Home   News  Product reviews  Website reviews  Forums   Competitions  Subscribe 

Security >> HijackThis logs help and analysis
 |  Print Topic
Jump to first unread post. Pages: 1 | 2 | >> (show all)
sonobby1
regular


Reg'd: Sat
Posts: 51
desktop icons and toolbar have disapeared
      #386640 - Sat Mar 01 2008 09:13 PM

hi all im new here, usually i can fix my problems on my own but this time i just cant figure it out, hope you can help.
i was downloading a program last night when avg said it found a virus, actually it was a trojan sheur. auua
shortly after that i lost all my desktop icons, ive tried everything to get them back but nothing works. i can open any program through my task manager but thats the only way. the problem seems to be the explorer.exe i can open it in task manager then all my icons reappear, but only for 10 seconds maybe. i read on this forum early today about something to try and fix it, so ive done this so far.
i downloaded the sdfix and ran it in safe mode like it said. it ran for about 25 mins doing all various fixes and deleting files etc. then i was asked to restart which i did, then when windows opened again it carried on with more fixes. so im at this point now where its done all that and the report.txt has been saved to the clipboard and saved in the sdfix folder. so am i missing something, do i need to do something else now because it still hasnt fixed the problem. hope ive explained everything, please help

another guy walnut sugested this first if it didnt work come here, i tried it and it didnt work
Go here http://www.kellys-korner-xp.com/xp_tweaks.htm and scroll down to line 195 on the right hand column and download the file. Save the REG File to your hard disk.

Double click it and answer yes to the import prompt.

If it doesn't work, go to the HiJackThis section of the forum, read the posting rules and post a log.

ok so now ive downloaded hijack this and here is the results

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:09:10, on 01/03/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\vsnpstd3.exe
C:\Program Files\Common Files\AOL\1140573878\ee\aolsoftware.exe
c:\program files\common files\aol\1140573878\ee\services\antiSpywareApp\ver2_0_12\AOLSP Scheduler.exe
c:\program files\common files\aol\1140573878\ee\aolsoftware.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: (no name) - - (no file)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - blank (file missing)
O3 - Toolbar: Starware - {9839B3B7-3F99-4498-884D-6CFCCD251AB1} - blank (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1140573878\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] C:\Program Files\Voyager100Test\fts.exe
O4 - HKLM\..\Run: [GSICONEXE] gsicon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Lexmark 3100 Series] "C:\Program Files\Lexmark 3100 Series\lxbrbmgr.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [pbmini]
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: msmsgs.exe
O4 - Global Startup: PC Alert 4.lnk = C:\Program Files\MSI\PC Alert 4\PCAlert4.exe
O8 - Extra context menu item: &AOL Toolbar search - <a href="res://C:\Program" target="_blank">res://C:\Program</a> Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - <a href="res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000" target="_blank">res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000</a>
O8 - Extra context menu item: Yahoo! &SMS - <a href="file:///C:\Program" target="_blank">file:///C:\Program</a> Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework/control/en-US/activex/TmHcmsX.CAB
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} - http://www.cult3d.com/download/cult.cab
O16 - DPF: {52A5CD24-64C6-4BAF-A4EC-4D13F451763F} - https://www.cuworld.com/PIC/inner_pic/packages/CUworld.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - http://81.1.41.137/activex/AxisCamControl.cab
O16 - DPF: {99E10933-61C6-11D6-83CE-00D0B749C940} - http://www.tech-connect.com/ecsa/CSWord/CSWord.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697516} - http://www.nullsoft.com/nsv/embed/nsvplayx_vp6_mp3.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} - http://game19.zylomgames.com/activex/zylomloader.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{63247C4E-A29D-403A-B5CF-E96F96B1CB1C}: NameServer = 192.168.0.1,4.2.2.2
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - AOL LLC - (no file)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 7813 bytes

any help would be greatfully appreciated
si

Edited by sonobby1 (Sat Mar 01 2008 09:36 PM)


Post Extras: Print Post   Remind Me!   Notify Moderator  
ourwilly
HijackThis Helper


Reg'd: Sun
Posts: 2820
Loc: England.
Re: desktop icons and toolbar have disapeared [Re: sonobby1]
      #386672 - Sun Mar 02 2008 08:56 AM

Hello sonobby1

Open HijackThis again, select "Do a System Scan only" and place a checkmark in the boxes before the following entries:

R3 - URLSearchHook: (no name) - - (no file)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - blank (file missing)
O3 - Toolbar: Starware - {9839B3B7-3F99-4498-884D-6CFCCD251AB1} - blank (file missing)
O4 - HKCU\..\Run: [pbmini]
O4 - Global Startup: msmsgs.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab

Close all other open windows and click on Fix checked, then exit HijackThis.


Re-Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, the Advanced Options Menu should appear;
  • Select the first option, to run Windows in Safe Mode, then press Enter.
  • Choose your usual account.
  • Open the extracted SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
    (Report.txt will also be copied to Clipboard ready for posting back on the forum).
  • Finally paste the contents of the Report.txt back on the forum with a new HijackThis log

Thank you.


