Bennie Tiller - 06-11-15 17:57:37.53 Service Pack 2 ComboFix 06.11.9 - Running from: "C:\Documents and Settings\Bennie Tiller\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Program Files\outlook C:\Program Files\Common Files\{C846E924-03E4-1033-0405-010504130001} ((((((((((((((((((((((((((((((( Files Created from 2006-10-15 to 2006-11-15 )))))))))))))))))))))))))))))))))) 2006-11-15 16:22 650 --a------ C:\WINDOWS\system32\tmp.reg 2006-11-15 16:22 53,248 --a------ C:\WINDOWS\system32\Process.exe 2006-11-15 16:22 40,960 --a------ C:\WINDOWS\system32\swsc.exe 2006-11-15 16:22 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2006-11-15 16:22 135,168 --a------ C:\WINDOWS\system32\swreg.exe 2006-11-15 13:50 121,856 --------- C:\WINDOWS\system32\xmllite.dll 2006-11-15 13:00 24,576 --a------ C:\WINDOWS\system32\STKIT432.DLL 2006-11-08 00:02 68,888 --a------ C:\WINDOWS\system32\xinput1_3.dll 2006-11-08 00:02 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll 2006-11-08 00:02 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll 2006-11-08 00:02 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll 2006-11-08 00:02 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll 2006-11-08 00:02 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2006-11-08 00:02 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll 2006-11-07 21:18 2,368 --a------ C:\WINDOWS\system32\SVKP.sys 2006-11-02 19:35 737,280 --a------ C:\WINDOWS\iun6002.exe 2006-11-02 19:33 57,344 --a------ C:\WINDOWS\system32\WNASPINT.DLL 2006-11-02 19:10 81,920 --a------ C:\WINDOWS\system32\viscomwave.dll 2006-11-02 19:10 643,072 --a------ C:\WINDOWS\system32\DVDProX2.dll 2006-11-02 19:10 339,968 --a------ C:\WINDOWS\system32\MP3EncX.dll 2006-11-02 19:10 28,672 --a------ C:\WINDOWS\system32\SmartMenuXP.dll 2006-11-02 19:10 139,264 --a------ C:\WINDOWS\system32\voltoCDX.dll 2006-11-02 19:10 1,110,016 --a------ C:\WINDOWS\system32\NMSDVDXU.dll 2006-11-01 01:16 344,064 --a------ C:\WINDOWS\system32\MSVCR70.DLL 2006-10-27 23:44 36,644 --------- C:\WINDOWS\system32\drivers\RapFile.sys 2006-10-27 23:44 24,344 --------- C:\WINDOWS\system32\drivers\RapNet.sys 2006-10-27 23:44 10 --a------ C:\WINDOWS\system32\drivers\tmbi.sys 2006-10-27 20:52 314 --a------ C:\avp_remove.reg 2006-10-27 18:54 94,968 --a------ C:\WINDOWS\system32\DCal.dll 2006-10-27 18:54 89,360 --a------ C:\WINDOWS\system32\VB5DB.DLL 2006-10-27 18:54 77,824 --a------ C:\WINDOWS\system32\Dwspy36.dll 2006-10-27 18:54 68,100 --a------ C:\WINDOWS\system32\Cheetah2.DLL 2006-10-27 18:54 61,440 --a------ C:\WINDOWS\system32\BPSInj36.dll 2006-10-27 18:54 577,536 --a------ C:\WINDOWS\system32\BPSTer36.dll 2006-10-27 18:54 430,080 --a------ C:\WINDOWS\system32\Msrepl35.dll 2006-10-27 18:54 32,768 --a------ C:\WINDOWS\system32\ffJmpWeb.dll 2006-10-27 18:54 29,696 --a------ C:\WINDOWS\system32\madTool.dll 2006-10-27 18:54 27,648 --a------ C:\WINDOWS\system32\madSetWindowLong.dll 2006-10-27 18:54 262,144 --a------ C:\WINDOWS\system32\Msrd2x35.dll 2006-10-27 18:54 24,848 --a------ C:\WINDOWS\system32\Msjter35.dll 2006-10-27 18:54 123,664 --a------ C:\WINDOWS\system32\Msjint35.dll 2006-10-27 18:54 1,056,768 --a------ C:\WINDOWS\system32\Msjet35.dll 2006-10-27 18:04 1,060,864 --a--c--- C:\WINDOWS\system32\MFC71.dll 2006-10-27 16:20 307,200 --a-s---- C:\WINDOWS\system32\InterceptHelper.dll 2006-10-27 16:20 176,128 --a-s---- C:\WINDOWS\system32\Interceptor.dll 2006-10-24 20:09 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll 2006-10-24 20:02 21,840 --a------ C:\WINDOWS\system32\SIntfNT.dll 2006-10-24 20:02 17,212 --a------ C:\WINDOWS\system32\SIntf32.dll 2006-10-24 20:02 12,067 --a------ C:\WINDOWS\system32\SIntf16.dll 2006-10-17 13:33 6,049,280 --------- C:\WINDOWS\system32\ieframe.dll 2006-10-17 13:33 50,688 --------- C:\WINDOWS\system32\msfeedsbs.dll 2006-10-17 13:33 458,752 --------- C:\WINDOWS\system32\msfeeds.dll 2006-10-17 13:33 180,736 --------- C:\WINDOWS\system32\ieui.dll 2006-10-17 13:05 206,336 --------- C:\WINDOWS\system32\WinFXDocObj.exe 2006-10-17 13:01 13,312 --a------ C:\WINDOWS\system32\ieudinit.exe 2006-10-17 12:58 61,952 --------- C:\WINDOWS\system32\icardie.dll 2006-10-17 12:58 12,288 --------- C:\WINDOWS\system32\msfeedssync.exe 2006-10-17 12:57 266,752 --------- C:\WINDOWS\system32\iertutil.dll 2006-10-17 12:27 380,928 --------- C:\WINDOWS\system32\ieapfltr.dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-11-15 17:58 -------- d-------- C:\Program Files\Common Files 2006-11-15 16:04 -------- d-------- C:\Program Files\SpyWall 2006-11-15 15:25 -------- d-------- C:\Program Files\Internet Explorer 2006-11-15 14:02 -------- d-------- C:\Program Files\1st Registry Repair 2006-11-15 13:31 -------- d-------- C:\Program Files\Morpheus 2006-11-15 13:25 -------- d-------- C:\Program Files\Eusing Free Registry Cleaner 2006-11-15 13:14 -------- d-------- C:\Program Files\Spyware Doctor 2006-11-15 13:00 -------- d-------- C:\Program Files\Registry Mechanic 2006-11-15 12:04 -------- d-------- C:\Program Files\Registry Medic 2006-11-14 19:12 61072 --a------ C:\WINDOWS\system32\drivers\klick.sys 2006-11-14 19:12 59536 --a------ C:\WINDOWS\system32\drivers\klin.sys 2006-11-14 19:05 -------- d-------- C:\Program Files\Lavasoft 2006-11-14 19:05 -------- d-------- C:\Documents and Settings\Bennie Tiller\Application Data\Lavasoft 2006-11-14 18:11 -------- d-------- C:\Program Files\Kaspersky Lab 2006-11-14 17:17 -------- d-------- C:\Documents and Settings\Bennie Tiller\Application Data\MySpace 2006-11-14 17:16 -------- d-------- C:\Program Files\MySpace 2006-11-14 17:03 -------- d-------- C:\Program Files\Fake Webcam 2006-11-14 00:35 -------- d-------- C:\Program Files\Windows Media Components 2006-11-08 02:34 -------- d-------- C:\Program Files\JoWooD 2006-11-06 22:11 -------- d-------- C:\Program Files\InstallShield Installation Information 2006-11-06 20:33 -------- d-------- C:\Program Files\AIM 2006-11-06 20:30 -------- d-------- C:\Program Files\AOD 2006-11-06 15:42 -------- d-------- C:\Program Files\Cheetah Burner 2006-10-31 19:18 -------- d-------- C:\Program Files\Tenebril SEP 2006-10-28 00:16 -------- d-------- C:\Program Files\Comodo 2006-10-27 21:51 2560 --a--c--- C:\WINDOWS\system32\BitCometRes.dll 2006-10-27 18:56 -------- d-------- C:\Program Files\PowerTools 12 2006-10-27 18:04 -------- d-------- C:\Program Files\Alwil Software 2006-10-27 16:20 -------- d-------- C:\Program Files\GhostSurf 2006 Platinum 2006-10-27 16:20 -------- d-------- C:\Documents and Settings\Bennie Tiller\Application Data\Tenebril 2006-10-27 16:16 -------- d-------- C:\Program Files\Trustix 2006-10-27 16:13 -------- d-------- C:\Documents and Settings\Bennie Tiller\Application Data\Comodo 2006-10-23 02:05 -------- d-------- C:\Program Files\Messenger 2006-10-23 02:04 -------- d-------- C:\Program Files\Windows Media Player 2006-10-23 01:59 -------- d-------- C:\Program Files\Outlook Express 2006-10-23 01:59 -------- d-------- C:\Program Files\Common Files\System 2006-10-21 23:13 -------- d-------- C:\Program Files\IGN 2006-10-21 23:13 -------- d-------- C:\Documents and Settings\Bennie Tiller\Application Data\iMesh 2006-10-17 13:33 413696 --a------ C:\WINDOWS\system32\vbscript.dll 2006-10-17 13:33 231424 --a------ C:\WINDOWS\system32\webcheck.dll 2006-10-17 13:33 156160 --a------ C:\WINDOWS\system32\msls31.dll 2006-10-17 13:06 78336 --a------ C:\WINDOWS\system32\ieencode.dll 2006-10-17 13:05 40960 --a------ C:\WINDOWS\system32\licmgr10.dll 2006-10-17 13:05 105984 --a------ C:\WINDOWS\system32\url.dll 2006-10-17 13:04 101376 --a------ C:\WINDOWS\system32\occache.dll 2006-10-17 13:03 17408 --a------ C:\WINDOWS\system32\corpol.dll 2006-10-17 13:01 71680 --a------ C:\WINDOWS\system32\admparse.dll 2006-10-17 13:01 55296 --a------ C:\WINDOWS\system32\iesetup.dll 2006-10-17 13:01 382976 --a------ C:\WINDOWS\system32\iedkcs32.dll 2006-10-17 13:01 229376 --a------ C:\WINDOWS\system32\ieaksie.dll 2006-10-17 13:01 152064 --a------ C:\WINDOWS\system32\ieakeng.dll 2006-10-17 13:00 54784 --a------ C:\WINDOWS\system32\ie4uinit.exe 2006-10-17 13:00 43008 --a------ C:\WINDOWS\system32\iernonce.dll 2006-10-17 13:00 123904 --a------ C:\WINDOWS\system32\advpack.dll 2006-10-17 12:57 36352 --a------ C:\WINDOWS\system32\imgutil.dll 2006-10-17 12:56 45568 --a------ C:\WINDOWS\system32\mshta.exe 2006-10-17 12:28 48128 --a------ C:\WINDOWS\system32\mshtmler.dll 2006-10-17 12:23 161792 --a------ C:\WINDOWS\system32\ieakui.dll 2006-10-13 07:35 65536 --a------ C:\WINDOWS\system32\nwwks.dll 2006-10-13 07:35 64000 --a------ C:\WINDOWS\system32\nwapi32.dll 2006-10-13 07:35 142336 --a------ C:\WINDOWS\system32\nwprovau.dll 2006-10-13 05:23 163584 --a------ C:\WINDOWS\system32\drivers\nwrdr.sys 2006-10-02 14:04 806912 --a--c--- C:\WINDOWS\system32\divx_xx0c.dll 2006-10-02 14:04 806912 --a--c--- C:\WINDOWS\system32\divx_xx07.dll 2006-10-02 14:04 790528 --a--c--- C:\WINDOWS\system32\divx_xx11.dll 2006-10-02 14:04 635486 --a------ C:\WINDOWS\system32\DivX.dll 2006-09-13 00:01 1084416 --a------ C:\WINDOWS\system32\msxml3.dll 2006-09-06 17:43 22752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2006-08-25 10:45 617472 --a------ C:\WINDOWS\system32\comctl32.dll 2006-08-21 07:21 16896 --a------ C:\WINDOWS\system32\fltlib.dll 2006-08-21 04:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe 2006-08-17 07:28 721920 --a------ C:\WINDOWS\system32\lsasrv.dll 2006-08-17 07:28 132096 --a------ C:\WINDOWS\system32\wkssvc.dll 2006-08-16 06:58 100352 --a------ C:\WINDOWS\system32\6to4svc.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background" "Yahoo! Pager"="\"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe\" -quiet" "AIM"="C:\\Program Files\\AIM\\aim.exe -cnetwait.odl" "MySpaceIM"="\"C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe\"" "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "kav"="\"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 6.0\\avp.exe\"" @="" "GhostSurf Reminder"="\"C:\\Program Files\\GhostSurf 2006 Platinum\\Privacy Control Center.exe\" reminder" "RegistryMechanic"="" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000005 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] "{C846E924-03E4-1033-0405-010504130001}"="C:\\WINDOWS\\SoftwareDistribution\\Download\\b15b843ee2a6cbca76875f1244f36866\\update\\Update.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^GhostSurf proxy.lnk] "backup"="C:\\WINDOWS\\pss\\GhostSurf proxy.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\GHOSTS~1\\Proxy.exe " "item"="GhostSurf proxy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SpyCatcher Protector.lnk] "backup"="C:\\WINDOWS\\pss\\SpyCatcher Protector.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\GHOSTS~1\\PROTEC~1.exe " "item"="SpyCatcher Protector" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Bennie Tiller^Start Menu^Programs^Startup^Morpheus.lnk] "backup"="C:\\WINDOWS\\pss\\Morpheus.lnkStartup" "location"="Startup" "command"="C:\\PROGRA~1\\Morpheus\\Morpheus.exe -min" "item"="Morpheus" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Bennie Tiller^Start Menu^Programs^Startup^Neverwinter Nights Registration.lnk] "backup"="C:\\WINDOWS\\pss\\Neverwinter Nights Registration.lnkStartup" "location"="Startup" "item"="Neverwinter Nights Registration" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Bennie Tiller^Start Menu^Programs^Startup^Scheduler.lnk] "backup"="C:\\WINDOWS\\pss\\Scheduler.lnkStartup" "location"="Startup" "command"="C:\\PROGRA~1\\GHOSTS~1\\SCHEDU~1.exe " "item"="Scheduler" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="" "hkey"="HKLM" "command"="" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="aim" "hkey"="HKCU" "command"="C:\\PROGRA~1\\AIM\\aim.exe -cnetwait.odl" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AOL" "hkey"="HKCU" "command"="\"C:\\Program Files\\America Online 9.0\\AOL.EXE\" -b" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Spyware Protection] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AOLSP Scheduler" "hkey"="HKLM" "command"="\"C:\\PROGRA~1\\COMMON~1\\AOL\\AOLSPY~1\\AOLSP Scheduler.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AOLDial" "hkey"="HKLM" "command"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI DeviceDetect] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ATIDtct" "hkey"="HKLM" "command"="C:\\Program Files\\ATI Multimedia\\main\\ATIDtct.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI Launchpad] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="launchpd" "hkey"="HKCU" "command"="\"C:\\Program Files\\ATI Multimedia\\main\\launchpd.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI Remote Control] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ATIRW" "hkey"="HKCU" "command"="C:\\Program Files\\ATI Multimedia\\RemCtrl\\ATIRW.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="atiptaxx" "hkey"="HKLM" "command"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dlmMgr] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AdobeDownloadManager" "hkey"="HKCU" "command"="\"C:\\Program Files\\Common Files\\Adobe\\ESD\\AdobeDownloadManager.exe\" restart=1" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="DAP" "hkey"="HKLM" "command"="\"C:\\Program Files\\DAP\\DAP.EXE\" /STARTUP" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eyeball Chat] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="EyeballChat" "hkey"="HKCU" "command"="\"C:\\Program Files\\Eyeball\\Eyeball Chat\\EyeballChat.exe\" -min" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GhostSurf Reminder] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Privacy Control Center" "hkey"="HKLM" "command"="\"C:\\Program Files\\GhostSurf 2006 Platinum\\Privacy Control Center.exe\" reminder" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AOLHostManager" "hkey"="HKLM" "command"="C:\\Program Files\\Common Files\\AOL\\1119319860\\EE\\AOLHostManager.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="dumprep 0 -k" "hkey"="HKLM" "command"="%systemroot%\\system32\\dumprep 0 -k" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msmsgs" "hkey"="HKCU" "command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msnmsgr" "hkey"="HKCU" "command"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="qttask" "hkey"="HKLM" "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="RealPlay" "hkey"="HKLM" "command"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="jusched" "hkey"="HKLM" "command"="C:\\Program Files\\Java\\jre1.5.0_07\\bin\\jusched.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="YahooMessenger" "hkey"="HKCU" "command"="\"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe\" -quiet" "inimapping"="0" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Completion time: 06-11-15 18:01:35.37 C:\ComboFix.txt ... 06-11-15 18:01

0

There is still a files that needs to be removed. Please download Brute Force Uninstaller Unzip it to it’s own folder (c:\BFU) Double click BFU.exe to run it. When the "Brute Force Uninstaller" window appears, click the "globe" icon in the top right hand corner. In the "Download BFU script..." window, copy and paste the following and then click OK: http://metallica.geekstogo.com/alcanshorty.bfu You should see the file alcanshorty.bfu appear in the bfu folder next to BFU.exe. Reboot into safe mode. Open the bfu folder and double click BFU.exe. To select the scriptfile to execute, first double click the folder icon to the left of the globe. You should now see a window containing alcanshorty.bfu, simply double click it. Finally, click the Execute button to begin. When the tool has finished running, you will get a "BFU" window with the message "Completed script execution", click on OK. Post a new Combofix log please.

0

Sorry I had a power outage earlier....I'll pick up where I left off at. Here is the Dr. Web log. BTW, I think the link for the ATF program is broken. I could not download it. Smurfedv6.exe;C:\Documents and Settings\Bennie Tiller\Desktop\lkj;Probably BACKDOOR.Trojan;Incurable.Deleted.; GTDownAO_106.ocx;C:\Program Files\Common Files\AolCoach\en_en;Adware.Gdown;Incurable.Deleted.; BPSSI1.exe;C:\Program Files\PowerTools 12;Probably BACKDOOR.Trojan;Incurable.Deleted.; Process.exe;C:\SmitfraudFix;Tool.Prockill;Incurable.Deleted.; restart.exe;C:\SmitfraudFix;Tool.ShutDown.11;Incurable.Deleted.; actskn45.ocx;C:\WINDOWS\system32;Trojan.Isbar.439;Deleted.; Process.exe;C:\WINDOWS\system32;Tool.Prockill;Incurable.Deleted.;

0

Ok, continue with response # 8 please.

0

Bennie Tiller - 06-11-15 17:57:37.53 Service Pack 2 ComboFix 06.11.9 - Running from: "C:\Documents and Settings\Bennie Tiller\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Program Files\outlook C:\Program Files\Common Files\{C846E924-03E4-1033-0405-010504130001} ((((((((((((((((((((((((((((((( Files Created from 2006-10-15 to 2006-11-15 )))))))))))))))))))))))))))))))))) 2006-11-15 16:22 650 --a------ C:\WINDOWS\system32\tmp.reg 2006-11-15 16:22 53,248 --a------ C:\WINDOWS\system32\Process.exe 2006-11-15 16:22 40,960 --a------ C:\WINDOWS\system32\swsc.exe 2006-11-15 16:22 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2006-11-15 16:22 135,168 --a------ C:\WINDOWS\system32\swreg.exe 2006-11-15 13:50 121,856 --------- C:\WINDOWS\system32\xmllite.dll 2006-11-15 13:00 24,576 --a------ C:\WINDOWS\system32\STKIT432.DLL 2006-11-08 00:02 68,888 --a------ C:\WINDOWS\system32\xinput1_3.dll 2006-11-08 00:02 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll 2006-11-08 00:02 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll 2006-11-08 00:02 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll 2006-11-08 00:02 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll 2006-11-08 00:02 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2006-11-08 00:02 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll 2006-11-07 21:18 2,368 --a------ C:\WINDOWS\system32\SVKP.sys 2006-11-02 19:35 737,280 --a------ C:\WINDOWS\iun6002.exe 2006-11-02 19:33 57,344 --a------ C:\WINDOWS\system32\WNASPINT.DLL 2006-11-02 19:10 81,920 --a------ C:\WINDOWS\system32\viscomwave.dll 2006-11-02 19:10 643,072 --a------ C:\WINDOWS\system32\DVDProX2.dll 2006-11-02 19:10 339,968 --a------ C:\WINDOWS\system32\MP3EncX.dll 2006-11-02 19:10 28,672 --a------ C:\WINDOWS\system32\SmartMenuXP.dll 2006-11-02 19:10 139,264 --a------ C:\WINDOWS\system32\voltoCDX.dll 2006-11-02 19:10 1,110,016 --a------ C:\WINDOWS\system32\NMSDVDXU.dll 2006-11-01 01:16 344,064 --a------ C:\WINDOWS\system32\MSVCR70.DLL 2006-10-27 23:44 36,644 --------- C:\WINDOWS\system32\drivers\RapFile.sys 2006-10-27 23:44 24,344 --------- C:\WINDOWS\system32\drivers\RapNet.sys 2006-10-27 23:44 10 --a------ C:\WINDOWS\system32\drivers\tmbi.sys 2006-10-27 20:52 314 --a------ C:\avp_remove.reg 2006-10-27 18:54 94,968 --a------ C:\WINDOWS\system32\DCal.dll 2006-10-27 18:54 89,360 --a------ C:\WINDOWS\system32\VB5DB.DLL 2006-10-27 18:54 77,824 --a------ C:\WINDOWS\system32\Dwspy36.dll 2006-10-27 18:54 68,100 --a------ C:\WINDOWS\system32\Cheetah2.DLL 2006-10-27 18:54 61,440 --a------ C:\WINDOWS\system32\BPSInj36.dll 2006-10-27 18:54 577,536 --a------ C:\WINDOWS\system32\BPSTer36.dll 2006-10-27 18:54 430,080 --a------ C:\WINDOWS\system32\Msrepl35.dll 2006-10-27 18:54 32,768 --a------ C:\WINDOWS\system32\ffJmpWeb.dll 2006-10-27 18:54 29,696 --a------ C:\WINDOWS\system32\madTool.dll 2006-10-27 18:54 27,648 --a------ C:\WINDOWS\system32\madSetWindowLong.dll 2006-10-27 18:54 262,144 --a------ C:\WINDOWS\system32\Msrd2x35.dll 2006-10-27 18:54 24,848 --a------ C:\WINDOWS\system32\Msjter35.dll 2006-10-27 18:54 123,664 --a------ C:\WINDOWS\system32\Msjint35.dll 2006-10-27 18:54 1,056,768 --a------ C:\WINDOWS\system32\Msjet35.dll 2006-10-27 18:04 1,060,864 --a--c--- C:\WINDOWS\system32\MFC71.dll 2006-10-27 16:20 307,200 --a-s---- C:\WINDOWS\system32\InterceptHelper.dll 2006-10-27 16:20 176,128 --a-s---- C:\WINDOWS\system32\Interceptor.dll 2006-10-24 20:09 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll 2006-10-24 20:02 21,840 --a------ C:\WINDOWS\system32\SIntfNT.dll 2006-10-24 20:02 17,212 --a------ C:\WINDOWS\system32\SIntf32.dll 2006-10-24 20:02 12,067 --a------ C:\WINDOWS\system32\SIntf16.dll 2006-10-17 13:33 6,049,280 --------- C:\WINDOWS\system32\ieframe.dll 2006-10-17 13:33 50,688 --------- C:\WINDOWS\system32\msfeedsbs.dll 2006-10-17 13:33 458,752 --------- C:\WINDOWS\system32\msfeeds.dll 2006-10-17 13:33 180,736 --------- C:\WINDOWS\system32\ieui.dll 2006-10-17 13:05 206,336 --------- C:\WINDOWS\system32\WinFXDocObj.exe 2006-10-17 13:01 13,312 --a------ C:\WINDOWS\system32\ieudinit.exe 2006-10-17 12:58 61,952 --------- C:\WINDOWS\system32\icardie.dll 2006-10-17 12:58 12,288 --------- C:\WINDOWS\system32\msfeedssync.exe 2006-10-17 12:57 266,752 --------- C:\WINDOWS\system32\iertutil.dll 2006-10-17 12:27 380,928 --------- C:\WINDOWS\system32\ieapfltr.dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-11-15 17:58 -------- d-------- C:\Program Files\Common Files 2006-11-15 16:04 -------- d-------- C:\Program Files\SpyWall 2006-11-15 15:25 -------- d-------- C:\Program Files\Internet Explorer 2006-11-15 14:02 -------- d-------- C:\Program Files\1st Registry Repair 2006-11-15 13:31 -------- d-------- C:\Program Files\Morpheus 2006-11-15 13:25 -------- d-------- C:\Program Files\Eusing Free Registry Cleaner 2006-11-15 13:14 -------- d-------- C:\Program Files\Spyware Doctor 2006-11-15 13:00 -------- d-------- C:\Program Files\Registry Mechanic 2006-11-15 12:04 -------- d-------- C:\Program Files\Registry Medic 2006-11-14 19:12 61072 --a------ C:\WINDOWS\system32\drivers\klick.sys 2006-11-14 19:12 59536 --a------ C:\WINDOWS\system32\drivers\klin.sys 2006-11-14 19:05 -------- d-------- C:\Program Files\Lavasoft 2006-11-14 19:05 -------- d-------- C:\Documents and Settings\Bennie Tiller\Application Data\Lavasoft 2006-11-14 18:11 -------- d-------- C:\Program Files\Kaspersky Lab 2006-11-14 17:17 -------- d-------- C:\Documents and Settings\Bennie Tiller\Application Data\MySpace 2006-11-14 17:16 -------- d-------- C:\Program Files\MySpace 2006-11-14 17:03 -------- d-------- C:\Program Files\Fake Webcam 2006-11-14 00:35 -------- d-------- C:\Program Files\Windows Media Components 2006-11-08 02:34 -------- d-------- C:\Program Files\JoWooD 2006-11-06 22:11 -------- d-------- C:\Program Files\InstallShield Installation Information 2006-11-06 20:33 -------- d-------- C:\Program Files\AIM 2006-11-06 20:30 -------- d-------- C:\Program Files\AOD 2006-11-06 15:42 -------- d-------- C:\Program Files\Cheetah Burner 2006-10-31 19:18 -------- d-------- C:\Program Files\Tenebril SEP 2006-10-28 00:16 -------- d-------- C:\Program Files\Comodo 2006-10-27 21:51 2560 --a--c--- C:\WINDOWS\system32\BitCometRes.dll 2006-10-27 18:56 -------- d-------- C:\Program Files\PowerTools 12 2006-10-27 18:04 -------- d-------- C:\Program Files\Alwil Software 2006-10-27 16:20 -------- d-------- C:\Program Files\GhostSurf 2006 Platinum 2006-10-27 16:20 -------- d-------- C:\Documents and Settings\Bennie Tiller\Application Data\Tenebril 2006-10-27 16:16 -------- d-------- C:\Program Files\Trustix 2006-10-27 16:13 -------- d-------- C:\Documents and Settings\Bennie Tiller\Application Data\Comodo 2006-10-23 02:05 -------- d-------- C:\Program Files\Messenger 2006-10-23 02:04 -------- d-------- C:\Program Files\Windows Media Player 2006-10-23 01:59 -------- d-------- C:\Program Files\Outlook Express 2006-10-23 01:59 -------- d-------- C:\Program Files\Common Files\System 2006-10-21 23:13 -------- d-------- C:\Program Files\IGN 2006-10-21 23:13 -------- d-------- C:\Documents and Settings\Bennie Tiller\Application Data\iMesh 2006-10-17 13:33 413696 --a------ C:\WINDOWS\system32\vbscript.dll 2006-10-17 13:33 231424 --a------ C:\WINDOWS\system32\webcheck.dll 2006-10-17 13:33 156160 --a------ C:\WINDOWS\system32\msls31.dll 2006-10-17 13:06 78336 --a------ C:\WINDOWS\system32\ieencode.dll 2006-10-17 13:05 40960 --a------ C:\WINDOWS\system32\licmgr10.dll 2006-10-17 13:05 105984 --a------ C:\WINDOWS\system32\url.dll 2006-10-17 13:04 101376 --a------ C:\WINDOWS\system32\occache.dll 2006-10-17 13:03 17408 --a------ C:\WINDOWS\system32\corpol.dll 2006-10-17 13:01 71680 --a------ C:\WINDOWS\system32\admparse.dll 2006-10-17 13:01 55296 --a------ C:\WINDOWS\system32\iesetup.dll 2006-10-17 13:01 382976 --a------ C:\WINDOWS\system32\iedkcs32.dll 2006-10-17 13:01 229376 --a------ C:\WINDOWS\system32\ieaksie.dll 2006-10-17 13:01 152064 --a------ C:\WINDOWS\system32\ieakeng.dll 2006-10-17 13:00 54784 --a------ C:\WINDOWS\system32\ie4uinit.exe 2006-10-17 13:00 43008 --a------ C:\WINDOWS\system32\iernonce.dll 2006-10-17 13:00 123904 --a------ C:\WINDOWS\system32\advpack.dll 2006-10-17 12:57 36352 --a------ C:\WINDOWS\system32\imgutil.dll 2006-10-17 12:56 45568 --a------ C:\WINDOWS\system32\mshta.exe 2006-10-17 12:28 48128 --a------ C:\WINDOWS\system32\mshtmler.dll 2006-10-17 12:23 161792 --a------ C:\WINDOWS\system32\ieakui.dll 2006-10-13 07:35 65536 --a------ C:\WINDOWS\system32\nwwks.dll 2006-10-13 07:35 64000 --a------ C:\WINDOWS\system32\nwapi32.dll 2006-10-13 07:35 142336 --a------ C:\WINDOWS\system32\nwprovau.dll 2006-10-13 05:23 163584 --a------ C:\WINDOWS\system32\drivers\nwrdr.sys 2006-10-02 14:04 806912 --a--c--- C:\WINDOWS\system32\divx_xx0c.dll 2006-10-02 14:04 806912 --a--c--- C:\WINDOWS\system32\divx_xx07.dll 2006-10-02 14:04 790528 --a--c--- C:\WINDOWS\system32\divx_xx11.dll 2006-10-02 14:04 635486 --a------ C:\WINDOWS\system32\DivX.dll 2006-09-13 00:01 1084416 --a------ C:\WINDOWS\system32\msxml3.dll 2006-09-06 17:43 22752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2006-08-25 10:45 617472 --a------ C:\WINDOWS\system32\comctl32.dll 2006-08-21 07:21 16896 --a------ C:\WINDOWS\system32\fltlib.dll 2006-08-21 04:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe 2006-08-17 07:28 721920 --a------ C:\WINDOWS\system32\lsasrv.dll 2006-08-17 07:28 132096 --a------ C:\WINDOWS\system32\wkssvc.dll 2006-08-16 06:58 100352 --a------ C:\WINDOWS\system32\6to4svc.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background" "Yahoo! Pager"="\"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe\" -quiet" "AIM"="C:\\Program Files\\AIM\\aim.exe -cnetwait.odl" "MySpaceIM"="\"C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe\"" "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "kav"="\"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 6.0\\avp.exe\"" @="" "GhostSurf Reminder"="\"C:\\Program Files\\GhostSurf 2006 Platinum\\Privacy Control Center.exe\" reminder" "RegistryMechanic"="" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000005 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] "{C846E924-03E4-1033-0405-010504130001}"="C:\\WINDOWS\\SoftwareDistribution\\Download\\b15b843ee2a6cbca76875f1244f36866\\update\\Update.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^GhostSurf proxy.lnk] "backup"="C:\\WINDOWS\\pss\\GhostSurf proxy.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\GHOSTS~1\\Proxy.exe " "item"="GhostSurf proxy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SpyCatcher Protector.lnk] "backup"="C:\\WINDOWS\\pss\\SpyCatcher Protector.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\GHOSTS~1\\PROTEC~1.exe " "item"="SpyCatcher Protector" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Bennie Tiller^Start Menu^Programs^Startup^Morpheus.lnk] "backup"="C:\\WINDOWS\\pss\\Morpheus.lnkStartup" "location"="Startup" "command"="C:\\PROGRA~1\\Morpheus\\Morpheus.exe -min" "item"="Morpheus" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Bennie Tiller^Start Menu^Programs^Startup^Neverwinter Nights Registration.lnk] "backup"="C:\\WINDOWS\\pss\\Neverwinter Nights Registration.lnkStartup" "location"="Startup" "item"="Neverwinter Nights Registration" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Bennie Tiller^Start Menu^Programs^Startup^Scheduler.lnk] "backup"="C:\\WINDOWS\\pss\\Scheduler.lnkStartup" "location"="Startup" "command"="C:\\PROGRA~1\\GHOSTS~1\\SCHEDU~1.exe " "item"="Scheduler" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="" "hkey"="HKLM" "command"="" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="aim" "hkey"="HKCU" "command"="C:\\PROGRA~1\\AIM\\aim.exe -cnetwait.odl" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AOL" "hkey"="HKCU" "command"="\"C:\\Program Files\\America Online 9.0\\AOL.EXE\" -b" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Spyware Protection] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AOLSP Scheduler" "hkey"="HKLM" "command"="\"C:\\PROGRA~1\\COMMON~1\\AOL\\AOLSPY~1\\AOLSP Scheduler.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AOLDial" "hkey"="HKLM" "command"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI DeviceDetect] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ATIDtct" "hkey"="HKLM" "command"="C:\\Program Files\\ATI Multimedia\\main\\ATIDtct.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI Launchpad] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="launchpd" "hkey"="HKCU" "command"="\"C:\\Program Files\\ATI Multimedia\\main\\launchpd.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI Remote Control] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ATIRW" "hkey"="HKCU" "command"="C:\\Program Files\\ATI Multimedia\\RemCtrl\\ATIRW.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="atiptaxx" "hkey"="HKLM" "command"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dlmMgr] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AdobeDownloadManager" "hkey"="HKCU" "command"="\"C:\\Program Files\\Common Files\\Adobe\\ESD\\AdobeDownloadManager.exe\" restart=1" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="DAP" "hkey"="HKLM" "command"="\"C:\\Program Files\\DAP\\DAP.EXE\" /STARTUP" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eyeball Chat] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="EyeballChat" "hkey"="HKCU" "command"="\"C:\\Program Files\\Eyeball\\Eyeball Chat\\EyeballChat.exe\" -min" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GhostSurf Reminder] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Privacy Control Center" "hkey"="HKLM" "command"="\"C:\\Program Files\\GhostSurf 2006 Platinum\\Privacy Control Center.exe\" reminder" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AOLHostManager" "hkey"="HKLM" "command"="C:\\Program Files\\Common Files\\AOL\\1119319860\\EE\\AOLHostManager.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="dumprep 0 -k" "hkey"="HKLM" "command"="%systemroot%\\system32\\dumprep 0 -k" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msmsgs" "hkey"="HKCU" "command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msnmsgr" "hkey"="HKCU" "command"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="qttask" "hkey"="HKLM" "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="RealPlay" "hkey"="HKLM" "command"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="jusched" "hkey"="HKLM" "command"="C:\\Program Files\\Java\\jre1.5.0_07\\bin\\jusched.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="YahooMessenger" "hkey"="HKCU" "command"="\"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe\" -quiet" "inimapping"="0" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Completion time: 06-11-15 18:01:35.37 C:\ComboFix.txt ... 06-11-15 18:01

0

Did you run combofix before you ran Brute Force Uninstaller? Please download Killbox by Option^Explicit. If you already have "Killbox" update to this newer version. Save it to your desktop. Please double-click Killbox.exe to run it. Select: Delete on Reboot then Click on the All Files button. Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy): C:\WINDOWS\iun6002.exe Return to Killbox, go to the File menu, and choose Paste from Clipboard. Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let us know if you receive this message!). If your computer does not restart automatically, please restart it manually. If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click Here to download and run missingfilesetup.exe. Then try Killbox again. Open notepad (Start Menu > Run > Type notepad and press "ok". Copy and paste everything into notepad between the x's making regedit4 the top line. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX REGEDIT4 [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it Fix.reg then save it to your desktop. Double click Fix.reg (or right click and choose Merge) and it will ask if you want to merge the contents into the registry, choose Yes. Post new Combofix and Hijack This logs please.

0

Okay here are the logs you asked for. Bennie Tiller - 06-11-18 13:10:28.43 Service Pack 2 ComboFix 06.11.9 - Running from: "C:\Documents and Settings\Bennie Tiller\Desktop" ((((((((((((((((((((((((((((((( Files Created from 2006-10-18 to 2006-11-18 )))))))))))))))))))))))))))))))))) 2006-11-17 16:21 271,360 --a------ C:\WINDOWS\system32\drivers\atksgt.sys 2006-11-17 16:21 18,048 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys 2006-11-15 16:22 650 --a------ C:\WINDOWS\system32\tmp.reg 2006-11-15 16:22 40,960 --a------ C:\WINDOWS\system32\swsc.exe 2006-11-15 16:22 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2006-11-15 16:22 135,168 --a------ C:\WINDOWS\system32\swreg.exe 2006-11-15 13:50 121,856 --------- C:\WINDOWS\system32\xmllite.dll 2006-11-15 13:00 24,576 --a------ C:\WINDOWS\system32\STKIT432.DLL 2006-11-08 00:02 68,888 --a------ C:\WINDOWS\system32\xinput1_3.dll 2006-11-08 00:02 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll 2006-11-08 00:02 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll 2006-11-08 00:02 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll 2006-11-08 00:02 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll 2006-11-08 00:02 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2006-11-08 00:02 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll 2006-11-07 21:18 2,368 --a------ C:\WINDOWS\system32\SVKP.sys 2006-11-02 19:33 57,344 --a------ C:\WINDOWS\system32\WNASPINT.DLL 2006-11-02 19:10 81,920 --a------ C:\WINDOWS\system32\viscomwave.dll 2006-11-02 19:10 643,072 --a------ C:\WINDOWS\system32\DVDProX2.dll 2006-11-02 19:10 339,968 --a------ C:\WINDOWS\system32\MP3EncX.dll 2006-11-02 19:10 28,672 --a------ C:\WINDOWS\system32\SmartMenuXP.dll 2006-11-02 19:10 139,264 --a------ C:\WINDOWS\system32\voltoCDX.dll 2006-11-02 19:10 1,110,016 --a------ C:\WINDOWS\system32\NMSDVDXU.dll 2006-11-01 01:16 344,064 --a------ C:\WINDOWS\system32\MSVCR70.DLL 2006-10-27 23:44 36,644 --------- C:\WINDOWS\system32\drivers\RapFile.sys 2006-10-27 23:44 24,344 --------- C:\WINDOWS\system32\drivers\RapNet.sys 2006-10-27 23:44 10 --a------ C:\WINDOWS\system32\drivers\tmbi.sys 2006-10-27 20:52 314 --a------ C:\avp_remove.reg 2006-10-27 18:54 94,968 --a------ C:\WINDOWS\system32\DCal.dll 2006-10-27 18:54 89,360 --a------ C:\WINDOWS\system32\VB5DB.DLL 2006-10-27 18:54 77,824 --a------ C:\WINDOWS\system32\Dwspy36.dll 2006-10-27 18:54 68,100 --a------ C:\WINDOWS\system32\Cheetah2.DLL 2006-10-27 18:54 61,440 --a------ C:\WINDOWS\system32\BPSInj36.dll 2006-10-27 18:54 577,536 --a------ C:\WINDOWS\system32\BPSTer36.dll 2006-10-27 18:54 430,080 --a------ C:\WINDOWS\system32\Msrepl35.dll 2006-10-27 18:54 32,768 --a------ C:\WINDOWS\system32\ffJmpWeb.dll 2006-10-27 18:54 29,696 --a------ C:\WINDOWS\system32\madTool.dll 2006-10-27 18:54 27,648 --a------ C:\WINDOWS\system32\madSetWindowLong.dll 2006-10-27 18:54 262,144 --a------ C:\WINDOWS\system32\Msrd2x35.dll 2006-10-27 18:54 24,848 --a------ C:\WINDOWS\system32\Msjter35.dll 2006-10-27 18:54 123,664 --a------ C:\WINDOWS\system32\Msjint35.dll 2006-10-27 18:54 1,056,768 --a------ C:\WINDOWS\system32\Msjet35.dll 2006-10-27 18:04 1,060,864 --a--c--- C:\WINDOWS\system32\MFC71.dll 2006-10-27 16:20 307,200 --a-s---- C:\WINDOWS\system32\InterceptHelper.dll 2006-10-27 16:20 176,128 --a-s---- C:\WINDOWS\system32\Interceptor.dll 2006-10-24 20:09 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll 2006-10-24 20:02 21,840 --a------ C:\WINDOWS\system32\SIntfNT.dll 2006-10-24 20:02 17,212 --a------ C:\WINDOWS\system32\SIntf32.dll 2006-10-24 20:02 12,067 --a------ C:\WINDOWS\system32\SIntf16.dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-11-17 16:20 -------- d-------- C:\Program Files\Common Files\Microsoft Shared 2006-11-17 16:11 -------- d--h----- C:\Program Files\InstallShield Installation Information 2006-11-15 17:58 -------- d-------- C:\Program Files\Common Files 2006-11-15 16:04 -------- d-------- C:\Program Files\SpyWall 2006-11-15 15:25 -------- d-------- C:\Program Files\Internet Explorer 2006-11-15 14:02 -------- d-------- C:\Program Files\1st Registry Repair 2006-11-15 13:25 -------- d-------- C:\Program Files\Eusing Free Registry Cleaner 2006-11-15 13:14 -------- d-------- C:\Program Files\Spyware Doctor 2006-11-15 13:00 -------- d-------- C:\Program Files\Registry Mechanic 2006-11-14 19:12 61072 --a------ C:\WINDOWS\system32\drivers\klick.sys 2006-11-14 19:12 59536 --a------ C:\WINDOWS\system32\drivers\klin.sys 2006-11-14 19:05 -------- d-------- C:\Program Files\Lavasoft 2006-11-14 19:05 -------- d-------- C:\Documents and Settings\Bennie Tiller\Application Data\Lavasoft 2006-11-14 18:11 -------- d-------- C:\Program Files\Kaspersky Lab 2006-11-14 17:17 -------- d-------- C:\Documents and Settings\Bennie Tiller\Application Data\MySpace 2006-11-14 17:16 -------- d-------- C:\Program Files\MySpace 2006-11-14 17:03 -------- d-------- C:\Program Files\Fake Webcam 2006-11-14 00:35 -------- d-------- C:\Program Files\Windows Media Components 2006-11-08 02:34 -------- d-------- C:\Program Files\JoWooD 2006-11-06 20:33 -------- d-------- C:\Program Files\AIM 2006-11-06 20:30 -------- d-------- C:\Program Files\AOD 2006-11-06 15:42 -------- d-------- C:\Program Files\Cheetah Burner 2006-10-31 19:18 -------- d-------- C:\Program Files\Tenebril SEP 2006-10-28 00:16 -------- d-------- C:\Program Files\Comodo 2006-10-27 21:51 2560 --a--c--- C:\WINDOWS\system32\BitCometRes.dll 2006-10-27 18:56 -------- d-------- C:\Program Files\PowerTools 12 2006-10-27 18:04 -------- d-------- C:\Program Files\Alwil Software 2006-10-27 16:20 -------- d-------- C:\Program Files\GhostSurf 2006 Platinum 2006-10-27 16:20 -------- d-------- C:\Documents and Settings\Bennie Tiller\Application Data\Tenebril 2006-10-27 16:16 -------- d-------- C:\Program Files\Trustix 2006-10-27 16:13 -------- d-------- C:\Documents and Settings\Bennie Tiller\Application Data\Comodo 2006-10-23 02:05 -------- d-------- C:\Program Files\Messenger 2006-10-23 02:04 -------- d-------- C:\Program Files\Windows Media Player 2006-10-23 01:59 -------- d-------- C:\Program Files\Outlook Express 2006-10-23 01:59 -------- d-------- C:\Program Files\Common Files\System 2006-10-21 23:13 -------- d-------- C:\Program Files\IGN 2006-10-21 23:13 -------- d-------- C:\Documents and Settings\Bennie Tiller\Application Data\iMesh 2006-10-17 13:33 6049280 --------- C:\WINDOWS\system32\ieframe.dll 2006-10-17 13:33 50688 --------- C:\WINDOWS\system32\msfeedsbs.dll 2006-10-17 13:33 458752 --------- C:\WINDOWS\system32\msfeeds.dll 2006-10-17 13:33 413696 --a------ C:\WINDOWS\system32\vbscript.dll 2006-10-17 13:33 231424 --a------ C:\WINDOWS\system32\webcheck.dll 2006-10-17 13:33 180736 --------- C:\WINDOWS\system32\ieui.dll 2006-10-17 13:33 156160 --a------ C:\WINDOWS\system32\msls31.dll 2006-10-17 13:06 78336 --a------ C:\WINDOWS\system32\ieencode.dll 2006-10-17 13:05 40960 --a------ C:\WINDOWS\system32\licmgr10.dll 2006-10-17 13:05 206336 --------- C:\WINDOWS\system32\WinFXDocObj.exe 2006-10-17 13:05 105984 --a------ C:\WINDOWS\system32\url.dll 2006-10-17 13:04 101376 --a------ C:\WINDOWS\system32\occache.dll 2006-10-17 13:03 17408 --a------ C:\WINDOWS\system32\corpol.dll 2006-10-17 13:01 71680 --a------ C:\WINDOWS\system32\admparse.dll 2006-10-17 13:01 55296 --a------ C:\WINDOWS\system32\iesetup.dll 2006-10-17 13:01 382976 --a------ C:\WINDOWS\system32\iedkcs32.dll 2006-10-17 13:01 229376 --a------ C:\WINDOWS\system32\ieaksie.dll 2006-10-17 13:01 152064 --a------ C:\WINDOWS\system32\ieakeng.dll 2006-10-17 13:01 13312 --a------ C:\WINDOWS\system32\ieudinit.exe 2006-10-17 13:00 54784 --a------ C:\WINDOWS\system32\ie4uinit.exe 2006-10-17 13:00 43008 --a------ C:\WINDOWS\system32\iernonce.dll 2006-10-17 13:00 123904 --a------ C:\WINDOWS\system32\advpack.dll 2006-10-17 12:58 61952 --------- C:\WINDOWS\system32\icardie.dll 2006-10-17 12:58 12288 --------- C:\WINDOWS\system32\msfeedssync.exe 2006-10-17 12:57 36352 --a------ C:\WINDOWS\system32\imgutil.dll 2006-10-17 12:57 266752 --------- C:\WINDOWS\system32\iertutil.dll 2006-10-17 12:56 45568 --a------ C:\WINDOWS\system32\mshta.exe 2006-10-17 12:28 48128 --a------ C:\WINDOWS\system32\mshtmler.dll 2006-10-17 12:27 380928 --------- C:\WINDOWS\system32\ieapfltr.dll 2006-10-17 12:23 161792 --a------ C:\WINDOWS\system32\ieakui.dll 2006-10-13 07:35 65536 --a------ C:\WINDOWS\system32\nwwks.dll 2006-10-13 07:35 64000 --a------ C:\WINDOWS\system32\nwapi32.dll 2006-10-13 07:35 142336 --a------ C:\WINDOWS\system32\nwprovau.dll 2006-10-13 05:23 163584 --a------ C:\WINDOWS\system32\drivers\nwrdr.sys 2006-10-02 14:04 806912 --a--c--- C:\WINDOWS\system32\divx_xx0c.dll 2006-10-02 14:04 806912 --a--c--- C:\WINDOWS\system32\divx_xx07.dll 2006-10-02 14:04 790528 --a--c--- C:\WINDOWS\system32\divx_xx11.dll 2006-10-02 14:04 635486 --a------ C:\WINDOWS\system32\DivX.dll 2006-09-13 00:01 1084416 --a------ C:\WINDOWS\system32\msxml3.dll 2006-09-06 17:43 22752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2006-08-25 10:45 617472 --a------ C:\WINDOWS\system32\comctl32.dll 2006-08-21 07:21 16896 --a------ C:\WINDOWS\system32\fltlib.dll 2006-08-21 04:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "kav"="\"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 6.0\\avp.exe\"" @="" "GhostSurf Reminder"="\"C:\\Program Files\\GhostSurf 2006 Platinum\\Privacy Control Center.exe\" reminder" "RegistryMechanic"="" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000005 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] "{C846E924-03E4-1033-0405-010504130001}"="C:\\WINDOWS\\SoftwareDistribution\\Download\\b15b843ee2a6cbca76875f1244f36866\\update\\Update.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^GhostSurf proxy.lnk] "backup"="C:\\WINDOWS\\pss\\GhostSurf proxy.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\GHOSTS~1\\Proxy.exe " "item"="GhostSurf proxy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SpyCatcher Protector.lnk] "backup"="C:\\WINDOWS\\pss\\SpyCatcher Protector.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\GHOSTS~1\\PROTEC~1.exe " "item"="SpyCatcher Protector" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Bennie Tiller^Start Menu^Programs^Startup^Morpheus.lnk] "backup"="C:\\WINDOWS\\pss\\Morpheus.lnkStartup" "location"="Startup" "command"="C:\\PROGRA~1\\Morpheus\\Morpheus.exe -min" "item"="Morpheus" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Bennie Tiller^Start Menu^Programs^Startup^Neverwinter Nights Registration.lnk] "backup"="C:\\WINDOWS\\pss\\Neverwinter Nights Registration.lnkStartup" "location"="Startup" "item"="Neverwinter Nights Registration" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Bennie Tiller^Start Menu^Programs^Startup^Scheduler.lnk] "backup"="C:\\WINDOWS\\pss\\Scheduler.lnkStartup" "location"="Startup" "command"="C:\\PROGRA~1\\GHOSTS~1\\SCHEDU~1.exe " "item"="Scheduler" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="" "hkey"="HKLM" "command"="" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="aim" "hkey"="HKCU" "command"="C:\\Program Files\\AIM\\aim.exe -cnetwait.odl" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AOL" "hkey"="HKCU" "command"="\"C:\\Program Files\\America Online 9.0\\AOL.EXE\" -b" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Spyware Protection] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AOLSP Scheduler" "hkey"="HKLM" "command"="\"C:\\PROGRA~1\\COMMON~1\\AOL\\AOLSPY~1\\AOLSP Scheduler.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AOLDial" "hkey"="HKLM" "command"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI DeviceDetect] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ATIDtct" "hkey"="HKLM" "command"="C:\\Program Files\\ATI Multimedia\\main\\ATIDtct.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI Launchpad] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="launchpd" "hkey"="HKCU" "command"="\"C:\\Program Files\\ATI Multimedia\\main\\launchpd.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI Remote Control] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ATIRW" "hkey"="HKCU" "command"="C:\\Program Files\\ATI Multimedia\\RemCtrl\\ATIRW.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="atiptaxx" "hkey"="HKLM" "command"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dlmMgr] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AdobeDownloadManager" "hkey"="HKCU" "command"="\"C:\\Program Files\\Common Files\\Adobe\\ESD\\AdobeDownloadManager.exe\" restart=1" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="DAP" "hkey"="HKLM" "command"="\"C:\\Program Files\\DAP\\DAP.EXE\" /STARTUP" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eyeball Chat] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="EyeballChat" "hkey"="HKCU" "command"="\"C:\\Program Files\\Eyeball\\Eyeball Chat\\EyeballChat.exe\" -min" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GhostSurf Reminder] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Privacy Control Center" "hkey"="HKLM" "command"="\"C:\\Program Files\\GhostSurf 2006 Platinum\\Privacy Control Center.exe\" reminder" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AOLHostManager" "hkey"="HKLM" "command"="C:\\Program Files\\Common Files\\AOL\\1119319860\\EE\\AOLHostManager.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="dumprep 0 -k" "hkey"="HKLM" "command"="%systemroot%\\system32\\dumprep 0 -k" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msmsgs" "hkey"="HKCU" "command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msnmsgr" "hkey"="HKCU" "command"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="MySpaceIM" "hkey"="HKCU" "command"="\"C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="qttask" "hkey"="HKLM" "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="RealPlay" "hkey"="HKLM" "command"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="jusched" "hkey"="HKLM" "command"="C:\\Program Files\\Java\\jre1.5.0_07\\bin\\jusched.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="YahooMessenger" "hkey"="HKCU" "command"="\"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe\" -quiet" "inimapping"="0" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Completion time: 06-11-18 13:15:34.76 C:\ComboFix.txt ... 06-11-18 13:15 C:\ComboFix2.txt ... 06-11-15 23:57 C:\ComboFix3.txt ... 06-11-15 18:01 Logfile of HijackThis v1.99.1 Scan saved at 1:17:42 PM, on 11/18/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\wscntfy.exe C:\DOCUME~1\BENNIE~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo! R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - C:\Program Files\GhostSurf 2006 Platinum\SCActiveBlock.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O4 - HKLM\..\Run: [kav] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" O4 - HKLM\..\Run: [GhostSurf Reminder] "C:\Program Files\GhostSurf 2006 Platinum\Privacy Control Center.exe" reminder O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll O15 - Trusted Zone: messenger.msn.com O15 - Trusted Zone: www.msn.com O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windows... O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - AppInit_DLLs: interceptor.dll O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing) O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing) O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - (no file)

0

How is you computer running now?

0

this is interesting O4 - HKLM\..\Run: [GhostSurf Reminder] "C:\Program Files\GhostSurf 2006 Platinum\Privacy Control Helping your everyday needs, Mr Saunders

0