Author Topic: Virus - Trojan (Read 786 times)

zephyrbc · « **on:** March 24, 2008, 06:18:12 AM »

Hi,

I have had a trojan virus for a while now that my antivirus program (AVG) picks up but wont allow me to heal. I can quarantine the file but the virus has obviously copied itself to a new file by that stage anyway as the same problem keeps on occuring.

I have attached a hijackthis log as well as a screenshot of my virus vault to show the frequency and the different file names

Thanks,

Scott

Logfile of HijackThis v1.99.1
Scan saved at 10:23:38 PM, on 3/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows SteadyState\SCTSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Gmail Notifier\gnotify.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\taskswitch.exe
C:\WINDOWS\system32\VTTimer.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Windows SteadyState\Bubble.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Microsoft Office\Office12\EXCEL.EXE
C:\PROGRA~1\Grisoft\AVG7\avgvv.exe
C:\Documents and Settings\Scott Harris\Desktop\VundoFix.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = About:People's Republic of Thailand (PRT)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Bubble] "%ProgramFiles%\Windows SteadyState\Bubble.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [WatchWAN] C:\Program Files\WatchWAN\WatchWAN.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://supportapj.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1182259101593
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - https://shop.getdigital.com.au/components/ImageUploader4.cab
O16 - DPF: {FD163A9A-A3D8-4F7D-8224-32F81AC29EDA} (VPlayer Control) - http://video.vividas.com/media/4926_Ansell.../vivid_ocx.jpeg
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe (file missing)
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

guestolo · « **Reply #1 on:** March 24, 2008, 11:56:50 AM »

Most of the files are in your System restore folders, there safe there for now
A couple I see aren't

Can you do the following
Delete your copy of Hijackthis, it's outdated
Download Hijackthis Installer from [color=\"#FF0000\"]HERE[/color]
For an alternate download location, you can try HERE
SAVE it to your desktop
Double click on HJTInstall.exe to run it
Choose Install

Hijackthis v2.0.2 will open
Just close it out for now, we'll need it later

Download [color=\"#008000\"]Deckard's System Scanner (dss.exe)[/color] to your desktop.
Close all applications and windows.
Double-click on dss.exe to run it and follow the prompts.
When the scan is complete, two text files will open; main.txt, which will be maximized and extra.txt, which will be minimized.

Post back just the Whole contents of Main.txt and Extra.txt

zephyrbc · « **Reply #2 on:** March 24, 2008, 06:45:43 PM »

Thanks for your reply, I've done that and the results are below. Also it seems like your link to download Hijackthis is not working or was down when i tried

Deckard's System Scanner v20071014.68
Run by Scott Harris on 2008-03-25 10:57:22
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.

-- Last 5 Restore Point(s) --
30: 2008-03-24 23:57:28 UTC - RP237 - Deckard's System Scanner Restore Point
29: 2008-03-24 06:27:26 UTC - RP236 - System Checkpoint
28: 2008-03-23 06:17:29 UTC - RP235 - Software Distribution Service 3.0
27: 2008-03-19 22:49:22 UTC - RP234 - System Checkpoint
26: 2008-03-18 22:01:40 UTC - RP233 - Software Distribution Service 3.0

-- First Restore Point --
1: 2008-02-28 21:40:23 UTC - RP208 - Software Distribution Service 3.0

Backed up registry hives.
Performed disk cleanup.

-- HijackThis (run as Scott Harris.exe) ----------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:59:38 AM, on 3/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows SteadyState\SCTSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Gmail Notifier\gnotify.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\taskswitch.exe
C:\WINDOWS\system32\VTTimer.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Windows SteadyState\Bubble.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
C:\Documents and Settings\Scott Harris\Desktop\dss.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\HIJACK~1\Scott Harris.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = About:People's Republic of Thailand (PRT)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Bubble] "%ProgramFiles%\Windows SteadyState\Bubble.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [WatchWAN] C:\Program Files\WatchWAN\WatchWAN.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://supportapj.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1182259101593
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - https://shop.getdigital.com.au/components/ImageUploader4.cab
O16 - DPF: {FD163A9A-A3D8-4F7D-8224-32F81AC29EDA} (VPlayer Control) - http://video.vividas.com/media/4926_Ansell.../vivid_ocx.jpeg
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe (file missing)
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 10004 bytes

-- File Associations -----------------------------------------------------------

All associations okay.

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 BANTExt (Belarc SMBios Access) - c:\windows\system32\drivers\bantext.sys
R2 MaVctrl - c:\windows\system32\drivers\mavc2k.sys <Not Verified; Mobile Action Technology Inc.; Handset Manager>

S3 APLMp50 (APLMp50 NDIS Protocol Driver) - c:\windows\system32\drivers\aplmp50.sys (file missing)
S3 FETNDIS (VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver) - c:\windows\system32\drivers\fetnd5.sys (file missing)
S3 gdrv - c:\windows\gdrv.sys <Not Verified; Windows ® 2000 DDK provider; Windows ® 2000 DDK driver>
S3 mamotou - c:\windows\system32\drivers\mamotou.sys <Not Verified; Mobile Action Technology Inc.; Handset Manager>
S3 NPF (NetGroup Packet Filter Driver) - c:\windows\system32\drivers\npf.sys <Not Verified; NetGroup - Politecnico di Torino; WinPcap Netgroup Packet Filter Driver>

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service>

S2 Ati HotKey Poller - c:\windows\system32\ati2evxx.exe (file missing)
S2 ATI Smart - c:\windows\system32\ati2sgag.exe (file missing)
S3 rpcapd (Remote Packet Capture Protocol v.0 (experimental)) - "c:\program files\winpcap\rpcapd.exe" -d -f "c:\program files\winpcap\rpcapd.ini" <Not Verified; NetGroup - Politecnico di Torino; Remote Packet Capture Daemon>
S3 ServiceLayer - "c:\program files\pc connectivity solution\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution>

-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description:
Device ID: PCI\VEN_1106&DEV_5364&SUBSYS_00000000&REV_00\3&2411E6FE&0&05
Manufacturer:
Name:
PNP Device ID: PCI\VEN_1106&DEV_5364&SUBSYS_00000000&REV_00\3&2411E6FE&0&05
Service:

-- Scheduled Tasks -------------------------------------------------------------

2008-03-25 10:32:00 268 --a------ C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job
2008-03-25 09:48:43 330 --ah----- C:\WINDOWS\Tasks\MP Scheduled Scan.job

-- Files created between 2008-02-25 and 2008-03-25 -----------------------------

2008-03-25 00:17:41 0 dr-h----- C:\Documents and Settings\Scott Harris\Recent
2008-03-24 22:18:01 0 d-------- C:\VundoFix Backups
2008-03-18 12:40:05 0 dr------- C:\Documents and Settings\LocalService\Favorites
2008-03-18 11:29:10 0 d-------- C:\Program Files\Spyware Doctor
2008-03-18 11:29:10 0 d-------- C:\Documents and Settings\Scott Harris\Application Data\PC Tools
2008-03-17 10:54:23 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-03-17 10:54:19 0 d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-03-11 13:11:05 0 d-------- C:\Program Files\GameSpot
2008-03-02 22:30:26 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-03-01 09:35:58 0 d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2008-03-01 09:27:36 0 d-------- C:\Program Files\Windows Live Toolbar
2008-03-01 09:27:33 0 d-------- C:\Program Files\Windows Live Favorites
2008-03-01 09:21:15 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-01 09:20:55 0 d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-29 09:09:55 0 d-------- C:\Program Files\iPod
2008-02-25 13:06:17 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-25 13:06:08 0 d-------- C:\Program Files\ZAR