Post Extras: Print Post   Remind Me!   Notify Moderator  
sonobby1
regular


Reg'd: Sat
Posts: 51
Re: desktop icons and toolbar have disapeared [Re: ourwilly]
      #386697 - Sun Mar 02 2008 12:13 PM

hi ive done as you asked here is the results

SDFix: Version 1.150

Run by User on 02/03/2008 at 11:49

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


Checking Files :

No Trojan Files Found






Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-02 12:02:40
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

IPC error: 2 The system cannot find the file specified.
scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update]
"NextDetectionTime"="2008-03-02 11:27:40"

scanning hidden files ...


scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 1


Remaining Services :



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\AOL 9.0\\waol.exe"="C:\\Program Files\\AOL 9.0\\waol.exe:*:Enabled:AOL 9.0"
"C:\\Program Files\\mIRC\\mirc.exe"="C:\\Program Files\\mIRC\\mirc.exe:*:Enabled:mIRC"
"C:\\Program Files\\BitLord\\BitLord.exe"="C:\\Program Files\\BitLord\\BitLord.exe:*:Enabled:BitLord"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Documents and Settings\\User\\Local Settings\\Temp\\~os65.tmp\\ossproxy.exe"="C:\\Documents and Settings\\User\\Local Settings\\Temp\\~os65.tmp\\ossproxy.exe:*:Enabled:ossproxy.exe"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"c:\\windows\\system32\\rk.exe"="c:\\windows\\system32\\rk.exe:*:Enabled:rk.exe"
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Disabled:RealPlayer"
"C:\\WINDOWS\\system32\\rundll32.exe"="C:\\WINDOWS\\system32\\rundll32.exe:*:Enabled:Run a DLL as an App"
"C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Enabled:Internet Explorer"
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL"
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLAcsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLAcsd.exe:*:Enabled:AOL"
"C:\\Program Files\\Common Files\\Synacast\\SynaLive\\PE.exe"="C:\\Program Files\\Common Files\\Synacast\\SynaLive\\PE.exe:*:Enabled:PE"
"C:\\Program Files\\NetMeeting\\conf.exe"="C:\\Program Files\\NetMeeting\\conf.exe:*:Disabled:Windowsr NetMeetingr"
"C:\\Program Files\\TeVeo\\TeVeo VIDiO Suite\\Live\\TeVeoLive.exe"="C:\\Program Files\\TeVeo\\TeVeo VIDiO Suite\\Live\\TeVeoLive.exe:*:Disabled:TeVeoLive"
"C:\\Program Files\\Windows Media Player\\wmplayer.exe"="C:\\Program Files\\Windows Media Player\\wmplayer.exe:*:Enabled:Windows Media Player"
"C:\\Program Files\\PPLive\\PPLive.exe"="C:\\Program Files\\PPLive\\PPLive.exe:*:Enabled:PPLive"
"C:\\WINDOWS\\system32\\P2P Networking\\P2P Networking.exe"="C:\\WINDOWS\\system32\\P2P Networking\\P2P Networking.exe:*:Enabled:P2P Networking"
"C:\\Program Files\\Kazaa\\kazaa.exe"="C:\\Program Files\\Kazaa\\kazaa.exe:*:Enabled:Kazaa"
"C:\\Documents and Settings\\User\\Local Settings\\Temp\\Rar$EX02.562\\SopCast\\SopCast.exe"="C:\\Documents and Settings\\User\\Local Settings\\Temp\\Rar$EX02.562\\SopCast\\SopCast.exe:*:Enabled:SoP Client"
"C:\\Documents and Settings\\User\\Local Settings\\Temp\\Rar$EX02.453\\SopCast_062\\SopCast\\SopCast.exe"="C:\\Documents and Settings\\User\\Local Settings\\Temp\\Rar$EX02.453\\SopCast_062\\SopCast\\SopCast.exe:*:Enabled:SoP Client"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
"C:\\Documents and Settings\\User\\Local Settings\\Temp\\Rar$EX01.421\\SopCast_062\\SopCast\\SopCast.exe"="C:\\Documents and Settings\\User\\Local Settings\\Temp\\Rar$EX01.421\\SopCast_062\\SopCast\\SopCast.exe:*:Enabled:SoP Client"
"C:\\Documents and Settings\\User\\Local Settings\\Temp\\Rar$EX00.891\\SopCast_062\\SopCast\\SopCast.exe"="C:\\Documents and Settings\\User\\Local Settings\\Temp\\Rar$EX00.891\\SopCast_062\\SopCast\\SopCast.exe:*:Enabled:SoP Client"
"C:\\PROGRA~1\\pcast\\PODCAS~1\\PODCAS~1.EXE"="C:\\PROGRA~1\\pcast\\PODCAS~1\\PODCAS~1.EXE:*:Enabled:Share Streaming"
"C:\\PROGRA~1\\pcast\\PODCAS~1\\PODCAS~2.EXE"="C:\\PROGRA~1\\pcast\\PODCAS~1\\PODCAS~2.EXE:*:Enabled:Share Streaming"
"C:\\Program Files\\pcast\\PodcastbarMini\\PodcastBarMini.exe"="C:\\Program Files\\pcast\\PodcastbarMini\\PodcastBarMini.exe:*:Enabled:Share Streaming"
"C:\\Program Files\\PPMate\\PPMate\\ppmate.exe"="C:\\Program Files\\PPMate\\PPMate\\ppmate.exe:*:Enabled:PPMate"
"C:\\Program Files\\PPStream\\PPStream.exe"="C:\\Program Files\\PPStream\\PPStream.exe:*:Enabled:PPStream"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\AOL 9.0\\waol.exe"="C:\\Program Files\\AOL 9.0\\waol.exe:*:Enabled:AOL 9.0"
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL"
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLAcsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLAcsd.exe:*:Enabled:AOL"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"

Remaining Files :



Files with Hidden Attributes :

