Logfile of HijackThis v1.99.1
Scan saved at 11:34:55 PM, on 8/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Iron Mountain\AgentSrv.EXE
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\taskswitch.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Iron Mountain\CBSysTray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopMail.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\notepad.exe
C:\hijackthis\analyze.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~4\Office12\GRA8E1~1.DLL
O2 - BHO: Google Desktop Search Capture - {7c1ce531-09e9-4fc5-9803-1c2956615786} - C:\Program Files\Google\Google Desktop Search\GoogleDesktopIE.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [\\MCFLY\EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE /P38 "\\MCFLY\EPSON Stylus Photo R300 Series" /O6 "USB001" /M "Stylus Photo R300"
O4 - HKLM\..\Run: [Auto EPSON Stylus Photo R300 Series on MCFLY] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE /P44 "Auto EPSON Stylus Photo R300 Series on MCFLY" /O16 "\\MCFLY\EPSONSty" /M "Stylus Photo R300"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [BackupNotify] C:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp /HIDEBL
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [EPSON Stylus Photo R380 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBOA.EXE /FU "C:\WINDOWS\TEMP\E_S9B.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Iron Mountain TaskBar Icon.LNK = C:\Program Files\Iron Mountain\CBSysTray.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q304&bd=pavilion&pf=laptop
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) -
http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) -
http://209.113.157.25/activex/AxisCamControl.ocx
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.0 Control) -
http://crm.icarconnect.com/uploader/ImageUploader3.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) -
http://www.crucial.com/controls/cpcScanner.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Connected Agent Service (AgentSrv) - Connected Corporation - C:\Program Files\Iron Mountain\AgentSrv.EXE
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Wednesday, August 08, 2007 11:32:17 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 9/08/2007
Kaspersky Anti-Virus database records: 377300
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
C:\
D:\
E:\
Scan Statistics:
Total number of scanned objects: 127097
Number of viruses found: 9
Number of infected objects: 30
Number of suspicious objects: 4
Duration of the scan process: 04:05:57
Infected Object Name / Virus Name / Last Action
C:\Apps\Windows XP Key Changer Pack\Windows XP Key Changer Pack\Key Changer.exe/data.rar/xpkey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\Apps\Windows XP Key Changer Pack\Windows XP Key Changer Pack\Key Changer.exe/data.rar/officekey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\Apps\Windows XP Key Changer Pack\Windows XP Key Changer Pack\Key Changer.exe/data.rar Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\Apps\Windows XP Key Changer Pack\Windows XP Key Changer Pack\Key Changer.exe RarSFX: infected - 3 skipped
C:\Apps\Windows XP Key Changer Pack\Windows XP Key Changer Pack\Windows XP Key Changer Pack.zip/Key Changer.exe/data.rar/xpkey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\Apps\Windows XP Key Changer Pack\Windows XP Key Changer Pack\Windows XP Key Changer Pack.zip/Key Changer.exe/data.rar/officekey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\Apps\Windows XP Key Changer Pack\Windows XP Key Changer Pack\Windows XP Key Changer Pack.zip/Key Changer.exe/data.rar Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\Apps\Windows XP Key Changer Pack\Windows XP Key Changer Pack\Windows XP Key Changer Pack.zip/Key Changer.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\Apps\Windows XP Key Changer Pack\Windows XP Key Changer Pack\Windows XP Key Changer Pack.zip ZIP: infected - 4 skipped
C:\Apps\Windows XP Key Changer Pack.rar/Windows XP Key Changer Pack/Key Changer.exe/data.rar/xpkey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\Apps\Windows XP Key Changer Pack.rar/Windows XP Key Changer Pack/Key Changer.exe/data.rar/officekey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\Apps\Windows XP Key Changer Pack.rar/Windows XP Key Changer Pack/Key Changer.exe/data.rar Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\Apps\Windows XP Key Changer Pack.rar/Windows XP Key Changer Pack/Key Changer.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\Apps\Windows XP Key Changer Pack.rar RAR: infected - 4 skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Application Data\muvee Technologies\030625\0102\0105\values Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PurityScan.zip/offun.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PurityScan.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumonde1.zip/retadpu1000106.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumonde1.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp Object is locked skipped
C:\Documents and Settings\All Users\DRM\drmstore.hds Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\McFly\Application Data\Mozilla\Firefox\Profiles\1dwa44dd.default\cert8.db Object is locked skipped
C:\Documents and Settings\McFly\Application Data\Mozilla\Firefox\Profiles\1dwa44dd.default\history.dat Object is locked skipped
C:\Documents and Settings\McFly\Application Data\Mozilla\Firefox\Profiles\1dwa44dd.default\key3.db Object is locked skipped
C:\Documents and Settings\McFly\Application Data\Mozilla\Firefox\Profiles\1dwa44dd.default\parent.lock Object is locked skipped
C:\Documents and Settings\McFly\Application Data\Mozilla\Firefox\Profiles\1dwa44dd.default\search.sqlite Object is locked skipped
C:\Documents and Settings\McFly\Application Data\Mozilla\Firefox\Profiles\1dwa44dd.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\McFly\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\AOL OCP\AIM\Storage\All Users\localStorage\common.cls Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\AOL OCP\AIM\Storage\data\j0uv1n\localStorage\common.cls Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\Google\Google Desktop Search\dbc2em.cf1 Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\Google\Google Desktop Search\dbc2emh.ht1 Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\Google\Google Desktop Search\dbdam Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\Google\Google Desktop Search\dbdao Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\Google\Google Desktop Search\dbeam Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\Google\Google Desktop Search\dbeao Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\Google\Google Desktop Search\dbm Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\Google\Google Desktop Search\dbu2dm.cf1 Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\Google\Google Desktop Search\dbu2dmh.ht1 Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\Google\Google Desktop Search\dbvm.cf1 Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\Google\Google Desktop Search\dbvmh.ht1 Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\Google\Google Desktop Search\fii.cf1 Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\Google\Google Desktop Search\fiih.ht1 Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\Google\Google Desktop Search\hp Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\Google\Google Desktop Search\hpt2i.ht1 Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\Google\Google Desktop Search\rpm.cf1 Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\Google\Google Desktop Search\rpm1n.cf1 Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\Google\Google Desktop Search\rpm1n1m.cf1 Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\Google\Google Desktop Search\rpm1n1mh.ht1 Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\Google\Google Desktop Search\rpm1nh.ht1 Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\Google\Google Desktop Search\rpmh.ht1 Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\Microsoft\Zune\CurrentDatabase_365.wmdb Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\Mozilla\Firefox\Profiles\1dwa44dd.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\Mozilla\Firefox\Profiles\1dwa44dd.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\Mozilla\Firefox\Profiles\1dwa44dd.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Application Data\Mozilla\Firefox\Profiles\1dwa44dd.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\McFly\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\McFly\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\McFly\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\found.000\dir0000.chk\126ADF0A.wmf Object is locked skipped
C:\found.000\dir0000.chk\184F5D81.dat Object is locked skipped
C:\found.000\dir0000.chk\18E442DA.wmf Object is locked skipped
C:\found.000\dir0000.chk\1B4160C6.wmf Object is locked skipped
C:\found.000\dir0000.chk\219672FF.dat Object is locked skipped
C:\found.000\dir0000.chk\2645C973.dat Object is locked skipped
C:\found.000\dir0000.chk\2A8EE2A0.wmf Object is locked skipped
C:\found.000\dir0000.chk\2EAECC11.wmf Object is locked skipped
C:\found.000\dir0000.chk\2FF338CC.dat Object is locked skipped
C:\found.000\dir0000.chk\328DCD76.dat Object is locked skipped
C:\found.000\dir0000.chk\3838BC2F.dat Object is locked skipped
C:\found.000\dir0000.chk\392D4221.wmf Object is locked skipped
C:\found.000\dir0000.chk\3A2F7142.wmf Object is locked skipped
C:\found.000\dir0000.chk\40FE3BA8.wmf Object is locked skipped
C:\found.000\dir0000.chk\47AC0CCB.wmf Object is locked skipped
C:\found.000\dir0000.chk\4C454F83.wmf Object is locked skipped
C:\found.000\dir0000.chk\53899D6D.dat Object is locked skipped
C:\found.000\dir0000.chk\611B1E14.wmf Object is locked skipped
C:\found.000\dir0000.chk\64DE81AE.wmf Object is locked skipped
C:\found.000\dir0000.chk\6A1F27F6.wmf Object is locked skipped
C:\found.000\dir0000.chk\6A8208FD.wmf Object is locked skipped
C:\found.000\dir0000.chk\6C15F789.wmf Object is locked skipped
C:\found.000\dir0000.chk\70A88850.wmf Object is locked skipped
C:\found.000\dir0000.chk\70F5E9D7.wmf Object is locked skipped
C:\found.000\dir0000.chk\725970C4.wmf Object is locked skipped
C:\found.000\dir0000.chk\725B6C8A.dat Object is locked skipped
C:\found.000\dir0000.chk\749CD1F5.wmf Object is locked skipped
C:\found.000\dir0000.chk\7DA5A528.dat Object is locked skipped
C:\found.000\dir0000.chk\821F5309.dat Object is locked skipped
C:\found.000\dir0000.chk\8DA789EC.wmf Object is locked skipped
C:\found.000\dir0000.chk\94F32F99.wmf Object is locked skipped
C:\found.000\dir0000.chk\9D507C37.dat Object is locked skipped
C:\found.000\dir0000.chk\AC507F05.wmf Object is locked skipped
C:\found.000\dir0000.chk\AC7FDFF8.wmf Object is locked skipped
C:\found.000\dir0000.chk\BD844113.wmf Object is locked skipped
C:\found.000\dir0000.chk\CD36F380.dat Object is locked skipped
C:\found.000\dir0000.chk\CD8C3947.wmf Object is locked skipped
C:\found.000\dir0000.chk\D0B334BA.dat Object is locked skipped
C:\found.000\dir0000.chk\D55D7F03.dat Object is locked skipped
C:\found.000\dir0000.chk\E01D08BB.dat Object is locked skipped
C:\found.000\dir0000.chk\E15C70F4.dat Object is locked skipped
C:\found.000\dir0000.chk\E236CE0F.wmf Object is locked skipped
C:\found.000\dir0000.chk\E3E72A5D.dat Object is locked skipped
C:\found.000\dir0000.chk\E6E0329C.wmf Object is locked skipped
C:\found.000\dir0000.chk\E88B4772.wmf Object is locked skipped
C:\found.000\dir0000.chk\EAFB0C5B.wmf Object is locked skipped
C:\found.000\dir0000.chk\F1D822DE.wmf Object is locked skipped
C:\found.000\dir0000.chk\FCE2258E.dat Object is locked skipped
C:\found.000\dir0000.chk\FEC8B9ED.wmf Object is locked skipped
C:\Program Files\HP\hpcoretech\hpcmerr.log Object is locked skipped
C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.614 skipped
C:\QooBox\Quarantine\C\Program Files\Internet Explorer\mesoxida83122.dll.vir Infected: not-a-virus:AdWare.Win32.TTC.b skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\G1\kmhp83122.exe.vir/data0002 Infected: not-a-virus:AdWare.Win32.TTC.b skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\G1\kmhp83122.exe.vir NSIS: infected - 1 skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\khfcaxu.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\mlljk.dll.vir.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.lc skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ssqpmkl.dll.vir.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\QooBox\Quarantine\C\WINDOWS\TISKY009.exe.vir Infected: not-a-virus:AdWare.Win32.ZenoSearch.o skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\tracking.log Object is locked skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP489\A0074564.exe Object is locked skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP490\A0074591.exe Object is locked skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP490\A0074596.exe Object is locked skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP491\A0074617.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP491\A0074618.dll Object is locked skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP491\A0074630.exe Object is locked skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP491\A0074634.dll Infected: not-a-virus:AdWare.Win32.Agent.co skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP491\A0074635.exe Object is locked skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP491\A0074688.exe Object is locked skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP491\A0074689.exe Object is locked skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP492\A0074904.exe Object is locked skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP492\A0074905.exe Object is locked skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP492\A0074906.EXE Object is locked skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP492\A0074910.exe Object is locked skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP492\A0074911.exe Object is locked skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP492\A0074912.exe Object is locked skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP492\A0074913.exe Object is locked skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP492\A0074914.exe Object is locked skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP492\A0074915.exe Object is locked skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP492\A0074916.exe Object is locked skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP492\A0074917.exe Object is locked skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP492\A0074918.exe Object is locked skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP492\A0074919.exe Object is locked skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP492\A0074920.exe Object is locked skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP492\A0074935.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP492\A0074936.dll Object is locked skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP498\A0076112.dll Infected: not-a-virus:AdWare.Win32.TTC.b skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP498\A0076114.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP498\A0076118.exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.b skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP498\A0076118.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP498\A0076120.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.o skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP499\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\atapi.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
Scan process completed.
ComboFix 07-08-08 - "McFly" 2007-08-08 18:51:29.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.115 [GMT -4:00]
Command switches used :: C:\Documents and Settings\McFly\Desktop\CFScript.txt
* Created a new restore point
FILE::
C:\Program Files\Common Files\rtene.html
C:\WINDOWS\system32\mlljk.dll.vir
C:\WINDOWS\system32\ssqpmkl.dll.vir
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-1742787390.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-1889913829.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-1928298226.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-469110455.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-471042242.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-506560168.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\1100213708.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\1206843932.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\2018687529.mtz
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\526287387.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\742448649.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\881760086.mtz
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\951693623.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\URLCache.ini
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-1224066126.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-2052203769.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-472782950.swf
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-536240057.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-543113937.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-622652813.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-955587560.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\1538491181.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\219363863.swf
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\497038039.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\638221729.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\URLCache.ini
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1115888183.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1769187361.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1828200587.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-2125218060.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-400313819.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-713993862.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\1097569047.mtz
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\2060262678.swf
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\2067265559.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\222539927.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\407034558.ini
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\617922566.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\URLCache.ini
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-1264736206.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-1593795534.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-1680656292.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-1731014742.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-1889913838.mtz
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-643896300.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\1097569052.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\1226721769.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\1479135848.mzv
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\1804118651.swf
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\1850125133.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\2115019120.mts
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\950776753.mzv
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\URLCache.ini
C:\DOCUME~1\McFly\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\UpdateVersionList_v2.mtx
C:\Program Files\Viewpoint
C:\VundoFix Backups
C:\WINDOWS\system32\mlljk.dll.vir
C:\WINDOWS\system32\ssqpmkl.dll.vir
((((((((((((((((((((((((( Files Created from 2007-07-08 to 2007-08-08 )))))))))))))))))))))))))))))))
2007-08-08 06:35 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-07 19:21 <DIR> d-------- C:\hijackthis
2007-07-30 23:44 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-07-30 19:40 <DIR> d-------- C:\Program Files\Lavasoft
2007-07-30 19:39 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-07-30 19:35 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-07-29 07:05 <DIR> d-------- C:\Temp
2007-07-14 08:12 <DIR> d-------- C:\DOCUME~1\McFly\APPLIC~1\Move Networks
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-08-08 07:42 --------- d-------- C:\Program Files\Iron Mountain
2007-06-29 18:48 --------- d-------- C:\DOCUME~1\McFly\APPLIC~1\AdobeUM
2007-06-24 20:11 --------- d-------- C:\Program Files\EPSON
2007-06-24 20:08 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-06-24 20:08 --------- d-------- C:\Program Files\ArcSoft
2007-06-24 20:06 --------- d-------- C:\Program Files\EPSON Print CD
2007-06-14 20:58 --------- d-------- C:\Program Files\Microsoft Works
2007-06-14 20:57 --------- d-------- C:\Program Files\MSBuild
2007-06-09 12:08 --------- d-------- C:\Program Files\HP
2007-06-09 06:49 --------- d-------- C:\Program Files\America Online 9.0
2007-05-16 11:12 86528 --------- C:\WINDOWS\system32\dllcache\directdb.dll
2007-05-16 11:12 85504 --------- C:\WINDOWS\system32\dllcache\wabimp.dll
2007-05-16 11:12 683520 --a------ C:\WINDOWS\system32\inetcomm.dll
2007-05-16 11:12 683520 --------- C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-05-16 11:12 510976 --------- C:\WINDOWS\system32\dllcache\wab32.dll
2007-05-16 11:12 1314816 --------- C:\WINDOWS\system32\dllcache\msoe.dll
2007-05-08 05:24 3583488 --a------ C:\WINDOWS\system32\dllcache\mshtml.dll
2007-01-25 10:14 563712 --a------ C:\WINDOWS\java\gotomypc_370.exe
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-06-17 16:48]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-06-17 16:43]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 04:01]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-04 18:40]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-04 18:38]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2005-01-12 15:54]
"DXDllRegExe"="dxdllreg.exe" []
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2004-04-30 13:32]
"eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [2006-04-18 10:32]
"\\MCFLY\EPSON Stylus Photo R300 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.exe" [2003-06-04 03:00]
"Auto EPSON Stylus Photo R300 Series on MCFLY"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.exe" [2003-06-04 03:00]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 20:52]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2005-08-23 10:52]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 17:48]
"CoolSwitch"="C:\WINDOWS\system32\taskswitch.exe" [2002-03-19 17:30]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]
"Zune Launcher"="C:\Program Files\Zune\ZuneLauncher.exe" [2006-12-12 15:45]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-01 16:51]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-07-31 20:20]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BackupNotify"="C:\Program Files\HP\Digital Imaging\bin\backupnotify.exe" []
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-04-27 17:17]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-08 23:42]
"EPSON Stylus Photo R380 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBOA.exe" [2006-05-29 04:00]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:00]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2005-02-14 10:45:38]
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-01-20 14:12:17]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 04:44:06]
Iron Mountain TaskBar Icon.LNK - C:\Program Files\Iron Mountain\CBSysTray.exe [2006-12-18 20:02:30]
R0 a347bus;a347bus;C:\WINDOWS\system32\DRIVERS\a347bus.sys
R0 a347scsi;a347scsi;C:\WINDOWS\system32\Drivers\a347scsi.sys
R1 eabfiltr;EABFiltr;\??\C:\WINDOWS\system32\drivers\EABFiltr.sys
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI;C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
R3 Afc;PPdus ASPI Shell;C:\WINDOWS\system32\drivers\Afc.sys
R3 CAMCAUD;Conexant AMC 3D Environmental Audio;C:\WINDOWS\system32\drivers\camcaud.sys
R3 CAMCHALA;CAMCHALA;C:\WINDOWS\system32\drivers\camchal.sys
R3 HSFHWICH;HSFHWICH;C:\WINDOWS\system32\DRIVERS\HSFHWICH.sys
R3 sdbus;sdbus;C:\WINDOWS\system32\DRIVERS\sdbus.sys
R3 tifm21;tifm21;C:\WINDOWS\system32\drivers\tifm21.sys
R3 w22n51;Intel(R) PRO/Wireless 2200 Adapter Driver;C:\WINDOWS\system32\DRIVERS\w22n51.sys
R3 wanatw;WAN Miniport (ATW);C:\WINDOWS\system32\DRIVERS\wanatw4.sys
S3 Bridge;MAC Bridge;C:\WINDOWS\system32\DRIVERS\bridge.sys
S3 BridgeMP;MAC Bridge Miniport;C:\WINDOWS\system32\DRIVERS\bridge.sys
S3 eabusb;eabusb;\??\C:\WINDOWS\system32\drivers\eabusb.sys
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service;"C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe"
S3 MSDV;Microsoft DV Camera and VCR;C:\WINDOWS\system32\DRIVERS\msdv.sys
S3 odserv;Microsoft Office Diagnostics Service;"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE"
S3 P2k;Motorola iDEN P2k Device;C:\WINDOWS\system32\DRIVERS\P2k.sys
S3 usbser;Motorola USB Modem Driver;C:\WINDOWS\system32\DRIVERS\usbser.sys
Contents of the 'Scheduled Tasks' folder
2007-08-03 17:28:21 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
**************************************************************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-08-08 19:01:40
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden registry entries ...
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}]
"DisplayName"="Alcohol 120(Trial Version)"
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"\\\\MCFLY\\EPSON Stylus Photo R300 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S4I2F1.EXE /P38 \"\\\\MCFLY\\EPSON Stylus Photo R300 Series\" /O6 \"USB001\" /M \"Stylus Photo R300\""
Completion time: 2007-08-08 19:07:38 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-08 19:05
C:\ComboFix2.txt ... 2007-08-08 18:33
--- E O F ---