Buy Malwarebytes antimalware
Google
The Spykiller
  Home Help Search Calendar Login Register   *
Board Language: Deutsch English
Advertise on this site

Welcome to The Spykiller

You only need to register to  get help with malware cleaning on your computer or take part in the general discussion forums You DO NOT need to register to upload suspicious files for examination or download any of the tools or use any other part of this site.
It takes a very long time and a lot of hard work on our part to read all the logs posted here and research and prepare the fixes for you. In many cases each part of the fix takes about 30 minutes to prepare so a large part of our time is spent helping you

 INSTRUCTIONS - Read This Before Posting For Malware Removal Help
Digg This!
The Spykiller  > Spyware & Malware removal and General computer help > Malware removal and help > Topic: Msiexec.exe is Infected!!!
Pages: 1 [2] 3 4 5 6 7 ... 16   Go Down
« previous next »
  Print  
Author Topic: Msiexec.exe is Infected!!!  (Read 17715 times)
0 Members and 2 Guests are viewing this topic.
xblade12100
*
Offline Offline

Posts: 93
« Reply #10 on: February 09, 2008, 18:39:10 »
sorry but I already Installed The recovery Console. and for your First answer when I click on the link, That's what it says, It doesn't let me download the zip
Logged
xblade12100
*
Offline Offline

Posts: 93
« Reply #11 on: February 09, 2008, 20:18:43 »
This might help, I got something that is called search settings and when msiexes.exe starts has Search settings in the window
Logged
xblade12100
*
Offline Offline

Posts: 93
« Reply #12 on: February 09, 2008, 20:45:18 »
Never Mind step 2 here is that Log

Code:
               $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
                        º                                    º
                                    hjtscanlist v2.0             
                        º                                    º
                        $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

Microsoft Windows XP [Version 5.1.2600]
 
 
C:

  2008-02-10 14:10      C:\WINDOWS --------- 0
  2008-02-09 13:00      C:\rollback.ini --------- 337
  2008-02-09 10:19      C:\ComboFix --------- 0
  2008-02-09 09:10      C:\boot.ini --------- 282
  2008-02-09 09:10      C:\cmdcons --------- 0
  2008-02-09 09:01      C:\BOOT.BAK --------- 211
  2008-02-09 08:51      C:\biosinfo --------- 53
        C:\pagefile.sys --------- 
  2008-02-08 17:51      C:\QooBox --------- 0
  2008-02-08 17:51      C:\ComboFix.txt --------- 21535
  2008-02-08 17:29      C:\Deckard --------- 0
  2008-02-06 16:49      C:\Program Files --------- 0
  2008-02-04 19:26      C:\Config.Msi --------- 0
  2008-02-03 11:16      C:\netstat.txt --------- 751
  2008-01-31 20:21      C:\SICKO --------- 0
  2008-01-21 20:19      C:\aidualc3 --------- 0
  2008-01-16 17:44      C:\NVIDIA --------- 0
  2008-01-14 17:24      C:\$VAULT$.AVG --------- 0
  2008-01-04 10:23      C:\RECYCLER --------- 0
  2008-01-04 10:23      C:\Documents and Settings --------- 0
  2007-12-24 13:14      C:\Output --------- 0
  2007-12-13 21:07      C:\BennyTools --------- 0
  2007-12-13 20:05      C:\System Volume Information --------- 0
  2007-12-05 18:30      C:\mugen --------- 0
  2007-11-19 19:42      C:\sccfg.sys --------- 256
  2007-11-19 19:42      C:\hook.log --------- 684
  2007-09-22 11:14      C:\s34s.3f --------- 19211
  2007-09-21 07:42      C:\Pink Floyd - Wish You Were Here.mp3 --------- 5083568
  2007-09-15 08:30      C:\ASPI.LOG --------- 4896
  2007-09-03 07:26      C:\VTPFiles --------- 0
  2007-08-25 22:11      C:\found.000 --------- 0
  2007-08-01 14:29      C:\sqmdata03.sqm --------- 268
  2007-08-01 14:29      C:\sqmnoopt03.sqm --------- 244
  2007-07-31 12:03      C:\sqmdata02.sqm --------- 268
  2007-07-31 12:03      C:\sqmnoopt02.sqm --------- 244
  2007-07-30 08:19      C:\sqmdata01.sqm --------- 268
  2007-07-30 08:19      C:\sqmnoopt01.sqm --------- 244
  2007-07-29 21:47      C:\sqmnoopt00.sqm --------- 244
  2007-07-29 21:47      C:\sqmdata00.sqm --------- 268
  2007-07-19 19:30      C:\wally --------- 0
  2007-07-15 13:46      C:\IPH.PH --------- 1100
  2007-06-30 09:41      C:\SBE --------- 0
  2007-06-29 18:53      C:\BenDriver --------- 0
  2007-06-28 22:34      C:\JimBackup --------- 0
  2007-06-27 19:47      C:\ATI --------- 0
  2007-06-27 18:59      C:\CONFIG.SYS --------- 0
  2007-06-27 18:59      C:\IO.SYS --------- 0
  2007-06-27 18:59      C:\MSDOS.SYS --------- 0
  2007-06-27 18:59      C:\AUTOEXEC.BAT --------- 0
  2007-02-27 21:42      C:\instiki-0.11.pl1 --------- 0
  2004-08-04 07:00      C:\kmd.exe --------- 388608
  2004-08-04 07:00      C:\NTDETECT.COM --------- 47564
  2004-08-04 07:00      C:\ntldr --------- 250032
  2004-08-04 07:00      C:\cmldr --------- 260272
  2001-06-09 13:25      C:\PDOXUSRS.NET --------- 13030
----------------------------------------