-- Find3M Report ---------------------------------------------------------------

2008-03-24 22:13:30 0 d-------- C:\Documents and Settings\Scott Harris\Application Data\uTorrent
2008-03-20 12:16:48 0 d-------- C:\Program Files\Call of Duty 4 - Modern Warfare
2008-03-17 12:41:33 0 d-------- C:\Program Files\Ad-Aware
2008-03-16 22:05:25 0 d-------- C:\Program Files\Video to iPod MP4 PSP 3GP Converter
2008-03-14 12:11:21 0 d-------- C:\Program Files\Java
2008-03-11 13:11:07 6038 --a------ C:\Program Files\install.log
2008-03-02 22:29:54 0 d-------- C:\Program Files\Windows Live
2008-03-01 09:22:33 0 d-------- C:\Program Files\MSN Messenger
2008-03-01 09:21:15 0 d-------- C:\Program Files\Common Files
2008-02-29 11:37:04 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-02-29 09:10:11 0 d-------- C:\Program Files\iTunes
2008-02-29 09:08:55 0 d-------- C:\Program Files\QuickTime
2008-02-24 15:38:00 0 d-------- C:\Program Files\Common Files\DVDVideoSoft
2008-02-24 15:37:16 0 d-------- C:\Program Files\DVDVideoSoft
2008-02-23 11:19:36 0 d-------- C:\Documents and Settings\Scott Harris\Application Data\Adobe
2008-02-22 23:24:46 0 d-------- C:\Program Files\Zero Assumption Digital Image Recovery
2008-02-22 23:03:54 0 d-------- C:\Program Files\Real Alternative
2008-02-01 11:11:10 586240 --a------ C:\WINDOWS\WLXPGSS.SCR <Not Verified; Microsoft Corporation; Windows Live Photo Gallery>

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Gmail Notifier\gnotify.exe" [07/16/2005 08:48 AM]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [07/09/2001 09:50 PM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25 AM]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [10/27/2006 01:47 AM]
"CoolSwitch"="C:\WINDOWS\system32\taskswitch.exe" [03/19/2002 06:30 PM]
"KernelFaultCheck"="C:\WINDOWS\system32\dumprep 0 -k" []
"VTTimer"="VTTimer.exe" [08/03/2006 05:53 PM C:\WINDOWS\system32\VTTimer.exe]
"S3Trayp"="S3trayp.exe" [07/11/2006 05:33 AM C:\WINDOWS\system32\S3Trayp.exe]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [12/22/2007 12:09 AM]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [11/03/2006 08:20 PM]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [09/17/2007 02:07 AM]
"nwiz"="nwiz.exe" [09/17/2007 02:07 AM C:\WINDOWS\system32\nwiz.exe]
"Bubble"="C:\Program Files\Windows SteadyState\Bubble.exe" [06/05/2007 04:56 PM]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [09/17/2007 02:07 AM]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [01/31/2008 11:13 PM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [02/19/2008 01:10 PM]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 10:16 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [03/01/2008 06:47 PM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 11:00 PM]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/14/2004 03:24 AM]
"WatchWAN"="C:\Program Files\WatchWAN\WatchWAN.exe" []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsMenu"=01000000
"ClearRecentDocsOnExit"=01000000
"NoSMMyPictures"=01000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Windows SteadyState]
@="Service"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{69b03bea-1171-11dc-a5db-00112f1784ed}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe 06tayewv3yj1hbzq.vbs

-- End of Deckard's System Scanner: finished at 2008-03-25 11:00:04 ------------

and the extra.txt

Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Professional (build 2600) SP 2.0
Architecture: X86; Language: English

CPU 0: Intel® Core(tm)2 CPU 6320 @ 1.86GHz
CPU 1: Intel® Core(tm)2 CPU 6320 @ 1.86GHz
Percentage of Memory in Use: 23%
Physical Memory (total/avail): 2047.48 MiB / 1561.61 MiB
Pagefile Memory (total/avail): 3939.93 MiB / 3625.38 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1931.19 MiB

A: is Removable (No Media)
C: is Fixed (NTFS) - 74.52 GiB total, 17.73 GiB free.
D: is Fixed (NTFS) - 9.77 GiB total, 5.41 GiB free.
E: is Fixed (NTFS) - 64.76 GiB total, 1.16 GiB free.
F: is CDROM (UDF)
G: is CDROM (No Media)
H: is Removable (FAT)

\\.\PHYSICALDRIVE0 - Disk drive - 74.53 GiB - 1 partition
\PARTITION0 (bootable) - Installable File System - 74.52 GiB - C:

\\.\PHYSICALDRIVE1 - Disk drive - 74.53 GiB - 2 partitions
\PARTITION0 (bootable) - Installable File System - 9.77 GiB - D:
\PARTITION1 - Extended w/Extended Int 13 - 64.76 GiB - E:

\\.\PHYSICALDRIVE2 - SanDisk SDDR-113 USB Device - 1937.53 MiB - 1 partition
\PARTITION0 - MS-DOS V4 Huge - 1938.38 MiB - H:

-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is enabled.

FirstRunDisabled is set.
AntiVirusDisableNotify is set.
FirewallDisableNotify is set.

FW: Norton Internet Worm Protection v2006 (Symantec) [color=\"RED\"]Disabled[/color]
AV: AVG 7.5.519 v7.5.519 (Grisoft)

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Documents and Settings\\Scott Harris\\Desktop\\utorrent.exe"="C:\\Documents and Settings\\Scott Harris\\Desktop\\utorrent.exe:*:Enabled:ÂµTorrent"
"C:\\Program Files\\DAP\\DAP.exe"="C:\\Program Files\\DAP\\DAP.exe:*:Enabled:Download Accelerator Plus (DAP)"
"C:\\StubInstaller.exe"="C:\\StubInstaller.exe:*:Enabled:LimeWire swarmed installer"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\Grisoft\\AVG Free\\avgw.exe"="C:\\Program Files\\Grisoft\\AVG Free\\avgw.exe:*:Enabled:AVG Free Edition for Windows"
"C:\\Program Files\\EA GAMES\\Battlefield Vietnam\\bfvietnam.exe"="C:\\Program Files\\EA GAMES\\Battlefield Vietnam\\bfvietnam.exe:*:Disabled:bfvietnam"
"C:\\Program Files\\mIRC\\mirc.exe"="C:\\Program Files\\mIRC\\mirc.exe:*:Enabled:mIRC"
"C:\\Program Files\\Zultrax P2P\\Zultrax.Exe"="C:\\Program Files\\Zultrax P2P\\Zultrax.Exe:*:Enabled:Zultrax"
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe"
"\\\\RIGHT\\Age of Empire\\Age of empires 2.exe"="\\\\RIGHT\\Age of Empire\\Age of empires 2.exe:*:Enabled:Age of empires 2.exe"
"C:\\WINDOWS\\system32\\dplaysvr.exe"="C:\\WINDOWS\\system32\\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\\Scott\\Games\\Age of Empires 2\\Age of empires 2.exe"="C:\\Scott\\Games\\Age of Empires 2\\Age of empires 2.exe:*:Enabled:Age of Empires II Expansion"
"C:\\Documents and Settings\\Scott Harris\\Local Settings\\Temp\\ElectronicArts_Patcher_000.exe"="C:\\Documents and Settings\\Scott Harris\\Local Settings\\Temp\\ElectronicArts_Patcher_000.exe:*:Enabled:ElectronicArts_Patcher_000"
"C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:ÂµTorrent"
"C:\\Program Files\\THQ\\Titan Quest\\Titan Quest.exe"="C:\\Program Files\\THQ\\Titan Quest\\Titan Quest.exe:*:Enabled:Titan Quest"
"C:\\Program Files\\THQ\\Titan Quest Immortal Throne\\Tqit.exe"="C:\\Program Files\\THQ\\Titan Quest Immortal Throne\\Tqit.exe:*:Enabled:Tqit"
"C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"="C:\\Program Files\\Call of Duty 4 - Modern Warfare\\iw3mp.exe:*:Enabled:Call of Duty® 4 - Modern Warfare(tm) "

-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Scott Harris\Application Data
CLASSPATH=.;C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=SCOTT
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Scott Harris
LOGONSERVER=\\SCOTT
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\WBEM;C:\Program Files\PC Connectivity Solution\;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\QuickTime\QTSystem\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 15 Stepping 6, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0f06
ProgramFiles=C:\Program Files
PROMPT=$P$G
QTJAVA=C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip
SCTPath=C:\Program Files\Windows SteadyState\
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\SCOTTH~1\LOCALS~1\Temp
TMP=C:\DOCUME~1\SCOTTH~1\LOCALS~1\Temp
USERDOMAIN=SCOTT
USERNAME=Scott Harris
USERPROFILE=C:\Documents and Settings\Scott Harris
windir=C:\WINDOWS

-- User Profiles ---------------------------------------------------------------

Scott Harris (admin)

