Help with logfile

[thedishdoc]

Hello, my computer is badly infected and I would appreciate some advice with my hijack this logfile. here is the dump.

Logfile of HijackThis v1.99.1
Scan saved at 8:46:07 AM, on 2/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
C:\PROGRA~1\McAfee\MSC\mctskshd.exe
C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
c:\Program Files\Common Files\Symantec Shared\Security Center\SymSCUI.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Slieqy\Hdwb.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
c:\program files\mcafee\msc\mcuimgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe
C:\Documents and Settings\Compaq_Owner\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE= ... pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE= ... pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.earthlink.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE= ... pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar6.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar6.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [Znmucl] C:\Program Files\Salf\Vwhamu.exe
O4 - HKLM\..\Run: [Kzflu] C:\Program Files\Jeubqvo\Bibaiw.exe
O4 - HKLM\..\Run: [Xajxqp] C:\Program Files\Yuqkpkk\Hscogc.exe
O4 - HKLM\..\Run: [Rgngnx] C:\Program Files\Sseriu\Dvwcaaa.exe
O4 - HKLM\..\Run: [Lqdmon] C:\Program Files\Wzuugrj\Ucyyw.exe
O4 - HKLM\..\Run: [Yenuu] C:\Program Files\Smwg\Icjvx.exe
O4 - HKLM\..\Run: [Iyrcuro] C:\Program Files\Rblqxs\Ptgpqm.exe
O4 - HKLM\..\Run: [Qawprv] C:\Program Files\Nwkkc\Knhw.exe
O4 - HKLM\..\Run: [Gphkam] C:\Program Files\Eatzu\Ceqsgx.exe
O4 - HKLM\..\Run: [Kzfhqi] C:\Program Files\Iavynnq\Sfxw.exe
O4 - HKLM\..\Run: [Ssvzcm] C:\Program Files\Qmne\Vwfm.exe
O4 - HKLM\..\Run: [Hvrccb] C:\Program Files\Sxgv\Fygutx.exe
O4 - HKLM\..\Run: [Qkcqk] C:\Program Files\Tdcf\Vqab.exe
O4 - HKLM\..\Run: [Nutqzooj] C:\Program Files\Uubb\Bkrbcj.exe
O4 - HKLM\..\Run: [Yoophhqh] C:\Program Files\Sotb\Aoqoe.exe
O4 - HKLM\..\Run: [Tdxpk] C:\Program Files\Whphjza\Cwigb.exe
O4 - HKLM\..\Run: [Ittuiyz] C:\Program Files\Mkywbzs\Dspn.exe
O4 - HKLM\..\Run: [Gafkf] C:\Program Files\Lgmlg\Ygkz.exe
O4 - HKLM\..\Run: [Tvhzpyx] C:\Program Files\Emat\Ubzgdh.exe
O4 - HKLM\..\Run: [Dnhplsm] C:\Program Files\Vpjh\Utyhzp.exe
O4 - HKLM\..\Run: [Rwcckglo] C:\Program Files\Rvhnho\Rkhrief.exe
O4 - HKLM\..\Run: [Hajkpu] C:\Program Files\Vvana\Zlvt.exe
O4 - HKLM\..\Run: [Ssfrdn] C:\Program Files\Mzjcb\Rkvpqp.exe
O4 - HKLM\..\Run: [Jasqpknv] C:\Program Files\Bouwljf\Imrhty.exe
O4 - HKLM\..\Run: [Nyysdf] C:\Program Files\Mgrchhr\Wfchoj.exe
O4 - HKLM\..\Run: [Uhnliwa] C:\Program Files\Uyxfhs\Eyavt.exe
O4 - HKLM\..\Run: [Olmia] C:\Program Files\Nxmkm\Vnroyr.exe
O4 - HKLM\..\Run: [Vrxpojw] C:\Program Files\Qxfcfbi\Uapqc.exe
O4 - HKLM\..\Run: [Vhekoqwm] C:\Program Files\Pnuiqbi\Vasclnf.exe
O4 - HKLM\..\Run: [Crbevfpw] C:\Program Files\Bfgzjgj\Byjt.exe
O4 - HKLM\..\Run: [Nfqwe] C:\Program Files\Oyymkig\Psiudpn.exe
O4 - HKLM\..\Run: [Ztfplm] C:\Program Files\Syrmd\Tgzez.exe
O4 - HKLM\..\Run: [Xqnac] C:\Program Files\Dytexvh\Crqk.exe
O4 - HKLM\..\Run: [Mvwxx] C:\Program Files\Ozhbhjv\Ocsz.exe
O4 - HKLM\..\Run: [Zqfxq] C:\Program Files\Zqbi\Gzjzw.exe
O4 - HKLM\..\Run: [Nbjoig] C:\Program Files\Zhtet\Sazo.exe
O4 - HKLM\..\Run: [Idvhfdl] C:\Program Files\Mhtghiy\Sfyo.exe
O4 - HKLM\..\Run: [Imsgyyf] C:\Program Files\Kxipf\Yiqwt.exe
O4 - HKLM\..\Run: [Ennct] C:\Program Files\Oxcpzct\Tikfei.exe
O4 - HKLM\..\Run: [Onsmygnx] C:\Program Files\Ebtj\Phxicg.exe
O4 - HKLM\..\Run: [Xyvfyw] C:\Program Files\Kdstz\Nshwpl.exe
O4 - HKLM\..\Run: [Waxilp] C:\Program Files\Slieqy\Hdwb.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe" -start
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Photags AutoDetect.lnk = C:\Program Files\PhoTags Express\Photags AutoDetect.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 0855953078
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee Log Manager (McLogManagerService) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Task Scheduler (mctskshd.exe) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mctskshd.exe
O23 - Service: McAfee User Manager (mcusrmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Thanks for any help in this matter.