 
C:\WINDOWS

  2008-02-10 14:12     C:\WINDOWS\WindowsUpdate.log --------- 1625573
  2008-02-10 14:11     C:\WINDOWS\wmsetup.log --------- 403
  2008-02-10 13:51     C:\WINDOWS\setupapi.log --------- 5554
  2008-02-09 10:19     C:\WINDOWS\PSEXESVC.EXE --------- 53248
  2008-02-09 09:10     C:\WINDOWS\WINNT32.LOG --------- 14836
  2008-02-09 09:10     C:\WINDOWS\UPGRADE.TXT --------- 264
  2008-02-09 09:10     C:\WINDOWS\wsdu.log --------- 38766
  2008-02-09 09:09     C:\WINDOWS\DHCPUPG.LOG --------- 178
  2008-02-09 09:01     C:\WINDOWS\win.ini --------- 1225
  2008-02-09 09:01     C:\WINDOWS\system.ini --------- 327
  2008-02-09 08:52     C:\WINDOWS\QTFont.qfn --------- 54156
  2008-02-09 08:51     C:\WINDOWS\0.log --------- 0
  2008-02-09 08:50     C:\WINDOWS\bootstat.dat --------- 2048
  2008-02-08 19:13     C:\WINDOWS\MEMORY.DMP --------- 1073299456
  2008-02-07 12:42     C:\WINDOWS\spupdsvc.log --------- 115269
  2008-02-07 08:28     C:\WINDOWS\KB926239.log --------- 23961
  2008-02-07 08:28     C:\WINDOWS\MSCompPackV1.log --------- 19086
  2008-02-07 08:27     C:\WINDOWS\wmp11.log --------- 43861
  2008-02-07 08:27     C:\WINDOWS\wmsetup10.log --------- 5790
  2008-02-07 08:25     C:\WINDOWS\WMFDist11.log --------- 98249
  2008-02-07 08:22     C:\WINDOWS\iis6.log --------- 208649
  2008-02-07 08:22     C:\WINDOWS\ntdtcsetup.log --------- 287891
  2008-02-07 08:22     C:\WINDOWS\tsoc.log --------- 522658
  2008-02-07 08:22     C:\WINDOWS\ocmsn.log --------- 73748
  2008-02-07 08:22     C:\WINDOWS\Wudf01000Inst.log --------- 24276
  2008-02-07 08:22     C:\WINDOWS\msgsocm.log --------- 67773
  2008-02-07 08:22     C:\WINDOWS\FaxSetup.log --------- 1326628
  2008-02-07 08:20     C:\WINDOWS\setuperr.log --------- 0
  2008-02-06 17:11     C:\WINDOWS\wiaservc.log --------- 48
  2008-02-06 17:11     C:\WINDOWS\wiadebug.log --------- 159
  2008-02-03 12:27     C:\WINDOWS\drwatson.log --------- 309
  2008-02-03 09:51     C:\WINDOWS\QTFont.for --------- 1409
  2008-01-27 10:30     C:\WINDOWS\ALCFDRTM.VER --------- 60416
  2008-01-22 16:33     C:\WINDOWS\cdplayer.ini --------- 4934
  2008-01-20 17:43     C:\WINDOWS\'Full Speed' Internet Booster + Performance Tests Setup Log.txt --------- 68576
  2008-01-17 17:01     C:\WINDOWS\KB925720.log --------- 36231
  2008-01-16 18:08     C:\WINDOWS\XpsEPSC.log --------- 29499
  2008-01-16 18:08     C:\WINDOWS\imsins.BAK --------- 1374
  2008-01-16 18:08     C:\WINDOWS\WIC.log --------- 30681
  2008-01-16 18:07     C:\WINDOWS\KB925876.log --------- 34328
  2008-01-16 18:06     C:\WINDOWS\KB920342.log --------- 36146
  2008-01-16 18:06     C:\WINDOWS\updspapi.log --------- 151185
  2008-01-16 18:06     C:\WINDOWS\KB904942.log --------- 47078
  2008-01-16 18:06     C:\WINDOWS\basecsp.log --------- 21354
  2008-01-16 18:06     C:\WINDOWS\KB896344.log --------- 25930
  2008-01-16 18:06     C:\WINDOWS\KB943460.log --------- 61895
  2008-01-12 17:01     C:\WINDOWS\KB939683.log --------- 16707
  2008-01-11 17:04     C:\WINDOWS\KB941569.log --------- 17712
  2008-01-11 17:03     C:\WINDOWS\KB929399.log --------- 15929
  2008-01-11 17:02     C:\WINDOWS\KB936782.log --------- 37734
  2008-01-11 16:12     C:\WINDOWS\setupapi.log.1.old --------- 2185165
  2008-01-09 16:03     C:\WINDOWS\ODBC.INI --------- 488
  2008-01-08 17:06     C:\WINDOWS\KB941644.log --------- 11275
  2008-01-08 17:02     C:\WINDOWS\KB943485.log --------- 11475
  2008-01-06 19:42     C:\WINDOWS\doom3.ini --------- 331
  2008-01-05 17:01     C:\WINDOWS\KB927891.log --------- 42441
  2008-01-04 19:45     C:\WINDOWS\KB899587.log --------- 91664
  2008-01-04 19:41     C:\WINDOWS\KB927779.log --------- 90263
  2008-01-04 19:36     C:\WINDOWS\KB927802.log --------- 82100
  2008-01-04 19:31     C:\WINDOWS\KB922819.log --------- 83577
  2008-01-04 19:29     C:\WINDOWS\KB885835.log --------- 81988
  2008-01-04 19:28     C:\WINDOWS\KB885836.log --------- 75152
  2008-01-04 19:28     C:\WINDOWS\KB923414.log --------- 79981
  2008-01-04 19:26     C:\WINDOWS\KB928255.log --------- 79310
  2008-01-04 19:25     C:\WINDOWS\KB931784.log --------- 94160
  2008-01-04 19:24     C:\WINDOWS\KB911927.log --------- 76784
  2008-01-04 19:24     C:\WINDOWS\KB901017.log --------- 73385
  2008-01-04 19:23     C:\WINDOWS\KB899591.log --------- 76613
  2008-01-04 19:22     C:\WINDOWS\KB933729.log --------- 42871
  2008-01-04 19:19     C:\WINDOWS\KB920685.log --------- 78071
  2008-01-04 19:17     C:\WINDOWS\KB893756.log --------- 75000
  2008-01-04 19:17     C:\WINDOWS\KB923980.log --------- 75856
  2008-01-04 19:17     C:\WINDOWS\KB911280.log --------- 74627
  2008-01-04 19:16     C:\WINDOWS\KB936021.log --------- 47814
  2008-01-04 19:16     C:\WINDOWS\KB911562.log --------- 74873
  2008-01-04 19:16     C:\WINDOWS\KB938828.log --------- 46205
  2008-01-04 19:16     C:\WINDOWS\KB924667.log --------- 71656
  2008-01-04 19:16     C:\WINDOWS\KB896423.log --------- 70792
  2008-01-04 19:15     C:\WINDOWS\KB900485.log --------- 72826
  2008-01-04 19:15     C:\WINDOWS\KB924270.log --------- 71474
  2008-01-04 19:15     C:\WINDOWS\KB931261.log --------- 74950
  2008-01-04 19:13     C:\WINDOWS\KB873339.log --------- 70083
  2008-01-04 19:13     C:\WINDOWS\KB921503.log --------- 42630
  2008-01-04 19:13     C:\WINDOWS\KB938829.log --------- 42867
  2008-01-04 19:13     C:\WINDOWS\KB896358.log --------- 67284
  2008-01-04 19:12     C:\WINDOWS\KB910437.log --------- 50936
  2008-01-04 19:08     C:\WINDOWS\KB925902.log --------- 66434
  2008-01-04 19:08     C:\WINDOWS\KB929123.log --------- 61047
  2008-01-04 19:08     C:\WINDOWS\KB920670.log --------- 55013
  2008-01-04 19:08     C:\WINDOWS\KB891781.log --------- 57545
  2008-01-04 19:08     C:\WINDOWS\KB918439.log --------- 68890
  2008-01-04 19:07     C:\WINDOWS\KB890046.log --------- 81789
  2008-01-04 19:07     C:\WINDOWS\KB926436.log --------- 57455
  2008-01-04 19:07     C:\WINDOWS\KB920872.log --------- 63513
  2008-01-04 19:06     C:\WINDOWS\KB942763.log --------- 36200
  2008-01-04 19:06     C:\WINDOWS\KB930178.log --------- 67521
  2008-01-04 19:06     C:\WINDOWS\KB919007.log --------- 50511
  2008-01-04 19:06     C:\WINDOWS\KB914388.log --------- 69514
  2008-01-04 19:05     C:\WINDOWS\KB905414.log --------- 76516
  2008-01-04 19:05     C:\WINDOWS\KB917953.log --------- 53106
  2008-01-04 19:05     C:\WINDOWS\KB932168.log --------- 58153
  2008-01-04 19:05     C:\WINDOWS\KB901214.log --------- 54812
  2008-01-04 19:05     C:\WINDOWS\KB923191.log --------- 47743
  2008-01-04 19:04     C:\WINDOWS\KB922582.log --------- 41143
  2008-01-04 19:04     C:\WINDOWS\KB918118.log --------- 62477
  2008-01-04 19:04     C:\WINDOWS\KB926255.log --------- 44890
  2008-01-04 19:04     C:\WINDOWS\KB941568.log --------- 28770
  2008-01-04 19:03     C:\WINDOWS\KB888302.log --------- 42093
  2008-01-04 19:03     C:\WINDOWS\KB900725.log --------- 51306
  2008-01-04 19:03     C:\WINDOWS\KB920213.log --------- 43615
  2008-01-04 19:02     C:\WINDOWS\KB935840.log --------- 45295
  2008-01-04 19:02     C:\WINDOWS\KB930916.log --------- 39909
  2008-01-04 19:02     C:\WINDOWS\KB938127-IE7.log --------- 34070
  2008-01-04 19:02     C:\WINDOWS\KB885884.log --------- 11128
  2008-01-04 19:02     C:\WINDOWS\KB908531.log --------- 45503
  2008-01-04 19:01     C:\WINDOWS\KB905749.log --------- 39293
  2008-01-04 19:00     C:\WINDOWS\KB913580.log --------- 47681
  2008-01-04 19:00     C:\WINDOWS\KB896428.log --------- 35707
  2008-01-04 19:00     C:\WINDOWS\KB908519.log --------- 41740
  2008-01-04 18:59     C:\WINDOWS\KB920683.log --------- 34151
  2008-01-04 18:59     C:\WINDOWS\KB914389.log --------- 44544
  2008-01-04 18:58     C:\WINDOWS\KB944653.log --------- 13240
  2008-01-04 18:58     C:\WINDOWS\KB890859.log --------- 44982
  2008-01-04 18:57     C:\WINDOWS\KB928843.log --------- 28410
  2008-01-04 17:00     C:\WINDOWS\KB893803v2.log --------- 30299
  2008-01-04 11:15     C:\WINDOWS\KB893803v2Uninst.log --------- 8162
  2008-01-04 11:15     C:\WINDOWS\KB925398.log --------- 49158
  2008-01-04 11:14     C:\WINDOWS\KB902400.log --------- 58785
  2008-01-04 11:14     C:\WINDOWS\KB941202.log --------- 20667
  2008-01-04 11:13     C:\WINDOWS\KB886185.log --------- 23337
  2008-01-04 11:13     C:\WINDOWS\KB935839.log --------- 59963
  2008-01-03 17:01     C:\WINDOWS\KB911564.log --------- 32704
  2008-01-03 17:00     C:\WINDOWS\KB916595.log --------- 52094
  2008-01-03 16:46     C:\WINDOWS\ie7_main.log --------- 57745
  2007-12-30 19:25     C:\WINDOWS\WINDVDBOOTRECDOE.sys --------- 2570
  2007-12-14 18:17     C:\WINDOWS\ie7.log --------- 142663
  2007-12-14 18:16     C:\WINDOWS\IDNMitigationAPIs.log --------- 19058
  2007-12-14 18:16     C:\WINDOWS\NLSDownlevelMapping.log --------- 18739
  2007-12-14 18:16     C:\WINDOWS\KB915865.log --------- 19495
  2007-12-13 19:59     C:\WINDOWS\ODBCINST.INI --------- 4161
  2007-12-13 19:58     C:\WINDOWS\WindowsShell.Manifest --------- 749
  2007-12-13 19:57     C:\WINDOWS\sessmgr.setup.log --------- 2063
  2007-12-13 19:56     C:\WINDOWS\cmsetacl.log --------- 373
  2007-12-13 19:49     C:\WINDOWS\regopt.log --------- 3578
  2007-12-06 07:27     C:\WINDOWS\setupapi.old --------- 528354
  2007-12-05 16:09     C:\WINDOWS\WinAVI Video Converter 9.0 Setup Log.txt --------- 24491
  2007-12-02 09:00     C:\WINDOWS\NeroDigital.ini --------- 69
  2007-12-01 08:29     C:\WINDOWS\98910.exe --------- 7650416
  2007-11-19 21:52     C:\WINDOWS\SwSys2.bmp --------- 0
  2007-11-19 21:52     C:\WINDOWS\SwSys1.bmp --------- 0
  2007-11-14 16:05     C:\WINDOWS\zllsputility.exe --------- 75248
  2007-10-12 22:42     C:\WINDOWS\KB939653-IE7.log --------- 23576
  2007-09-26 19:02     C:\WINDOWS\Thumbs.db --------- 8704
  2007-09-24 16:53     C:\WINDOWS\msxml6-KB933579-enu-x86.LOG --------- 510216
  2007-09-22 11:09     C:\WINDOWS\PowerReg.dat --------- 0
  2007-09-08 22:37     C:\WINDOWS\mafosav.INI --------- 82
  2007-09-04 18:00     C:\WINDOWS\Wininit.ini --------- 22
  2007-09-03 07:25     C:\WINDOWS\Icon_1.ico --------- 64766
  2007-09-02 22:08     C:\WINDOWS\BricoPackFoldersDelete.cmd --------- 6114
  2007-09-02 22:08     C:\WINDOWS\BricoPackUninst.txt --------- 64949
  2007-09-02 22:08     C:\WINDOWS\BricoPackUninst.cmd --------- 64949
  2007-09-02 22:08     C:\WINDOWS\BricoPack Wallpaper.bmp --------- 2359350
  2007-08-31 07:36     C:\WINDOWS\Swypeout Battle Racing Patch Log.txt --------- 4305
  2007-08-28 19:10     C:\WINDOWS\KB933360.log --------- 22885
  2007-08-15 10:30     C:\WINDOWS\WPE PRO.INI --------- 318
  2007-08-15 08:50     C:\WINDOWS\KB937143-IE7.log --------- 21717
  2007-08-15 08:50     C:\WINDOWS\msxml4-KB936181-enu.LOG --------- 289890
  2007-08-13 08:21     C:\WINDOWS\netdet.ini --------- 84
  2007-08-06 17:36     C:\WINDOWS\KB911993-V2Uninst.log --------- 11756
  2007-07-29 19:37     C:\WINDOWS\KB911993-V2.log --------- 12879
  2007-07-29 19:34     C:\WINDOWS\DPINST.LOG --------- 6150
  2007-07-22 08:48     C:\WINDOWS\mozver.dat --------- 1156
  2007-07-21 10:17     C:\WINDOWS\setupapi.log.0.old --------- 1102555
  2007-07-15 13:44     C:\WINDOWS\nsreg.dat --------- 335
  2007-07-13 12:20     C:\WINDOWS\discwriter.log --------- 1330
  2007-07-13 12:20     C:\WINDOWS\OrangeBurn.log --------- 0
  2007-07-09 14:26     C:\WINDOWS\VSWizard.ini --------- 102
  2007-07-07 14:12     C:\WINDOWS\WgaNotify.log --------- 6553
  2007-06-30 19:31     C:\WINDOWS\KB929969.log --------- 55158
  2007-06-30 19:31     C:\WINDOWS\KB933566-IE7.log --------- 22064
  2007-06-30 10:50     C:\WINDOWS\KB914440.log --------- 5746
  2007-06-30 10:50     C:\WINDOWS\KB933566.log --------- 59466
  2007-06-29 18:39     C:\WINDOWS\KB924191.log --------- 47995
  2007-06-29 18:39     C:\WINDOWS\KB917734.log --------- 36802
  2007-06-29 18:38     C:\WINDOWS\KB924496.log --------- 42501
  2007-06-29 18:37     C:\WINDOWS\KB931836.log --------- 52509
  2007-06-29 18:37     C:\WINDOWS\KB887472.log --------- 39422
  2007-06-29 18:37     C:\WINDOWS\KB923689.log --------- 29086
  2007-06-29 18:36     C:\WINDOWS\KB917344.log --------- 31793
  2007-06-29 18:35     C:\WINDOWS\KB904706.log --------- 23168
  2007-06-29 18:34     C:\WINDOWS\KB894391.log --------- 21893
  2007-06-27 21:06     C:\WINDOWS\ALCFDRTM.EXE --------- 60416
  2007-06-27 20:00     C:\WINDOWS\KB898461.log --------- 7788
  2007-06-27 19:48     C:\WINDOWS\ATIWDM.LOG --------- 1478
  2007-06-27 19:15     C:\WINDOWS\msicpl.ini --------- 0
  2007-06-27 19:02     C:\WINDOWS\REGLOCS.OLD --------- 8192
  2007-06-27 18:59     C:\WINDOWS\control.ini --------- 0
  2007-06-27 18:55     C:\WINDOWS\vbaddin.ini --------- 37
  2007-06-27 18:55     C:\WINDOWS\vb.ini --------- 36
  2007-06-27 14:50     C:\WINDOWS\Sti_Trace.log --------- 0
  2007-06-14 13:10     C:\WINDOWS\Driver.ico --------- 17542
  2007-06-13 05:23     C:\WINDOWS\explorer.exe --------- 1033216
  2007-03-02 12:48     C:\WINDOWS\VPlay801.exe --------- 81920
  2007-01-21 12:53     C:\WINDOWS\bass.dll --------- 92728
  2006-10-31 21:32     C:\WINDOWS\screengenie.scr --------- 1559056
  2006-08-07 17:03     C:\WINDOWS\MGR.ico --------- 766
  2005-05-26 18:22     C:\WINDOWS\hh.exe --------- 10752
  2004-12-01 02:54     C:\WINDOWS\SOUNDMAN.EXE --------- 77824
  2004-08-04 07:00     C:\WINDOWS\taskman.exe --------- 15360
  2004-08-04 07:00     C:\WINDOWS\SET8.tmp --------- 13753
  2004-08-04 07:00     C:\WINDOWS\SETB1.tmp --------- 1042903
  2004-08-04 07:00     C:\WINDOWS\SET47.tmp --------- 13753
  2004-08-04 07:00     C:\WINDOWS\twain_32.dll --------- 50688
  2004-08-04 07:00     C:\WINDOWS\twunk_16.exe --------- 49680
  2004-08-04 07:00     C:\WINDOWS\twunk_32.exe --------- 25600
  2004-08-04 07:00     C:\WINDOWS\Greenstone.bmp --------- 26582
  2004-08-04 07:00     C:\WINDOWS\desktop.ini --------- 2
  2004-08-04 07:00     C:\WINDOWS\SETB4.tmp --------- 1086058
  2004-08-04 07:00     C:\WINDOWS\SETC0.tmp --------- 13753
  2004-08-04 07:00     C:\WINDOWS\vmmreg32.dll --------- 18944
  2004-08-04 07:00     C:\WINDOWS\Soap Bubbles.bmp --------- 65978
  2004-08-04 07:00     C:\WINDOWS\Prairie Wind.bmp --------- 65954
  2004-08-04 07:00     C:\WINDOWS\msdfmap.ini --------- 1405
  2004-08-04 07:00     C:\WINDOWS\FeatherTexture.bmp --------- 16730
  2004-08-04 07:00     C:\WINDOWS\Coffee Bean.bmp --------- 17062
  2004-08-04 07:00     C:\WINDOWS\SET4.tmp --------- 1086058
  2004-08-04 07:00     C:\WINDOWS\clock.avi --------- 82944
  2004-08-04 07:00     C:\WINDOWS\SET3B.tmp --------- 1086058
  2004-08-04 07:00     C:\WINDOWS\SET38.tmp --------- 1042903
  2004-08-04 07:00     C:\WINDOWS\SET3.tmp --------- 1042903
  2004-08-04 07:00     C:\WINDOWS\Gone Fishing.bmp --------- 17336
  2004-08-04 07:00     C:\WINDOWS\winhelp.exe --------- 256192
  2004-08-04 07:00     C:\WINDOWS\winhlp32.exe --------- 283648
  2004-08-04 07:00     C:\WINDOWS\Zapotec.bmp --------- 9522
  2004-08-04 07:00     C:\WINDOWS\winnt.bmp --------- 48680
  2004-08-04 07:00     C:\WINDOWS\winnt256.bmp --------- 48680
  2004-08-04 07:00     C:\WINDOWS\regedit.exe --------- 146432
  2004-08-04 07:00     C:\WINDOWS\Santa Fe Stucco.bmp --------- 65832
  2004-08-04 07:00     C:\WINDOWS\River Sumida.bmp --------- 26680
  2004-08-04 07:00     C:\WINDOWS\Blue Lace 16.bmp --------- 1272
  2004-08-04 07:00     C:\WINDOWS\explorer.scf --------- 80
  2004-08-04 07:00     C:\WINDOWS\twain.dll --------- 94784
  2004-08-04 07:00     C:\WINDOWS\Rhododendron.bmp --------- 17362
  2004-08-04 07:00     C:\WINDOWS\notepad.exe --------- 69120
  2004-08-04 07:00     C:\WINDOWS\_default.pif --------- 707
  2003-06-05 18:30     C:\WINDOWS\WMSysPr9.prx --------- 316640
  2003-05-22 00:50     C:\WINDOWS\WMSysPr8.prx --------- 156910
  2001-09-20 03:19     C:\WINDOWS\screengenie.xml --------- 289
  2000-08-31 08:00     C:\WINDOWS\Nircmd.exe --------- 51200
  1998-10-29 14:45     C:\WINDOWS\IsUninst.exe --------- 306688
----------------------------------------

 
C:\WINDOWS\System

 2004-08-04 07:00    C:\WINDOWS\System\AVICAP.DLL --------- 69584
 2004-08-04 07:00    C:\WINDOWS\System\AVIFILE.DLL --------- 109456
 2004-08-04 07:00    C:\WINDOWS\System\COMMDLG.DLL --------- 32816
 2004-08-04 07:00    C:\WINDOWS\System\KEYBOARD.DRV --------- 2000
 2004-08-04 07:00    C:\WINDOWS\System\LZEXPAND.DLL --------- 9936
 2004-08-04 07:00    C:\WINDOWS\System\MCIAVI.DRV --------- 73376
 2004-08-04 07:00    C:\WINDOWS\System\MCISEQ.DRV --------- 25264
 2004-08-04 07:00    C:\WINDOWS\System\MCIWAVE.DRV --------- 28160
 2004-08-04 07:00    C:\WINDOWS\System\MMSYSTEM.DLL --------- 68768
 2004-08-04 07:00    C:\WINDOWS\System\MMTASK.TSK --------- 1152
 2004-08-04 07:00    C:\WINDOWS\System\MOUSE.DRV --------- 2032
 2004-08-04 07:00    C:\WINDOWS\System\MSVIDEO.DLL --------- 126912
 2004-08-04 07:00    C:\WINDOWS\System\OLECLI.DLL --------- 82944
 2004-08-04 07:00    C:\WINDOWS\System\OLESVR.DLL --------- 24064
 2004-08-04 07:00    C:\WINDOWS\System\setup.inf --------- 59167
 2004-08-04 07:00    C:\WINDOWS\System\SHELL.DLL --------- 5120
 2004-08-04 07:00    C:\WINDOWS\System\SOUND.DRV --------- 1744
 2004-08-04 07:00    C:\WINDOWS\System\stdole.tlb --------- 5532
 2004-08-04 07:00    C:\WINDOWS\System\SYSTEM.DRV --------- 3360
 2004-08-04 07:00    C:\WINDOWS\System\TAPI.DLL --------- 19200
 2004-08-04 07:00    C:\WINDOWS\System\TIMER.DRV --------- 4048
 2004-08-04 07:00    C:\WINDOWS\System\VER.DLL --------- 9008
 2004-08-04 07:00    C:\WINDOWS\System\VGA.DRV --------- 2176
 2004-08-04 07:00    C:\WINDOWS\System\WFWNET.DRV --------- 13600
 2004-08-04 07:00    C:\WINDOWS\System\WINSPOOL.DRV --------- 146432
----------------------------------------

 
C:\WINDOWS\System32

 2008-02-09 08:53     C:\WINDOWS\system32\CatRoot2 --------- 0
 2008-02-09 08:52     C:\WINDOWS\system32\wpa.dbl --------- 13646
 2008-02-09 08:51     C:\WINDOWS\system32\vsconfig.xml --------- 355090
 2008-02-08 20:40     C:\WINDOWS\system32\mlfcache.dat --------- 28608
 2008-02-08 17:42     C:\WINDOWS\system32\drivers --------- 0
 2008-02-07 12:41     C:\WINDOWS\system32\ZoneLabs --------- 0
 2008-02-07 08:28     C:\WINDOWS\system32\CatRoot --------- 0
 2008-02-07 08:27     C:\WINDOWS\system32\amcompat.tlb --------- 16832
 2008-02-07 08:27     C:\WINDOWS\system32\nscompat.tlb --------- 23392
 2008-02-07 08:26     C:\WINDOWS\system32\dllcache --------- 0
 2008-02-05 15:44     C:\WINDOWS\system32\msiexec.exe --------- 78848
 2008-02-03 13:37     C:\WINDOWS\system32\FNTCACHE.DAT --------- 1449256
 2008-02-01 09:48     C:\WINDOWS\system32\rmoc3260.dll --------- 185944
 2008-02-01 09:47     C:\WINDOWS\system32\pndx5032.dll --------- 5632
 2008-02-01 09:47     C:\WINDOWS\system32\pndx5016.dll --------- 6656
 2008-02-01 09:47     C:\WINDOWS\system32\pncrt.dll --------- 278528
 2008-01-31 22:51     C:\WINDOWS\system32\zllictbl.dat --------- 4212
 2008-01-20 11:53     C:\WINDOWS\system32\winsock.dll --------- 2864
 2008-01-20 09:58     C:\WINDOWS\system32\config --------- 0
 2008-01-19 22:17     C:\WINDOWS\system32\CONFIG.NT --------- 2626
 2008-01-17 07:44     C:\WINDOWS\system32\usmt --------- 0
 2008-01-16 18:24     C:\WINDOWS\system32\ReinstallBackups --------- 0
 2008-01-16 18:21     C:\WINDOWS\system32\perfh009.dat --------- 500768
 2008-01-16 18:21     C:\WINDOWS\system32\PerfStringBackup.INI --------- 586018
 2008-01-16 18:21     C:\WINDOWS\system32\perfc009.dat --------- 94708
 2008-01-16 18:09     C:\WINDOWS\system32\XPSViewer --------- 0
 2008-01-16 18:09     C:\WINDOWS\system32\en-US --------- 0
 2008-01-16 18:08     C:\WINDOWS\system32\spool --------- 0
 2008-01-13 11:42     C:\WINDOWS\system32\lsdelete.exe --------- 12632
 2008-01-10 15:41     C:\WINDOWS\system32\Macromed --------- 0
 2008-01-10 15:27     C:\WINDOWS\system32\QuickTimeVR.qtx --------- 90112
 2008-01-10 15:27     C:\WINDOWS\system32\QuickTime.qts --------- 57344
 2008-01-06 13:44     C:\WINDOWS\system32\URTTEMP --------- 0
 2008-01-05 19:35     C:\WINDOWS\system32\Microsoft --------- 0
 2008-01-05 19:34     C:\WINDOWS\system32\DRVSTORE --------- 0
 2008-01-05 18:13     C:\WINDOWS\system32\bits --------- 0
 2008-01-04 19:06     C:\WINDOWS\system32\TZLog.log --------- 389350
 2008-01-04 11:14     C:\WINDOWS\system32\Com --------- 0
 2008-01-02 10:21     C:\WINDOWS\system32\MRT.exe --------- 17642616
 2008-01-01 17:19     C:\WINDOWS\system32\dvdcopylogfile.txt --------- 0
 2007-12-24 13:13     C:\WINDOWS\system32\DVDRipperDiamond_sysquict.dat --------- 34
 2007-12-24 13:13     C:\WINDOWS\system32\BASSMOD.dll --------- 9728
 2007-12-17 13:53     C:\WINDOWS\system32\nvapps.nvb --------- 159458
 2007-12-13 21:14     C:\WINDOWS\system32\NtmsData --------- 0
 2007-12-13 20:05     C:\WINDOWS\system32\Restore --------- 0
 2007-12-13 20:03     C:\WINDOWS\system32\$winnt$.inf --------- 288
 2007-12-13 19:59     C:\WINDOWS\system32\ias --------- 0
 2007-12-13 19:58     C:\WINDOWS\system32\WindowsLogon.manifest --------- 488
 2007-12-13 19:58     C:\WINDOWS\system32\logonui.exe.manifest --------- 488
 2007-12-13 19:58     C:\WINDOWS\system32\nwc.cpl.manifest --------- 749
 2007-12-13 19:58     C:\WINDOWS\system32\cdplayer.exe.manifest --------- 749
 2007-12-13 19:58     C:\WINDOWS\system32\wuaucpl.cpl.manifest --------- 749
 2007-12-13 19:58     C:\WINDOWS\system32\sapi.cpl.manifest --------- 749
 2007-12-13 19:58     C:\WINDOWS\system32\ncpa.cpl.manifest --------- 749
 2007-12-13 19:58     C:\WINDOWS\system32\oobe --------- 0
 2007-12-13 19:57     C:\WINDOWS\system32\emptyregdb.dat --------- 22704
 2007-12-11 17:34     C:\WINDOWS\system32\ssldivx.dll --------- 200704
 2007-12-11 17:34     C:\WINDOWS\system32\libdivx.dll --------- 1044480
 2007-12-09 05:26     C:\WINDOWS\system32\Setup --------- 0
 2007-12-09 05:25     C:\WINDOWS\system32\wbem --------- 0
 2007-12-09 05:25     C:\WINDOWS\system32\npp --------- 0
 2007-12-09 05:18     C:\WINDOWS\system32\icsxml --------- 0
 2007-12-09 05:18     C:\WINDOWS\system32\1033 --------- 0
 2007-12-05 02:53     C:\WINDOWS\system32\NVUNINST.EXE --------- 356352
 2007-12-05 01:41     C:\WINDOWS\system32\nvapi.dll --------- 385024
 2007-12-05 01:41     C:\WINDOWS\system32\nvcod.dll --------- 35328
 2007-12-05 01:41     C:\WINDOWS\system32\nvoglnt.dll --------- 6901760
 2007-12-05 01:41     C:\WINDOWS\system32\nvsvc32.exe --------- 155716
 2007-12-05 01:41     C:\WINDOWS\system32\nvudisp.exe --------- 356352
 2007-12-05 01:41     C:\WINDOWS\system32\nv4_disp.dll --------- 5773568
 2007-12-05 01:41     C:\WINDOWS\system32\nvnt4cpl.dll --------- 286720
 2007-12-05 01:41     C:\WINDOWS\system32\nvvitvs.dll --------- 3710976
 2007-12-05 01:41     C:\WINDOWS\system32\nvwddi.dll --------- 81920
 2007-12-05 01:41     C:\WINDOWS\system32\nvcodins.dll --------- 35328
 2007-12-05 01:41     C:\WINDOWS\system32\nvcolor.exe --------- 147456
 2007-12-05 01:41     C:\WINDOWS\system32\nvcpl.cpl --------- 413696
 2007-12-05 01:41     C:\WINDOWS\system32\nvcpl.dll --------- 8523776
 2007-12-05 01:41     C:\WINDOWS\system32\nvcplui.exe --------- 753664
 2007-12-05 01:41     C:\WINDOWS\system32\nvwss.dll --------- 2498560
 2007-12-05 01:41     C:\WINDOWS\system32\nvcuda.dll --------- 1089536
 2007-12-05 01:41     C:\WINDOWS\system32\nvdisp.nvu --------- 17737
 2007-12-05 01:41     C:\WINDOWS\system32\nvdisps.dll --------- 6549504
 2007-12-05 01:41     C:\WINDOWS\system32\nvmobls.dll --------- 1228800
 2007-12-05 01:41     C:\WINDOWS\system32\nvgames.dll --------- 3420160
 2007-12-05 01:41     C:\WINDOWS\system32\nvmctray.dll --------- 81920
 2007-12-05 01:41     C:\WINDOWS\system32\nvmccs.dll --------- 229376
 2007-12-05 01:41     C:\WINDOWS\system32\nvmccsrs.dll --------- 45056
 2007-12-05 01:41     C:\WINDOWS\system32\nvmccss.dll --------- 188416
 2007-12-05 01:41     C:\WINDOWS\system32\nvexpbar.dll --------- 307200
 2007-12-04 08:04     C:\WINDOWS\system32\aswBoot.exe --------- 837496
 2007-12-04 07:54     C:\WINDOWS\system32\AvastSS.scr --------- 95608
 2007-12-03 20:47     C:\WINDOWS\system32\MSWINSCK.OCX --------- 109248
 2007-11-25 19:02     C:\WINDOWS\system32\DirectX --------- 0
 2007-11-21 16:11     C:\WINDOWS\system32\jupdate-1.6.0_03-b05.log --------- 5387
 2007-11-14 16:05     C:\WINDOWS\system32\vsdatant.sys --------- 394952
 2007-11-14 16:05     C:\WINDOWS\system32\zpeng24.dll --------- 1086952
 2007-11-14 16:04     C:\WINDOWS\system32\zlcommdb.dll --------- 71144
 2007-11-14 16:04     C:\WINDOWS\system32\zlcomm.dll --------- 83432
 2007-11-14 16:04     C:\WINDOWS\system32\vswmi.dll --------- 46568
 2007-11-14 16:04     C:\WINDOWS\system32\vsxml.dll --------- 99816
----------------------------------------

 
C:\WINDOWS\Prefetch

 2008-02-10 15:41     C:\WINDOWS\Prefetch\CMD.EXE-087B4001.pf --------- 20418
 2008-02-10 15:40     C:\WINDOWS\Prefetch\WINRAR.EXE-39C6DAD9.pf --------- 17404
 2008-02-10 15:39     C:\WINDOWS\Prefetch\SAFARI.EXE-238FF382.pf --------- 71414
 2008-02-10 15:00     C:\WINDOWS\Prefetch\UPDCLIENT.EXE-215FC96B.pf --------- 66856
 2008-02-10 14:49     C:\WINDOWS\Prefetch\layout.ini --------- 388346
 2008-02-10 14:29     C:\WINDOWS\Prefetch\JNES.EXE-074DAD3B.pf --------- 30994
 2008-02-10 14:29     C:\WINDOWS\Prefetch\VERCLSID.EXE-3667BD89.pf --------- 17376
 2008-02-10 14:26     C:\WINDOWS\Prefetch\YPSR.EXE-01FF0F16.pf --------- 37868
 2008-02-10 14:16     C:\WINDOWS\Prefetch\DWWIN.EXE-30875ADC.pf --------- 23926
 2008-02-10 14:15     C:\WINDOWS\Prefetch\DUMPREP.EXE-1B46F901.pf --------- 110392
 2008-02-10 14:15     C:\WINDOWS\Prefetch\IEXPLORE.EXE-27122324.pf --------- 104510
 2008-02-10 14:15     C:\WINDOWS\Prefetch\REALPLAY.EXE-1BF219BD.pf --------- 18480
 2008-02-10 14:15     C:\WINDOWS\Prefetch\WMPLAYER.EXE-18DDEFA6.pf --------- 72226
 2008-02-10 14:11     C:\WINDOWS\Prefetch\WUAUCLT.EXE-399A8E72.pf --------- 95236
 2008-02-10 14:11     C:\WINDOWS\Prefetch\XPSEPSC-X86-EN-US.EXE-1EC957D7.pf --------- 50088
 2008-02-10 14:10     C:\WINDOWS\Prefetch\WMIPRVSE.EXE-28F301A9.pf --------- 149074
 2008-02-10 14:10     C:\WINDOWS\Prefetch\SETUP_WM.EXE-3135CBD6.pf --------- 45698
 2008-02-10 14:07     C:\WINDOWS\Prefetch\WLLOGINPROXY.EXE-1781D844.pf --------- 31260
 2008-02-10 13:56     C:\WINDOWS\Prefetch\WINWORD.EXE-29F5CB89.pf --------- 57676
 2008-02-10 13:52     C:\WINDOWS\Prefetch\RUNDLL32.EXE-451FC2C0.pf --------- 17584
 2008-02-10 13:51     C:\WINDOWS\Prefetch\RUNDLL32.EXE-3017F7CA.pf --------- 31530
 2008-02-10 13:47     C:\WINDOWS\Prefetch\MSXML6-KB927977-ENU-X86.EXE-068D41EA.pf --------- 24630
 2008-02-10 13:47     C:\WINDOWS\Prefetch\SETUP.EXE-34AD352C.pf --------- 53824
 2008-02-10 13:44     C:\WINDOWS\Prefetch\FIREFOX.EXE-28641590.pf --------- 124872
 2008-02-10 13:17     C:\WINDOWS\Prefetch\AVGINET.EXE-035BBB37.pf --------- 47138
 2008-02-10 13:16     C:\WINDOWS\Prefetch\RUNDLL32.EXE-12E27DD0.pf --------- 20838
 2008-02-09 12:58     C:\WINDOWS\Prefetch\AVAST.SETUP-032170A8.pf --------- 127404
 2008-02-09 12:49     C:\WINDOWS\Prefetch\MSHTA.EXE-331DF029.pf --------- 35270
 2008-02-09 12:49     C:\WINDOWS\Prefetch\RUNDLL32.EXE-13CC3015.pf --------- 16628
 2008-02-09 12:43     C:\WINDOWS\Prefetch\TASKMGR.EXE-20256C55.pf --------- 21208
 2008-02-09 12:38     C:\WINDOWS\Prefetch\NOTEPAD.EXE-336351A9.pf --------- 57152
 2008-02-09 12:37     C:\WINDOWS\Prefetch\HIJACKTHIS.EXE-34A0FC79.pf --------- 36032
 2008-02-09 10:48     C:\WINDOWS\Prefetch\DFRGNTFS.EXE-269967DF.pf --------- 54726
 2008-02-09 10:48     C:\WINDOWS\Prefetch\DEFRAG.EXE-273F131E.pf --------- 16860
 2008-02-09 10:19     C:\WINDOWS\Prefetch\SED.CFEXE-268D7E58.pf --------- 4614
 2008-02-09 10:19     C:\WINDOWS\Prefetch\NIRCMD.EXE-2C39EF53.pf --------- 8828
 2008-02-09 10:19     C:\WINDOWS\Prefetch\REGT.CFEXE-15DB5DAE.pf --------- 12470
 2008-02-09 10:19     C:\WINDOWS\Prefetch\SWREG.CFEXE-287CC9EF.pf --------- 8018
 2008-02-09 10:19     C:\WINDOWS\Prefetch\PSEXEC.CFEXE-2CB6A9EC.pf --------- 9714
 2008-02-09 10:19     C:\WINDOWS\Prefetch\PSEXESVC.EXE-35EFACCF.pf --------- 8396
 2008-02-09 10:19     C:\WINDOWS\Prefetch\NIRCMD.CFEXE-19FF4781.pf --------- 11282
 2008-02-09 10:19     C:\WINDOWS\Prefetch\KMD.EXE-2FAFDF40.pf --------- 5404
 2008-02-09 10:19     C:\WINDOWS\Prefetch\GREP.CFEXE-20443039.pf --------- 3792
 2008-02-09 10:19     C:\WINDOWS\Prefetch\MTEE.CFEXE-1E067BC7.pf --------- 4782
 2008-02-09 10:19     C:\WINDOWS\Prefetch\CHCP.COM-18156052.pf --------- 5922
 2008-02-09 10:19     C:\WINDOWS\Prefetch\NIRCMD.COM-223F42C3.pf --------- 10034
 2008-02-09 10:19     C:\WINDOWS\Prefetch\LISTDLLS.CFEXE-163777B3.pf --------- 6970
 2008-02-09 10:18     C:\WINDOWS\Prefetch\VFIND.CFEXE-3074654A.pf --------- 9924
 2008-02-09 10:18     C:\WINDOWS\Prefetch\SWXCACLS.CFEXE-24057B3B.pf --------- 8184
 2008-02-09 10:18     C:\WINDOWS\Prefetch\FINDSTR.EXE-0CA6274B.pf --------- 11760
 2008-02-09 10:18     C:\WINDOWS\Prefetch\COMBOFIX.EXE-03358D3F.pf --------- 61212
 2008-02-09 10:17     C:\WINDOWS\Prefetch\RUNDLL32.EXE-119778A1.pf --------- 31678
 2008-02-09 10:16     C:\WINDOWS\Prefetch\MAKEBT32.EXE-2D3460E4.pf --------- 5026
 2008-02-09 10:16     C:\WINDOWS\Prefetch\NTVDM.EXE-1A10A423.pf --------- 14162
 2008-02-09 10:16     C:\WINDOWS\Prefetch\WINDOWSXP-KB310994-SP2-HOME-B-33F07C2C.pf --------- 63754
 2008-02-09 10:07     C:\WINDOWS\Prefetch\UNINSTALL.EXE-013F1E3A.pf --------- 14060
 2008-02-09 10:07     C:\WINDOWS\Prefetch\IDMAN.EXE-1682C990.pf --------- 31232
 2008-02-09 10:05     C:\WINDOWS\Prefetch\UPDATER.EXE-2BC7D0CC.pf --------- 52914
 2008-02-09 10:03     C:\WINDOWS\Prefetch\LIMEWIRE.EXE-1944953E.pf --------- 68384
 2008-02-09 09:31     C:\WINDOWS\Prefetch\NOTEPAD.EXE-189578DA.pf --------- 17452
 2008-02-09 09:31     C:\WINDOWS\Prefetch\SORT.EXE-194AE83C.pf --------- 11562
 2008-02-09 09:31     C:\WINDOWS\Prefetch\FIND.EXE-0EC32F1E.pf --------- 12292
 2008-02-09 09:31     C:\WINDOWS\Prefetch\CSCRIPT.EXE-1C26180C.pf --------- 30614
 2008-02-09 09:31     C:\WINDOWS\Prefetch\SED.EXE-018B67A7.pf --------- 4352
 2008-02-09 09:30     C:\WINDOWS\Prefetch\SWREG.EXE-2079F288.pf --------- 13148
 2008-02-09 09:30     C:\WINDOWS\Prefetch\JIM.EXE-1BA629F2.pf --------- 32938
 2008-02-09 09:30     C:\WINDOWS\Prefetch\MD5DEEP.EXE-32116D83.pf --------- 5918
 2008-02-09 09:28     C:\WINDOWS\Prefetch\DSS.EXE-089883A3.pf --------- 19684
 2008-02-09 09:28     C:\WINDOWS\Prefetch\SDUPDATE.EXE-00420EF0.pf --------- 58382
 2008-02-09 09:27     C:\WINDOWS\Prefetch\SPYBOTSD.EXE-1344276B.pf --------- 81994
 2008-02-09 09:27     C:\WINDOWS\Prefetch\SBSD152UPD.TMP-1A91106B.pf --------- 15672
 2008-02-09 09:27     C:\WINDOWS\Prefetch\SBSD152UPD.EXE-095A0D85.pf --------- 16276
 2008-02-09 09:27     C:\WINDOWS\Prefetch\UPDATE.EXE-131667C7.pf --------- 17604
 2008-02-09 09:11     C:\WINDOWS\Prefetch\IMAPI.EXE-0BF740A4.pf --------- 17740
 2008-02-09 09:10     C:\WINDOWS\Prefetch\MPCMDRUN.EXE-1F9D1CA1.pf --------- 84586
 2008-02-09 09:09     C:\WINDOWS\Prefetch\WINNT32.EXE-07CE5394.pf --------- 76932
 2008-02-09 09:02     C:\WINDOWS\Prefetch\SCANNINGPROCESS.EXE-2307B631.pf --------- 63696
 2008-02-09 08:59     C:\WINDOWS\Prefetch\MSCONFIG.EXE-35E4DAE9.pf --------- 56848
 2008-02-09 08:57     C:\WINDOWS\Prefetch\JAVA.EXE-0539FACC.pf --------- 8510
 2008-02-09 08:54     C:\WINDOWS\Prefetch\IEMONITOR.EXE-2D8B91C4.pf --------- 42226
 2008-02-09 08:54     C:\WINDOWS\Prefetch\MMC.EXE-2F7FB306.pf --------- 50148
 2008-02-09 08:53     C:\WINDOWS\Prefetch\AVGW.EXE-2A7BF89D.pf --------- 70000
 2008-02-09 08:53     C:\WINDOWS\Prefetch\YOUTUBEUPLOADER.EXE-20103859.pf --------- 14318
 2008-02-09 08:53     C:\WINDOWS\Prefetch\RUNDLL32.EXE-2BD1A661.pf --------- 43266
 2008-02-09 08:52     C:\WINDOWS\Prefetch\OSA.EXE-2CD63980.pf --------- 39880
 2008-02-09 08:52     C:\WINDOWS\Prefetch\ATIRW.EXE-0278DACF.pf --------- 20066
 2008-02-09 08:52     C:\WINDOWS\Prefetch\GOOGLEUPDATE.EXE-06D7673B.pf --------- 14070
 2008-02-09 08:52     C:\WINDOWS\Prefetch\MANTISPM.EXE-2BF058BA.pf --------- 17172
 2008-02-09 08:52     C:\WINDOWS\Prefetch\IPODSERVICE.EXE-3192DE38.pf --------- 8628
 2008-02-09 08:52     C:\WINDOWS\Prefetch\SSDK02.EXE-234B405C.pf --------- 9132
 2008-02-09 08:52     C:\WINDOWS\Prefetch\TEATIMER.EXE-1F57E47A.pf --------- 9368
 2008-02-09 08:52     C:\WINDOWS\Prefetch\READER_SL.EXE-1A438403.pf --------- 13538
 2008-02-09 08:52     C:\WINDOWS\Prefetch\PCMSERVICE.EXE-2EBE282E.pf --------- 15406
 2008-02-09 08:52     C:\WINDOWS\Prefetch\YCOMMON.EXE-0BCDC1E4.pf --------- 21078
 2008-02-09 08:52     C:\WINDOWS\Prefetch\ASHDISP.EXE-0B874892.pf --------- 24690
 2008-02-09 08:52     C:\WINDOWS\Prefetch\AVGCC.EXE-062F63C6.pf --------- 7106
 2008-02-09 08:52     C:\WINDOWS\Prefetch\CTFMON.EXE-0E17969B.pf --------- 16808
 2008-02-09 08:52     C:\WINDOWS\Prefetch\ITUNESHELPER.EXE-15823303.pf --------- 13150
 2008-02-09 08:52     C:\WINDOWS\Prefetch\SOUNDMAN.EXE-19745A34.pf --------- 12746
 2008-02-09 08:52     C:\WINDOWS\Prefetch\JUSCHED.EXE-287286E1.pf --------- 11552
 2008-02-09 08:52     C:\WINDOWS\Prefetch\MSASCUI.EXE-08BEC8D8.pf --------- 23776
 2008-02-09 08:52     C:\WINDOWS\Prefetch\NWIZ.EXE-2D0F9FBC.pf --------- 28368
 2008-02-09 08:52     C:\WINDOWS\Prefetch\REALSCHED.EXE-3282FD31.pf --------- 22614
 2008-02-09 08:52     C:\WINDOWS\Prefetch\YOP.EXE-344A80E6.pf --------- 48044
 2008-02-09 08:52     C:\WINDOWS\Prefetch\WGATRAY.EXE-0ED38BED.pf --------- 57850
 2008-02-09 08:52     C:\WINDOWS\Prefetch\SW20.EXE-1937B160.pf --------- 32330
 2008-02-09 08:52     C:\WINDOWS\Prefetch\ZLCLIENT.EXE-1C550EB2.pf --------- 35456
 2008-02-09 08:52     C:\WINDOWS\Prefetch\SW24.EXE-0803863D.pf --------- 10454
 2008-02-09 08:52     C:\WINDOWS\Prefetch\RUNDLL32.EXE-415F88EC.pf --------- 23884
 2008-02-09 08:52     C:\WINDOWS\Prefetch\ALG.EXE-0F138680.pf --------- 16452
 2008-02-09 08:52     C:\WINDOWS\Prefetch\ASHWEBSV.EXE-0548EF0A.pf --------- 23384
 2008-02-09 08:52     C:\WINDOWS\Prefetch\ASHMAISV.EXE-12E27032.pf --------- 39160
 2008-02-09 08:52     C:\WINDOWS\Prefetch\RUNDLL32.EXE-35A483DA.pf --------- 22078
 2008-02-09 08:52     C:\WINDOWS\Prefetch\WMPNETWK.EXE-2C0727AF.pf --------- 27940
 2008-02-09 08:52     C:\WINDOWS\Prefetch\NVSVC32.EXE-1F9EED18.pf --------- 27094
 2008-02-09 08:52     C:\WINDOWS\Prefetch\RUNDLL32.EXE-1857459C.pf --------- 17180
 2008-02-09 08:52     C:\WINDOWS\Prefetch\SQLSERVR.EXE-2DE82A9C.pf --------- 30702
 2008-02-09 08:52     C:\WINDOWS\Prefetch\SVCHOST.EXE-3530F672.pf --------- 15592
 2008-02-09 08:52     C:\WINDOWS\Prefetch\MDNSRESPONDER.EXE-02F30C6E.pf --------- 11500
 2008-02-09 08:51     C:\WINDOWS\Prefetch\AVGEMC.EXE-38E59DAC.pf --------- 30368
 2008-02-09 08:51     C:\WINDOWS\Prefetch\AVGUPSVC.EXE-0DA751F2.pf --------- 10428
 2008-02-09 08:51     C:\WINDOWS\Prefetch\AVGAMSVR.EXE-22E996D2.pf --------- 22306
 2008-02-09 08:51     C:\WINDOWS\Prefetch\APPLEMOBILEDEVICESERVICE.EXE-2BCF7F43.pf --------- 23680
 2008-02-09 08:51     C:\WINDOWS\Prefetch\NTOSBOOT-B00DFAAD.pf --------- 854190
----------------------------------------

 
C:\WINDOWS\Tasks

 2008-02-09 08:53     C:\WINDOWS\Tasks\MP Scheduled Scan.job --------- 330
 2008-02-09 08:50     C:\WINDOWS\Tasks\SA.DAT --------- 6
 2008-02-08 17:30     C:\WINDOWS\Tasks\Spybot - Search & Destroy -  Scheduled Task.job --------- 440
 2008-02-05 20:00     C:\WINDOWS\Tasks\SpywareBlaster.job --------- 264
 2008-02-05 20:00     C:\WINDOWS\Tasks\Ad-Aware SE Personal.job --------- 348
 2008-02-04 20:00     C:\WINDOWS\Tasks\Norton Security Online - Run Full System Scan - Wyatt.job --------- 576
 2004-08-04 07:00     C:\WINDOWS\Tasks\desktop.ini --------- 65
----------------------------------------

 
C:\WINDOWS\Temp

 2008-02-10 14:30     C:\WINDOWS\Temp\_avast4_ --------- 0
 2008-02-09 08:50     C:\WINDOWS\Temp\Perflib_Perfdata_7a4.dat --------- 16384
 2008-02-09 08:50     C:\WINDOWS\Temp\ZLT05a9d.TMP --------- 256
 2008-02-09 08:50     C:\WINDOWS\Temp\ZLT05a9a.TMP --------- 256
----------------------------------------

 
C:\DOCUME~1\Jim\LOCALS~1\Temp

 2008-02-10 14:13      C:\DOCUME~1\Jim\LOCALS~1\Temp\wmplog01.sqm --------- 1648
 2008-02-10 14:11      C:\DOCUME~1\Jim\LOCALS~1\Temp\wmplog00.sqm --------- 1420
 2008-02-10 13:47      C:\DOCUME~1\Jim\LOCALS~1\Temp\msxml6-KB927977-enu-x86.exe --------- 910080
 2008-02-10 13:47      C:\DOCUME~1\Jim\LOCALS~1\Temp\Virtual_PC_2007_Install.msi --------- 28084736
 2008-02-09 12:43      C:\DOCUME~1\Jim\LOCALS~1\Temp\hsperfdata_Jim --------- 0
 2008-02-09 12:16      C:\DOCUME~1\Jim\LOCALS~1\Temp\~DF7BE3.tmp --------- 16384
 2008-02-09 10:19      C:\DOCUME~1\Jim\LOCALS~1\Temp\IXP000.TMP --------- 0
 2008-02-09 08:52      C:\DOCUME~1\Jim\LOCALS~1\Temp\~DF72EF.tmp --------- 16384
----------------------------------------

 
C:\Program Files

----------------------------------------

 
C:\Documents and Settings\All Users\..

Jim   
Cole   
Administrator   
Wyatt   
Default User   
LocalService   
NetworkService   
All Users   
----------------------------------------

 
C:\WINDOWS\system32\drivers\etc\hosts

127.0.0.1       localhost
127.0.0.1 007guard.com
127.0.0.1 www.007guard.com
127.0.0.1 008i.com
127.0.0.1 008k.com
127.0.0.1 www.008k.com
127.0.0.1 00hq.com
127.0.0.1 www.00hq.com
127.0.0.1 010402.com
127.0.0.1 032439.com
127.0.0.1 www.032439.com
127.0.0.1 1001-search.info
127.0.0.1 www.1001-search.info
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 100sexlinks.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 123topsearch.com
127.0.0.1 www.123topsearch.com
127.0.0.1 132.com
127.0.0.1 www.132.com
127.0.0.1 136136.net
127.0.0.1 www.136136.net
127.0.0.1 139mm.com
127.0.0.1 www.139mm.com
127.0.0.1 163ns.com
127.0.0.1 www.163ns.com
127.0.0.1 171203.com
127.0.0.1 17-plus.com
127.0.0.1 1800searchonline.com
127.0.0.1 www.1800searchonline.com
127.0.0.1 180searchassistant.com
127.0.0.1 www.180searchassistant.com
127.0.0.1 180solutions.com
127.0.0.1 www.180solutions.com
127.0.0.1 181.365soft.info
127.0.0.1 www.181.365soft.info
127.0.0.1 1987324.com
127.0.0.1 www.1987324.com
127.0.0.1 1-domains-registrations.com
127.0.0.1 www.1-domains-registrations.com
127.0.0.1 1-extreme.biz
127.0.0.1 www.1-extreme.biz
127.0.0.1 1sexparty.com
127.0.0.1 www.1sexparty.com
127.0.0.1 1stantivirus.com
127.0.0.1 www.1stantivirus.com
127.0.0.1 1stpagehere.com
127.0.0.1 www.1stpagehere.com
127.0.0.1 1stsearchportal.com
127.0.0.1 www.1stsearchportal.com
127.0.0.1 2.82211.net
127.0.0.1 www.2006ooo.com
127.0.0.1 2007-download.com
127.0.0.1 www.2007-download.com
127.0.0.1 2020search.com
127.0.0.1 www.2020search.com
127.0.0.1 20x2p.com
127.0.0.1 24.365soft.info
127.0.0.1 www.24.365soft.info
127.0.0.1 24-7pharmacy.info
127.0.0.1 www.24-7pharmacy.info
127.0.0.1 24-7searching-and-more.com
127.0.0.1 www.24-7searching-and-more.com
127.0.0.1 24teen.com
127.0.0.1 www.24teen.com
127.0.0.1 2every.net
127.0.0.1 www.2every.net
127.0.0.1 2ndpower.com
127.0.0.1 2search.com
127.0.0.1 www.2search.com
127.0.0.1 2search.org
127.0.0.1 www.2search.org
127.0.0.1 2squared.com
127.0.0.1 www.2squared.com
127.0.0.1 3322.org
127.0.0.1 www.3322.org
127.0.0.1 365soft.info
127.0.0.1 36site.com

----------------------------------------

 

 
***** Ende des Scans 2008-02-10 um 15:42:07.82 *** 
 

 
Logged
xblade12100
*
Offline Offline

Posts: 93
« Reply #13 on: February 09, 2008, 20:58:51 »
Also, This a Old HijackThis 3-4 Days old, This Shows the problem, here are 2 logs:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:57, on 2008-02-10
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\ATI Multimedia\PowerCinema\PCMService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
C:\Documents and Settings\Jim\Local Settings\Application Data\Google\Update\1.0.103.0\GoogleUpdate.exe
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Jim\Local Settings\Application Data\YouTube\Uploader\youtubeuploader.exe
C:\Program Files\Safari\Safari.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://rogers.my.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {B8A7839C-51E8-4067-ADA3-CA74BABC1976} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {B8A7839C-51E8-4067-ADA3-CA74BABC1976} - (no file)
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [osCheck] "C:\PROGRA~1\Symantec\osCheck.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {18955D47-882E-48fc-B903-A4BDD030E7FD} - (no file)
O9 - Extra 'Tools' menuitem: GigaSize Toolbar - {18955D47-882E-48fc-B903-A4BDD030E7FD} - (no file)
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase4009.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 10162 bytes

and

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:43:01 PM, on 2/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Grisoft\AVG7\avgwb.dat
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Safari\Safari.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://rogers.my.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ATIService] "C:\Program Files\ATI Multimedia\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [RegClean Expert Scheduler] "C:\Program Files\Registry Clean Expert\RCHelper.exe" /startup
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Jim\Local Settings\Application Data\Google\Update\1.0.103.0\GoogleUpdate.exe"
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Startup: YouTube Uploader.lnk = C:\Documents and Settings\Jim\Local Settings\Application Data\YouTube\Uploader\youtubeuploader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {18955D47-882E-48fc-B903-A4BDD030E7FD} - (no file)
O9 - Extra 'Tools' menuitem: GigaSize Toolbar - {18955D47-882E-48fc-B903-A4BDD030E7FD} - (no file)
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase4009.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

--
End of file - 11000 bytes
 
Logged
xblade12100
*
Offline Offline

Posts: 93
« Reply #14 on: February 10, 2008, 00:05:11 »
when I was on the computer AVG said Trojan horse Delf.CPO was Detected and I moved it to the Vault, Here is a HiJack This log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:03, on 2008-02-10
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\ATI Multimedia\PowerCinema\PCMService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
C:\Documents and Settings\Jim\Local Settings\Application Data\Google\Update\1.0.103.0\GoogleUpdate.exe
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Jim\Local Settings\Application Data\YouTube\Uploader\youtubeuploader.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Safari\Safari.exe
C:\PROGRA~1\Grisoft\AVG7\avgvv.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://rogers.my.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [osCheck] "C:\PROGRA~1\Symantec\osCheck.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase4009.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 9822 bytes
Logged
Ruby
Authorized Users
*****
Offline Offline

Posts: 1066



WWW
« Reply #15 on: February 10, 2008, 00:07:53 »
By the moment we don't need any other logfiles, thanks. Please follow these instructions and make sure not to use other programs while asking for help on The Spykiller, otherwise it will be very difficult to help you to clean up your machine which is horribly compromised.

The C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe is running on your machine, what means that we will not be able to clean it up. Please follow these instructions to disable the TeaTimer: start Spybot - Search & Destroy, deactivate "Resident TeaTimer": Click onto "Advanced mode" > "YES" > "Tools" > Click  "Resident" > take off the checkmark next to "Resident TeaTimer" "activ" Box > exit.

When finished I want that you go on with the instructions of ""A guide and tutorial on using ComboFix""; scroll down to the following line:

""Once you have finished installing the Windows Recovery Console, please continue with the rest of the tutorial.""

Please read the tutorial first: Close down all applications, close any open browser and make sure you are disconnected from the net. Unplug the cable if need be before running combofix. Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with the ComboFix or remove some of its embedded files which may cause "unpredictable results". Run the ComboFix again and make us see the new C:\ComboFix.txt.
Logged
      
xblade12100
*
Offline Offline

Posts: 93
« Reply #16 on: February 10, 2008, 01:57:27 »
Please help me because I was scanning with AVG and I AVG said that I havr Trojan horse Delf.CPO and i moved it to the chest, I don't Know what has made this happan,

Thank you Cheesy
Logged
Ruby
Authorized Users
*****
Offline Offline

Posts: 1066



WWW
« Reply #17 on: February 10, 2008, 13:26:03 »
You may want to stop with opening new threads. I am merging all your new threads to this one, there is no need for any new thread!

I have asked you some postings before to stop the TeaTimer from running. Why don't you do it? Please follow these instructions first, otherwise you will get your infection back onto your machine:
Quote
The C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe is running on your machine, what means that we will not be able to clean it up. Please follow these instructions to disable the TeaTimer: start Spybot - Search & Destroy, deactivate "Resident TeaTimer": Click onto "Advanced mode" > "YES" > "Tools" > Click  "Resident" > take off the checkmark next to "Resident TeaTimer" "activ" Box > exit.
Did you disable the TeaTimer now?

Then go on....

  • Download the attached CFScript.txt to your desktop

    Close any open browsers and make sure you are disconnected from the net.
    Unplug the cable if need be before going any further    .

    Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.



  • This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply together with a new HijackThis log.

    Remember to reconnect to the net and enable any disabled antivirus etc BEFORE reconnecting.

  • Note: these instructions and script were created specifically for this user.  If you are not this user, do NOT follow these instructions  or use this script as it could damage the workings of your system.

    This will create a zip file named something like  [38]-Submit_2008-02-10@xx.xx.zip

    At the end it will pop up an alert & open your browser and ask you to send the zip file please follow those instructions. We need to see the zip file before we can carry on with the fix. If there is no pop up alert or open browser then please go to  http://www.thespykiller.co.uk/index.php?board=1.0 and upload these files so they can be examined and if needed distributed to antivirus companies.
    Just press new topic, fill in the needed details and just give a link to your post here, then press the browse button and then navigate to & select the files on your computer. If there is more than 1 file then press the more attachments button for each extra file and browse and select etc and then when all the files are listed in the windows press send to upload the files (do not post HJT logs there as they will not get dealt with)

[attachment deleted by admin]
Logged
      
xblade12100
*
Offline Offline

Posts: 93
« Reply #18 on: February 10, 2008, 14:02:37 »
here is the link and also a Combofix
 log:

http://thespykiller.co.uk/index.php/topic,5879.0.html

Don't open the Zip unless you are ruby

ComboFix 08-02.05.3 - Jim 2008-02-11  8:38:06.3 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1033.18.482 [GMT -5:00]
Running from: C:\Documents and Settings\Jim\Desktop\Logs\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jim\Desktop\CFScript.txt
 * Created a new restore point

FILE
C:\WINDOWS\system32\WinSys.exe
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\98910.exe

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_XDVA028
-------\LEGACY_XDVA039
-------\LEGACY_XDVA042
-------\XDva028
-------\XDva039
-------\XDva042


(((((((((((((((((((((((((   Files Created from 2008-01-11 to 2008-02-11  )))))))))))))))))))))))))))))))
.

2008-02-09 10:18 . 2004-08-04 07:00   388,608   --a------   C:\kmd.exe
2008-02-09 09:10 . 2004-08-04 07:00   260,272   -r-hs----   C:\cmldr
2008-02-09 08:52 . 2008-02-09 10:07   <DIR>   d--------   C:\Documents and Settings\Jim\Application Data\DMCache
2008-02-08 17:29 . 2008-02-08 17:29   <DIR>   d--------   C:\Deckard
2008-02-07 10:58 . 2003-03-13 12:51   51,200   --a------   C:\WINDOWS\system32\camcodec.dll
2008-02-07 10:58 . 2003-03-13 12:51   1,461   --a------   C:\WINDOWS\system32\drivers\camcodec.inf
2008-02-05 16:43 . 2008-02-05 16:43   <DIR>   d--------   C:\Program Files\Trend Micro
2008-02-03 11:03 . 2008-02-03 11:03   <DIR>   d--------   C:\Program Files\AVSMedia
2008-02-03 09:51 . 2008-02-11 08:46   54,156   --ah-----   C:\WINDOWS\QTFont.qfn
2008-02-03 09:51 . 2008-02-03 09:51   1,409   --a------   C:\WINDOWS\QTFont.for
2008-02-02 09:49 . 2008-02-02 09:49   <DIR>   d--------   C:\Program Files\Microsoft Windows OneCare Live
2008-02-01 09:48 . 2008-02-01 09:49   <DIR>   d--------   C:\Program Files\Common Files\xing shared
2008-01-31 23:03 . 2008-02-05 20:34   <DIR>   d--------   C:\Documents and Settings\Jim\Application Data\Search Settings
2008-01-31 22:37 . 2008-01-31 22:37   <DIR>   d--------   C:\Program Files\Common Files\SWF Studio
2008-01-31 22:36 . 2008-01-31 22:40   <DIR>   d--------   C:\Documents and Settings\Jim\Application Data\Dealio
2008-01-31 20:21 . 2008-01-31 20:21   <DIR>   d--------   C:\SICKO
2008-01-30 16:04 . 2008-02-11 08:33   805   --a------   C:\rollback.ini
2008-01-30 15:44 . 2007-11-14 16:05   1,086,952   --a------   C:\WINDOWS\system32\zpeng24.dll
2008-01-29 19:48 . 2008-01-29 19:48   <DIR>   d--------   C:\Documents and Settings\Jim\Application Data\MailFrontier
2008-01-29 19:43 . 2008-02-11 08:47   12,907,808   --ahs----   C:\WINDOWS\system32\drivers\fidbox.dat
2008-01-29 19:43 . 2008-02-11 08:43   173,876   --ahs----   C:\WINDOWS\system32\drivers\fidbox.idx
2008-01-29 19:37 . 2008-01-29 20:29   <DIR>   d--------   C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-01-29 19:36 . 2007-11-14 16:05   75,248   --a------   C:\WINDOWS\zllsputility.exe
2008-01-29 19:35 . 2008-02-07 12:41   <DIR>   d--------   C:\WINDOWS\system32\ZoneLabs
2008-01-29 19:35 . 2008-01-29 19:35   <DIR>   d--------   C:\Program Files\Zone Labs
2008-01-29 19:35 . 2008-02-11 08:45   355,090   --a------   C:\WINDOWS\system32\vsconfig.xml
2008-01-28 17:53 . 2008-01-31 23:23   <DIR>   d--------   C:\Documents and Settings\Jim\Application Data\Vso
2008-01-28 17:53 . 2008-01-28 17:53   47,360   --a------   C:\WINDOWS\system32\drivers\pcouffin.sys
2008-01-28 17:53 . 2008-01-31 23:23   47,360   --a------   C:\Documents and Settings\Jim\Application Data\pcouffin.sys
2008-01-22 19:46 . 2008-01-28 17:44   <DIR>   d--------   C:\Documents and Settings\Jim\dwhelper
2008-01-20 17:44 . 2008-01-20 17:44   <DIR>   d--------   C:\Documents and Settings\Jim\Application Data\MozillaControl
2008-01-20 16:27 . 2008-01-21 18:09   <DIR>   d--------   C:\Program Files\Opera
2008-01-19 22:36 . 2008-02-10 18:27   <DIR>   d--------   C:\Documents and Settings\Jim\Application Data\SiteAdvisor
2008-01-19 22:36 . 2008-01-19 22:36   <DIR>   d--------   C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-01-19 22:36 . 2008-01-19 22:36   <DIR>   d--------   C:\Documents and Settings\All Users\Application Data\McAfee
2008-01-19 22:17 . 2007-12-04 08:04   837,496   --a------   C:\WINDOWS\system32\aswBoot.exe
2008-01-19 22:17 . 2004-01-09 04:13   380,928   --a------   C:\WINDOWS\system32\actskin4.ocx
2008-01-19 22:17 . 2007-12-04 07:54   95,608   --a------   C:\WINDOWS\system32\AvastSS.scr
2008-01-19 22:17 . 2007-12-04 09:55   94,544   --a------   C:\WINDOWS\system32\drivers\aswmon2.sys
2008-01-19 22:17 . 2007-12-04 09:56   93,264   --a------   C:\WINDOWS\system32\drivers\aswmon.sys
2008-01-19 22:17 . 2007-12-04 09:51   42,912   --a------   C:\WINDOWS\system32\drivers\aswTdi.sys
2008-01-19 22:17 . 2007-12-04 09:49   26,624   --a------   C:\WINDOWS\system32\drivers\aavmker4.sys
2008-01-19 22:17 . 2007-12-04 09:53   23,152   --a------   C:\WINDOWS\system32\drivers\aswRdr.sys
2008-01-19 22:16 . 2008-01-19 22:16   <DIR>   d--------   C:\Program Files\Alwil Software
2008-01-17 16:50 . 2008-01-17 16:50   <DIR>   d--------   C:\Program Files\iPod
2008-01-16 18:42 . 2008-01-16 18:42   27,496   --a------   C:\Documents and Settings\Jim\Application Data\GDIPFONTCACHEV1.DAT
2008-01-16 18:14 . 2008-01-16 18:14   <DIR>   d--------   C:\Program Files\MSBuild
2008-01-16 18:09 . 2008-01-16 18:09   <DIR>   d--------   C:\WINDOWS\system32\XPSViewer
2008-01-16 18:09 . 2008-01-16 18:09   <DIR>   d--------   C:\Program Files\Reference Assemblies
2008-01-16 18:08 . 2006-06-29 13:07   14,048   ---------   C:\WINDOWS\system32\spmsg2.dll
2008-01-16 17:37 . 2008-01-16 17:37   <DIR>   d--------   C:\Program Files\SystemRequirementsLab
2008-01-16 17:37 . 2008-01-16 17:37   <DIR>   d--------   C:\Documents and Settings\Jim\Application Data\SystemRequirementsLab
2008-01-14 15:42 . 2008-01-23 17:39   <DIR>   d--------   C:\Documents and Settings\Jim\Application Data\dvdcss
2008-01-13 17:14 . 2008-01-13 17:14   <DIR>   d--------   C:\Program Files\Common Files\Scanner
2008-01-13 11:03 . 2008-01-13 11:03   <DIR>   d--------   C:\WINDOWS\.jagex_cache_32
2008-01-12 21:07 . 2008-01-12 21:07   <DIR>   d--------   C:\Documents and Settings\Jim\Application Data\vlc

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-11 13:24   ---------   d-----w   C:\Documents and Settings\Jim\Application Data\AVG7
2008-02-10 20:54   ---------   d-----w   C:\Program Files\Bonjour
2008-02-09 15:04   ---------   d-----w   C:\Documents and Settings\Jim\Application Data\LimeWire
2008-02-07 15:57   ---------   d-----w   C:\Program Files\CamStudio
2008-02-02 14:57   ---------   d-----w   C:\Program Files\SpywareBlaster
2008-02-01 14:48   ---------   d-----w   C:\Program Files\Common Files\Real
2008-02-01 13:44   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2008-01-30 22:43   ---------   d-----w   C:\Documents and Settings\Jim\Application Data\Apple Computer
2008-01-30 01:27   ---------   d-----w   C:\Program Files\Common Files\Symantec Shared
2008-01-18 13:46   ---------   d-----w   C:\Program Files\iTunes
2008-01-17 21:48   ---------   d-----w   C:\Program Files\QuickTime
2008-01-13 22:14   ---------   d-----w   C:\Program Files\Yahoo!
2008-01-13 16:45   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-01-10 01:46   ---------   d-----w   C:\Program Files\Common Files\Adobe
2008-01-10 00:49   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-01-09 22:48   ---------   d-----w   C:\Program Files\Common Files\Macrovision Shared
2008-01-09 00:56   ---------   d-----w   C:\Program Files\VideoProfessor
2008-01-09 00:55   ---------   d-----w   C:\Documents and Settings\Jim\Application Data\Media Player Classic
2008-01-07 00:49   ---------   d-----w   C:\Program Files\Doom 3
2008-01-07 00:17   ---------   d-----w   C:\Program Files\Doom 3 Demo
2008-01-06 18:25   ---------   d-----w   C:\Program Files\Total Video Converter
2008-01-06 17:53   ---------   d-----w   C:\Program Files\Zeallsoft
2008-01-05 23:05   ---------   d-----w   C:\Program Files\Windows Live Safety Center
2008-01-04 15:24   ---------   d-----w   C:\Documents and Settings\Administrator\Application Data\AVG7
2008-01-03 23:55   ---------   d-----w   C:\Program Files\Blender Foundation
2008-01-03 23:52   ---------   d-----w   C:\Program Files\LimeWire
2008-01-03 21:45   ---------   d-----w   C:\Documents and Settings\Jim\Application Data\Yahoo!
2008-01-03 21:33   ---------   d-----w   C:\Documents and Settings\Jim\Application Data\Talkback
2008-01-03 19:56   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Avg7
2008-01-03 19:49   ---------   d-----w   C:\Documents and Settings\LocalService\Application Data\AVG7
2008-01-03 19:49   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-03 00:52   ---------   d-----w   C:\Program Files\VideoLAN
2008-01-03 00:44   ---------   d-----w   C:\Program Files\DVD Decrypter
2008-01-03 00:21   ---------   d-----w   C:\Program Files\Safari
2008-01-01 18:09   ---------   d-----w   C:\Program Files\Registry Clean Expert
2007-12-26 20:36   ---------   d-----w   C:\Program Files\Guitar Pro 5
2007-12-24 15:47   ---------   d-----w   C:\Program Files\DivX
2007-12-24 15:25   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-12-15 02:14   ---------   d-----w   C:\Program Files\Microsoft.NET
2007-12-15 02:14   ---------   d-----w   C:\Program Files\Microsoft Visual Studio 8
2007-12-15 02:14   ---------   d-----w   C:\Program Files\Common Files\Merge Modules
2007-12-14 22:24   ---------   d-----w   C:\Program Files\Game_Maker7
2007-12-14 02:46   ---------   d-----w   C:\Program Files\Lavasoft
2007-12-14 02:46   ---------   d-----w   C:\Program Files\Common Files\Wise Installation Wizard
2007-11-20 00:42   256   ----a-w   C:\sccfg.sys
.

((((((((((((((((((((((((((((((((((((((((((((   Look   )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

---- Directory of C:\SICKO ----

2008-01-29 18:00   102400   --a------   C:\SICKO\VIDEO_TS\VTS_01_0.BUP
2008-01-29 17:53   8192   --a------   C:\SICKO\VIDEO_TS\VIDEO_TS.IFO
2008-01-29 17:53   8192   --a------   C:\SICKO\VIDEO_TS\VIDEO_TS.BUP
2008-01-29 17:53   102400   --a------   C:\SICKO\VIDEO_TS\VTS_01_0.IFO


(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B8A7839C-51E8-4067-ADA3-CA74BABC1976}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]
"Steam"="" []
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46 1460560]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [ ]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [ ]
"ATI Remote Control"="C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe" [2005-04-15 14:18 1482752]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [ ]
"SoundMan"="SOUNDMAN.EXE" [2004-12-01 02:54 77824 C:\WINDOWS\SOUNDMAN.EXE]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 17:20 866584]
"osCheck"="C:\PROGRA~1\Symantec\osCheck.exe" [ ]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [ ]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-01-10 15:27 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-03 20:56 579072]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 08:00 79224]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 07:00 158208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 08:01 437160]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 07:00 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-03 20:56 219136]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Jim^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=C:\Documents and Settings\Jim\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Jim^Start Menu^Programs^Startup^YouTube Uploader.lnk]
path=C:\Documents and Settings\Jim\Start Menu\Programs\Startup\YouTube Uploader.lnk
backup=C:\WINDOWS\pss\YouTube Uploader.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI Remote Control]
--a------ 2005-04-15 14:18 1482752 C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
--a------ 2007-12-04 08:00 79224 C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
--a------ 2008-01-03 20:56 579072 C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent]
C:\Program Files\BitTorrent\bittorrent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
C:\Program Files\Common Files\Symantec Shared\ccApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-04 07:00 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
C:\Program Files\DAEMON Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
--a----t- 2008-01-19 21:58 21488 C:\Documents and Settings\Jim\Local Settings\Application Data\Google\Update\1.0.103.0\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
C:\Program Files\Internet Download Manager\IDMan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-01-15 03:22 267048 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2007-12-05 01:41 81920 C:\WINDOWS\system32\NvMcTray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\osCheck]
C:\PROGRA~1\Symantec\osCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-01-10 15:27 385024 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegClean Expert Scheduler]
C:\Program Files\Registry Clean Expert\RCHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--a------ 2007-08-31 16:46 1460560 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
--a------ 2006-11-03 17:20 866584 C:\Program Files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinSys]
C:\WINDOWS\system32\WinSys.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ose"=3 (0x3)
"odserv"=3 (0x3)
"Nero BackItUp Scheduler 3"=2 (0x2)
"comHost"=3 (0x3)
"YPCService"=3 (0x3)

R1 AmdPPM;AMD HwPState Processor Driver;C:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 21:46]
R2 SQLWriter;SQL Server VSS Writer;"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe" [2007-02-10 04:29]
R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);C:\WINDOWS\system32\DRIVERS\A3AB.sys [2007-05-23 04:15]
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2007-06-28 19:01]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-06 01:00:00 C:\WINDOWS\Tasks\Ad-Aware SE Personal.job"
- C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Aware2007.exe
"2008-02-11 13:47:40 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2008-02-05 01:00:00 C:\WINDOWS\Tasks\Norton Security Online - Run Full System Scan - Wyatt.job"
- C:\PROGRA~1\Symantec\Norton AntiVirus\Navw32.exeh/TASK:
"2008-02-08 22:30:00 C:\WINDOWS\Tasks\Spybot - Search & Destroy -  Scheduled Task.job"
- C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe,/AUTOCHECK /AUTOFIX  /AUTOUPDATE /AUTOCLOSE+C:\Program Files\Spybot - Search & Destroy
"2008-02-06 01:00:00 C:\WINDOWS\Tasks\SpywareBlaster.job"
- C:\PROGRA~1\SPYWAR~1\SPYWAR~1.EXE
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-11 08:47:56
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
.
**************************************************************************
.
Completion time: 2008-02-11  8:53:16 - machine was rebooted
ComboFix-quarantined-files.txt  2008-02-11 13:53:03
ComboFix2.txt  2008-02-11 01:21:02
ComboFix3.txt  2008-02-08 22:51:44
.
2008-02-10 19:11:58   --- E O F --- 

« Last Edit: February 10, 2008, 17:45:14 by Derek » Logged
xblade12100
*
Offline Offline

Posts: 93
« Reply #19 on: February 10, 2008, 14:07:03 »
Hey Rudy!  Grin

Here is that Combofix log:
I uploaded that file you said but I think Teatimer was on during the scan when I disabled it and I looked at this, It said that Teatimer was on!
Anyways, here is the Files
ComboFix 08-02.05.3 - Jim 2008-02-10 20:13:30.2 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1033.18.349 [GMT -5:00]
Running from: C:\Documents and Settings\Jim\Desktop\Logs\ComboFix.exe
.

(((((((((((((((((((((((((   Files Created from 2008-01-11 to 2008-02-11  )))))))))))))))))))))))))))))))
.

2008-02-09 09:10 . 2004-08-04 07:00   260,272   -r-hs----   C:\cmldr
2008-02-09 08:52 . 2008-02-09 10:07   <DIR>   d--------   C:\Documents and Settings\Jim\Application Data\IDM
2008-02-09 08:52 . 2008-02-09 10:07   <DIR>   d--------   C:\Documents and Settings\Jim\Application Data\DMCache
2008-02-08 17:39 . 2004-08-04 07:00   388,608   --a------   C:\kmd.exe
2008-02-08 17:29 . 2008-02-08 17:29   <DIR>   d--------   C:\Deckard
2008-02-07 10:58 . 2003-03-13 12:51   51,200   --a------   C:\WINDOWS\system32\camcodec.dll
2008-02-07 10:58 . 2003-03-13 12:51   1,461   --a------   C:\WINDOWS\system32\drivers\camcodec.inf
2008-02-05 16:43 . 2008-02-05 16:43   <DIR>   d--------   C:\Program Files\Trend Micro
2008-02-03 11:03 . 2008-02-03 11:03   <DIR>   d--------   C:\Program Files\AVSMedia
2008-02-03 09:51 . 2008-02-09 08:52   54,156   --ah-----   C:\WINDOWS\QTFont.qfn
2008-02-03 09:51 . 2008-02-03 09:51   1,409   --a------   C:\WINDOWS\QTFont.for
2008-02-02 09:49 . 2008-02-02 09:49   <DIR>   d--------   C:\Program Files\Microsoft Windows OneCare Live
2008-02-01 09:48 . 2008-02-01 09:49   <DIR>   d--------   C:\Program Files\Common Files\xing shared
2008-01-31 23:03 . 2008-02-05 20:34   <DIR>   d--------   C:\Documents and Settings\Jim\Application Data\Search Settings
2008-01-31 22:37 . 2008-01-31 22:37   <DIR>   d--------   C:\Program Files\Common Files\SWF Studio
2008-01-31 22:36 . 2008-01-31 22:40   <DIR>   d--------   C:\Documents and Settings\Jim\Application Data\Dealio
2008-01-31 20:21 . 2008-01-31 20:21   <DIR>   d--------   C:\SICKO
2008-01-30 16:04 . 2008-02-10 20:01   337   --a------   C:\rollback.ini
2008-01-30 15:44 . 2007-11-14 16:05   1,086,952   --a------   C:\WINDOWS\system32\zpeng24.dll
2008-01-29 19:48 . 2008-01-29 19:48   <DIR>   d--------   C:\Documents and Settings\Jim\Application Data\MailFrontier
2008-01-29 19:43 . 2008-02-10 20:19   12,717,856   --ahs----   C:\WINDOWS\system32\drivers\fidbox.dat
2008-01-29 19:43 . 2008-02-09 00:39   156,764   --ahs----   C:\WINDOWS\system32\drivers\fidbox.idx
2008-01-29 19:37 . 2008-01-29 20:29   <DIR>   d--------   C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-01-29 19:36 . 2007-11-14 16:05   75,248   --a------   C:\WINDOWS\zllsputility.exe
2008-01-29 19:35 . 2008-02-07 12:41   <DIR>   d--------   C:\WINDOWS\system32\ZoneLabs
2008-01-29 19:35 . 2008-01-29 19:35   <DIR>   d--------   C:\Program Files\Zone Labs
2008-01-29 19:35 . 2008-02-09 08:51   355,090   --a------   C:\WINDOWS\system32\vsconfig.xml
2008-01-28 17:53 . 2008-01-31 23:23   <DIR>   d--------   C:\Documents and Settings\Jim\Application Data\Vso
2008-01-28 17:53 . 2008-01-28 17:53   47,360   --a------   C:\WINDOWS\system32\drivers\pcouffin.sys
2008-01-28 17:53 . 2008-01-31 23:23   47,360   --a------   C:\Documents and Settings\Jim\Application Data\pcouffin.sys
2008-01-22 19:46 . 2008-01-28 17:44   <DIR>   d--------   C:\Documents and Settings\Jim\dwhelper
2008-01-20 17:44 . 2008-01-20 17:44   <DIR>   d--------   C:\Documents and Settings\Jim\Application Data\MozillaControl
2008-01-20 16:27 . 2008-01-21 18:09   <DIR>   d--------   C:\Program Files\Opera
2008-01-19 22:36 . 2008-02-10 18:27   <DIR>   d--------   C:\Documents and Settings\Jim\Application Data\SiteAdvisor
2008-01-19 22:36 . 2008-01-19 22:36   <DIR>   d--------   C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-01-19 22:36 . 2008-01-19 22:36   <DIR>   d--------   C:\Documents and Settings\All Users\Application Data\McAfee
2008-01-19 22:17 . 2007-12-04 08:04   837,496   --a------   C:\WINDOWS\system32\aswBoot.exe
2008-01-19 22:17 . 2004-01-09 04:13   380,928   --a------   C:\WINDOWS\system32\actskin4.ocx
2008-01-19 22:17 . 2007-12-04 07:54   95,608   --a------   C:\WINDOWS\system32\AvastSS.scr
2008-01-19 22:17 . 2007-12-04 09:55   94,544   --a------   C:\WINDOWS\system32\drivers\aswmon2.sys
2008-01-19 22:17 . 2007-12-04 09:56   93,264   --a------   C:\WINDOWS\system32\drivers\aswmon.sys
2008-01-19 22:17 . 2007-12-04 09:51   42,912   --a------   C:\WINDOWS\system32\drivers\aswTdi.sys
2008-01-19 22:17 . 2007-12-04 09:49   26,624   --a------   C:\WINDOWS\system32\drivers\aavmker4.sys
2008-01-19 22:17 . 2007-12-04 09:53   23,152   --a------   C:\WINDOWS\system32\drivers\aswRdr.sys
2008-01-19 22:16 . 2008-01-19 22:16   <DIR>   d--------   C:\Program Files\Alwil Software
2008-01-17 16:50 . 2008-01-17 16:50   <DIR>   d--------   C:\Program Files\iPod
2008-01-16 18:42 . 2008-01-16 18:42   27,496   --a------   C:\Documents and Settings\Jim\Application Data\GDIPFONTCACHEV1.DAT
2008-01-16 18:14 . 2008-01-16 18:14   <DIR>   d--------   C:\Program Files\MSBuild
2008-01-16 18:09 . 2008-01-16 18:09   <DIR>   d--------   C:\WINDOWS\system32\XPSViewer
2008-01-16 18:09 . 2008-01-16 18:09   <DIR>   d--------   C:\Program Files\Reference Assemblies
2008-01-16 18:08 . 2006-06-29 13:07   14,048   ---------   C:\WINDOWS\system32\spmsg2.dll
2008-01-16 17:37 . 2008-01-16 17:37   <DIR>   d--------   C:\Program Files\SystemRequirementsLab
2008-01-16 17:37 . 2008-01-16 17:37   <DIR>   d--------   C:\Documents and Settings\Jim\Application Data\SystemRequirementsLab
2008-01-14 15:42 . 2008-01-23 17:39   <DIR>   d--------   C:\Documents and Settings\Jim\Application Data\dvdcss
2008-01-13 17:14 . 2008-01-13 17:14   <DIR>   d--------   C:\Program Files\Common Files\Scanner
2008-01-13 11:03 . 2008-01-13 11:03   <DIR>   d--------   C:\WINDOWS\.jagex_cache_32
2008-01-12 21:07 . 2008-01-12 21:07   <DIR>   d--------   C:\Documents and Settings\Jim\Application Data\vlc