Fri 25 Apr 2003 49,221 A..H. --- "C:\Program Files\AOL 8.0\aolphx.exe"
Fri 25 Apr 2003 36,937 A..H. --- "C:\Program Files\AOL 8.0\aoltray.exe"
Fri 25 Apr 2003 40,960 A..H. --- "C:\Program Files\AOL 8.0\RBM.exe"
Fri 25 Apr 2003 237,633 A..H. --- "C:\Program Files\AOL 8.0\waol.exe"
Tue 22 Jun 2004 54,384 A..H. --- "C:\Program Files\AOL 9.0\aolphx.exe"
Tue 22 Jun 2004 156,784 A..H. --- "C:\Program Files\AOL 9.0\aoltray.exe"
Tue 22 Jun 2004 31,344 A..H. --- "C:\Program Files\AOL 9.0\RBM.exe"
Sat 1 Oct 2005 56 A.SHR --- "C:\WINDOWS\system32\5DCD1F4E2F.sys"
Sun 12 Oct 2003 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Fri 25 Apr 2003 49,223 A..H. --- "C:\Program Files\AOL 8.0\COMIT\cswitch.exe"
Sat 13 Nov 2004 37,376 A..H. --- "C:\Program Files\Common Files\Adobe\ESD\DLMCleanup.exe"
Sun 5 Oct 2003 1,206 A..HR --- "C:\Program Files\Common Files\Symantec Shared\Registry Backup\ccReg.reg"
Sun 5 Oct 2003 12,368 A..HR --- "C:\Program Files\Common Files\Symantec Shared\Registry Backup\CommonClient.reg"
Wed 11 Dec 2002 73,728 A.SH. --- "C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System\wmplayer.exe"
Sun 12 Oct 2003 4,348 ...H. --- "C:\Documents and Settings\User\My Documents\My Music\License Backup\drmv1key.bak"
Sat 13 Mar 2004 20 A..H. --- "C:\Documents and Settings\User\My Documents\My Music\License Backup\drmv1lic.bak"
Sun 12 Oct 2003 400 ...H. --- "C:\Documents and Settings\User\My Documents\My Music\License Backup\drmv2key.bak"
Sat 13 Mar 2004 1,536 A..H. --- "C:\Documents and Settings\User\My Documents\My Music\License Backup\drmv2lic.bak"
Fri 14 Oct 2005 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\81830fade50434252c160da6e86e315c\BIT1C8.tmp"
Sun 27 Aug 2006 6,358 A..H. --- "C:\Documents and Settings\User\Application Data\Microsoft\Office\Shortcut Bar\Des488.tmp"
Sun 27 Aug 2006 7,318 A..H. --- "C:\Documents and Settings\User\Application Data\Microsoft\Office\Shortcut Bar\Off480.tmp"
Sun 27 Aug 2006 31,798 A..H. --- "C:\Documents and Settings\User\Application Data\Microsoft\Office\Shortcut Bar\Pro484.tmp"
Mon 18 Sep 2006 8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\lock.tmp"

Finished!

and here is the hijack this log file
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:13:31, on 02/03/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1140573878\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] C:\Program Files\Voyager100Test\fts.exe
O4 - HKLM\..\Run: [GSICONEXE] gsicon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Lexmark 3100 Series] "C:\Program Files\Lexmark 3100 Series\lxbrbmgr.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [pbmini]
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: msmsgs.exe
O4 - Global Startup: PC Alert 4.lnk = C:\Program Files\MSI\PC Alert 4\PCAlert4.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework/control/en-US/activex/TmHcmsX.CAB
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} - http://www.cult3d.com/download/cult.cab
O16 - DPF: {52A5CD24-64C6-4BAF-A4EC-4D13F451763F} - https://www.cuworld.com/PIC/inner_pic/packages/CUworld.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - http://81.1.41.137/activex/AxisCamControl.cab
O16 - DPF: {99E10933-61C6-11D6-83CE-00D0B749C940} - http://www.tech-connect.com/ecsa/CSWord/CSWord.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697516} - http://www.nullsoft.com/nsv/embed/nsvplayx_vp6_mp3.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} - http://game19.zylomgames.com/activex/zylomloader.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{63247C4E-A29D-403A-B5CF-E96F96B1CB1C}: NameServer = 192.168.0.1,4.2.2.2
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - AOL LLC - (no file)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 7145 bytes

ok ive done everything you asked and still the icons are not there, am i doomed lol?


Post Extras: Print Post   Remind Me!   Notify Moderator  
ourwilly
HijackThis Helper


Reg'd: Sun
Posts: 2820
Loc: England.
Re: desktop icons and toolbar have disapeared [Re: sonobby1]
      #386746 - Sun Mar 02 2008 08:32 PM

Hello sonobby1

We have a lot of work to do here, So please try and work your way through these instructions.

1. Please look at This Post

As these are susceptible to various forms of malware. Please Uninstall all Peer 2 peer software using Add/Remove programs and then Right-Click on and delete the Peer to Peer folders from your system.



2. Click on: Start > Run and type in: services.msc Click "OK"

In the Services window look for AOL Spyware Protection Service

Select/highlight and right click the entry, and choose: Properties
On the General tab, under Service Status click the Stop button
Beside: Startup Type, in the drop menu, select: Disabled
Click "Apply" then "OK"


3. I would like you to now Download AVG Anti-Spyware v7.5 and save it to your Desktop <- (Important! Vista Users should install from that same location).
(This is Ewido 4.0 renamed and updated with a special "clean driver" for removing persistent malware.)
  • After download, double click on the file to launch the install process.
  • Choose a language, click "OK" and then click "Next".
  • Read the "License Agreement" and click "I Agree".
  • Accept default installation path: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5, click "Next", then click "Install".
  • After setup completes, click "Finish" to start the program automatically or launch AVG Anti-Spyware by double-clicking its icon on your desktop or in the system tray.
  • Connect to the Internet, go back to AVG Anti-Spyware, select the "Update" button and click "Start update". Wait until you see the "Update successful" message. If you are having problems with the updater, manually download and update with the AVG Anti-Spyware Full database installer.
  • Exit AVG Anti-Spyware when done - DO NOT perform a scan yet.


