PDA

View Full Version : Virtumonde, Smitfraud, god knows what else


landex21
2007-09-23, 21:05
I have been engaging in unsafe surfing and am paying for it. Please help!

Kaspersky Results


Sunday, September 23, 2007 2:05:38 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.1
Kaspersky Anti-Virus database last update: 23/09/2007
Kaspersky Anti-Virus database records: 422601
Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true
Scan Target My Computer
A:\
C:\
D:\
E:\
F:\
Scan Statistics
Total number of scanned objects 58730
Number of viruses found 23
Number of infected objects 74
Number of suspicious objects 4
Duration of the scan process 01:11:21

Infected Object Name Virus Name Last Action
C:\check_LSA7.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-10292006-165429.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumonde1.zip/winBB.tmp.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumonde1.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Yazzle.zip/Yazzle1162OinUninstaller.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Yazzle.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\329806C3.tmp Infected: not-a-virus:AdWare.Win32.Virtumonde.ej skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\33C41D78.exe Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\33CE1B6E.exe Infected: Trojan.Win32.Agent.vg skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\37AE1DD2.exe Infected: Backdoor.Win32.Agent.aly skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\44C2129C.exe Infected: Trojan.Win32.Obfuscated.ev skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4CC83BC8.exe Infected: Trojan-Downloader.Win32.Agent.avm skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4CCB65C4.tmp Infected: Packed.Win32.Klone.g skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\60180AB1.tmp Infected: not-a-virus:AdWare.Win32.Virtumonde.ej skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\614B755F.exe Infected: Trojan.Win32.Agent.vg skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\62E45366.exe/data0002 Infected: Trojan-Downloader.Win32.PurityScan.dc skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\62E45366.exe NSIS: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\62E45366.exe CryptFF: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\791925A8.def Infected: not-a-virus:AdWare.Win32.180Solutions.ax skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\4646FFA2.TMP Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\837228F7.TMP Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\925DE04E.TMP Object is locked skipped
C:\Documents and Settings\DEFAULT\Application Data\Mozilla\Firefox\Profiles\prfl0f5k.default\cert8.db Object is locked skipped
C:\Documents and Settings\DEFAULT\Application Data\Mozilla\Firefox\Profiles\prfl0f5k.default\formhistory.dat Object is locked skipped
C:\Documents and Settings\DEFAULT\Application Data\Mozilla\Firefox\Profiles\prfl0f5k.default\history.dat Object is locked skipped
C:\Documents and Settings\DEFAULT\Application Data\Mozilla\Firefox\Profiles\prfl0f5k.default\key3.db Object is locked skipped
C:\Documents and Settings\DEFAULT\Application Data\Mozilla\Firefox\Profiles\prfl0f5k.default\parent.lock Object is locked skipped
C:\Documents and Settings\DEFAULT\Application Data\Mozilla\Firefox\Profiles\prfl0f5k.default\search.sqlite Object is locked skipped
C:\Documents and Settings\DEFAULT\Application Data\Mozilla\Firefox\Profiles\prfl0f5k.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\DEFAULT\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\DEFAULT\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\DEFAULT\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\DEFAULT\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\DEFAULT\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{ADDBFB9C-CBDE-4D17-98C5-B2A761B40C18} Object is locked skipped
C:\Documents and Settings\DEFAULT\Local Settings\Application Data\Mozilla\Firefox\Profiles\prfl0f5k.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\DEFAULT\Local Settings\Application Data\Mozilla\Firefox\Profiles\prfl0f5k.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\DEFAULT\Local Settings\Application Data\Mozilla\Firefox\Profiles\prfl0f5k.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\DEFAULT\Local Settings\Application Data\Mozilla\Firefox\Profiles\prfl0f5k.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\DEFAULT\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\DEFAULT\Local Settings\History\History.IE5\MSHist012007092320070924\index.dat Object is locked skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temp\1664.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temp\16agent.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temp\32sys.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temp\6416.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temp\agent16.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temp\agent32.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temp\gosC6.tmp Infected: Trojan.Win32.Dialer.qn skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temp\hostwin.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temp\look32.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temp\monhost.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temp\monlook.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temp\monsyn.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temp\powerserver.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temp\sv64.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temp\svagent.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temp\svwin.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temp\synmon.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temp\synpower.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temp\sys64.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temp\sysmon.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temp\syssv.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temp\syswin.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temp\win64.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temp\winCD.tmp.exe Infected: Trojan-Downloader.Win32.VB.bjr skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temp\winlook.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temporary Internet Files\Content.IE5\416BOTE7\lkjh[1] Infected: Trojan-Downloader.Win32.Tiny.id skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temporary Internet Files\Content.IE5\C9AJ05AR\xc60[1].exe Infected: Trojan.Win32.Dialer.qn skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temporary Internet Files\Content.IE5\CH6FGHAJ\hlpsrv[1].exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temporary Internet Files\Content.IE5\K9EV0DE3\xc42[1].exe/data0002 Infected: Trojan-Downloader.Win32.PurityScan.eg skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temporary Internet Files\Content.IE5\K9EV0DE3\xc42[1].exe NSIS: infected - 1 skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temporary Internet Files\Content.IE5\MOFP9EZS\xcd23[1].exe Infected: Trojan-Downloader.Win32.VB.bjr skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temporary Internet Files\Content.IE5\OLAZSD6R\valera[1] Infected: Trojan.Win32.Agent.bck skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temporary Internet Files\Content.IE5\OND3EIR9\antzom[1].exe Infected: Trojan.Win32.Dialer.qn skipped
C:\Documents and Settings\DEFAULT\Local Settings\Temporary Internet Files\Content.IE5\Q1HANYTW\xc23[1].exe Infected: Trojan-Downloader.Win32.Alphabet.gen skipped
C:\Documents and Settings\DEFAULT\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\DEFAULT\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\IBMTOOLS\APPS\RRPC\RRPC\superinstall.EXE/IGWSE2SAS2.1WM2.1.EXE/HOTVIEW.EXE Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.333 skipped
C:\IBMTOOLS\APPS\RRPC\RRPC\superinstall.EXE/IGWSE2SAS2.1WM2.1.EXE/VNCHOOKS.DLL Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.333 skipped
C:\IBMTOOLS\APPS\RRPC\RRPC\superinstall.EXE/IGWSE2SAS2.1WM2.1.EXE Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.333 skipped
C:\IBMTOOLS\APPS\RRPC\RRPC\superinstall.EXE ZIP: infected - 3 skipped
C:\Program Files\hlpsrv.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\System Volume Information\_restore{29FD9B63-4F58-4DB0-B2C4-8709D5244F27}\RP410\A0041526.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\System Volume Information\_restore{29FD9B63-4F58-4DB0-B2C4-8709D5244F27}\RP410\A0042506.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\System Volume Information\_restore{29FD9B63-4F58-4DB0-B2C4-8709D5244F27}\RP410\A0042523.dll Infected: Trojan.Win32.Dialer.qn skipped
C:\System Volume Information\_restore{29FD9B63-4F58-4DB0-B2C4-8709D5244F27}\RP410\A0042525.exe Infected: Trojan-Downloader.Win32.Alphabet.gen skipped
C:\System Volume Information\_restore{29FD9B63-4F58-4DB0-B2C4-8709D5244F27}\RP410\A0042527.exe Infected: Trojan-Downloader.Win32.PurityScan.eg skipped
C:\System Volume Information\_restore{29FD9B63-4F58-4DB0-B2C4-8709D5244F27}\RP410\A0042542.exe Infected: Virus.Win32.Virut.q skipped
C:\System Volume Information\_restore{29FD9B63-4F58-4DB0-B2C4-8709D5244F27}\RP410\A0042543.exe Infected: Trojan.Win32.Inject.ff skipped
C:\System Volume Information\_restore{29FD9B63-4F58-4DB0-B2C4-8709D5244F27}\RP410\A0042552.exe/data.rar/keygen.exe Infected: Trojan.Win32.Inject.ff skipped
C:\System Volume Information\_restore{29FD9B63-4F58-4DB0-B2C4-8709D5244F27}\RP410\A0042552.exe/data.rar/crack.exe Infected: Trojan-Downloader.Win32.Agent.dlu skipped
C:\System Volume Information\_restore{29FD9B63-4F58-4DB0-B2C4-8709D5244F27}\RP410\A0042552.exe/data.rar/serial.exe Infected: Trojan.Win32.Dialer.vc skipped
C:\System Volume Information\_restore{29FD9B63-4F58-4DB0-B2C4-8709D5244F27}\RP410\A0042552.exe/data.rar/install.exe Infected: Virus.Win32.Virut.q skipped
C:\System Volume Information\_restore{29FD9B63-4F58-4DB0-B2C4-8709D5244F27}\RP410\A0042552.exe/data.rar Infected: Virus.Win32.Virut.q skipped
C:\System Volume Information\_restore{29FD9B63-4F58-4DB0-B2C4-8709D5244F27}\RP410\A0042552.exe RarSFX: infected - 5 skipped
C:\System Volume Information\_restore{29FD9B63-4F58-4DB0-B2C4-8709D5244F27}\RP410\A0042557.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\System Volume Information\_restore{29FD9B63-4F58-4DB0-B2C4-8709D5244F27}\RP410\A0042568.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\System Volume Information\_restore{29FD9B63-4F58-4DB0-B2C4-8709D5244F27}\RP411\A0042570.dll Infected: Trojan-Downloader.Win32.Agent.dlu skipped
C:\System Volume Information\_restore{29FD9B63-4F58-4DB0-B2C4-8709D5244F27}\RP411\A0042571.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
C:\System Volume Information\_restore{29FD9B63-4F58-4DB0-B2C4-8709D5244F27}\RP412\A0043568.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped
C:\System Volume Information\_restore{29FD9B63-4F58-4DB0-B2C4-8709D5244F27}\RP412\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\mgrs.exe Infected: Trojan-Downloader.Win32.Alphabet.gen skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\dnmtiqoc.exe Infected: Trojan.Win32.Agent.bck skipped
C:\WINDOWS\system32\drvvov.dll Infected: Trojan.Win32.Dialer.qn skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
Scan process completed.
landex21
2007-09-23, 21:07
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 2:55:32 PM, on 9/23/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\gearsec.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\mgrs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\DEFAULT\Desktop\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=56626&homepage=http://securityresponse.symantec.com/avcenter/fix_homepage/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {441DB29F-007B-78A3-2FB5-0895C1F3DCC9} - C:\WINDOWS\system32\cbaqbo.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {6CAB6AA9-2536-60E6-F302-06BE133D9C67} - C:\WINDOWS\system32\ohsgfkj.dll (file missing)
O2 - BHO: (no name) - {7378296C-1FA1-46CC-927A-059E501AFAE4} - C:\Program Files\Zkouxtdr\aedbixuq.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {88282EB1-2AD1-4F4F-9BCB-5AAE6F45F7A0} - C:\WINDOWS\system32\vturo.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [UIUCU] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\UIUCU.EXE -CLEAN_UP -S
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [UC_Start] C:\IBMTools\Updater\ucstartup.exe
O4 - HKLM\..\Run: [slapkdeh] rundll32.exe "C:\Program Files\slapkdeh\spexqzwh.dll",Init
O4 - HKLM\..\Run: [yhmbqtsb] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\yhmbqtsb.dll"
O4 - HKLM\..\Run: [smgr] mgrs.exe
O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\vmtoluru.dll",sitypnow
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O11 - Options group: [JAVA_IBM] Java (IBM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O20 - Winlogon Notify: khffgeb - C:\WINDOWS\SYSTEM32\khffgeb.dll
O20 - Winlogon Notify: winjyp32 - winjyp32.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: gearsec - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 5539 bytes