-- Add/Remove Programs ---------------------------------------------------------

--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Ad-Aware SE Professional --> C:\PROGRA~1\Ad-Aware\UNWISE.EXE C:\PROGRA~1\Ad-Aware\INSTALL.LOG
Adobe Acrobat 4.0 --> C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Common Files\Adobe\Acrobat 4.0\NT\Uninst.isu" -c"C:\Program Files\Common Files\Adobe\Acrobat 4.0\NT\Uninst.dll"
Adobe Flash Player 9 ActiveX --> C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
Adobe Flash Player Plugin --> C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 8.1.2 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003}
Albumprinter Australia --> "C:\Program Files\Albumprinter Australia\unins000.exe"
Alt-Tab Task Switcher Powertoy for Windows XP --> MsiExec.exe /I{A7050037-F0EA-4BAB-BCD5-FC05507D6147}
Altap Salamander 2.5 RC3 --> C:\Program Files\Altap Salamander 2.5 RC3\remove\remove.exe
Apple Mobile Device Support --> MsiExec.exe /I{44734179-8A79-4DEE-BB08-73037F065543}
Apple Software Update --> MsiExec.exe /I{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}
ÂµTorrent --> "C:\Program Files\uTorrent\uTorrent.exe" /UNINSTALL
AVG 7.5 --> C:\Program Files\Grisoft\AVG7\setup.exe /UNINSTALL
AVIcodec (remove only) --> "C:\Program Files\AVIcodec\uninst.exe"
Belarc Advisor 7.2 --> C:\PROGRA~1\Belarc\Advisor\Uninstall.exe C:\PROGRA~1\Belarc\Advisor\INSTALL.LOG
Big Two --> C:\WINDOWS\st6unst.exe -n "C:\Program Files\Big Two card game\ST6UNST.LOG"
BitTorrent 5.0.8 --> "C:\Program Files\BitTorrent\uninstall.exe"
Call of Duty® 4 - Modern Warfare(tm) --> C:\Program Files\InstallShield Installation Information\{E48469CC-635E-4FD5-A122-1497C286D217}\setup.exe -runfromtemp -l0x0409
Call of Duty® 4 - Modern Warfare(tm) 1.4 Patch --> C:\Program Files\InstallShield Installation Information\{3BD633E0-4BF8-4499-9149-88F0767D449C}\setup.exe -runfromtemp -l0x0409
Call of Duty® 4 - Modern Warfare(tm) 1.5 Multiplayer Patch --> C:\Program Files\InstallShield Installation Information\{8503C901-85D7-4262-88D2-8D8B2A7B08B8}\setup.exe -runfromtemp -l0x0409
CEP - Color Enable Package --> "C:\PROGRA~1\EAGAME~1\zCEP_Uninstaller\unins000.exe"
ClearType Tuning Control Panel Applet --> MsiExec.exe /I{C9E4932C-8417-4E4C-A0E3-EE534810AB4D}
Codec Pack - All In 1 6.0.3.0 --> C:\WINDOWS\iun6002.exe "C:\Program Files\Codec Pack - All In 1\irunin.ini"
DivX Web Player --> C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
DVD Decrypter (Remove Only) --> "C:\Program Files\DVD Decrypter\uninstall.exe"
DVD Shrink 3.2 --> "C:\Program Files\DVD Shrink\unins000.exe"
ExtractNow --> "C:\Program Files\ExtractNow\unins000.exe"
FLV Player 1.3.3 --> "C:\Program Files\FLVPlayer\uninstall.exe"
Free Video Flip and Rotate version 1.2 --> "C:\Program Files\DVDVideoSoft\Free Video Flip and Rotate\unins000.exe"
GameSpot Download Manager --> "C:\Program Files\GameSpot\uninstall.exe"
Google Earth --> MsiExec.exe /I{1E04F83B-2AB9-4301-9EF7-E86307F79C72}
Google Gmail Notifier --> "C:\Program Files\Gmail Notifier\UninstallGmail.exe"
Highlight Viewer (Windows Live Toolbar) --> MsiExec.exe /X{A5C4AD72-25FE-4899-B6DF-6D8DF63C93CF}
HijackThis 2.0.2 --> "C:\Program Files\HijackThis\HijackThis.exe" /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399) --> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Image Resizer Powertoy for Windows XP --> MsiExec.exe /I{1CB92574-96F2-467B-B793-5CEB35C40C29}
Intel® Processor ID Utility --> MsiExec.exe /X{A92A4DB0-CD37-42D1-BE1D-603D53C24328}
iTunes --> MsiExec.exe /I{80FD852F-5AAC-4129-B931-06AAFFA43138}
J2SE Runtime Environment 5.0 Update 10 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150100}
J2SE Runtime Environment 5.0 Update 11 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150110}
J2SE Runtime Environment 5.0 Update 8 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150080}
Java(tm) 6 Update 2 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
Java(tm) 6 Update 3 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java(tm) 6 Update 5 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java(tm) SE Runtime Environment 6 Update 1 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
K-Lite Codec Pack 3.3.0 Full --> "C:\Program Files\K-Lite Codec Pack\unins000.exe"
Kaspersky Online Scanner --> C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
LimeWire PRO 4.14.3 --> "C:\Program Files\LimeWire\uninstall.exe"
Map Button (Windows Live Toolbar) --> MsiExec.exe /X{7745B7A9-F323-4BB9-9811-01BF57A028DA}
Messenger Plus! Live --> "C:\Program Files\Messenger Plus\Uninstall.exe"
Microsoft Base Smart Card Cryptographic Service Provider Package --> "C:\WINDOWS\$NtUninstallbasecsp$\spuninst\spuninst.exe"
Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Office Access MUI (English) 2007 --> MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
Microsoft Office Access Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2007 --> MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Groove MUI (English) 2007 --> MsiExec.exe /X{90120000-00BA-0409-0000-0000000FF1CE}
Microsoft Office Groove Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0114-0409-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (English) 2007 --> MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE}
Microsoft Office OneNote MUI (English) 2007 --> MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2007 --> MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007 --> MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007 --> MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007 --> MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007 --> MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007 --> MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Publisher MUI (English) 2007 --> MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007 --> MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Ultimate 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ULTIMATER /dll OSETUP.DLL
Microsoft Office Ultimate 2007 --> MsiExec.exe /X{91120000-002E-0000-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007 --> MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft SQL Server 2005 Compact Edition [ENU] --> MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
mIRC --> "C:\Program Files\mIRC\mirc.exe" -uninstall
Mozilla Firefox (2.0.0.12) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 6.0 Parser (KB933579) --> MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
Nero Media Player --> C:\WINDOWS\UNNMP.exe /UNINSTALL
Nero OEM --> C:\Program Files\Nero Burning Software\nero\uninstall\UNNERO.exe /UNINSTALL
Nokia Connectivity Cable Driver --> RUNDLL32.EXE nsesetup.dll,DoNTUninst
NVIDIA Drivers --> C:\WINDOWS\system32\nvudisp.exe UninstallGUI
Paragon Drive Backup 8.5 Special Edition --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5F9662B9-ED3F-4F02-9DEE-EFA1F95F629F}\Setup.exe" -l0x9
PC Connectivity Solution --> MsiExec.exe /I{AB2347E4-153B-4194-AA3B-97C0A662B369}
Planet Poker --> C:\PROGRA~1\PLANET~1\UNWISE.EXE C:\PROGRA~1\PLANET~1\INSTALL.LOG
QuickTime --> MsiExec.exe /I{BFD96B89-B769-4CD6-B11E-E79FFD46F067}
Real Alternative 1.52 --> "C:\Program Files\Real Alternative\unins000.exe"
Security Update for CAPICOM (KB931906) --> MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906) --> MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Excel 2007 (KB946974) --> msiexec /package {91120000-002E-0000-0000-0000000FF1CE} /uninstall {85E83E2E-AF9B-439B-B4F9-EB9B7EF6A00E}
Security Update for Office 2007 (KB934062) --> msiexec /package {91120000-002E-0000-0000-0000000FF1CE} /uninstall {305D509B-F194-4638-9F0F-D9E4C05F9D33}
Security Update for Office 2007 (KB947801) --> msiexec /package {91120000-002E-0000-0000-0000000FF1CE} /uninstall {02B5A17B-01BE-4BA6-95F1-1CBB46EBC76E}
Security Update for Outlook 2007 (KB946983) --> msiexec /package {91120000-002E-0000-0000-0000000FF1CE} /uninstall {66B9496E-C0C3-4065-9868-85CCA92126C3}
Smart Menus (Windows Live Toolbar) --> MsiExec.exe /X{F084395C-40FB-4DB3-981C-B51E74E1E83D}
SoundMAX --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\Setup.exe"
Spyware Doctor 5.5 --> C:\Program Files\Spyware Doctor\unins000.exe /LOG
Symantec KB-DocID:2003093015493306 --> MsiExec.exe /I{08C5815C-2C6E-44f8-8748-0E61BC9AFB68}
Tweak UI --> "C:\WINDOWS\system32\mshta.exe" "res://C:\WINDOWS\system32\TweakUI.exe/uninstall.hta"
Uninstall 1.0.0.0 --> "C:\Program Files\Common Files\DVDVideoSoft\unins000.exe"
Update for Office 2007 (KB932080) --> msiexec /package {91120000-002E-0000-0000-0000000FF1CE} /uninstall {EDC9CA29-6BC1-471C-828C-7A36109005D7}
Update for Office 2007 (KB934393) --> msiexec /package {91120000-002E-0000-0000-0000000FF1CE} /uninstall {92FBAD46-E7F6-49FA-89B5-C39FC5BFAD15}
Update for Outlook 2007 Junk Email Filter (kb947945) --> msiexec /package {91120000-002E-0000-0000-0000000FF1CE} /uninstall {E397056B-7AE5-4FF1-8B13-276BF8201847}
Update for Word 2007 (KB934173) --> msiexec /package {91120000-002E-0000-0000-0000000FF1CE} /uninstall {C6A89125-5473-45E3-B413-ED8186437475}
VIA Platform Device Manager --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{20D4A895-748C-4D88-871C-FDB1695B0169}
VIA Rhine-Family Fast-Ethernet Adapter --> Rundll32.exe vuins32.dll,vuins32Ex $Rhine $VIA
VIA/S3G Display Driver --> VTsetvga.exe -s -rRundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\system32\dc04i.inf
Video to iPod MP4 PSP 3GP Converter --> "C:\WINDOWS\Video to iPod MP4 PSP 3GP Converter\uninstall.exe" "/U:C:\Program Files\Video to iPod MP4 PSP 3GP Converter\Uninstall\uninstall.xml"
WinBoost 4.88 --> "C:\Program Files\WinBoost\unins000.exe"
Windows Defender --> MsiExec.exe /I{A06275F4-324B-4E85-95E6-87B2CD729401}
Windows Driver Package - Nokia (WUDFRd) WPD (11/03/2006 6.82.26.2) --> C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\pccswpddri_6B630EE2E66584353C6CD8683D447072872F34D8\pccswpddriver.inf
Windows Live Favorites for Windows Live Toolbar --> MsiExec.exe /X{786C4AD1-DCBA-49A6-B0EF-B317A344BD66}
Windows Live installer --> MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}
Windows Live Mail --> MsiExec.exe /I{184E7118-0295-43C4-B72C-1D54AA75AAF7}
Windows Live Messenger --> MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0}
Windows Live Photo Gallery --> MsiExec.exe /X{2D4F6BE3-6FEF-4FE9-9D01-1406B220D08C}
Windows Live Sign-in Assistant --> MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
Windows Live Toolbar --> "C:\Program Files\Windows Live Toolbar\UnInstall.exe" {D5A145FC-D00C-4F1A-9119-EB4D9D659750}
Windows Live Toolbar --> MsiExec.exe /X{D5A145FC-D00C-4F1A-9119-EB4D9D659750}
Windows Live Toolbar Extension (Windows Live Toolbar) --> MsiExec.exe /X{341201D4-4F61-4ADB-987E-9CCE4D83A58D}
Windows Live Writer --> MsiExec.exe /X{9176251A-4CC1-4DDB-B343-B487195EB397}
Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Format SDK Hotfix - KB891122 --> "C:\WINDOWS\$NtUninstallKB891122$\spuninst\spuninst.exe"
Windows Presentation Foundation --> MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows SteadyState --> "C:\WINDOWS\$NtUninstallSCT$\spuninst\spuninst.exe"
WinPcap 3.1 beta4 --> "C:\Program Files\WinPcap\Uninstall.exe" "C:\Program Files\WinPcap\install.log"
WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe
WinZip --> "C:\Program Files\WinZip\WINZIP32.EXE" /uninstall
XML Paper Specification Shared Components Pack 1.0 -->
XP Codec Pack --> C:\Program Files\XP Codec Pack\Uninstall.exe
Zero Assumption Digital Image Recovery 1.2 --> "C:\Program Files\Zero Assumption Digital Image Recovery\unins000.exe"
Zero Assumption Recovery Version 8.3 --> "C:\Program Files\ZAR\unins000.exe"

