virus No 0 Yes No C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudCgp15.zip

00020994 W32/Bagle.pwdzip Virus No 0 Yes No C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudCgp7.zip

00020994 W32/Bagle.pwdzip Virus No 0 Yes No C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC2.zip

00020994 W32/Bagle.pwdzip Virus No 0 Yes No C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AdBreak7.zip

00020994 W32/Bagle.pwdzip Virus No 0 Yes No C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AdBreak4.zip

00020994 W32/Bagle.pwdzip Virus No 0 Yes No C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AdBreak11.zip

00020994 W32/Bagle.pwdzip Virus No 0 Yes No C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC4.zip

00020994 W32/Bagle.pwdzip Virus No 0 Yes No C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudCgp18.zip

00020994 W32/Bagle.pwdzip Virus No 0 Yes No C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudCgp22.zip

00020994 W32/Bagle.pwdzip Virus No 0 Yes No C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC3.zip

00035722 adware/comet Adware No 0 Yes No HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{7BED0340-176B-44bc-915E-C21C1DD6F617}

00035722 adware/comet Adware No 0 Yes No HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant

00035722 adware/comet Adware No 0 Yes No HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{D49E9D35-254C-4c6a-9D17-95018D228FF5}

00035722 adware/comet Adware No 0 Yes No c:\program files\starware

00035722 adware/comet Adware No 0 Yes No HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{2D51D869-C36B-42bd-AE68-0A81BC771FA5}

00035722 adware/comet Adware No 0 Yes No c:\documents and settings\gs\application data\starware

00035722 adware/comet Adware No 0 Yes No c:\documents and settings\all users\application data\starware

00040319 adware/activesearch Adware No 0 Yes No HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{12F02779-6D88-4958-8AD3-83C12D86ADC7}

00040376 adware/adblaster Adware No 0 Yes No HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71}

00040376 adware/adblaster Adware No 0 Yes No HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{e9147a0a-a866-4214-b47c-da821891240f}

00047327 adware/adsincontext Adware No 0 Yes No HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{029E02F0-A0E5-4B19-B958-7BF2DB29FB13}

00048242 adware/404search Adware No 0 Yes No HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{53C330D6-A4AB-419B-B45D-FD4411C1FEF4}

00120993 adware/deskwizz Adware No 0 Yes No HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C5AF2622-8C75-4dfb-9693-23AB7686A456}

00122030 adware/fastvideoplayer Adware No 0 Yes No HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B5DD9A64-5C4B-4A48-BE56-97C1A8F85708}

00132710 dialer.xd Dialers No 0 Yes No HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{54645654-2225-4455-44A1-9F4543D34546}

00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@trafficmp[2].txt

00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Local Settings\Temp\Cookies\gs@casalemedia[1].txt

00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Local Settings\Temp\Cookies\gs@doubleclick[1].txt

00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@atdmt[2].txt

00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Local Settings\Temp\Cookies\gs@atdmt[2].txt

00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@247realmedia[1].txt

00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Local Settings\Temp\Cookies\gs@fastclick[1].txt

00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Local Settings\Temp\Cookies\gs@tribalfusion[2].txt

00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@tribalfusion[2].txt

00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Local Settings\Temp\Cookies\gs@mediaplex[1].txt

00147796 Cookie/Entrepreneur TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@entrepreneur[1].txt

00149064 Cookie/Maxserving TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@maxserving[2].txt

00152401 Cookie/Belnk TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@belnk[1].txt

00159564 Cookie/WUpd TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@revenue[1].txt

00162730 Cookie/Belnk TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@dist.belnk[2].txt

00167430 Cookie/myaffiliateprogram TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@www.myaffiliateprogram[1].txt

00167670 Cookie/Seeq TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@seeq[1].txt

00167677 Cookie/WebPower TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@webpower[2].txt

00167747 Cookie/Azjmp TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@azjmp[2].txt

00168048 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@perf.overture[1].txt