[Gecko]

Hello thedishdoc, welcome to our forums

You weren’t kidding its really infected, I think the best approach would be to use AVG Anti-Spyware first

You can download AVG Anti-Spyware 7.5 from and save that file to your desktop.
This is a 30 day trial of the program

1. Once you have downloaded AVG Anti-Spyware 7.5, locate the icon on the desktop and double-click it to launch the set up program.

2. Once the setup is complete you will need run AVG Anti-Spyware and update the definition files.

3. On the main screen select the icon "Update" then select the "Update now" link.
Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.

4. Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.

5. Once in the Settings screen click on "Recommended actions" and then select "Quarantine".

6. Under "Reports"
* Select "Automatically generate report after every scan"
* Un-Select "Only if threats were found"

Close AVG Anti-Spyware, Do Not run a scan just yet, we will shortly.

Reboot your computer into SafeMode:
Restart Windows after you see the BIOS screen and before Windows starts to load.
Start tapping the F8 key. The Windows Advanced Options Menu appears.
Use the Arrow key to ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.

IMPORTANT: Do not open any other windows or programs while AVG Anti-Spyware is scanning:

1. Lauch AVG Anti-Spyware by double-clicking the icon on your desktop.

2. Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".

3. AVG Anti-Spyware will now begin the scanning process, be patient this may take a little time.
Once the scan is complete do the following:

4. If you have any infections you will prompted, then select "Apply all actions"

5. Next select the "Reports" icon at the top.

6. Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).

7. Close AVG Anti-Spyware and reboot your system back into Normal Mode and post the results of the AVG Anti-Spyware report scan in your reply, along with a fresh hijackthis log.

[thedishdoc]

Thank you for your help getting this machine back to normal. I have followed your instructions. Here is the new logfile.