-- Application Event Log -------------------------------------------------------

Event Record #/Type9019 / Success
Event Submitted/Written: 03/25/2008 10:17:05 AM
Event ID/Source: 12001 / usnjsvc
Event Description:
The Messenger Sharing USN Journal Reader service started successfully.

Event Record #/Type9000 / Success
Event Submitted/Written: 03/24/2008 10:42:38 AM
Event ID/Source: 12001 / usnjsvc
Event Description:
The Messenger Sharing USN Journal Reader service started successfully.

Event Record #/Type8989 / Success
Event Submitted/Written: 03/23/2008 05:15:14 PM
Event ID/Source: 12001 / usnjsvc
Event Description:
The Messenger Sharing USN Journal Reader service started successfully.

Event Record #/Type8977 / Success
Event Submitted/Written: 03/21/2008 08:03:18 AM
Event ID/Source: 12001 / usnjsvc
Event Description:
The Messenger Sharing USN Journal Reader service started successfully.

Event Record #/Type8964 / Success
Event Submitted/Written: 03/20/2008 09:10:09 AM
Event ID/Source: 12001 / usnjsvc
Event Description:
The Messenger Sharing USN Journal Reader service started successfully.

-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.

-- System Event Log ------------------------------------------------------------

Event Record #/Type26160 / Warning
Event Submitted/Written: 03/25/2008 10:59:54 AM
Event ID/Source: 3004 / WinDefend
Event Description:
%SCOTT27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %SCOTT27 can't undo changes that you allow.

For more information please see the following:
%SCOTT275

Scan ID: {A29B6163-BA41-4C12-8F47-B17829896196}

User: SCOTT\Scott Harris

Name: %SCOTT271

ID: %SCOTT272

Severity: 1.1.1593.05

Category: 1.1.1593.06

Path Found: %SCOTT276

Alert Type: %SCOTT278

Detection Type: 1.1.1593.02

Event Record #/Type26159 / Warning
Event Submitted/Written: 03/25/2008 10:59:54 AM
Event ID/Source: 3004 / WinDefend
Event Description:
%SCOTT27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %SCOTT27 can't undo changes that you allow.

For more information please see the following:
%SCOTT275

Scan ID: {0BBA51A8-DE25-4F44-82C6-3BF88B33BFBD}

User: SCOTT\Scott Harris

Name: %SCOTT271

ID: %SCOTT272

Severity: 1.1.1593.05

Category: 1.1.1593.06

Path Found: %SCOTT276

Alert Type: %SCOTT278

Detection Type: 1.1.1593.02

Event Record #/Type26158 / Warning
Event Submitted/Written: 03/25/2008 10:59:54 AM
Event ID/Source: 3004 / WinDefend
Event Description:
%SCOTT27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %SCOTT27 can't undo changes that you allow.

For more information please see the following:
%SCOTT275

Scan ID: {5DBF7173-D734-4084-A21D-7E24038773A4}

User: SCOTT\Scott Harris

Name: %SCOTT271

ID: %SCOTT272

Severity: 1.1.1593.05

Category: 1.1.1593.06

Path Found: %SCOTT276

Alert Type: %SCOTT278

Detection Type: 1.1.1593.02

Event Record #/Type26157 / Warning
Event Submitted/Written: 03/25/2008 10:59:51 AM
Event ID/Source: 3004 / WinDefend
Event Description:
%SCOTT27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %SCOTT27 can't undo changes that you allow.