00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Local Settings\Temp\Cookies\gs@ad.yieldmanager[2].txt

00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Local Settings\Temp\Cookies\gs@serving-sys[2].txt

00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@serving-sys[1].txt

00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@bs.serving-sys[1].txt

00168097 Cookie/BurstBeacon TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@www.burstbeacon[2].txt

00168097 Cookie/BurstBeacon TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Local Settings\Temp\Cookies\gs@www.burstbeacon[1].txt

00168102 Cookie/Falkag TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@as1.falkag[2].txt

00168109 Cookie/Adtech TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@adtech[1].txt

00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@server.iad.liveperson[2].txt

00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Local Settings\Temp\Cookies\gs@advertising[1].txt

00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@advertising[1].txt

00169287 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Local Settings\Temp\Cookies\gs@adrevolver[1].txt

00170304 Cookie/WebtrendsLive TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Local Settings\Temp\Cookies\gs@statse.webtrendslive[2].txt

00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@ads.pointroll[2].txt

00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@overture[1].txt

00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@realmedia[2].txt

00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Local Settings\Temp\Cookies\gs@realmedia[1].txt

00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@questionmarket[1].txt

00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Local Settings\Temp\Cookies\gs@questionmarket[2].txt

00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Local Settings\Temp\Cookies\gs@zedo[2].txt

00173520 Cookie/Bluestreak TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Local Settings\Temp\Cookies\gs@bluestreak[1].txt

00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Local Settings\Temp\Cookies\gs@adrevolver[2].txt

00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@adultfriendfinder[1].txt

00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@go[1].txt

00196960 Cookie/Belnk TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@ath.belnk[2].txt

00199981 Cookie/Seeq TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@www48.seeq[1].txt

00199984 Cookie/Searchportal TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@searchportal.information[2].txt

00206648 adware/activshopper Adware No 0 Yes No HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1ADBCCE8-CF84-441E-9B38-AFC7A19C06A4}

00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@target[2].txt

00207712 Cookie/360i TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@ct.360i[2].txt

00207862 Cookie/did-it TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@did-it[2].txt

00218901 adware/adbars Adware No 0 Yes No HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{51641EF3-8A7A-4D84-8659-B0911E947CC8}

00221182 adware/eshopper Adware No 0 Yes No c:\windows\system32\eshopee.exe

00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@atwola[1].txt

00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Local Settings\Temp\Cookies\gs@atwola[1].txt

00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@smartadserver[2].txt

00277997 Adware/Comet Adware No 0 Yes No C:\Program Files\Starware\bin\Starware.dll

00286734 Cookie/Adserver TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@adserver.filefront[1].txt

00286736 Cookie/Cgi-bin TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@www6.addfreestats[1].txt

00293517 Cookie/AdDynamix TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@ads.addynamix[2].txt

00325830 Cookie/Bridgetrack TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@citi.bridgetrack[1].txt

00520936 Application/ViewPoint HackTools No 0 Yes No C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll

01196325 Cookie/Enhance TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@enhance[2].txt

02903429 Adware/Adband Adware No 0 Yes No C:\Program Files\ISM\ism.exe

02908816 Cookie/Starware TrackingCookie No 0 Yes No C:\Documents and Settings\GS\Cookies\gs@h.starware[1].txt

02912158 Trj/Clicker.AJZ Virus/Trojan Yes 2 Yes No C:\Program Files\RcvSystem\httpdchk.dll

02931619 Application/SpyMaxx HackTools No 0 Yes No C:\Program Files\SpyAway\clsReg.dll

03281395 Generic Malware Virus/Trojan No 0 Yes No C:\Documents and Settings\GS\Desktop\Unused Desktop Shortcuts\spyaway_setup.exe

03281395 Generic Malware Virus/Trojan No 0 Yes No C:\Program Files\SpyAway\uninstall.exe

03398240 Adware/AntiSpywareMaster Adware No 0 Yes No C:\Documents and Settings\GS\Local Settings\Temporary Internet Files\Content.IE5\G723CE71\data[1].htm