Logfile of HijackThis v1.99.1
Scan saved at 10:41:35 AM, on 2/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
C:\PROGRA~1\McAfee\MSC\mctskshd.exe
C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
c:\Program Files\Common Files\Symantec Shared\Security Center\SymSCUI.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
c:\program files\mcafee\msc\mcuimgr.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Documents and Settings\Compaq_Owner\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE= ... pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE= ... pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.earthlink.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE= ... pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar7.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar7.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [Znmucl] C:\Program Files\Salf\Vwhamu.exe
O4 - HKLM\..\Run: [Kzflu] C:\Program Files\Jeubqvo\Bibaiw.exe
O4 - HKLM\..\Run: [Xajxqp] C:\Program Files\Yuqkpkk\Hscogc.exe
O4 - HKLM\..\Run: [Rgngnx] C:\Program Files\Sseriu\Dvwcaaa.exe
O4 - HKLM\..\Run: [Lqdmon] C:\Program Files\Wzuugrj\Ucyyw.exe
O4 - HKLM\..\Run: [Yenuu] C:\Program Files\Smwg\Icjvx.exe
O4 - HKLM\..\Run: [Iyrcuro] C:\Program Files\Rblqxs\Ptgpqm.exe
O4 - HKLM\..\Run: [Qawprv] C:\Program Files\Nwkkc\Knhw.exe
O4 - HKLM\..\Run: [Gphkam] C:\Program Files\Eatzu\Ceqsgx.exe
O4 - HKLM\..\Run: [Kzfhqi] C:\Program Files\Iavynnq\Sfxw.exe
O4 - HKLM\..\Run: [Ssvzcm] C:\Program Files\Qmne\Vwfm.exe
O4 - HKLM\..\Run: [Hvrccb] C:\Program Files\Sxgv\Fygutx.exe
O4 - HKLM\..\Run: [Qkcqk] C:\Program Files\Tdcf\Vqab.exe
O4 - HKLM\..\Run: [Nutqzooj] C:\Program Files\Uubb\Bkrbcj.exe
O4 - HKLM\..\Run: [Yoophhqh] C:\Program Files\Sotb\Aoqoe.exe
O4 - HKLM\..\Run: [Tdxpk] C:\Program Files\Whphjza\Cwigb.exe
O4 - HKLM\..\Run: [Ittuiyz] C:\Program Files\Mkywbzs\Dspn.exe
O4 - HKLM\..\Run: [Gafkf] C:\Program Files\Lgmlg\Ygkz.exe
O4 - HKLM\..\Run: [Tvhzpyx] C:\Program Files\Emat\Ubzgdh.exe
O4 - HKLM\..\Run: [Dnhplsm] C:\Program Files\Vpjh\Utyhzp.exe
O4 - HKLM\..\Run: [Rwcckglo] C:\Program Files\Rvhnho\Rkhrief.exe
O4 - HKLM\..\Run: [Hajkpu] C:\Program Files\Vvana\Zlvt.exe
O4 - HKLM\..\Run: [Ssfrdn] C:\Program Files\Mzjcb\Rkvpqp.exe
O4 - HKLM\..\Run: [Jasqpknv] C:\Program Files\Bouwljf\Imrhty.exe
O4 - HKLM\..\Run: [Nyysdf] C:\Program Files\Mgrchhr\Wfchoj.exe
O4 - HKLM\..\Run: [Uhnliwa] C:\Program Files\Uyxfhs\Eyavt.exe
O4 - HKLM\..\Run: [Olmia] C:\Program Files\Nxmkm\Vnroyr.exe
O4 - HKLM\..\Run: [Vrxpojw] C:\Program Files\Qxfcfbi\Uapqc.exe
O4 - HKLM\..\Run: [Vhekoqwm] C:\Program Files\Pnuiqbi\Vasclnf.exe
O4 - HKLM\..\Run: [Crbevfpw] C:\Program Files\Bfgzjgj\Byjt.exe
O4 - HKLM\..\Run: [Nfqwe] C:\Program Files\Oyymkig\Psiudpn.exe
O4 - HKLM\..\Run: [Ztfplm] C:\Program Files\Syrmd\Tgzez.exe
O4 - HKLM\..\Run: [Xqnac] C:\Program Files\Dytexvh\Crqk.exe
O4 - HKLM\..\Run: [Mvwxx] C:\Program Files\Ozhbhjv\Ocsz.exe
O4 - HKLM\..\Run: [Zqfxq] C:\Program Files\Zqbi\Gzjzw.exe
O4 - HKLM\..\Run: [Nbjoig] C:\Program Files\Zhtet\Sazo.exe
O4 - HKLM\..\Run: [Idvhfdl] C:\Program Files\Mhtghiy\Sfyo.exe
O4 - HKLM\..\Run: [Imsgyyf] C:\Program Files\Kxipf\Yiqwt.exe
O4 - HKLM\..\Run: [Ennct] C:\Program Files\Oxcpzct\Tikfei.exe
O4 - HKLM\..\Run: [Onsmygnx] C:\Program Files\Ebtj\Phxicg.exe
O4 - HKLM\..\Run: [Xyvfyw] C:\Program Files\Kdstz\Nshwpl.exe
O4 - HKLM\..\Run: [Waxilp] C:\Program Files\Slieqy\Hdwb.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe" -start
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Photags AutoDetect.lnk = C:\Program Files\PhoTags Express\Photags AutoDetect.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 0855953078
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee Log Manager (McLogManagerService) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Task Scheduler (mctskshd.exe) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mctskshd.exe
O23 - Service: McAfee User Manager (mcusrmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