For more information please see the following:
%SCOTT275

Scan ID: {945F7A13-7034-4292-8917-CC7D3117FD90}

User: SCOTT\Scott Harris

Name: %SCOTT271

ID: %SCOTT272

Severity: 1.1.1593.05

Category: 1.1.1593.06

Path Found: %SCOTT276

Alert Type: %SCOTT278

Detection Type: 1.1.1593.02

Event Record #/Type26156 / Warning
Event Submitted/Written: 03/25/2008 10:59:51 AM
Event ID/Source: 3004 / WinDefend
Event Description:
%SCOTT27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %SCOTT27 can't undo changes that you allow.

For more information please see the following:
%SCOTT275

Scan ID: {B6AC1DC7-5ABC-494C-97F7-DDBC1474D2A7}

User: SCOTT\Scott Harris

Name: %SCOTT271

ID: %SCOTT272

Severity: 1.1.1593.05

Category: 1.1.1593.06

Path Found: %SCOTT276

Alert Type: %SCOTT278

Detection Type: 1.1.1593.02

-- End of Deckard's System Scanner: finished at 2008-03-25 11:00:04 ------------

Following that scan I have rerun the new version of hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:01:37 AM, on 3/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows SteadyState\SCTSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Gmail Notifier\gnotify.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\taskswitch.exe
C:\WINDOWS\system32\VTTimer.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Windows SteadyState\Bubble.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\notepad.exe
C:\WINDOWS\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = About:People's Republic of Thailand (PRT)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Bubble] "%ProgramFiles%\Windows SteadyState\Bubble.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [WatchWAN] C:\Program Files\WatchWAN\WatchWAN.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00

guestolo · « **Reply #3 on:** March 24, 2008, 10:17:51 PM »

Download this file - Combofix.exe and save it ONLY to your desktop
We'll need it in a bit

Download the Flash_Disinfector.exe from here and save to desktop
http://www.techsupportforum.com/sectools/s...Disinfector.exe
Again, we'll need it in a bit

==Open notepad
Copy ALL the BLUE text below and Paste to notepad
Don't use anything else than notepad or the script will not work

[color=\"#0000FF\"]File::
C:\WINDOWS\06tayewv3yj1hbzq.vbs
Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{69b03bea-1171-11dc-a5db-00112f1784ed}]
[/color]
Save this as txtfile on your desktop
name it:
CFScript

I suggest that you PRINT the remainder of these instructions, or save them to a textfile on desktop
Physically disconnect your Internet cable from the back of the computer
Disable your AntiVirus software temporarily so as it won't interfere with the next fix

In addition, disable your Spyware Protection software
deactivate Spyware Doctor's OnGuard Tools

1. From within Spyware Doctor, click the "OnGuard" button on the left side.
2. Uncheck "Activate OnGuard".

Window's Defender
Open Windows Defender.
Click on Tools, General Settings.
Scroll down and uncheck Turn on real-time protection (recommended).
After you uncheck this, click on the Save button and close Windows Defender.

Run Flash_Disinfector.exe, Follow the prompts
Insert any removable flash drives you may have when prompted

Drag CFScript.txt into ComboFix.exe
Combofix will start>>Follow the prompts
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

When finished, it shall produce a log for you with the name C:\ComboFix.txt..
I'll need to see that log

Reconnect cable to internet
If you don't get Internet connection within a minute
Reboot the computer

Post back all the following

1. Post the log from ComboFix
2. Post a fresh hijackthis log

zephyrbc · « **Reply #4 on:** March 25, 2008, 02:49:03 AM »

Ok, I've done what you said too and here are the new logs

Scott,

ComboFix 08-03-24.1 - Scott Harris 2008-03-25 18:52:16.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.61.1033.18.1440 [GMT 11:00]
Running from: C:\Documents and Settings\Scott Harris\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Scott Harris\Desktop\CFScript.txt
* Created a new restore point

[color=\"red\"]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/color]

FILE ::
C:\WINDOWS\06tayewv3yj1hbzq.vbs
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Common Files\{38546~1
C:\Program Files\Common Files\{E8546~1
C:\WINDOWS\system32\components
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\packet.dll
C:\WINDOWS\system32\pthreadVC.dll
C:\WINDOWS\system32\wanpacket.dll
C:\WINDOWS\system32\wpcap.dll
I:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Service_NPF

((((((((((((((((((((((((( Files Created from 2008-02-25 to 2008-03-25 )))))))))))))))))))))))))))))))
.

2008-03-25 18:54 . 2004-08-04 23:00 24,576 --a------ C:\WINDOWS\system32\CF_init.exe
2008-03-25 16:48 . 2008-03-25 16:48 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2008-03-25 16:48 . 2008-03-25 16:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Macrovision
2008-03-25 10:54 . 2008-03-25 10:54 <DIR> d-------- C:\Deckard
2008-03-24 22:18 . 2008-03-24 22:18 <DIR> d-------- C:\VundoFix Backups
2008-03-18 11:36 . 2008-03-18 11:36 51,355 --a------ C:\WINDOWS\system32\muzika.xm
2008-03-18 11:29 . 2008-03-18 11:37 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-03-18 11:29 . 2008-03-18 11:29 <DIR> d-------- C:\Documents and Settings\Scott Harris\Application Data\PC Tools
2008-03-18 11:29 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-03-18 11:29 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-03-18 11:29 . 2008-02-01 12:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-03-18 11:29 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-03-17 10:54 . 2008-03-17 10:54 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-03-17 10:54 . 2008-03-17 10:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-03-11 13:11 . 2008-03-11 13:11 <DIR> d-------- C:\Program Files\GameSpot
2008-03-02 22:30 . 2008-03-02 22:30 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-03-02 09:14 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-03-01 09:35 . 2008-03-01 09:35 <DIR> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2008-03-01 09:27 . 2008-03-01 09:28 <DIR> d-------- C:\Program Files\Windows Live Toolbar
2008-03-01 09:27 . 2008-03-01 09:27 <DIR> d-------- C:\Program Files\Windows Live Favorites
2008-03-01 09:21 . 2008-03-01 09:25 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-01 09:20 . 2008-03-01 09:20 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-29 12:16 . 2006-11-13 17:02 288,768 --------- C:\WINDOWS\system32\rhttpaa.dll
2008-02-29 12:16 . 2006-11-13 17:02 116,736 --------- C:\WINDOWS\system32\aaclient.dll
2008-02-29 12:16 . 2006-11-13 17:02 36,352 --------- C:\WINDOWS\system32\tsgqec.dll
2008-02-29 09:09 . 2008-02-29 09:09 <DIR> d-------- C:\Program Files\iPod
2008-02-25 13:06 . 2008-02-25 13:23 <DIR> d-------- C:\Program Files\ZAR
2008-02-25 13:06 . 2008-03-25 18:48 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-25 12:46 . 2008-02-25 12:47 2,475,460 --ahs---- C:\Thumbs.db

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-25 07:46 --------- d-----w C:\Documents and Settings\Scott Harris\Application Data\uTorrent
2008-03-25 05:47 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-25 05:45 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-25 01:49 --------- d-----w C:\Program Files\Ad-Aware
2008-03-20 01:16 --------- d-----w C:\Program Files\Call of Duty 4 - Modern Warfare
2008-03-20 00:52 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-03-20 00:52 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-03-18 00:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7
2008-03-16 11:05 --------- d-----w C:\Program Files\Video to iPod MP4 PSP 3GP Converter
2008-03-14 01:11 --------- d-----w C:\Program Files\Java
2008-03-12 22:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-03-11 02:11 6,038 ----a-w C:\Program Files\install.log
2008-03-02 11:29 --------- d-----w C:\Program Files\Windows Live
2008-02-29 22:22 --------- d-----w C:\Program Files\MSN Messenger
2008-02-28 22:10 --------- d-----w C:\Program Files\iTunes
2008-02-28 22:08 --------- d-----w C:\Program Files\QuickTime
2008-02-24 04:38 --------- d-----w C:\Program Files\Common Files\DVDVideoSoft
2008-02-24 04:37 --------- d-----w C:\Program Files\DVDVideoSoft
2008-02-23 04:04 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-02-23 01:36 22,328 ----a-w C:\Documents and Settings\Scott Harris\Application Data\PnkBstrK.sys
2008-02-22 12:24 --------- d-----w C:\Program Files\Zero Assumption Digital Image Recovery
2008-02-22 12:03 --------- d-----w C:\Program Files\Real Alternative
2008-02-01 00:11 586,240 ----a-w C:\WINDOWS\WLXPGSS.SCR
2006-10-16 06:43 20,096 ----a-w C:\Documents and Settings\Scott Harris\Application Data\GDIPFONTCACHEV1.DAT
2006-10-18 13:47 316,078 --sha-w C:\WINDOWS\system32\mlnmp.bak1
2006-10-23 04:10 369,075 --sha-w C:\WINDOWS\system32\mlnmp.bak2
2006-10-23 04:10 369,075 --sha-w C:\WINDOWS\system32\mlnmp.ini2
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2008-03-01 18:47 5724184]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 23:00 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-14 03:24 1694208]
"WatchWAN"="C:\Program Files\WatchWAN\WatchWAN.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Gmail Notifier\gnotify.exe" [2005-07-16 08:48 479232]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 21:50 155648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 01:47 31016]
"CoolSwitch"="C:\WINDOWS\system32\taskswitch.exe" [2002-03-19 18:30 45632]
"VTTimer"="VTTimer.exe" [2006-08-03 17:53 53248 C:\WINDOWS\system32\VTTimer.exe]
"S3Trayp"="S3trayp.exe" [2006-07-11 05:33 176128 C:\WINDOWS\system32\S3Trayp.exe]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-22 00:09 579072]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 20:20 866584]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 02:07 8491008]
"nwiz"="nwiz.exe" [2007-09-17 02:07 1626112 C:\WINDOWS\system32\nwiz.exe]
"Bubble"="C:\Program Files\Windows SteadyState\Bubble.exe" [2007-06-05 16:56 64000]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 02:07 81920]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 23:00 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-27 01:17 219136]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyPictures"= 01000000

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\StubInstaller.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"C:\\Scott\\Games\\Age of Empires 2\\Age of empires 2.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=

R0 hotcore3;hotcore3;C:\WINDOWS\system32\drivers\hotcore3.sys [2007-02-08 18:26]
R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2006-02-23 14:38]
R0 xfilt;VIA SATA IDE Hot-plug Driver;C:\WINDOWS\system32\DRIVERS\xfilt.sys [2006-02-23 14:39]
R2 Windows SteadyState;Windows SteadyState Service;"C:\Program Files\Windows SteadyState\SCTSvc.exe" [2007-06-05 16:56]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2008-01-02 02:12]
S3 APLMp50;APLMp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\APLMp50.sys []
S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [2007-06-24 14:40]
S3 mamotou;mamotou;C:\WINDOWS\system32\DRIVERS\mamotou.sys [2005-11-07 17:50]
S3 S3GIGP;S3GIGP;C:\WINDOWS\system32\DRIVERS\S3gIGPm.sys [2006-08-14 13:51]
S4 Ql1cddeeasm;Ql1cddeeasm;C:\WINDOWS\system32\drivers\cbidf2k.sys [2004-08-04 23:00]

.
Contents of the 'Scheduled Tasks' folder
"2008-03-25 07:32:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
"2008-03-25 07:59:26 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-25 18:57:08
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
.
**************************************************************************
.
Completion time: 2008-03-25 19:00:53 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-25 08:00:51
.
2008-03-23 06:17:35 --- E O F ---

and heres the hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:04:31 PM, on 3/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows SteadyState\SCTSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Gmail Notifier\gnotify.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = About:People's Republic of Thailand (PRT)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Bubble] "%ProgramFiles%\Windows SteadyState\Bubble.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [WatchWAN] C:\Program Files\WatchWAN\WatchWAN.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://supportapj.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1182259101593
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - https://shop.getdigital.com.au/components/ImageUploader4.cab
O16 - DPF: {FD163A9A-A3D8-4F7D-8224-32F81AC29EDA} (VPlayer Control) - http://video.vividas.com/media/4926_Ansell.../vivid_ocx.jpeg
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe (file missing)
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 9597 bytes

guestolo · « **Reply #5 on:** March 25, 2008, 10:30:53 PM »

Sorry about the delay
Can you now do the following
Download [color=\"blue\"]OTMoveIt2.exe[/color] by OldTimer:

Save it to your desktop.
Please double-click OTMoveIt2.exe to run it.
Copy the entries below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose "Copy"):

================================================

C:\WINDOWS\system32\CF_init.exe
C:\Deckard
C:\VundoFix Backups
C:\WINDOWS\system32\muzika.xm
C:\WINDOWS\system32\mlnmp.bak1
C:\WINDOWS\system32\mlnmp.bak2
C:\WINDOWS\system32\mlnmp.ini2

======================================================
Return to OTMoveIt2, right-click on the "Paste List of Files/Folders to be Moved" window and choose "Paste".
Click the red "[color=\"red\"]MoveIt![/color]" button.
Close OTMoveIt when it has completed.

[color=\"red\"]Note[/color]: If an entry cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose "Yes".

OTMoveIt would of created a log at this location
C:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log

Post that log along with a fresh hijackthis log
Let me know how things are running please

zephyrbc · « **Reply #6 on:** March 26, 2008, 05:09:09 PM »

Thanks again, your help is appreciated, I havnt had any viruses for a while now, but its hard to tell as it would pop up at random times. Things seem pretty good tho