;===============================================================================

================================================================================

=

===================

SUSPECTS

Sent Location C

;===============================================================================

================================================================================

=

===================

No C:\Program Files\QdrDrive\qdrloader.exe C

;===============================================================================

================================================================================

=

===================

VULNERABILITIES

Id Severity Description C

;===============================================================================

================================================================================

=

===================

;===============================================================================

================================================================================

=

===================

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 5:19:28 PM, on 8/7/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

C:\Program Files\Nero\Nero 7\InCD\InCD.exe

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\Program Files\QuickTime\qttask.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\PROGRA~1\ENLTV\ENLTV\TVTray.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\MySpace\IM\MySpaceIM.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\AIM6\aim6.exe

C:\Program Files\GetModule\GetModule20.exe

C:\Program Files\GetPack\GetPack20.exe

C:\Program Files\Common Files\AOL\1136712267\ee\AOLHostManager.exe

C:\Program Files\Common Files\AOL\1136712267\ee\AOLServiceHost.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\Program Files\AIM6\aolsoftware.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\ENLTV\ENLTV\RemoteService\RS.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

C:\Documents and Settings\GS\Application Data\U3\0000060501007077\LaunchPad.exe

C:\Documents and Settings\GS\Application Data\U3\0000060501007077\285E6953-BF3C-4445-9376-3FE5D7F645B2\Exec\bin\SignupShield.exe

C:\Documents and Settings\GS\Application Data\U3\0000060501007077\1F30627F-0195-44d4-8C24-1999F3C02C50\Exec\AvastU3.exe

C:\Documents and Settings\GS\Application Data\U3\0000060501007077\1F30627F-0195-44d4-8C24-1999F3C02C50\Exec\ScanU3.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/dp/search?x=wKX1ILE...vIynOqimuav9g==

R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll

R3 - URLSearchHook: (no name) - - (no file)

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\mgmrwmrv.exe,

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx

O2 - BHO: (no name) - {36D9BC0E-A273-469B-B16C-12715F3B969C} - C:\Program Files\Online Services\wodefagerC:\DOCUME~1\GS\LOCALS~1\Temp\CEMG555077.exe.dll (file missing)

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll

O2 - BHO: BndAero6 IE Helper - {82E5E2FF-9260-4d88-B0C6-7CC358C5D418} - C:\Program Files\QdrDrive\QdrDrive11.dll

O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll

O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll

O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [inCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1136712267\ee\AOLHostManager.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [TVTray] C:\PROGRA~1\ENLTV\ENLTV\TVTray.exe

O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKLM\..\Run: [spyAway] C:\Program Files\SpyAway\SpyAway.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp

O4 - HKCU\..\Run: [GetModule20] "C:\Program Files\GetModule\GetModule20.exe"

O4 - HKCU\..\Run: [GetPack20] "C:\Program Files\GetPack\GetPack20.exe"

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')

O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe

O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1134923201123

O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flas...ent/swflash.cab

O18 - Filter hijack: text/html - {07851C6A-1C43-41d9-8319-BC89154A8C00} - C:\Program Files\RcvSystem\httpdchk.dll

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: SuperTV Pro Remote Control Service (RemoteControlService) - Unknown owner - C:\Program Files\ENLTV\ENLTV\RemoteService\RS.exe

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--

End of file - 10870 bytes

mbam_log_8_7_2008__17_46_14_.txt

hijackthis.txt

ActiveScan.txt

mbam_log_8_7_2008__17_46_14_.txt

hijackthis.txt

ActiveScan.txt

Edited August 8, 2008 by JeanInMontana
Post logs inline

JeanInMontana · August 8, 2008

You didn't remove anything with MBAM. Update MBAM, do a quick scan, be sure you take action. Copy and paste that log in to your reply and a new HJT log.