Reboot your computer in "SAFE MODE" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with AVG Anti-Spyware as follows:
  • Click on the "Scanner" button and choose the "Settings" tab.
  • Under "How to act?", click on "Recommended actions" and choose "Quarantine" to set default action for detected malware.
  • Under "How to Scan?", "Possibly unwanted software", and What to Scan?" leave all the default settings.
  • Under "Reports" select "Do not automatically generate reports".
  • Click the "Scan" tab to return to scanning options.
  • Click "Complete System Scan" to start.
  • When the scan has finished, it should automatically be set to Quarantine--if not click on Recommended Action and set it there.
  • You will also be presented with a list of infected objects found. Click "Apply all actions" to place the files in Quarantine.
IMPORTANT! Do not save the report before you have clicked the :Apply all actions button. If you do, the log that is created will indicate "No action taken", making it more difficult to interpret the report. So be sure you save it only AFTER clicking the "Apply all actions" button.
  • Click on "Save Report" to view all completed scans. Click on the most recent scan you performed, select "Save report as" and save to your desktop. The default file name will be in date/time format: Report-Scan-200706-1606. A copy of each report will be saved in C:\Documents and Settings\<user profile>\Application Data\Grisoft\AVG Antispyware 7.5\Reports.
  • If you installed AVG AS over a previous version, reports are saved in C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Reports\
  • If you are a Vista user, reports are saved in C:\Users\<username>\AppData\Roaming\Grisoft\AVG Antispyware 7.5\Reports\
Exit AVG Anti-Spyware when done, reboot normally and post the AVg log report and a new HijackThis log.

Thank you


Post Extras: Print Post   Remind Me!   Notify Moderator  
sonobby1
regular


Reg'd: Sat
Posts: 51
Re: desktop icons and toolbar have disapeared [Re: ourwilly]
      #386759 - Mon Mar 03 2008 12:25 AM

hi there our willy, ive read through what i have to do and as its a bit late now and i dont want to make any mistakes, i just want to get things right.
from my logs above can you tell me which p2p programs you want me to remove?
in add remove programs i think theres only 2 sopcast and i think bitlord.?
can you see any more that i need to remove before i start?
thanks for your time
si
ill start tomorrow evening uk time


Post Extras: Print Post   Remind Me!   Notify Moderator  
ourwilly
HijackThis Helper


Reg'd: Sun
Posts: 2820
Loc: England.
Re: desktop icons and toolbar have disapeared [Re: sonobby1]
      #386839 - Mon Mar 03 2008 07:05 PM

Hello sonobby1

Your Firewall is showing signs of eMule, P2P Networking + Kazaa if these have been removed then thats a good start.

I'll keep a look out for you posting the AVg log report and a new HijackThis log.

ourwilly


Post Extras: Print Post   Remind Me!   Notify Moderator  
sonobby1
regular


Reg'd: Sat
Posts: 51
Re: desktop icons and toolbar have disapeared [Re: ourwilly]
      #386897 - Tue Mar 04 2008 12:56 AM

hi our willy well i done the avg scan and all wennt well untill it finished , i applied all action and i got an warning.
it said
the file c;\program ...... and another one cannot be removed beacuse it is embedded in the archive. well i got 4 options, do you want to remove the whole archive, and the options were yes ,yes for all, no, no for all
i wasnt sure what to do so i said no. then it repeated itself with another file, and i said no again, i said no 3 times before i realise i was deleting all the bad files i think.
there was 150 bad files of which only 1 was a major threat i think. after them 3, i said yes to all and tthen it finished and i saved the log. i hope i havent messed up. any way here is the log file of avg.

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 00:33:07 04/03/2008

+ Scan result:



C:\Documents and Settings\All Users\Start Menu\Programs\Startup\msmsgs.exe -> Hijacker.Small : Cleaned with backup (quarantined).
C:\Program Files\Trend Micro\HijackThis\backups\backup-20080302-113527-197-msmsgs.exe -> Hijacker.Small : Cleaned with backup (quarantined).
C:\Program Files\auctiontypostoolbar.exe -> Not-A-Virus.Adware.Mostofate : Cleaned with backup (quarantined).
C:\Program Files\PestPatrol\Quarantine\20060630234343.zip/Documents and Settings/User/Cookies/user@247realmedia[2].txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.243:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.25:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.26:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.327:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.342:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.405:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.480:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.484:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.685:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.704:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\User\Cookies\user@112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\User\Cookies\user@122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\User\Cookies\user@aoleusearch.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\User\Cookies\user@aoluk.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\User\Cookies\user@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\User\Cookies\user@opodo.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\User\Cookies\user@paypal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\User\Cookies\user@premiumtv.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\User\Cookies\user@teletext.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\User\Cookies\user@trinitymirror.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20070831173005.zip/Documents and Settings/User/Cookies/user@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.741:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.742:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.743:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.744:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\User\Cookies\user@3.adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\User\Cookies\user@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\User\Cookies\user@ads.adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\User\Cookies\user@ads.addynamix[1].txt -> TrackingCookie.Addynamix : Cleaned.
C:\Documents and Settings\User\Cookies\user@rotator.adjuggler[2].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\User\Cookies\user@adrevolver[3].txt -> TrackingCookie.Adrevolver : Cleaned.
C:\Documents and Settings\User\Cookies\user@media.adrevolver[2].txt -> TrackingCookie.Adrevolver : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20060630234343.zip/Documents and Settings/User/Cookies/user@adtech[2].txt -> TrackingCookie.Adtech : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20070831173005.zip/Documents and Settings/User/Cookies/user@adtech[2].txt -> TrackingCookie.Adtech : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20060326234854.zip/Documents and Settings/User/Cookies/user@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20060630234343.zip/Documents and Settings/User/Cookies/user@advertising[2].txt -> TrackingCookie.Advertising : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20060914202249.zip/Documents and Settings/User/Cookies/user@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20070831173005.zip/Documents and Settings/User/Cookies/user@advertising[2].txt -> TrackingCookie.Advertising : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20060914202249.zip/Documents and Settings/User/Cookies/user@adviva[1].txt -> TrackingCookie.Adviva : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20070831173005.zip/Documents and Settings/User/Cookies/user@adviva[2].txt -> TrackingCookie.Adviva : Cleaned.
:mozilla.547:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.65:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20060326234854.zip/Documents and Settings/User/Cookies/user@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20060630234343.zip/Documents and Settings/User/Cookies/user@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20060914202249.zip/Documents and Settings/User/Cookies/user@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20070831173005.zip/Documents and Settings/User/Cookies/user@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20070831173005.zip/Documents and Settings/User/Cookies/user@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20070831173005.zip/Documents and Settings/User/Cookies/user@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.222:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Casinodelrio : Cleaned.
:mozilla.223:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Casinodelrio : Cleaned.
:mozilla.730:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Casinotropez : Cleaned.
C:\Documents and Settings\User\Cookies\user@connextra[2].txt -> TrackingCookie.Connextra : Cleaned.
:mozilla.952:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20060326234854.zip/Documents and Settings/User/Cookies/user@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20060630234343.zip/Documents and Settings/User/Cookies/user@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20060914202249.zip/Documents and Settings/User/Cookies/user@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20070831173005.zip/Documents and Settings/User/Cookies/user@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.840:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.848:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.855:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.881:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.884:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.891:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.909:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.921:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.938:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.983:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\User\Cookies\user@e-2dj6wakokmcpabo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\User\Cookies\user@e-2dj6waloqgdpgco.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\User\Cookies\user@e-2dj6walyulcpado.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\User\Cookies\user@e-2dj6wbk4elajeho.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\User\Cookies\user@e-2dj6wfkikpcjcaq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\User\Cookies\user@e-2dj6wfkyqicjaco.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\User\Cookies\user@e-2dj6wjmiqmazcbp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.351:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Etracker : Cleaned.
C:\Documents and Settings\User\Cookies\user@adopt.euroclick[1].txt -> TrackingCookie.Euroclick : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20060630234343.zip/Documents and Settings/User/Cookies/user@as1.falkag[1].txt -> TrackingCookie.Falkag : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20070831173005.zip/Documents and Settings/User/Cookies/user@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.905:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.908:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.917:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\User\Cookies\user@ehg-eset.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\User\Cookies\user@ehg-idgentertainment.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\User\Cookies\user@ehg-reed.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20060630234343.zip/Documents and Settings/User/Cookies/user@ehg-bskyb.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20060630234343.zip/Documents and Settings/User/Cookies/user@hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20070831173005.zip/Documents and Settings/User/Cookies/user@ehg-bskyb.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.715:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Information : Cleaned.
C:\Documents and Settings\User\Cookies\user@searchportal.information[1].txt -> TrackingCookie.Information : Cleaned.
:mozilla.185:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Lasvegasusacasino : Cleaned.
:mozilla.186:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Lasvegasusacasino : Cleaned.
:mozilla.707:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.789:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.59:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20060630234343.zip/Documents and Settings/User/Cookies/user@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20060914202249.zip/Documents and Settings/User/Cookies/user@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20070831173005.zip/Documents and Settings/User/Cookies/user@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.267:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned.
:mozilla.341:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Netflame : Cleaned.
:mozilla.592:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.593:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.594:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\User\Cookies\user@overture[1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\User\Cookies\user@ads.pointroll[1].txt -> TrackingCookie.Pointroll : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20070831173005.zip/Documents and Settings/User/Cookies/user@pro-market[2].txt -> TrackingCookie.Pro-market : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20060630234343.zip/Documents and Settings/User/Cookies/user@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20070831173005.zip/Documents and Settings/User/Cookies/user@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20070831173005.zip/Documents and Settings/User/Cookies/user@realmedia[1].txt -> TrackingCookie.Realmedia : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20070831173005.zip/Documents and Settings/User/Cookies/user@web4.realtracker[1].txt -> TrackingCookie.Realtracker : Cleaned.
:mozilla.365:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.366:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.367:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.368:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.369:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.370:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.371:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
C:\Documents and Settings\User\Cookies\user@revsci[1].txt -> TrackingCookie.Revsci : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20060630234343.zip/Documents and Settings/User/Cookies/user@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20060630234343.zip/Documents and Settings/User/Cookies/user@serving-sys[1].txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20060914202249.zip/Documents and Settings/User/Cookies/user@serving-sys[1].txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20070517221754.zip/Documents and Settings/User/Cookies/user@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20070831173005.zip/Documents and Settings/User/Cookies/user@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20070831173005.zip/Documents and Settings/User/Cookies/user@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.489:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.490:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.944:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20060326234854.zip/Documents and Settings/User/Cookies/user@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20060630234343.zip/Documents and Settings/User/Cookies/user@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20060914202249.zip/Documents and Settings/User/Cookies/user@statcounter[2].txt -> TrackingCookie.Statcounter : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20070831173005.zip/Documents and Settings/User/Cookies/user@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.572:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.573:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.574:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.575:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.576:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.971:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\User\Cookies\user@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20070831173005.zip/Documents and Settings/User/Cookies/user@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20070831173005.zip/Documents and Settings/User/Cookies/user@trafficmp[2].txt -> TrackingCookie.Trafficmp : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20070831173005.zip/Documents and Settings/User/Cookies/user@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20060914202249.zip/Documents and Settings/User/Cookies/user@statse.webtrendslive[2].txt -> TrackingCookie.Webtrendslive : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20070831173005.zip/Documents and Settings/User/Cookies/user@statse.webtrendslive[1].txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.89:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Yadro : Cleaned.
C:\Documents and Settings\User\Cookies\user@yadro[1].txt -> TrackingCookie.Yadro : Cleaned.
C:\Program Files\PestPatrol\Quarantine\20070831173005.zip/Documents and Settings/User/Cookies/user@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.112:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hgflsai9.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.