here is the log for moveit

C:\WINDOWS\system32\CF_init.exe moved successfully.
C:\Deckard\System Scanner\backup\WINDOWS\temp\_isTmp_{8675309} moved successfully.
C:\Deckard\System Scanner\backup\WINDOWS\temp\_ISTMP0.DIR moved successfully.
C:\Deckard\System Scanner\backup\WINDOWS\temp\WLXPL_DX moved successfully.
C:\Deckard\System Scanner\backup\WINDOWS\temp\Temporary Internet Files\Content.IE5\Y7DGZJZ1 moved successfully.
C:\Deckard\System Scanner\backup\WINDOWS\temp\Temporary Internet Files\Content.IE5\IX2NAQT6 moved successfully.
C:\Deckard\System Scanner\backup\WINDOWS\temp\Temporary Internet Files\Content.IE5\GMSWVZ2D moved successfully.
C:\Deckard\System Scanner\backup\WINDOWS\temp\Temporary Internet Files\Content.IE5\DL3BDAYL moved successfully.
C:\Deckard\System Scanner\backup\WINDOWS\temp\Temporary Internet Files\Content.IE5 moved successfully.
C:\Deckard\System Scanner\backup\WINDOWS\temp\Temporary Internet Files moved successfully.
C:\Deckard\System Scanner\backup\WINDOWS\temp\MPTelemetrySubmit moved successfully.
C:\Deckard\System Scanner\backup\WINDOWS\temp\History\History.IE5 moved successfully.
C:\Deckard\System Scanner\backup\WINDOWS\temp\History moved successfully.
C:\Deckard\System Scanner\backup\WINDOWS\temp\Cookies moved successfully.
C:\Deckard\System Scanner\backup\WINDOWS\temp moved successfully.
C:\Deckard\System Scanner\backup\WINDOWS\Downloaded Program Files moved successfully.
C:\Deckard\System Scanner\backup\WINDOWS moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\~nsu.tmp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\{C0C99785-EDBA-4F33-96CF-F0CF1EB5FB8D} moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\{B8A0FABC-6CBC-4C20-85FD-B18278A01695}\{2B653229-9854-4989-B780-D978F5F13EAB} moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\{B8A0FABC-6CBC-4C20-85FD-B18278A01695} moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\{8D802171-E3A8-46EB-8FEF-1A170873C249} moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\{8B32BE00-3849-4151-96D5-5618C638FD6C}\{5A118437-3B7B-402B-955C-A74B847CB0DE} moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\{8B32BE00-3849-4151-96D5-5618C638FD6C} moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\{70FF7DF1-E69E-47df-9AA6-F062FADD6146} moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\{1A6ECBF2-A161-4806-9EA7-0C150717E22F} moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\_ir_sf7_temp_0 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\WPDNSE moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\Word8.0 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\WLTB Custom Button Feeds moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\WER9410.dir00 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\WER8c77.dir00 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\WER4b00.dir00 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\VBE moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\tmp00007b18 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\Temporary Directory 2 for messpatch-g5-80812v2(www.mess.be).zip moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\Temporary Directory 1 for messpatch-g5-80812v2(www.mess.be).zip moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\Temporary Directory 1 for aoe3demotrn.zip moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\Temporary Directory 1 for 306.zip moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\Temporary Directory 1 for 1009.zip moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\TCD5.tmp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\TCD1E.tmp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\StoreFiles moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\SLOT moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\rdFC.tmp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\rdCE.tmp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\rd83.tmp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\rd79.tmp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\rd7.tmp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\rd6.tmp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\rd5.tmp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\rd1A.tmp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\RarSFX1 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\RarSFX0 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\PPT11.0 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\PPT10.0 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-9 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-8 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-7 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-6 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-5 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-46 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-45 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-44 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-43 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-42 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-41 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-40 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-4 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-39 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-38 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-37 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-36 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-35 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-34 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-33 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-32 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-31 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-30 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-3 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-29 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-28 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-27 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-26 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-25 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-24 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-23 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-22 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-21 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-20 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-2 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-19 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-18 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-17 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-16 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-15 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-14 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-13 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-12 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-11 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-10 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp-1 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\plugtmp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\pft1E~tmp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\OWP5.tmp\Word.en-us moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\OWP5.tmp\Updates moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\OWP5.tmp\Ultimater.WW moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\OWP5.tmp\Rosebud.en-us moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\OWP5.tmp\Publisher.en-us moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\OWP5.tmp\Proofing.en-us\Proof.fr moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\OWP5.tmp\Proofing.en-us\Proof.es moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\OWP5.tmp\Proofing.en-us\Proof.en moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\OWP5.tmp\Proofing.en-us moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\OWP5.tmp\PowerPoint.en-us moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\OWP5.tmp\Outlook.en-us moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\OWP5.tmp\OneNote.en-us moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\OWP5.tmp\Office64.en-us moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\OWP5.tmp\Office.en-us\1033 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\OWP5.tmp\Office.en-us moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\OWP5.tmp\InfoPath.en-us moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\OWP5.tmp\Groove.en-us\Groove.en-us moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\OWP5.tmp\Groove.en-us moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\OWP5.tmp\Excel.en-us moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\OWP5.tmp\Catalog moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\OWP5.tmp\Access.en-us\Access.en-us moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\OWP5.tmp\Access.en-us moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\OWP5.tmp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\outlook logging moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\OIS\temp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\OIS\cacheFiles moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\OIS moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\nsf84.tmp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\VirusDef moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\VAData\Dict moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\VAData moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\SymSC\SYMWMIIS\SymSC moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\SymSC\SYMWMIIS moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\SymSC\SYMWMIAV\SymSC moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\SymSC\SYMWMIAV moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\SymSC moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\SymNet\SymNet\System32\Drivers moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\SymNet\SymNet\System32 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\SymNet\SymNet\SYMSHARE\Manifest moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\SymNet\SymNet\SYMSHARE\IDS moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\SymNet\SymNet\SYMSHARE moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\SymNet\SymNet moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\SymNet moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\SymMCEAI\SymMCEAI\SYMSHARE moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\SymMCEAI\SymMCEAI moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\SymMCEAI moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\SymLnch moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\SPBBC\SPBBC\SYMSHARE\SPBBC moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\SPBBC\SPBBC\SYMSHARE\MANIFEST moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\SPBBC\SPBBC\SYMSHARE moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\SPBBC\SPBBC moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\SPBBC moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\SpamDefs moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\SEVINST moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\Redist\MSRedist\Ansi moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\Redist\MSRedist moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\Redist moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\Proxy\ccPxyExt moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\Proxy\ccPxyCre moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\Proxy moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\PreScan moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\NSC\NSCCore\SPMan moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\NSC\NSCCore\SecCon moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\NSC\NSCCore\SCenter moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\NSC\NSCCore moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\NSC moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\NISTools moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\MSI moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\LUpdate moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\HelpMSI\External moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\HelpMSI moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\FRE moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\ccCommon\ccCommon moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support\ccCommon moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Support moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\SymLT\SYMSHARE\MANIFEST moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\SymLT\SYMSHARE\CCPD-LC moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\SymLT\SYMSHARE moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\SymLT moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\Setup\SYMSHARE\MANIFEST moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\Setup\SYMSHARE moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\Setup\MANIFEST moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\Setup\APP moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\Setup\AntiSpam moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\Setup\ADBLCK moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\Setup moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\PControl\SYMSHARE\MANIFEST moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\PControl\SYMSHARE moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\PControl\Symantec moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\PControl\APP moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\PControl moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\ISCommon\SYMSHARE\SPBBC moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\ISCommon\SYMSHARE\PEPUTIL moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\ISCommon\SYMSHARE\Options moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\ISCommon\SYMSHARE\MANIFEST moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\ISCommon\SYMSHARE\ADBLCK moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\ISCommon\SYMSHARE moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\ISCommon\Options moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\ISCommon\MANIFEST moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\ISCommon\APP\IDSDefs moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\ISCommon\APP moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\ISCommon moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\asCore\SYMSHARE\Options moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\asCore\SYMSHARE\MANIFEST moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\asCore\SYMSHARE moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\asCore\Options moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\asCore\MANIFEST moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\asCore\AntiSpam moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\asCore moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\AdBlck\SYMSHARE\Options moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\AdBlck\SYMSHARE\MANIFEST moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\AdBlck\SYMSHARE moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\AdBlck\Options moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\AdBlck\MANIFEST moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\AdBlck\ADBLCK moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup\AdBlck moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Setup moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\NAV\Parent\SYMSHARE\MANIFEST moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\NAV\Parent\SYMSHARE moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\NAV\Parent moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\NAV\External\Symantec\NORTON\Tasks moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\NAV\External\Symantec\NORTON moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\NAV\External\Symantec moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\NAV\External\NORTON\APP\WINXP moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\NAV\External\NORTON\APP\WIN98NT moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\NAV\External\NORTON\APP moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\NAV\External\NORTON moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\NAV\External\CommonFi\SYMSHARE\SPBBC moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\NAV\External\CommonFi\SYMSHARE\PEPUTIL moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\NAV\External\CommonFi\SYMSHARE\MANIFEST moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\NAV\External\CommonFi\SYMSHARE moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\NAV\External\CommonFi moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\NAV\External moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\NAV moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9\Manual moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\NIS9 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\msohtmlclip1\01 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\msohtmlclip1 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\msohtmlclip moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\msohtml1\01 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\msohtml1 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\msgpl_b2bf.tmp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\msgpl_8c9b.tmp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\MPTelemetrySubmit moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\MPSampleSubmit moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\MessengerCache moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\IXP849.TMP moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\issD.tmp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\iss72.tmp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\iss3.tmp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\iss2C.tmp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\iss1E.tmp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\ispCE.tmp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\isp9.tmp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\isp8.tmp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\isp7.tmp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\isp59.tmp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\ICD1.tmp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\hsperfdata_Scott Harris moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\Excel8.0 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\e-tax Temp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\DataRecovery_EN moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\Crack moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\CDM\{CAB48E7C-44C3-4B51-AEC2-74784522E9F7} moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\CDM moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\Adobe Reader 8 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\Adobe\Acrobat\8.0 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\Adobe\Acrobat moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\Adobe moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\34platoon moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp\.viv moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1\Temp moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1\LOCALS~1 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1\SCOTTH~1 moved successfully.
C:\Deckard\System Scanner\backup\DOCUME~1 moved successfully.
C:\Deckard\System Scanner\backup moved successfully.
C:\Deckard\System Scanner moved successfully.
C:\Deckard moved successfully.
C:\VundoFix Backups moved successfully.
C:\WINDOWS\system32\muzika.xm moved successfully.
C:\WINDOWS\system32\mlnmp.bak1 moved successfully.
C:\WINDOWS\system32\mlnmp.bak2 moved successfully.
C:\WINDOWS\system32\mlnmp.ini2 moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.21 log created on 03272008_092136

and this is the latest hijack this log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:25:04 AM, on 3/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows SteadyState\SCTSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exeC:\Program Files\Analog Devices\SoundMAX\SMAgent.exeC:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeC:\Program Files\Spyware Doctor\pctsTray.exeC:\WINDOWS\System32\alg.exeC:\WINDOWS\system32\wbem\wmiprvse.exeC:\Program Files\Gmail Notifier\gnotify.exeC:\Program Files\Java\jre1.6.0_05\bin\jusched.exeC:\Program Files\Microsoft Office\Office12\GrooveMonitor.exeC:\WINDOWS\system32\taskswitch.exeC:\WINDOWS\system32\VTTimer.exeC:\PROGRA~1\Grisoft\AVG7\avgcc.exeC:\Program Files\Windows Defender\MSASCui.exeC:\Program Files\Windows SteadyState\Bubble.exeC:\WINDOWS\system32\RUNDLL32.EXEC:\WINDOWS\system32\wbem\unsecapp.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Windows Live\Messenger\MsnMsgr.ExeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Windows Live\Messenger\usnsvc.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\HijackThis\HijackThis.exeC:\WINDOWS\system32\wbem\wmiprvse.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = About:People's Republic of Thailand (PRT)R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLLO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dllO3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dllO4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Gmail Notifier\gnotify.exeO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exeO4 - HKLM\..\Run: [VTTimer] VTTimer.exeO4 - HKLM\..\Run: [S3Trayp] S3trayp.exeO4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUPO4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hideO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [Bubble] "%ProgramFiles%\Windows SteadyState\Bubble.exe"O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottimeO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /backgroundO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exeO8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htmO8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspxO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dllO9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dllO9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dllO9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLLO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://supportapj.dell.com/systemprofiler/SysPro.CABO16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d..._unicode.cabO16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} - http://housecall65.trendmicro.com/housecal...x/hcImpl.cabO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://download.bitdefender.com/resources/...8/oscan8.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...182259101593O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} - https://shop.getdigital.com.au/components/I...ploader4.cabO16 - DPF: {FD163A9A-A3D8-4F7D-8224-32F81AC29EDA} - http://video.vividas.com/media/4926_Ansell...vid_ocx.jpegO18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLLO23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe (file missing)O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe (file missing)O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exeO23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exeO23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exeO23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exeO23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exeO23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exeO23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exeO23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exeO23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe--End of file - 10247 bytes

guestolo · « **Reply #7 on:** March 27, 2008, 03:01:13 PM »

Sorry for the delay
The last hijackthis log you posted is hard to read

Can you run a fresh scan and save logfile with Hijackthis
When the log opens
click on FORMAT and if WordWrap is checked, uncheck it
Then copy>paste back here the fresh log please

zephyrbc · « **Reply #8 on:** March 28, 2008, 06:18:26 PM »

Yep, done

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:34:24 AM, on 3/29/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows SteadyState\SCTSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Gmail Notifier\gnotify.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\taskswitch.exe
C:\WINDOWS\system32\VTTimer.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Windows SteadyState\Bubble.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = About:People's Republic of Thailand (PRT)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Bubble] "%ProgramFiles%\Windows SteadyState\Bubble.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://supportapj.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1182259101593
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} - https://shop.getdigital.com.au/components/ImageUploader4.cab
O16 - DPF: {FD163A9A-A3D8-4F7D-8224-32F81AC29EDA} - http://video.vividas.com/media/4926_Ansell.../vivid_ocx.jpeg
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe (file missing)
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 10242 bytes

guestolo · « **Reply #9 on:** March 29, 2008, 11:40:59 AM »

Can you do the following
Do a "System scan only" with Hijackthis and put a check next to these entries:

O16 - DPF: {FD163A9A-A3D8-4F7D-8224-32F81AC29EDA} - http://video.vividas.com/media/4926_Ansell.../vivid_ocx.jpeg

After you have ticked the above entries, close All other open windows
Including this one
Leave Hijackthis open and click FIX CHECKED
OK the prompt and exit Hijackthis

Post back and let me know how things are still running please
Note: Did you recently uninstall Symantecs?

zephyrbc · « **Reply #10 on:** March 29, 2008, 04:54:23 PM »

Things seem to be running well. I uninstalled symnatec months ago

Scott

guestolo · « **Reply #11 on:** March 29, 2008, 05:08:49 PM »

Go to START>>All Programs>>Accessories>>System Tools>>System Restore
Select>>Create a New restore point
Give it a name, any name,
and click Create
Windows will prompt when it was created successfully

When that's done

Go to START>>RUN>>type the following
cleanmgr
Hit OK
Let if finish calculating

Select the More Options tab
and click Cleanup.. under 'System Restore'
This will clear all later restore points except for the one you just made

Ok the prompts, it may take a few seconds to remove old restore points
Ok again after it's ready and let it finish cleaning

NEXT:
Go to START>>RUN>>copy and paste the next command below in bold
Then hit OK

ComboFix /u
This will uninstall combofix

download the [color=\"red\"]OTMoveIt2 by OldTimer[/color][/url].

Save it to your desktop.
Double-click OTMoveIt2.exe to run it.
Click the Cleanup! button
A list will be downloaded>>Allow it Internet access if prompted by your Firewall
Don't change anything in this list
Select Yes at the prompt
Wait for the confirmation box to open to reboot the computer
Don't mouseclick during the wait as you may cause the tool to stall
Select Yes to reboot Now

NOTE: This procedure will also delete OTMoveit.exe from desktop

Manually delete the next 2 folders
C:\Deckard
C:\Qoobox

Since it appears not all of Norton's may have been removed
I suggest that you go to the following link
Norton Removal Tool
Follow all of STEP 3

I suggest that you add SpywareBlaster to your protection software
SpywareBlaster by JavaCool

After installation, Check for updates
After updating, select "Protection" on the Left
Then select "Enable all Protection"
"Check for updates every couple of weeks"
after every update just simply click the "enable protection on all unprotected items"

Take a look at miekiemoes site with other ideas on How to prevent Malware:

I hope that helps

http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/smile.gif\' class=\'bbc_emoticon\' alt=\'

\' />

NOTE: Is this computer set in a public location?
I see the following running that may indicate so
O4 - HKLM\..\Run: [Bubble] "%ProgramFiles%\Windows SteadyState\Bubble.exe"

zephyrbc · « **Reply #12 on:** March 29, 2008, 05:45:21 PM »

Thanks again for your quick reply.

When I ran the uninstall spyware doctor picked up Trojan-PWS Bancos in C: Combofix\pv.cfexe and another in C: 327882r2fwjfw\pv.cfexe. Im not sure whether spyware doctor just mistakenly picked up that program or whether it was an actual trojan. I scanned with avg as well and didnt get anything.

Other than that I followed all the steps with no dramas

My computer isnt a public computer, its just a private home computer so should that file be changed?

I appreciate your time and help

Thanks'

Scott

guestolo · « **Reply #13 on:** March 29, 2008, 06:46:46 PM »

That entry is optional, usually seen when it is a Shared computer or multiple users., but is available to everyone

Here's some more info on
Windows Steadystate
HOUSEHOLD use

Optionally, you must decide if you need the program
If you look in your Add and Remove programs, you should find 'Windows SteadyState'

In addition, if you didn't purposely install
WinPcap 3.1 beta4, remove it, if you have to ask what it is, you don't need it

http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/smile.gif\' class=\'bbc_emoticon\' alt=\'

\' />

zephyrbc · « **Reply #14 on:** March 30, 2008, 02:55:06 AM »

Thanks a lot for your help,

I appreciate your time and effort

Regards,

Scott

guestolo · « **Reply #15 on:** March 30, 2008, 11:38:18 AM »

As your issues appear resolved, I'll lock this topic
Take care zephyrbc

http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/smile.gif\' class=\'bbc_emoticon\' alt=\'

\' />

TheTechGuide Forum

News:

Author Topic: Virus - Trojan (Read 786 times)

zephyrbc

Virus - Trojan

guestolo

Virus - Trojan

zephyrbc

Virus - Trojan

guestolo

Virus - Trojan

zephyrbc

Virus - Trojan

guestolo

Virus - Trojan

zephyrbc

Virus - Trojan

guestolo

Virus - Trojan

zephyrbc

Virus - Trojan

guestolo

Virus - Trojan

zephyrbc

Virus - Trojan

guestolo

Virus - Trojan

zephyrbc

Virus - Trojan

guestolo

Virus - Trojan

zephyrbc

Virus - Trojan

guestolo

Virus - Trojan