ShadowFeonix · August 9, 2008

Sorry this took so long to reply just got home from work

Here is the updated log

Malwarebytes' Anti-Malware 1.24

Database version: 1034

Windows 5.1.2600 Service Pack 2

9:58:10 PM 8/8/2008

mbam-log-8-8-2008 (21-58-10).txt

Scan type: Quick Scan

Objects scanned: 52947

Time elapsed: 15 minute(s), 41 second(s)

Memory Processes Infected: 2

Memory Modules Infected: 0

Registry Keys Infected: 26

Registry Values Infected: 5

Registry Data Items Infected: 0

Folders Infected: 27

Files Infected: 88

Memory Processes Infected:

C:\Program Files\GetModule\GetModule20.exe (Trojan.Agent) -> Unloaded process successfully.

C:\Program Files\GetPack\GetPack20.exe (Trojan.Agent) -> Unloaded process successfully.

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CLASSES_ROOT\Interface\{71493218-e553-4fa8-85e2-e6d18fa75509} (Rogue.SpyMaxx) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Typelib\{f4f41439-82fc-4681-acb0-7d3798f685c0} (Rogue.SpyMaxx) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{1e33f406-ab8f-4153-a5c8-089aeff5cc87} (Rogue.SpyMaxx) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\mdreg.clsreg (Rogue.SpyMaxx) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\bndaero6.band (Adware.SearchAid) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\TypeLib\{ddbc293e-52e4-45e8-a684-2c3c96efc069} (Adware.SearchAid) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{15f56b17-a0f8-4288-a24c-0f913b34d67b} (Adware.SearchAid) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{15f56b17-a0f8-4288-a24c-0f913b34d67b} (Adware.SearchAid) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{82e5e2ff-9260-4d88-b0c6-7cc358c5d418} (Adware.SearchAid) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{82e5e2ff-9260-4d88-b0c6-7cc358c5d418} (Adware.SearchAid) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\bndaero6.band.1 (Adware.SearchAid) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\bndaero6.bho (Adware.SearchAid) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\bndaero6.bho.1 (Adware.SearchAid) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\AppID\{5c9da244-a571-4fe7-ab8c-ca47703c686b} (Adware.ISM) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\TypeLib\{4ebd21a2-8ce0-47dd-8eb6-c902333d582c} (Rogue.SpyAway) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{4698d99d-ca8f-438a-ac82-96495a2de714} (Rogue.SpyAway) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{548e1154-fa99-4b77-9fc5-02c9d8c9d24d} (Rogue.SpyAway) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ism (Adware.ISM) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\icheck (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\GetModule (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\GetPack (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\AppID\BndAero6.DLL (Adware.ISM) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\QdrPack (Adware.ISM) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\QdrModule (Adware.ISM) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\QdrDrive (Adware.ISM) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\spyaway (Rogue.SpyAway) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\getmodule20 (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\getpack20 (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{d49e9d35-254c-4c6a-9d17-95018d228ff5} (Adware.Starware) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spyaway (Rogue.SpyAway) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\searchassistant (Adware.Starware) -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

C:\Program Files\SpyAway (Rogue.SpyAway) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Start Menu\Programs\SpyAway (Rogue.SpyAway) -> Quarantined and deleted successfully.

C:\Program Files\Starware (Adware.Starware) -> Quarantined and deleted successfully.

C:\Program Files\Starware\bin (Adware.Starware) -> Quarantined and deleted successfully.

C:\Program Files\Starware\icons (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\buttons (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\contexts (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\images (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\SimpleUpdate (Adware.Starware) -> Quarantined and deleted successfully.

C:\Program Files\3721 (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Program Files\3721\assist (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Program Files\QdrDrive (Adware.AdBand) -> Quarantined and deleted successfully.

C:\Program Files\ISM (Adware.ISM) -> Quarantined and deleted successfully.

C:\Program Files\QdrModule (Adware.ISM) -> Quarantined and deleted successfully.

C:\Program Files\QdrPack (Adware.ISM) -> Quarantined and deleted successfully.