::Report end

and here is the hijack log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:53:10, on 04/03/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\vsnpstd3.exe
C:\Program Files\Common Files\AOL\1140573878\ee\AOLSoftware.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\wanmpsvc.exe
c:\program files\common files\aol\1140573878\ee\services\antiSpywareApp\ver2_0_12\AOLSP Scheduler.exe
c:\program files\common files\aol\1140573878\ee\aolsoftware.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1140573878\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] C:\Program Files\Voyager100Test\fts.exe
O4 - HKLM\..\Run: [GSICONEXE] gsicon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Lexmark 3100 Series] "C:\Program Files\Lexmark 3100 Series\lxbrbmgr.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [pbmini]
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: PC Alert 4.lnk = C:\Program Files\MSI\PC Alert 4\PCAlert4.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework/control/en-US/activex/TmHcmsX.CAB
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} - http://www.cult3d.com/download/cult.cab
O16 - DPF: {52A5CD24-64C6-4BAF-A4EC-4D13F451763F} - https://www.cuworld.com/PIC/inner_pic/packages/CUworld.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - http://81.1.41.137/activex/AxisCamControl.cab
O16 - DPF: {99E10933-61C6-11D6-83CE-00D0B749C940} - http://www.tech-connect.com/ecsa/CSWord/CSWord.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697516} - http://www.nullsoft.com/nsv/embed/nsvplayx_vp6_mp3.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} - http://game19.zylomgames.com/activex/zylomloader.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{63247C4E-A29D-403A-B5CF-E96F96B1CB1C}: NameServer = 192.168.0.1,4.2.2.2
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 7636 bytes

i hope i have done all you asked let me know m8
thanks for your t
time
si


Post Extras: Print Post   Remind Me!   Notify Moderator  
ourwilly
HijackThis Helper


Reg'd: Sun
Posts: 2820
Loc: England.
Re: desktop icons and toolbar have disapeared [Re: sonobby1]
      #386900 - Tue Mar 04 2008 05:55 AM

Hello sonobby1

Please visit this webpage for instructions for downloading and running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

This includes installing the Windows XP Recovery Console in case you have not installed it yet.

When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new HijackThis log

Thank you.


Post Extras: Print Post   Remind Me!   Notify Moderator  
sonobby1
regular


Reg'd: Sat
Posts: 51
Re: desktop icons and toolbar have disapeared [Re: ourwilly]
      #387015 - Tue Mar 04 2008 10:26 PM

hi our willy can you please bear with me for a few days. i just havent had time tonight, ive read what i have to do and its to late tonight to attampt that. I have a very important night ahead of me tomorow night studying for an exam so tomorrow is out also. Ill get back onto it on thursday, please forgive me for the inconvenience it may cause you.
regards
si


Post Extras: Print Post   Remind Me!   Notify Moderator  
sonobby1
regular


Reg'd: Sat
Posts: 51
Re: desktop icons and toolbar have disapeared [Re: sonobby1]
      #387225 - Thu Mar 06 2008 05:07 PM

hi our willy thank you for being patient, i think ive done what you asked so here is the combo fix log and a new hijack log.
i would like to add this is the first time my desktop and icons have stayed , they dissapeared for a few seconds when it restarted, but so far after 5 mins they are still there.ok here are the logs.