====================================================

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 8:32:39 AM 2/9/2007

+ Scan result:



C:\Program Files\Common Files\WinSoftware\Prcheck.dll -> Adware.ErrorSafe : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{36EC0028-8B85-4538-BB29-A461B426C5A6}\RP150\A0079140.dll -> Adware.EZula : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Rotue -> Adware.InternetOptimizer : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{36EC0028-8B85-4538-BB29-A461B426C5A6}\RP150\A0079137.ocx -> Adware.MediaMotor : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{36EC0028-8B85-4538-BB29-A461B426C5A6}\RP150\A0079141.exe -> Adware.MediaMotor : Cleaned with backup (quarantined).
C:\WINDOWS\em.ocx -> Adware.MediaMotor : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{36EC0028-8B85-4538-BB29-A461B426C5A6}\RP150\A0079139.exe -> Adware.NetNucleus : Cleaned with backup (quarantined).
C:\Program Files\WinFixer_2005\FFWrap.dll -> Adware.SafeError : Cleaned with backup (quarantined).
C:\Program Files\WinFixer_2005\FxCor.dll -> Adware.SafeError : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris.YOUR-71A232D1A6.000\Start Menu\Programs\SpySheriff -> Adware.SpySheriff : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris.YOUR-71A232D1A6.000\Start Menu\Programs\SpySheriff\SpySheriff.lnk -> Adware.SpySheriff : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{36EC0028-8B85-4538-BB29-A461B426C5A6}\RP138\A0073080.exe -> Adware.SystemDoctor : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{36EC0028-8B85-4538-BB29-A461B426C5A6}\RP149\A0079076.exe -> Adware.WebHancer : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{36EC0028-8B85-4538-BB29-A461B426C5A6}\RP149\A0079077.dll -> Adware.WebHancer : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{36EC0028-8B85-4538-BB29-A461B426C5A6}\RP149\A0079079.inf -> Adware.WebHancer : Cleaned with backup (quarantined).
C:\Program Files\WinFixer_2005\up.dat -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris.YOUR-71A232D1A6.000\Local Settings\Temp\UERT_0001_D19M2109\installer.exe -> Adware.WinFixer : Cleaned with backup (quarantined).
C:\Program Files\WinFixer_2005\Updater.exe -> Adware.WinFixer : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{36EC0028-8B85-4538-BB29-A461B426C5A6}\RP150\A0079135.dll -> Adware.Winfixer : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris.YOUR-71A232D1A6.000\Local Settings\Temp\nsc2A.tmp\TagDLL.dll -> Adware.Yazzle : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{36EC0028-8B85-4538-BB29-A461B426C5A6}\RP149\A0079072.exe -> Adware.ZenoSearch : Cleaned with backup (quarantined).
C:\Documents and Settings\Jenna.YOUR-71A232D1A6\Local Settings\Temporary Internet Files\Content.IE5\1IRXP68I\install[1].exe -> Downloader.Dyfica : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{36EC0028-8B85-4538-BB29-A461B426C5A6}\RP141\A0077465.exe -> Downloader.Dyfica : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{36EC0028-8B85-4538-BB29-A461B426C5A6}\RP141\A0077469.exe -> Downloader.Dyfica : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{36EC0028-8B85-4538-BB29-A461B426C5A6}\RP141\A0077464.exe -> Downloader.Dyfuca.ez : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{36EC0028-8B85-4538-BB29-A461B426C5A6}\RP141\A0077468.exe -> Downloader.Dyfuca.ez : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temporary Internet Files\Content.IE5\MR8RQDWF\upgrade[1].exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris.YOUR-71A232D1A6.000\Local Settings\Temp\stdrun11.exe -> Downloader.Small.buy : Cleaned with backup (quarantined).
C:\Documents and Settings\Brandon.YOUR-71A232D1A6\Local Settings\Temporary Internet Files\Content.IE5\QBSRQ1GZ\l[1].htm -> Downloader.Small.co : Cleaned with backup (quarantined).
C:\Documents and Settings\Lisa\Desktop\Windows Fixer.exe -> Not-A-Virus.Downloader.Win32.Agent.f : Cleaned with backup (quarantined).
C:\Documents and Settings\Lisa\Local Settings\Temporary Internet Files\Content.IE5\4LMN0H6V\WFXScanR[1].exe -> Not-A-Virus.Downloader.Win32.Agent.f : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{36EC0028-8B85-4538-BB29-A461B426C5A6}\RP138\A0073081.exe -> Not-A-Virus.Downloader.Win32.WinFixer.t : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris.YOUR-71A232D1A6.000\Cookies\chris@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Brandon\Cookies\brandon@www.burstbeacon[1].txt -> TrackingCookie.Burstbeacon : Cleaned.
C:\Documents and Settings\Chris\Cookies\chris@www.burstbeacon[1].txt -> TrackingCookie.Burstbeacon : Cleaned.
C:\Documents and Settings\Lisa.YOUR-71A232D1A6\Cookies\lisa@www.burstbeacon[1].txt -> TrackingCookie.Burstbeacon : Cleaned.
C:\Documents and Settings\Brandon\Cookies\brandon@cj[1].txt -> TrackingCookie.Cj : Cleaned.
C:\Documents and Settings\Brandon\Cookies\brandon@cz3.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned.
C:\Documents and Settings\Brandon\Cookies\brandon@cz4.clickzs[1].txt -> TrackingCookie.Clickzs : Cleaned.
C:\Documents and Settings\Brandon\Cookies\brandon@cz8.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned.
C:\Documents and Settings\Brandon\Cookies\brandon@vip.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned.
C:\Documents and Settings\Brandon\Cookies\brandon@com[2].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\Chris\Cookies\chris@com[2].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\Lisa.YOUR-71A232D1A6\Cookies\lisa@cpvfeed[1].txt -> TrackingCookie.Cpvfeed : Cleaned.
C:\Program Files\EarthLink\Protection Control Center\Backup\QCki0610200615036505984.pwn -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\Chris\Cookies\chris@hypertracker[1].txt -> TrackingCookie.Hypertracker : Cleaned.
C:\Documents and Settings\Brandon\Cookies\brandon@ilead.itrack[1].txt -> TrackingCookie.Itrack : Cleaned.
C:\Documents and Settings\Brandon\Cookies\brandon@sales.liveperson[1].txt -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\Chris.YOUR-71A232D1A6\Cookies\chris@sales.liveperson[1].txt -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\Chris\Cookies\chris@sales.liveperson[2].txt -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\Jenna\Cookies\jenna@sales.liveperson[1].txt -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\Lisa.YOUR-71A232D1A6\Cookies\lisa@sales.liveperson[1].txt -> TrackingCookie.Liveperson : Cleaned.
C:\Program Files\EarthLink\Protection Control Center\Backup\QCki0610200615036505000.pwn -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\Brandon\Cookies\brandon@ads.realcastmedia[1].txt -> TrackingCookie.Realcastmedia : Cleaned.
C:\Documents and Settings\Chris\Cookies\chris@ads.realcastmedia[2].txt -> TrackingCookie.Realcastmedia : Cleaned.
C:\Documents and Settings\Brandon.YOUR-71A232D1A6\Cookies\brandon@anad.tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Chris.YOUR-71A232D1A6\Cookies\chris@anad.tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Lisa.YOUR-71A232D1A6\Cookies\lisa@anad.tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Lisa.YOUR-71A232D1A6\Cookies\lisa@anat.tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Brandon.YOUR-71A232D1A6\Cookies\brandon@login.tracking101[1].txt -> TrackingCookie.Tracking101 : Cleaned.
C:\Documents and Settings\Brandon.YOUR-71A232D1A6\Cookies\brandon@yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Program Files\Common Files\{ECE4E428-0710-1033-1029-040624040001}\services.dll -> Trojan.Small : Cleaned with backup (quarantined).
C:\Program Files\Media-Codec -> Trojan.Small : Cleaned with backup (quarantined).
C:\Program Files\Bfgzjgj\Byjt.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Bouwljf\Imrhty.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Dytexvh\Crqk.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Eatzu\Ceqsgx.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Ebtj\Phxicg.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Emat\Ubzgdh.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Iavynnq\Sfxw.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Jeubqvo\Bibaiw.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Kdstz\Nshwpl.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Kxipf\Yiqwt.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Lgmlg\Ygkz.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Mgrchhr\Wfchoj.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Mhtghiy\Sfyo.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Mkywbzs\Dspn.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Mzjcb\Rkvpqp.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Nwkkc\Knhw.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Nxmkm\Vnroyr.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Oxcpzct\Tikfei.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Oyymkig\Psiudpn.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Ozhbhjv\Ocsz.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Pnuiqbi\Vasclnf.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Qmne\Vwfm.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Qxfcfbi\Uapqc.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Rblqxs\Ptgpqm.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Rvhnho\Rkhrief.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Salf\Vwhamu.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Smwg\Icjvx.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Sotb\Aoqoe.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Sseriu\Dvwcaaa.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Sxgv\Fygutx.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Syrmd\Tgzez.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Tdcf\Vqab.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Uubb\Bkrbcj.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Uyxfhs\Eyavt.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Vpjh\Utyhzp.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Vvana\Zlvt.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Whphjza\Cwigb.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Wzuugrj\Ucyyw.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Yuqkpkk\Hscogc.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Zhtet\Sazo.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Zqbi\Gzjzw.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{36EC0028-8B85-4538-BB29-A461B426C5A6}\RP141\A0077470.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{36EC0028-8B85-4538-BB29-A461B426C5A6}\RP150\A0079134.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{36EC0028-8B85-4538-BB29-A461B426C5A6}\RP153\A0079188.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).


::Report end

[Gecko]

Thedishdoc,

Please copy this to Notepad and print it. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

You have two programs running that we need to stop to get this all fixed.

Disable Spybot's TeaTimer
• Run Spybot-S&D in Advanced Mode
• If it is not already set to do this, go to the Mode menu
select "Advanced Mode"
• On the left hand side, click on Tools
• Then click on the Resident icon in the list
• Uncheck "Resident TeaTimer" and OK any prompts.

Don't forget to re-start Spybot S&D's Teatimer when your machine is clean by undoing the above change.

Disable Windows Defender's
• Open Windows Defender
• Click on "Tools"
• Click on "General Settings"
• Scroll down to "Real-time protection options"
• Uncheck "Turn on Real-time protection (recommended)"
• Click "Save"
• Exit the program.
• Restart your computer

Don't forget to re-enable Windows Defender Real Time Protection when your machine is clean.

Next download to your desktop.
Click killbox.exe.
Select the option "Delete on reboot".
Click the button: All Files (!important!)
Now it should flash green.

Next copy the below red part:

C:\Program Files\Salf\Vwhamu.exe
C:\Program Files\Jeubqvo\Bibaiw.exe
C:\Program Files\Yuqkpkk\Hscogc.exe
C:\Program Files\Sseriu\Dvwcaaa.exe
C:\Program Files\Wzuugrj\Ucyyw.exe
C:\Program Files\Smwg\Icjvx.exe
C:\Program Files\Rblqxs\Ptgpqm.exe
C:\Program Files\Nwkkc\Knhw.exe
C:\Program Files\Eatzu\Ceqsgx.exe
C:\Program Files\Iavynnq\Sfxw.exe
C:\Program Files\Qmne\Vwfm.exe
C:\Program Files\Sxgv\Fygutx.exe
C:\Program Files\Tdcf\Vqab.exe
C:\Program Files\Uubb\Bkrbcj.exe
C:\Program Files\Sotb\Aoqoe.exe
C:\Program Files\Whphjza\Cwigb.exe
C:\Program Files\Mkywbzs\Dspn.exe
C:\Program Files\Lgmlg\Ygkz.exe
C:\Program Files\Emat\Ubzgdh.exe
C:\Program Files\Vpjh\Utyhzp.exe
C:\Program Files\Rvhnho\Rkhrief.exe
C:\Program Files\Vvana\Zlvt.exe
C:\Program Files\Mzjcb\Rkvpqp.exe
C:\Program Files\Bouwljf\Imrhty.exe
C:\Program Files\Mgrchhr\Wfchoj.exe
C:\Program Files\Uyxfhs\Eyavt.exe
C:\Program Files\Nxmkm\Vnroyr.exe
C:\Program Files\Qxfcfbi\Uapqc.exe
C:\Program Files\Pnuiqbi\Vasclnf.exe
C:\Program Files\Bfgzjgj\Byjt.exe
C:\Program Files\Oyymkig\Psiudpn.exe
C:\Program Files\Syrmd\Tgzez.exe
C:\Program Files\Dytexvh\Crqk.exe
C:\Program Files\Ozhbhjv\Ocsz.exe
C:\Program Files\Zqbi\Gzjzw.exe
C:\Program Files\Zhtet\Sazo.exe
C:\Program Files\Mhtghiy\Sfyo.exe
C:\Program Files\Kxipf\Yiqwt.exe
C:\Program Files\Oxcpzct\Tikfei.exe
C:\Program Files\Ebtj\Phxicg.exe
C:\Program Files\Kdstz\Nshwpl.exe
C:\Program Files\Slieqy\Hdwb.exe
C:\windows\Network Diagnostic\xpnetdiag.exe

Click 'File' in the killbox Menu on top and choose Paste from clipboard

Then press the button that looks like a red circle with a white X in it.
Killbox will tell you that all listed files will be removed on next reboot and asks if you would like to Reboot now, click YES
If you don't get that message, reboot manually.

Your computer must reboot now.

After reboot, (you might get error messages about the deleted files, we will fix them with Hijackthis)

Open hijackthis and put a check next to the below entries:

O4 - HKLM\..\Run: [Znmucl] C:\Program Files\Salf\Vwhamu.exe
O4 - HKLM\..\Run: [Kzflu] C:\Program Files\Jeubqvo\Bibaiw.exe
O4 - HKLM\..\Run: [Xajxqp] C:\Program Files\Yuqkpkk\Hscogc.exe
O4 - HKLM\..\Run: [Rgngnx] C:\Program Files\Sseriu\Dvwcaaa.exe
O4 - HKLM\..\Run: [Lqdmon] C:\Program Files\Wzuugrj\Ucyyw.exe
O4 - HKLM\..\Run: [Yenuu] C:\Program Files\Smwg\Icjvx.exe
O4 - HKLM\..\Run: [Iyrcuro] C:\Program Files\Rblqxs\Ptgpqm.exe
O4 - HKLM\..\Run: [Qawprv] C:\Program Files\Nwkkc\Knhw.exe
O4 - HKLM\..\Run: [Gphkam] C:\Program Files\Eatzu\Ceqsgx.exe
O4 - HKLM\..\Run: [Kzfhqi] C:\Program Files\Iavynnq\Sfxw.exe
O4 - HKLM\..\Run: [Ssvzcm] C:\Program Files\Qmne\Vwfm.exe
O4 - HKLM\..\Run: [Hvrccb] C:\Program Files\Sxgv\Fygutx.exe
O4 - HKLM\..\Run: [Qkcqk] C:\Program Files\Tdcf\Vqab.exe
O4 - HKLM\..\Run: [Nutqzooj] C:\Program Files\Uubb\Bkrbcj.exe
O4 - HKLM\..\Run: [Yoophhqh] C:\Program Files\Sotb\Aoqoe.exe
O4 - HKLM\..\Run: [Tdxpk] C:\Program Files\Whphjza\Cwigb.exe
O4 - HKLM\..\Run: [Ittuiyz] C:\Program Files\Mkywbzs\Dspn.exe
O4 - HKLM\..\Run: [Gafkf] C:\Program Files\Lgmlg\Ygkz.exe
O4 - HKLM\..\Run: [Tvhzpyx] C:\Program Files\Emat\Ubzgdh.exe
O4 - HKLM\..\Run: [Dnhplsm] C:\Program Files\Vpjh\Utyhzp.exe
O4 - HKLM\..\Run: [Rwcckglo] C:\Program Files\Rvhnho\Rkhrief.exe
O4 - HKLM\..\Run: [Hajkpu] C:\Program Files\Vvana\Zlvt.exe
O4 - HKLM\..\Run: [Ssfrdn] C:\Program Files\Mzjcb\Rkvpqp.exe
O4 - HKLM\..\Run: [Jasqpknv] C:\Program Files\Bouwljf\Imrhty.exe
O4 - HKLM\..\Run: [Nyysdf] C:\Program Files\Mgrchhr\Wfchoj.exe
O4 - HKLM\..\Run: [Uhnliwa] C:\Program Files\Uyxfhs\Eyavt.exe
O4 - HKLM\..\Run: [Olmia] C:\Program Files\Nxmkm\Vnroyr.exe
O4 - HKLM\..\Run: [Vrxpojw] C:\Program Files\Qxfcfbi\Uapqc.exe
O4 - HKLM\..\Run: [Vhekoqwm] C:\Program Files\Pnuiqbi\Vasclnf.exe
O4 - HKLM\..\Run: [Crbevfpw] C:\Program Files\Bfgzjgj\Byjt.exe
O4 - HKLM\..\Run: [Nfqwe] C:\Program Files\Oyymkig\Psiudpn.exe
O4 - HKLM\..\Run: [Ztfplm] C:\Program Files\Syrmd\Tgzez.exe
O4 - HKLM\..\Run: [Xqnac] C:\Program Files\Dytexvh\Crqk.exe
O4 - HKLM\..\Run: [Mvwxx] C:\Program Files\Ozhbhjv\Ocsz.exe
O4 - HKLM\..\Run: [Zqfxq] C:\Program Files\Zqbi\Gzjzw.exe
O4 - HKLM\..\Run: [Nbjoig] C:\Program Files\Zhtet\Sazo.exe
O4 - HKLM\..\Run: [Idvhfdl] C:\Program Files\Mhtghiy\Sfyo.exe
O4 - HKLM\..\Run: [Imsgyyf] C:\Program Files\Kxipf\Yiqwt.exe
O4 - HKLM\..\Run: [Ennct] C:\Program Files\Oxcpzct\Tikfei.exe
O4 - HKLM\..\Run: [Onsmygnx] C:\Program Files\Ebtj\Phxicg.exe
O4 - HKLM\..\Run: [Xyvfyw] C:\Program Files\Kdstz\Nshwpl.exe
O4 - HKLM\..\Run: [Waxilp] C:\Program Files\Slieqy\Hdwb.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

Now click the fix button and close Hijackthis.

Click Start, click My computer and then right click on your C: drive and select "Properties"
Now click the "Disk cleanup" button, in the next window put a check next to Recycle Bin, Temporary Internet Files and Temporary Files click OK and then click yes in the popup window.

Restart your computer and post a new HiJackThis log when your reply.

[thedishdoc]

I appreciate the help. Here is the latest logfile.

Logfile of HijackThis v1.99.1
Scan saved at 11:23:35 AM, on 2/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
C:\PROGRA~1\McAfee\MSC\mctskshd.exe
C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\Program Files\Common Files\Symantec Shared\Security Center\SymSCUI.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
c:\program files\mcafee\msc\mcuimgr.exe
C:\Documents and Settings\Compaq_Owner\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE= ... pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE= ... pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.earthlink.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE= ... pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar7.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar7.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe" -start
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Photags AutoDetect.lnk = C:\Program Files\PhoTags Express\Photags AutoDetect.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 0855953078
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee Log Manager (McLogManagerService) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Task Scheduler (mctskshd.exe) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mctskshd.exe
O23 - Service: McAfee User Manager (mcusrmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

[Gecko]

Your log is clean

How is it running now?