C:\Program Files\GetPack (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Program Files\iCheck (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Program Files\GetModule (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\GS\Start Menu\Programs\Internet Speed Monitor (Adware.AdSponsor) -> Quarantined and deleted successfully.

C:\Documents and Settings\GS\Application Data\Starware (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\GS\Application Data\Starware\Games (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\GS\Application Data\Starware\Movies (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\GS\Application Data\Starware\Screensavers (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\GS\Application Data\Starware\ScreensaversMarketingSitePager (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\GS\Application Data\Starware\SearchMatch (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\GS\Application Data\Starware\SearchMatch\searchMatchPages (Adware.Starware) -> Quarantined and deleted successfully.

Files Infected:

C:\Program Files\GetModule\GetModule20.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Program Files\GetPack\GetPack20.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Program Files\SpyAway\clsReg.dll (Rogue.SpyMaxx) -> Quarantined and deleted successfully.

C:\Program Files\QdrDrive\QdrDrive11.dll (Adware.SearchAid) -> Quarantined and deleted successfully.

C:\Documents and Settings\GS\Local Settings\Temporary Internet Files\Content.IE5\3JV1GD1K\gettpa120[1].exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Program Files\SpyAway\config.dat (Rogue.SpyAway) -> Quarantined and deleted successfully.

C:\Program Files\SpyAway\filesbase.bin (Rogue.SpyAway) -> Quarantined and deleted successfully.

C:\Program Files\SpyAway\global_virus_table.bin (Rogue.SpyAway) -> Quarantined and deleted successfully.

C:\Program Files\SpyAway\hosts.dat (Rogue.SpyAway) -> Quarantined and deleted successfully.

C:\Program Files\SpyAway\ignoredomainsbase.bin (Rogue.SpyAway) -> Quarantined and deleted successfully.

C:\Program Files\SpyAway\ignorefilesbase.bin (Rogue.SpyAway) -> Quarantined and deleted successfully.

C:\Program Files\SpyAway\ignoreregsbase.bin (Rogue.SpyAway) -> Quarantined and deleted successfully.

C:\Program Files\SpyAway\regbase.bin (Rogue.SpyAway) -> Quarantined and deleted successfully.

C:\Program Files\SpyAway\sa_ie_monitor.dll (Rogue.SpyAway) -> Quarantined and deleted successfully.

C:\Program Files\SpyAway\spy.dat (Rogue.SpyAway) -> Quarantined and deleted successfully.

C:\Program Files\SpyAway\SpyAway.exe (Rogue.SpyAway) -> Quarantined and deleted successfully.

C:\Program Files\SpyAway\stat.bin (Rogue.SpyAway) -> Quarantined and deleted successfully.

C:\Program Files\SpyAway\uninstall.exe (Rogue.SpyAway) -> Quarantined and deleted successfully.

C:\Program Files\SpyAway\uninstall.log (Rogue.SpyAway) -> Quarantined and deleted successfully.

C:\Program Files\SpyAway\urlbase.bin (Rogue.SpyAway) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Start Menu\Programs\SpyAway\SpyAway.lnk (Rogue.SpyAway) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Start Menu\Programs\SpyAway\Uninstall SpyAway.lnk (Rogue.SpyAway) -> Quarantined and deleted successfully.

C:\Program Files\Starware\bin\Starware.dll (Adware.Starware) -> Quarantined and deleted successfully.

C:\Program Files\Starware\icons\star_16.ico (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\cursorcafe.bmp (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\cursorcafeA.bmp (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\FindIt.bmp (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\FindItHot.bmp (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\findithotxp.png (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\finditxp.png (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\games.bmp (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\gamesA.bmp (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\Highlight.bmp (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\HighlightHot.bmp (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\highlighthotxp.png (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\highlightxp.png (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\logo.bmp (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\logoxp.bmp (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\moviesA.bmp (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\Reference.bmp (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\ReferenceHot.bmp (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\referencehotxp.png (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\referencexp.png (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\screensaver.bmp (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\screensaverA.bmp (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\Weather.bmp (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\weatherhotxp.png (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\buttons\weatherxp.png (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\contexts\error.xml (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\contexts\Related.xml (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\contexts\Travel.xml (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\images\walertXP.bmp (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\SimpleUpdate\ProductMessagingConfig.xml (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\SimpleUpdate\ProductMessagingConfig.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\SimpleUpdate\SimpleUpdateConfig.xml (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\SimpleUpdate\SimpleUpdateConfig.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\SimpleUpdate\TimerManagerConfig.xml (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Starware\SimpleUpdate\TimerManagerConfig.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.

