Welcome to Tech Support Forum home to more then 136,000 problems solved. Issues have included: Spyware, Malware, Virus Issues, Windows, Microsoft, Linux, Networking, Security, Hardware, and Gaming Getting your problem solved is as easy as:
1. Registering for a free account
2. Asking your question
3. Receiving an answer

Registered members:
* Get free support
* Communicate privately with other members (PM).
* Removal of this message
* See fewer ads.
* And much more..

 




Want to know how to post a question? click here Having problems with spyware and pop-ups? First Steps
Go Back   Tech Support Forum > Security Center > HijackThis Log Help > Resolved HJT Threads
Browser's got mind of own Browser's got mind of own
User Name
Password
Site Map Register Donate Rules Blogs Mark Forums Read

Resolved HJT Threads Resolved spyware and popup issues.

 
Page 2 of 2 < 1 2
 
Thread Tools
Old 01-10-2008, 10:49 PM   #21 (permalink)
TSF Enthusiast
 
Cathy95820's Avatar
 
Join Date: Dec 2007
Location: Sacramento, CA
Posts: 1,069
OS: Windows XP Svs.Pk 2


Re: Browser's got mind of own
Quick question re: Kapersky's........The scan requires me to download the program first? or am I on the wrong page? http://www.kaspersky.com/virusscanner

tx

Cathy
Cathy95820 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 01-11-2008, 06:28 AM   #22 (permalink)
TSF Enthusiast
 
Cathy95820's Avatar
 
Join Date: Dec 2007
Location: Sacramento, CA
Posts: 1,069
OS: Windows XP Svs.Pk 2


Re: Browser's got mind of own
OOOPSIE

NEVER MIND

Having a blonde moment lol
Cathy95820 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 01-11-2008, 04:43 PM   #23 (permalink)
TSF Enthusiast
 
Cathy95820's Avatar
 
Join Date: Dec 2007
Location: Sacramento, CA
Posts: 1,069
OS: Windows XP Svs.Pk 2


Re: Browser's got mind of own
Well, ..... here I am again........back to original question about being on the right page.

I tried to download Kapernsky ... first time I downloaded and tried to open it I rec'd error that the file was incomplete and to download a new copy (it was 800 + kbs vs 23. mbytes.... second time I now have 1.09 mbytes.

I must be at the wrong place or doin wrong thing....will stand by for assistance from you. Sorry this is draggin out so long. I live w/daughter and her 4 kids 11-2 yrs old and now other daughters kids are here too (7 total from 11-2..... And lucky me ... I'm the caregiver for the whole crew. aaaaaaaaaaahhhhhhhhhhh lol I thought my 2 kids were plenty when they were little. Dang havin 7 is crazy. Dont know how moms and dads with huge families do it.

so have to bounce between being grandma and tryin to get my "best friend" back in good running condition. So far the kids are winning.

Tx,

Cathy
Cathy95820 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 01-12-2008, 12:13 PM   #24 (permalink)
Moderator, Analyst, Security Team
 
TheBruce1's Avatar
 
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 3,247
OS: XP


Re: Browser's got mind of own
Hi Cathy


Sounds like you have your hands full

Try this link http://www.kaspersky.com/kos/eng/par...avwebscan.html
__________________
Member of ASAP since 2007
Member of UNITE since 2008

**Notice to BT customers**
Trial of BT-Phorm spyware to start 30th September, 2008- for more information please visit No DPI website for more information.



Phorm, previously known as 121Media were responsible for the Apropos rootkit, see Here for more information on said rootkit.


If we have helped you in anyway,please consider Donating
TheBruce1 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 01-15-2008, 04:49 AM   #25 (permalink)
TSF Enthusiast
 
Cathy95820's Avatar
 
Join Date: Dec 2007
Location: Sacramento, CA
Posts: 1,069
OS: Windows XP Svs.Pk 2


Re: Browser's got mind of own
ComboFix 08-01-10.2 - Owner 2008-01-13 2:31:56.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.207 [GMT -8:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\bxfyfljo.ini
C:\WINDOWS\system32\dbfcorhu.ini
C:\WINDOWS\system32\eberbccb.ini
C:\WINDOWS\system32\faiojgdt.ini
C:\WINDOWS\system32\fouqajtg.ini
C:\WINDOWS\system32\glfmqyao.ini
C:\WINDOWS\system32\ibhpgsvl.ini
C:\WINDOWS\system32\nxliejyw.ini
C:\WINDOWS\system32\ojhowwbf.ini
C:\WINDOWS\system32\pmbmaptv.ini
C:\WINDOWS\system32\qirkmmnd.ini
C:\WINDOWS\system32\qrttpdyd.ini
C:\WINDOWS\system32\rciuauvj.ini
C:\WINDOWS\system32\xitkkwoy.ini

.
((((((((((((((((((((((((( Files Created from 2007-12-13 to 2008-01-13 )))))))))))))))))))))))))))))))
.