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-11 00:13   ---------   d-----w   C:\Documents and Settings\Jim\Application Data\AVG7
2008-02-10 20:54   ---------   d-----w   C:\Program Files\Bonjour
2008-02-09 15:07   ---------   d-----w   C:\Program Files\Internet Download Manager
2008-02-09 15:04   ---------   d-----w   C:\Documents and Settings\Jim\Application Data\LimeWire
2008-02-08 21:44   409,088   ----a-w   C:\WINDOWS\Internet Logs\xDB7.tmp
2008-02-08 19:45   2,116,096   ----a-w   C:\WINDOWS\Internet Logs\xDB6.tmp
2008-02-08 17:50   2,116,096   ----a-w   C:\WINDOWS\Internet Logs\xDB5.tmp
2008-02-07 23:43   2,112,000   ----a-w   C:\WINDOWS\Internet Logs\xDB4.tmp
2008-02-07 15:57   ---------   d-----w   C:\Program Files\CamStudio
2008-02-06 23:49   2,076,160   ----a-w   C:\WINDOWS\Internet Logs\xDB3.tmp
2008-02-05 20:44   78,848   ----a-w   C:\WINDOWS\system32\msiexec.exe
2008-02-05 02:29   1,748,480   ----a-w   C:\WINDOWS\Internet Logs\xDB2.tmp
2008-02-02 14:57   ---------   d-----w   C:\Program Files\SpywareBlaster
2008-02-01 14:48   ---------   d-----w   C:\Program Files\Common Files\Real
2008-02-01 13:44   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2008-01-31 02:38   1,251,328   ----a-w   C:\WINDOWS\Internet Logs\xDB1.tmp
2008-01-30 22:43   ---------   d-----w   C:\Documents and Settings\Jim\Application Data\Apple Computer
2008-01-30 01:27   ---------   d-----w   C:\Program Files\Common Files\Symantec Shared
2008-01-18 13:46   ---------   d-----w   C:\Program Files\iTunes
2008-01-17 21:48   ---------   d-----w   C:\Program Files\QuickTime
2008-01-13 22:14   ---------   d-----w   C:\Program Files\Yahoo!
2008-01-13 16:45   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-01-13 16:42   12,632   ----a-w   C:\WINDOWS\system32\lsdelete.exe
2008-01-10 01:46   ---------   d-----w   C:\Program Files\Common Files\Adobe
2008-01-10 00:49   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-01-09 22:48   ---------   d-----w   C:\Program Files\Common Files\Macrovision Shared
2008-01-09 00:56   ---------   d-----w   C:\Program Files\VideoProfessor
2008-01-09 00:55   ---------   d-----w   C:\Documents and Settings\Jim\Application Data\Media Player Classic
2008-01-07 00:49   ---------   d-----w   C:\Program Files\Doom 3
2008-01-07 00:17   ---------   d-----w   C:\Program Files\Doom 3 Demo
2008-01-06 18:25   ---------   d-----w   C:\Program Files\Total Video Converter
2008-01-06 17:53   ---------   d-----w   C:\Program Files\Zeallsoft
2008-01-05 23:05   ---------   d-----w   C:\Program Files\Windows Live Safety Center
2008-01-04 15:24   ---------   d-----w   C:\Documents and Settings\Administrator\Application Data\AVG7
2008-01-03 23:55   ---------   d-----w   C:\Program Files\Blender Foundation
2008-01-03 23:52   ---------   d-----w   C:\Program Files\LimeWire
2008-01-03 21:45   ---------   d-----w   C:\Documents and Settings\Jim\Application Data\Yahoo!
2008-01-03 21:33   ---------   d-----w   C:\Documents and Settings\Jim\Application Data\Talkback
2008-01-03 19:56   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Avg7
2008-01-03 19:49   ---------   d-----w   C:\Documents and Settings\LocalService\Application Data\AVG7
2008-01-03 19:49   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-03 00:52   ---------   d-----w   C:\Program Files\VideoLAN
2008-01-03 00:44   ---------   d-----w   C:\Program Files\DVD Decrypter
2008-01-03 00:21   ---------   d-----w   C:\Program Files\Safari
2008-01-01 18:09   ---------   d-----w   C:\Program Files\Registry Clean Expert
2007-12-26 20:36   ---------   d-----w   C:\Program Files\Guitar Pro 5
2007-12-24 15:47   ---------   d-----w   C:\Program Files\DivX
2007-12-24 15:25   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-12-15 02:14   ---------   d-----w   C:\Program Files\Microsoft.NET
2007-12-15 02:14   ---------   d-----w   C:\Program Files\Microsoft Visual Studio 8
2007-12-15 02:14   ---------   d-----w   C:\Program Files\Common Files\Merge Modules
2007-12-14 22:24   ---------   d-----w   C:\Program Files\Game_Maker7
2007-12-14 02:46   ---------   d-----w   C:\Program Files\Lavasoft
2007-12-14 02:46   ---------   d-----w   C:\Program Files\Common Files\Wise Installation Wizard
2007-12-11 22:34   200,704   ----a-w   C:\WINDOWS\system32\ssldivx.dll
2007-12-11 22:34   1,044,480   ----a-w   C:\WINDOWS\system32\libdivx.dll
2007-12-05 07:53   356,352   ----a-w   C:\WINDOWS\system32\NVUNINST.EXE
2007-12-05 06:41   81,920   ----a-w   C:\WINDOWS\system32\nvwddi.dll
2007-12-05 06:41   81,920   ----a-w   C:\WINDOWS\system32\nvmctray.dll
2007-12-05 06:41   8,523,776   ----a-w   C:\WINDOWS\system32\nvcpl.dll
2007-12-05 06:41   753,664   ----a-w   C:\WINDOWS\system32\nvcplui.exe
2007-12-05 06:41   6,901,760   ----a-w   C:\WINDOWS\system32\nvoglnt.dll
2007-12-05 06:41   6,549,504   ----a-w   C:\WINDOWS\system32\nvdisps.dll
2007-12-05 06:41   5,773,568   ----a-w   C:\WINDOWS\system32\nv4_disp.dll
2007-12-05 06:41   45,056   ----a-w   C:\WINDOWS\system32\nvmccsrs.dll
2007-12-05 06:41   385,024   ----a-w   C:\WINDOWS\system32\nvapi.dll
2007-12-05 06:41   356,352   ----a-w   C:\WINDOWS\system32\nvudisp.exe
2007-12-05 06:41   35,328   ----a-w   C:\WINDOWS\system32\nvcodins.dll
2007-12-05 06:41   35,328   ----a-w   C:\WINDOWS\system32\nvcod.dll
2007-12-05 06:41   307,200   ----a-w   C:\WINDOWS\system32\nvexpbar.dll
2007-12-05 06:41   3,710,976   ----a-w   C:\WINDOWS\system32\nvvitvs.dll
2007-12-05 06:41   3,420,160   ----a-w   C:\WINDOWS\system32\nvgames.dll
2007-12-05 06:41   286,720   ----a-w   C:\WINDOWS\system32\nvnt4cpl.dll
2007-12-05 06:41   229,376   ----a-w   C:\WINDOWS\system32\nvmccs.dll
2007-12-05 06:41   2,498,560   ----a-w   C:\WINDOWS\system32\nvwss.dll
2007-12-05 06:41   188,416   ----a-w   C:\WINDOWS\system32\nvmccss.dll
2007-12-05 06:41   155,716   ----a-w   C:\WINDOWS\system32\nvsvc32.exe
2007-12-05 06:41   147,456   ----a-w   C:\WINDOWS\system32\nvcolor.exe
2007-12-05 06:41   1,228,800   ----a-w   C:\WINDOWS\system32\nvmobls.dll
2007-12-05 06:41   1,089,536   ----a-w   C:\WINDOWS\system32\nvcuda.dll
2007-12-01 13:29   7,650,416   ----a-w   C:\WINDOWS\98910.exe
2007-11-20 00:42   256   ----a-w   C:\sccfg.sys
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]
"Steam"="" []
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46 1460560]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [ ]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [ ]
"ATI Remote Control"="C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe" [2005-04-15 14:18 1482752]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [ ]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 07:00 158208]
"SoundMan"="SOUNDMAN.EXE" [2004-12-01 02:54 77824 C:\WINDOWS\SOUNDMAN.EXE]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 17:20 866584]
"osCheck"="C:\PROGRA~1\Symantec\osCheck.exe" [ ]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [ ]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-01-10 15:27 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-03 20:56 579072]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 08:00 79224]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 08:01 437160]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 07:00 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-03 20:56 219136]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Jim^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=C:\Documents and Settings\Jim\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Jim^Start Menu^Programs^Startup^YouTube Uploader.lnk]
path=C:\Documents and Settings\Jim\Start Menu\Programs\Startup\YouTube Uploader.lnk
backup=C:\WINDOWS\pss\YouTube Uploader.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI Remote Control]
--a------ 2005-04-15 14:18 1482752 C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
--a------ 2007-12-04 08:00 79224 C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
--a------ 2008-01-03 20:56 579072 C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent]
C:\Program Files\BitTorrent\bittorrent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
C:\Program Files\Common Files\Symantec Shared\ccApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-04 07:00 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
C:\Program Files\DAEMON Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
--a----t- 2008-01-19 21:58 21488 C:\Documents and Settings\Jim\Local Settings\Application Data\Google\Update\1.0.103.0\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
C:\Program Files\Internet Download Manager\IDMan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-01-15 03:22 267048 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2007-12-05 01:41 81920 C:\WINDOWS\system32\NvMcTray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\osCheck]
C:\PROGRA~1\Symantec\osCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-01-10 15:27 385024 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegClean Expert Scheduler]
C:\Program Files\Registry Clean Expert\RCHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--a------ 2007-08-31 16:46 1460560 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
--a------ 2006-11-03 17:20 866584 C:\Program Files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinSys]
C:\WINDOWS\system32\WinSys.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ose"=3 (0x3)
"odserv"=3 (0x3)
"Nero BackItUp Scheduler 3"=2 (0x2)
"comHost"=3 (0x3)
"YPCService"=3 (0x3)

R1 AmdPPM;AMD HwPState Processor Driver;C:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 21:46]
R2 SQLWriter;SQL Server VSS Writer;"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe" [2007-02-10 04:29]
R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);C:\WINDOWS\system32\DRIVERS\A3AB.sys [2007-05-23 04:15]
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2007-06-28 19:01]
S3 XDva028;XDva028;C:\WINDOWS\system32\XDva028.sys []
S3 XDva039;XDva039;C:\WINDOWS\system32\XDva039.sys []
S3 XDva042;XDva042;C:\WINDOWS\system32\XDva042.sys []

.
Contents of the 'Scheduled Tasks' folder
"2008-02-06 01:00:00 C:\WINDOWS\Tasks\Ad-Aware SE Personal.job"
- C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Aware2007.exe
"2008-02-10 22:00:59 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2008-02-05 01:00:00 C:\WINDOWS\Tasks\Norton Security Online - Run Full System Scan - Wyatt.job"
- C:\PROGRA~1\Symantec\Norton AntiVirus\Navw32.exeh/TASK:
"2008-02-08 22:30:00 C:\WINDOWS\Tasks\Spybot - Search & Destroy -  Scheduled Task.job"
- C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe,/AUTOCHECK /AUTOFIX  /AUTOUPDATE /AUTOCLOSE+C:\Program Files\Spybot - Search & Destroy
"2008-02-06 01:00:00 C:\WINDOWS\Tasks\SpywareBlaster.job"
- C:\PROGRA~1\SPYWAR~1\SPYWAR~1.EXE
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-10 20:19:30
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-10 20:20:59
ComboFix-quarantined-files.txt  2008-02-11 01:20:47
ComboFix2.txt  2008-02-08 22:51:44
.
2008-02-10 19:11:58   --- E O F --- 
« Last Edit: February 10, 2008, 17:46:12 by Derek » Logged
Pages: 1 [2] 3 4 5 6 7 ... 16   Go Up
  Print  
The Spykiller  > Spyware & Malware removal and General computer help > Malware removal and help > Topic: Msiexec.exe is Infected!!!
 « previous next »
 
Jump to:  

Donations

You have come to The Spykiller for help because your Antivirus or Antispyware hasn't been able to fix your problem.

Modern Malware has become so involved and difficult to fix that it takes a very long time and a lot of hard work to read all the logs posted here and research and prepare the fixes for you. In many cases each part of the fix takes about 30 minutes to prepare, so a large part of my time is spent helping you

Would you do all this for nothing?

The reason I run this site is to raise funds for Hedgehog Rescue

Please donate if I have helped you or you have found this site useful.

You can donate safely and securely by using the paypal service, just click on one of the buttons below.

To donate in UK £

To donate in US$

To donate in Euro €

Any amount no matter how small is gratefully accepted and needed to ensure we keep the Rescue Centre running

To donate via paypal when the button doesn't appear or the link doesn't work: just go to www.paypal.com or your country's paypal log in page and chose send money and use help@thehedgehog.co.uk as recipient email address and select other service as the option. then follow prompts


.

Useful Advice and Programs
   7 day shop
  Software
   Antiviruses
     Kaspersky
     Trojan Remover
   Other Software
     Useful Downloads
     Spyware Fixing Tools
  
  Information
   Security & Protection Blog
   Prevention
   Using Autoruns
   Process Library
     System Restore
  Software Reviews
     Wintasks
  Rss feeds
     Microsoft Security
     MSRC
     Malware blog
     Secunia
Kaspersky online scanner
Take the Kaspersky Challenge: See what your current antivirus is missing. Our free online virus scanner is a great way to find out if you have any viruses or spyware on your machine without having to uninstall your current antivirus software or install a new one.

Most importantly, you can see what viruses your current antivirus software let slip through! Now works with ANY Java enabled browser
Stop killing hedgehogs with strimmers
User
Welcome, Guest. Please login or register.
Did you miss your activation email?
March 12, 2010, 18:33:11

Login with username, password and session length
secunia Software inspector

Google ads
RoboForm: Learn more...

You have come to The Spykiller for help because your Antivirus or Antispyware hasn't been able to fix your problem.

Modern Malware is so involved and difficult to fix that it takes a very long time and a lot of hard work to read all the logs posted here and research and prepare the fixes for you.
In many cases each part of the fix takes about 30 minutes to prepare, so a large part of my time is spent helping you

Would you do all this for nothing?

I run this site to help raise funds for Hedgehog Rescue

Please donate if I have helped you or you have found this site useful.

You can donate safely and securely by using the PayPal service, just click on one of the buttons below.

To donate in UK £

To donate in US$

To donate in Euro €

Any amount no matter how small is gratefully accepted and needed to ensure we keep the Rescue Centre running
Powered by MySQL Powered by PHP Powered by SMF 1.1.11 | SMF © 2006-2009, Simple Machines LLC
TinyPortal v0.9.8 © Bloc 		Valid XHTML 1.0! Valid CSS!
Page created in 0.214 seconds with 32 queries.

Google visited last this page February 19, 2010, 21:27:01