C:\Program Files\3721\assist\asbar.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Program Files\QdrDrive\qdrloader.exe (Adware.AdBand) -> Quarantined and deleted successfully.

C:\Program Files\ISM\ism.exe (Adware.ISM) -> Quarantined and deleted successfully.

C:\Program Files\ISM\Uninstall.exe (Adware.ISM) -> Quarantined and deleted successfully.

C:\Program Files\QdrModule\dicy.gz (Adware.ISM) -> Quarantined and deleted successfully.

C:\Program Files\QdrModule\kwdy.gz (Adware.ISM) -> Quarantined and deleted successfully.

C:\Program Files\QdrModule\pckr.dat (Adware.ISM) -> Quarantined and deleted successfully.

C:\Program Files\QdrModule\softyadsupdate.exe (Adware.ISM) -> Quarantined and deleted successfully.

C:\Program Files\QdrPack\dicts.gz (Adware.ISM) -> Quarantined and deleted successfully.

C:\Program Files\QdrPack\dsmupd.exe (Adware.ISM) -> Quarantined and deleted successfully.

C:\Program Files\QdrPack\trgts.gz (Adware.ISM) -> Quarantined and deleted successfully.

C:\Program Files\GetPack\dictame.gz (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Program Files\GetPack\trgtame.gz (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Program Files\iCheck\Uninstall.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Program Files\GetModule\dicik.gz (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Program Files\GetModule\kwdik.gz (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\GS\Start Menu\Programs\Internet Speed Monitor\Check Now.lnk (Adware.AdSponsor) -> Quarantined and deleted successfully.

C:\Documents and Settings\GS\Start Menu\Programs\Internet Speed Monitor\Uninstall.lnk (Adware.AdSponsor) -> Quarantined and deleted successfully.

C:\Documents and Settings\GS\Application Data\Starware\Games\GamesOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\GS\Application Data\Starware\Games\GamesOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\GS\Application Data\Starware\Movies\MoviesOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\GS\Application Data\Starware\Movies\MoviesOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\GS\Application Data\Starware\Screensavers\ScreensaversOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\GS\Application Data\Starware\Screensavers\ScreensaversOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\GS\Application Data\Starware\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.

C:\Documents and Settings\GS\Application Data\Starware\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\winfrun32.bin (Malware.Trace) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\ESHOPEE.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\WINDOWS\aconti.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\WINDOWS\hotporn.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

mbam_log_8_8_2008__21_58_10_.txt

Edited August 9, 2008 by JeanInMontana
DO NOT ADD LOGS AS AN ATTACHMENT!

JeanInMontana · August 9, 2008

Your not following instructions. Post logs in the reply, not as an attachment and I asked for a new HJT log after you did the removal.

ShadowFeonix · August 9, 2008

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:09:54 PM, on 8/9/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\ENLTV\ENLTV\RemoteService\RS.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

C:\Program Files\Nero\Nero 7\InCD\InCD.exe

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\Program Files\QuickTime\qttask.exe

C:\PROGRA~1\ENLTV\ENLTV\TVTray.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\MySpace\IM\MySpaceIM.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Common Files\AOL\1136712267\ee\AOLHostManager.exe

C:\Program Files\Common Files\AOL\1136712267\ee\AOLServiceHost.exe

C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

C:\Program Files\Curse\CurseClient.exe

C:\Program Files\uTorrent\uTorrent.exe

C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =