help with hjt and vx2/urllogic - Page 2

Question

crunchie 990 Most Valuable Poster

19 Years Ago

Your last silent runners log showed that they do exist. Please post another one and we can try something. Post an hijackthis log too please.

DMR 152 Wombat At Large

19 Years Ago

Not that this will solve you're problems, but the following entry in your log indicates that you are running a slighty older version of HijackThis:

"Logfile of HijackThis v1.99.0"

Please uninstall your current version of HJT through your Add/Remove programs control panel, download the most recent veraion (1.99.1) from the link in my sig below, and use that version from now on.

crunchie 990 Most Valuable Poster

19 Years Ago

Please do follow DMR's advice first. Looking at that silent runners log, those files no longer exist? I am wondering now whether the scan was done before removing the files with killbox, or if you hadn't rebooted? Either way there are just a couple of cleanups to do in your HJT log. How is your PC behaving??

Scan with hijackthis and tick the boxes next to all the following entries, then close all browser and explorer windows, and hit the "Fix checked" button.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm

crunchie 990 Most Valuable Poster

19 Years Ago

Apart from these entries;

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm

there is nothing showing in your logs :).

How is your PC behaving??

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

mjbickford 0 Light Poster · Answer 1 · 2005-02-20T05:11:28+00:00

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

Find.bat is running from: C:\Documents and Settings\Mike Bickford.NOTEBOOK\Desktop\Find It NT-2K-XP

------- System Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 4868-CFDF

Directory of C:\WINDOWS\System32

02/13/2005 11:47 PM 475 wwsc.dll
02/12/2005 12:44 PM <DIR> DLLCACHE
05/18/2004 05:59 AM <DIR> Microsoft
1 File(s) 475 bytes
2 Dir(s) 3,728,191,488 bytes free

------- Hidden Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 4868-CFDF

Directory of C:\WINDOWS\System32

02/13/2005 11:47 PM 475 wwsc.dll
02/12/2005 12:44 PM <DIR> DLLCACHE
02/11/2005 08:20 PM 106 dxoej.dll
09/15/2004 01:03 AM <DIR> GroupPolicy
08/01/2004 11:11 AM 488 logonui.exe.manifest
08/01/2004 11:11 AM 488 WindowsLogon.manifest
08/01/2004 11:10 AM 749 sapi.cpl.manifest
08/01/2004 11:10 AM 749 nwc.cpl.manifest
08/01/2004 11:10 AM 749 ncpa.cpl.manifest
08/01/2004 11:10 AM 749 wuaucpl.cpl.manifest
08/01/2004 11:10 AM 749 cdplayer.exe.manifest
9 File(s) 5,302 bytes
2 Dir(s) 3,728,187,392 bytes free

------------ Files Named "Guard" ---------------

Volume in drive C has no label.
Volume Serial Number is 4868-CFDF

Directory of C:\WINDOWS\System32

------ Temp Files in System32 Directory ------

Volume in drive C has no label.
Volume Serial Number is 4868-CFDF

Directory of C:\WINDOWS\System32

07/16/2003 08:19 AM 2,577 CONFIG.TMP
1 File(s) 2,577 bytes
0 Dir(s) 3,728,187,392 bytes free

------------------ User Agent ----------------

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""

------------- Keys Under Notify -------------

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
@=""
"DLLName"="igfxsrvc.dll"
"Asynchronous"=dword:00000001
"Impersonate"=dword:00000001
"Unlock"="WinlogonUnlockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"DllName"="C:\\WINDOWS\\System32\\NavLogon.dll"
"StartShell"="NavStartShellEvent"
"Logoff"="NavLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Sebring]
"Asynchronous"=dword:00000000
"Dllname"="C:\\WINDOWS\\System32\\LgNotify.dll"
"Impersonate"=dword:00000000
"Logon"="SebringUserLogon"
"Logoff"="SebringUserLogoff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

------------- Locate.com Results -------------

-------- Strings.exe Qoologic Results --------

C:\WINDOWS\SYSTEM32\cgcpzg.dll: updates.qoologic.com
C:\WINDOWS\SYSTEM32\ezeauz.dll: updates.qoologic.com
C:\WINDOWS\SYSTEM32\hphqmp.exe: updates.qoologic.com

--------- Strings.exe Aspack Results ---------

C:\WINDOWS\SYSTEM32\ntdll.dll: .aspack
C:\WINDOWS\SYSTEM32\pqpvyq.dat: .aspack
C:\WINDOWS\SYSTEM32\wywkoy.exe: .aspack

-------------- HKLM Run Key ----------------

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"vptray"="C:\\PROGRA~1\\ANTIVI~1\\vptray.exe"
"HotKeysCmds"="C:\\WINDOWS\\system32\\hkcmd.exe"
"PRONoMgr.exe"="C:\\Program Files\\Intel\\NCS\\PROSet\\PRONoMgr.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"gcasServ"="\"C:\\Program Files\\Microsoft AntiSpyware\\gcasServ.exe\""
"Narrator"="C:\\WINDOWS\\system32\\wywkoy.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 2 · 2005-02-20T08:25:21+00:00

This isn't working at all :(. This is the first time I have not had these qoologic files removed. Let's try the pocket killbox's big brother.

Please download The Killbox from here: http://www.computercops.biz/zx/phoenix22/KillBox.zip

Unzip the files to a folder.

Run the Killbox and paste the full file path of each of the below files in the box and click on Standard File Kill and End Explorer Shell While Killing File. Click on the button with the red circle and an X in the middle after you enter each file (see the files below).

C:\WINDOWS\SYSTEM32\cgcpzg.dll
C:\WINDOWS\SYSTEM32\ezeauz.dll
C:\WINDOWS\SYSTEM32\hphqmp.exe
C:\WINDOWS\SYSTEM32\pqpvyq.dat
C:\WINDOWS\SYSTEM32\wywkoy.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hyhnpy.exe

Reboot afterwards if the files are successfully deleted.

If all files are not deleted, do not reboot yet. Run the Killbox again and paste the full file path in the box and click on Delete on Reboot. Next click on the button with the red circle and an X in the middle. You will get a message saying "File with be deleted on next reboot, Process and Reboot now?" Click "Yes" to reboot only after the last file you enter.

Post an hijackthis log (from the 1.99.1 version) and a Find_it log and a qoologic log please.

mjbickford 0 Light Poster · Answer 3 · 2005-02-20T10:36:22+00:00

Kill Box still doesnt seem to be working. I ALSO cant seem to get killbox to delete on re-boot either.

Here is the log:

Log for KillBox Version: 2.00.0179
------------------------------------

Input Entry C:\WINDOWS\SYSTEM32\cgcpzg.dll
c:\windows\system32\cgcpzg.dll Was deleted Successfully
Input Entry C:\WINDOWS\SYSTEM32\ezeauz.dll
c:\windows\system32\ezeauz.dll Could Not be Deleted
Input Entry C:\WINDOWS\SYSTEM32\hphqmp.exe
c:\windows\system32\hphqmp.exe Was deleted Successfully
Input Entry C:\WINDOWS\SYSTEM32\pqpvyq.dat
c:\windows\system32\pqpvyq.dat Was deleted Successfully
Input Entry C:\WINDOWS\SYSTEM32\wywkoy.exe
c:\windows\system32\wywkoy.exe Was deleted Successfully
Input Entry C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hyhnpy.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hyhnpy.exe Does not exist
Input Entry C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hyhnpy.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hyhnpy.exe Does not exist

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 4 · 2005-02-20T11:29:45+00:00

OK. On the files that it is having problems with, try the same process in safe mode.
Can you post the logs so that I can see any changes.

mjbickford 0 Light Poster · Answer 5 · 2005-02-21T10:58:32+00:00

Even in safe mode it didnt work

Log for KillBox Version: 2.00.0179
------------------------------------

Input Entry C:\WINDOWS\SYSTEM32\cgcpzg.dll
c:\windows\system32\cgcpzg.dll Was deleted Successfully
Input Entry C:\WINDOWS\SYSTEM32\ezeauz.dll
c:\windows\system32\ezeauz.dll Was deleted Successfully
Input Entry C:\WINDOWS\SYSTEM32\hphqmp.exe
c:\windows\system32\hphqmp.exe Was deleted Successfully
Input Entry C:\WINDOWS\SYSTEM32\pqpvyq.dat
c:\windows\system32\pqpvyq.dat Was deleted Successfully
Input Entry C:\WINDOWS\SYSTEM32\pqpvyq.dat
C:\WINDOWS\SYSTEM32\pqpvyq.dat Does not exist
Input Entry C:\WINDOWS\SYSTEM32\wywkoy.exe
C:\WINDOWS\SYSTEM32\wywkoy.exe Does not exist
Input Entry C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hyhnpy.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hyhnpy.exe Does not exist

mjbickford 0 Light Poster · Answer 6 · 2005-02-21T12:46:24+00:00

Logfile of HijackThis v1.99.0
Scan saved at 10:45:44 PM, on 2/20/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\cisvc.exe
C:\PROGRA~1\ANTIVI~1\DefWatch.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\ANTIVI~1\Rtvscan.exe
C:\WINDOWS\system32\RegSrvc.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\System32\mqsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\1XConfig.exe
C:\WINDOWS\System32\mqtgsvc.exe
C:\PROGRA~1\ANTIVI~1\vptray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\hyhnpy.exe
C:\Program Files\Sony Handheld\HOTSYNC.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Online Services\AnalogX\POW\pow.exe
C:\Program Files\QUICKENW\bagent.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Documents and Settings\Mike Bickford.NOTEBOOK\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.att.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.att.net/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\ANTIVI~1\vptray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Startup: POW!.lnk = C:\Program Files\Online Services\AnalogX\POW\pow.exe
O4 - Startup: Quicken Scheduled Updates.lnk = C:\Program Files\QUICKENW\bagent.exe
O8 - Extra context menu item: &Check Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Download with GetRight - C:\Program Files\Online Services\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\Online Services\GetRight\GRbrowse.htm
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\ANTIVI~1\DefWatch.exe
O23 - Service: Intel NCS NetService - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client - Symantec Corporation - C:\PROGRA~1\ANTIVI~1\Rtvscan.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\system32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor - Intel Corporation - C:\WINDOWS\system32\S24EvMon.exe

mjbickford 0 Light Poster · Answer 7 · 2005-02-21T12:55:38+00:00

C:\Documents and Settings\Mike Bickford.NOTEBOOK\Desktop

PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Files Found in system Folder............
------------------------
C:\WINDOWS\SYSTEM32\cgcpzg.dll: updates.qoologic.com
C:\WINDOWS\SYSTEM32\ezeauz.dll: updates.qoologic.com
C:\WINDOWS\SYSTEM32\hphqmp.exe: updates.qoologic.com
C:\WINDOWS\SYSTEM32\ntdll.dll: .aspack
C:\WINDOWS\SYSTEM32\pqpvyq.dat: .aspack
C:\WINDOWS\SYSTEM32\wywkoy.exe: .aspack

Files Found in all users startup Folder............
------------------------
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\hyhnpy.exe: .aspack

mjbickford 0 Light Poster · Answer 8 · 2005-02-21T13:12:52+00:00

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

Find.bat is running from: C:\Documents and Settings\Mike Bickford.NOTEBOOK\Desktop\Find It NT-2K-XP

------- System Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 4868-CFDF

Directory of C:\WINDOWS\System32

02/13/2005 11:47 PM 475 wwsc.dll
02/12/2005 12:44 PM <DIR> DLLCACHE
05/18/2004 05:59 AM <DIR> Microsoft
1 File(s) 475 bytes
2 Dir(s) 3,678,605,312 bytes free

------- Hidden Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 4868-CFDF

Directory of C:\WINDOWS\System32

02/13/2005 11:47 PM 475 wwsc.dll
02/12/2005 12:44 PM <DIR> DLLCACHE
02/11/2005 08:20 PM 106 dxoej.dll
09/15/2004 01:03 AM <DIR> GroupPolicy
08/01/2004 11:11 AM 488 logonui.exe.manifest
08/01/2004 11:11 AM 488 WindowsLogon.manifest
08/01/2004 11:10 AM 749 sapi.cpl.manifest
08/01/2004 11:10 AM 749 nwc.cpl.manifest
08/01/2004 11:10 AM 749 ncpa.cpl.manifest
08/01/2004 11:10 AM 749 wuaucpl.cpl.manifest
08/01/2004 11:10 AM 749 cdplayer.exe.manifest
9 File(s) 5,302 bytes
2 Dir(s) 3,678,601,216 bytes free

------------ Files Named "Guard" ---------------

Volume in drive C has no label.
Volume Serial Number is 4868-CFDF

Directory of C:\WINDOWS\System32

------ Temp Files in System32 Directory ------

Volume in drive C has no label.
Volume Serial Number is 4868-CFDF

Directory of C:\WINDOWS\System32

07/16/2003 08:19 AM 2,577 CONFIG.TMP
1 File(s) 2,577 bytes
0 Dir(s) 3,678,601,216 bytes free