ComboFix 08-03-05.3 - User 2008-03-06 16:40:50.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1033.18.233 [GMT 0:00]
Running from: C:\Documents and Settings\User\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Common Files\{34F1E~1
C:\Program Files\Common Files\{34F1E~1\Bar888.dll
C:\Program Files\Common Files\{34F1E~1\UnInstall.exe
C:\Program Files\Common Files\{84F1E~1
C:\Program Files\montorgueil
C:\Program Files\montorgueil\14.03619
C:\Program Files\montorgueil\Oversexe_fellations\Oversexe_fellations.ico
C:\Program Files\montorgueil\Oversexe_fellations\Thumbs.db
C:\Program Files\update.exe
C:\Temp\sanR24
C:\WINDOWS\system32\_003713_.tmp.dll
C:\WINDOWS\system32\_003714_.tmp.dll
C:\WINDOWS\system32\_003715_.tmp.dll
C:\WINDOWS\system32\_003716_.tmp.dll
C:\WINDOWS\system32\_003723_.tmp.dll
C:\WINDOWS\system32\_003724_.tmp.dll
C:\WINDOWS\system32\_003725_.tmp.dll
C:\WINDOWS\system32\_003726_.tmp.dll
C:\WINDOWS\system32\_003727_.tmp.dll
C:\WINDOWS\system32\_003728_.tmp.dll
C:\WINDOWS\system32\_003735_.tmp.dll
C:\WINDOWS\system32\_003736_.tmp.dll
C:\WINDOWS\system32\_003737_.tmp.dll
C:\WINDOWS\system32\_003738_.tmp.dll
C:\WINDOWS\system32\_003740_.tmp.dll
C:\WINDOWS\system32\_003741_.tmp.dll
C:\WINDOWS\system32\_003744_.tmp.dll
C:\WINDOWS\system32\_003745_.tmp.dll
C:\WINDOWS\system32\_003747_.tmp.dll
C:\WINDOWS\system32\_003748_.tmp.dll
C:\WINDOWS\system32\_003749_.tmp.dll
C:\WINDOWS\system32\_003751_.tmp.dll
C:\WINDOWS\system32\_003752_.tmp.dll
C:\WINDOWS\system32\_003753_.tmp.dll
C:\WINDOWS\system32\_003754_.tmp.dll
C:\WINDOWS\system32\_003755_.tmp.dll
C:\WINDOWS\system32\_003762_.tmp.dll
C:\WINDOWS\system32\_003763_.tmp.dll
C:\WINDOWS\system32\_003764_.tmp.dll
C:\WINDOWS\system32\_003765_.tmp.dll
C:\WINDOWS\system32\_003767_.tmp.dll
C:\WINDOWS\system32\_003768_.tmp.dll
C:\WINDOWS\system32\_003771_.tmp.dll
C:\WINDOWS\system32\_003772_.tmp.dll
C:\WINDOWS\system32\_003774_.tmp.dll
C:\WINDOWS\system32\_003775_.tmp.dll
C:\WINDOWS\system32\_003776_.tmp.dll
C:\WINDOWS\system32\_003778_.tmp.dll
C:\WINDOWS\system32\_003779_.tmp.dll
C:\WINDOWS\system32\_003781_.tmp.dll
C:\WINDOWS\system32\_003785_.tmp.dll
C:\WINDOWS\system32\_003786_.tmp.dll
C:\WINDOWS\system32\_003788_.tmp.dll
C:\WINDOWS\system32\_003789_.tmp.dll
C:\WINDOWS\system32\_003791_.tmp.dll
C:\WINDOWS\system32\_003793_.tmp.dll
C:\WINDOWS\system32\_003794_.tmp.dll
C:\WINDOWS\system32\_003795_.tmp.dll
C:\WINDOWS\system32\_003796_.tmp.dll
C:\WINDOWS\system32\_003797_.tmp.dll
C:\WINDOWS\system32\_003800_.tmp.dll
C:\WINDOWS\system32\_003802_.tmp.dll
C:\WINDOWS\system32\_003803_.tmp.dll
C:\WINDOWS\system32\_003804_.tmp.dll
C:\WINDOWS\system32\_003808_.tmp.dll
C:\WINDOWS\system32\_003809_.tmp.dll
C:\WINDOWS\system32\_003810_.tmp.dll
C:\WINDOWS\system32\_003814_.tmp.dll
C:\WINDOWS\System32\awtsq.dll
C:\WINDOWS\system32\iDlo01
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\qstwa.ini
C:\WINDOWS\system32\qstwa.ini2

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\nm


((((((((((((((((((((((((( Files Created from 2008-02-06 to 2008-03-06 )))))))))))))))))))))))))))))))
.

2008-03-03 21:59 . 2008-03-03 21:59 <DIR> d-------- C:\Documents and Settings\User\Application Data\Grisoft
2008-03-03 21:59 . 2007-05-30 12:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-03-01 21:08 . 2008-03-01 21:08 812,344 --a------ C:\HJTInstall.exe
2008-03-01 20:59 . 2008-03-01 21:03 2,521 --a------ C:\xp_taskbar_desktop_fixall.vbs
2008-03-01 18:22 . 2008-03-01 18:22 <DIR> d-------- C:\WINDOWS\ERUNT
2008-03-01 18:02 . 2008-03-02 12:09 <DIR> d-------- C:\SDFix
2008-03-01 17:35 . 2002-05-14 12:08 20,540 --a------ C:\WINDOWS\system32\dllcache\admin.dll
2008-02-29 20:02 . 2008-03-06 16:49 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-29 20:02 . 2008-03-06 16:45 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-29 19:38 . 2008-03-06 16:41 <DIR> d-------- C:\Temp
2008-02-26 22:23 . 2008-02-26 22:23 5,564,979 --a------ C:\Program Files\xpmanager.exe
2008-02-12 00:24 . 2008-02-12 00:24 5,617,160 --a------ C:\Program Files\camfrog.exe
2008-02-08 23:32 . 2006-03-17 05:04 8,351,232 --a--c--- C:\WINDOWS\system32\dllcache\shell32.dll
2008-02-08 23:32 . 2004-08-20 22:01 700,928 --a------ C:\WINDOWS\system32\sxs.dll
2008-02-08 23:32 . 2004-08-20 22:01 700,928 --a--c--- C:\WINDOWS\system32\dllcache\sxs.dll
2008-02-08 23:32 . 2004-08-20 22:01 82,432 --a------ C:\WINDOWS\system32\fldrclnr.dll
2008-02-08 23:32 . 2004-08-20 22:01 82,432 --a--c--- C:\WINDOWS\system32\dllcache\fldrclnr.dll
2008-02-08 23:27 . 2004-03-30 01:48 36,864 --a------ C:\WINDOWS\system32\mf3216.dll
2008-02-08 23:27 . 2004-03-30 01:48 36,864 --a--c--- C:\WINDOWS\system32\dllcache\mf3216.dll
2008-02-08 23:26 . 2005-10-20 22:33 991,232 --a------ C:\WINDOWS\system32\esent.dll
2008-02-08 23:25 . 2004-10-12 16:22 170,112 --a--c--- C:\WINDOWS\system32\dllcache\rdbss.sys
2008-02-08 23:25 . 2004-10-28 01:29 92,160 --a--c--- C:\WINDOWS\system32\dllcache\cscdll.dll
2008-02-08 23:25 . 2004-10-28 01:29 92,160 --a------ C:\WINDOWS\system32\cscdll.dll
2008-02-08 23:20 . 2005-08-22 18:36 154,624 --a------ C:\WINDOWS\system32\netman.dll
2008-02-08 23:20 . 2005-08-23 03:51 111,104 --a------ C:\WINDOWS\system32\umpnpmgr.dll
2008-02-08 23:16 . 2005-06-15 17:50 285,184 --a------ C:\WINDOWS\system32\kerberos.dll
2008-02-08 23:16 . 2005-06-10 23:55 53,248 --a------ C:\WINDOWS\system32\spoolsv.exe
2008-02-08 23:15 . 2005-07-08 16:09 238,592 --a------ C:\WINDOWS\system32\tapisrv.dll
2008-02-08 23:15 . 2005-06-29 01:54 68,608 --a------ C:\WINDOWS\system32\mscms.dll
2008-02-08 23:12 . 2005-04-22 05:20 51,712 --a--c--- C:\WINDOWS\system32\dllcache\agentdpv.dll
2008-02-08 23:10 . 2005-03-02 18:20 53,760 --a------ C:\WINDOWS\system32\authz.dll
2008-02-08 23:07 . 2005-01-11 01:20 118,272 -----c--- C:\WINDOWS\system32\dllcache\dhtmled.ocx
2008-02-08 23:06 . 2004-12-07 19:34 79,872 -----c--- C:\WINDOWS\system32\dllcache\srvsvc.dll
2008-02-08 23:05 . 2004-11-16 21:32 68,096 --a------ C:\WINDOWS\system32\hlink.dll
2008-02-08 23:05 . 2004-11-16 21:32 68,096 --a--c--- C:\WINDOWS\system32\dllcache\hlink.dll
2008-02-08 23:02 . 2004-10-28 18:06 201,216 -----c--- C:\WINDOWS\system32\dllcache\wordpad.exe
2008-02-08 23:01 . 2004-10-28 01:29 681,984 -----c--- C:\WINDOWS\system32\dllcache\lsasrv.dll
2008-02-08 23:01 . 2004-11-17 17:57 493,056 --a------ C:\WINDOWS\system32\hypertrm.dll
2008-02-08 23:01 . 2004-10-28 01:29 116,736 -----c--- C:\WINDOWS\system32\dllcache\shsvcs.dll
2008-02-08 23:00 . 2004-10-15 21:01 577,536 --a------ C:\WINDOWS\system32\mlang.dll
2008-02-08 23:00 . 2004-10-15 21:01 577,536 -----c--- C:\WINDOWS\system32\dllcache\mlang.dll
2008-02-07 21:13 . 2008-02-07 21:20 <DIR> d-------- C:\Program Files\SlySoft
2008-02-07 21:08 . 2008-02-07 21:08 9,868,672 --a------ C:\Program Files\Alcohol120_trial_1[1].9.7.6022.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-06 16:49 --------- d-----w C:\Program Files\PestPatrol
2008-03-06 09:36 --------- d-----w C:\Documents and Settings\User\Application Data\AVG7
2008-03-01 21:08 --------- d-----w C:\Program Files\Trend Micro
2008-02-23 16:50 --------- d-----w C:\Program Files\AOL 9.0
2008-02-21 18:57 --------- d-----w C:\Program Files\Common Files\aolshare
2008-02-21 18:57 --------- d-----w C:\Program Files\Common Files\AOL
2008-02-10 15:59 1,362,977 ----a-w C:\Program Files\BitLord_1.01.exe
2008-02-10 13:57 --------- d-----w C:\Program Files\SopCast
2008-02-10 10:39 --------- d-----w C:\Program Files\TVUPlayer
2008-02-07 21:57 --------- d-----w C:\Program Files\XviD
2008-02-05 18:22 --------- d-----w C:\Program Files\Easy MPEG AVI DIVX WMV RM to DVD
2008-02-04 20:49 6,033,094 ----a-w C:\Program Files\easy_video_to_dvd.exe
2008-01-27 18:19 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-26 23:44 1,528,418 ----a-w C:\Program Files\revosetup.exe
2008-01-26 23:40 1,709,019 ----a-w C:\Program Files\MoffCalc2Setup.exe
2008-01-21 23:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\TVU networks
2008-01-20 23:05 100,274 ----a-w C:\Program Files\onecentauction.pdf
2008-01-20 18:52 23,405,072 ----a-w C:\Program Files\AdbeRdr811_en_US.exe
2008-01-17 22:54 --------- d-----w C:\Program Files\Ulead Systems
2008-01-17 22:52 --------- d--h--w C:\Program Files\Zero G Registry
2008-01-17 22:50 --------- d-----w C:\Program Files\Oront Burning Kit 2
2008-01-17 22:48 --------- d-----w C:\Program Files\mIRC
2008-01-11 22:45 --------- d-----w C:\Documents and Settings\User\Application Data\Obsidium
2008-01-11 22:43 6,143,310 ----a-w C:\Program Files\burningkit2_basic.exe
2008-01-10 23:27 287,240 ----a-w C:\Program Files\dxwebsetup.exe
2008-01-10 23:26 15,452,536 ----a-w C:\Program Files\IE7-WindowsXP-x86-enu.exe
2008-01-10 23:25 1,446,464 ----a-w C:\Program Files\Silverlight.exe
2007-12-31 13:14 18,067,416 ----a-w C:\Program Files\turbo lister.exe
2007-12-30 19:54 10,178,247 ----a-w C:\Program Files\orlRNM450e_enu.exe
2007-12-21 21:17 2,003,176 ----a-w C:\Program Files\WindowsInstaller-KB884016-v2-x86.exe
2007-12-12 00:25 53,143 ----a-w C:\Program Files\media.htm
2007-10-07 14:08 91,346,756 ----a-w C:\Program Files\diagnostic disc.exe
2007-09-29 12:09