2008-01-11 05:30 . 2008-01-11 05:30 <DIR> d-------- C:\KAV
2008-01-10 15:49 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-09 17:24 . 2008-01-09 17:24 <DIR> d-------- C:\Program Files\Learn2.com
2008-01-09 17:24 . 2008-01-09 17:41 <DIR> d-------- C:\Program Files\AOL Companion
2008-01-09 17:24 . 2008-01-09 17:24 <DIR> d-------- C:\Install Winamp
2008-01-09 17:24 . 2008-01-09 17:24 <DIR> d-------- C:\Install ICQ
2008-01-09 17:24 . 2008-01-09 17:24 <DIR> d-------- C:\Install AOL Communicator
2008-01-09 17:23 . 2008-01-09 17:23 <DIR> d-------- C:\Program Files\Viewpoint
2008-01-09 17:23 . 2003-09-24 11:42 153,088 --a------ C:\WINDOWS\system32\jgdwmie.dll
2008-01-09 17:23 . 2003-09-24 11:41 24,660 --a------ C:\WINDOWS\system32\aolddial.dll
2008-01-09 17:22 . 2008-01-09 17:24 <DIR> d-------- C:\Program Files\Common Files\aolshare
2008-01-09 17:22 . 2008-01-13 02:31 <DIR> d-------- C:\Program Files\America Online 9.0
2008-01-09 17:22 . 2003-08-27 10:27 65,536 --a------ C:\WINDOWS\wanmpsvc.exe
2008-01-09 00:41 . 2008-01-09 00:41 <DIR> d-------- C:\Program Files\Studio 3
2008-01-09 00:30 . 2008-01-09 00:30 <DIR> d-------- C:\WINDOWS\databecker222ceprog01
2008-01-08 22:16 . 2008-01-09 17:24 <DIR> d-------- C:\WINDOWS\occache
2008-01-08 22:15 . 2003-05-30 13:46 1,706,800 --a------ C:\WINDOWS\system32\gdiplus.dll
2008-01-08 22:15 . 2003-01-10 17:13 33,588 --a------ C:\WINDOWS\system32\drivers\wanatw4.sys
2008-01-08 09:58 . 2008-01-08 09:58 <DIR> d-------- C:\Program Files\NaturalSoft
2008-01-08 09:49 . 2008-01-08 09:49 <DIR> d-------- C:\Program Files\Camtech
2008-01-01 06:39 . 2008-01-01 08:25 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2007-12-28 21:19 . 2007-12-28 21:19 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2007-12-28 21:19 . 2007-12-28 21:19 <DIR> d-------- C:\Program Files\Common Files\Java
2007-12-21 16:51 . 2007-12-21 16:51 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-21 13:58 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\system32\drivers\SDTHOOK.SYS
2007-12-21 13:58 . 2007-06-08 09:44 8,576 --a------ C:\WINDOWS\system32\drivers\cwlygpipemsm.sys
2007-12-20 22:24 . 2007-12-21 14:57 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-12-20 22:24 . 2007-12-20 22:24 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2007-12-20 15:07 . 2007-12-20 15:07 294 --ahs---- C:\WINDOWS\system32\epnmvvnb.ini
2007-12-19 11:23 . 2007-12-20 08:41 <DIR> d-------- C:\Program Files\eMule
2007-12-17 18:06 . 2008-01-12 04:45 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-12-17 18:06 . 2007-12-17 18:06 1,409 --a------ C:\WINDOWS\QTFont.for
2007-12-16 04:56 . 2007-12-16 04:56 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\LEGO Company
2007-12-16 04:55 . 2007-12-20 08:41 <DIR> d-------- C:\Program Files\LEGO Company
2007-12-16 00:50 . 2007-12-16 00:50 <DIR> d-------- C:\Program Files\Pivot Stickfigure Animator
2007-12-16 00:49 . 2007-12-17 18:05 <DIR> d-------- C:\Program Files\Desktop Graffitist
2007-12-14 18:40 . 2007-12-14 18:40 <DIR> d-------- C:\Program Files\SpywareBlaster

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-12 12:41 --------- d-----w C:\Program Files\Common Files\AOL
2008-01-10 10:42 --------- d-----w C:\Program Files\Java
2008-01-10 01:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-01-10 01:11 --------- d-----w C:\Program Files\AOL Pictures
2008-01-09 06:17 --------- d-----w C:\Program Files\Common Files\aolback
2008-01-09 06:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2007-12-21 22:40 --------- d-----w C:\Program Files\Google
2007-12-21 22:40 --------- d-----w C:\Program Files\Digital Media Reader
2007-12-20 16:42 --------- d-----w C:\Program Files\SpiderSol Buddy Pogo
2007-12-20 16:32 --------- d-----w C:\Program Files\TypeItIn
2007-12-11 21:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-04 21:47 --------- d-----w C:\Documents and Settings\Owner\Application Data\FrostWire
2007-12-04 17:57 --------- d-----w C:\Documents and Settings\Owner\Application Data\LimeWire
2007-11-25 07:20 --------- d-----w C:\Program Files\PeoplePC
2007-11-25 05:38 --------- d-----w C:\Program Files\Oberon Media
2007-11-25 04:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee.com
2007-11-25 04:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2007-11-25 04:47 --------- d-----w C:\Program Files\PeoplePC Accelerated(2)
2007-11-17 13:52 --------- d-----w C:\Program Files\LimeWire
2007-11-16 17:29 806 ----a-w C:\Documents and Settings\Owner\Application Data\wklnhst.dat
2007-11-16 13:39 932 ----a-w C:\WINDOWS\Fonts\font.txt
2007-11-16 00:26 --------- d-----w C:\Program Files\McAfee.com
2007-11-16 00:22 --------- d-----w C:\Program Files\McAfee
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-28 01:40 227,328 ----a-w C:\WINDOWS\system32\wmasf.dll
2004-11-25 06:55 70 ----a-w C:\Program Files\SerialInfo.txt
2004-08-11 22:15 1,867,768 ----a-r C:\Program Files\autorun.exe
2004-07-28 22:53 22,486 ----a-r C:\Program Files\autorun.ico
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A8FB8EB3-183B-4598-924D-86F0E5E37085}]
2006-01-24 15:07 220672 --a------ C:\Program Files\PeoplePC\Toolbar\PPCToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11D4-9B18-009027A5CD4F}
{A8FB8EB3-183B-4598-924D-86F0E5E37085}

[HKEY_CLASSES_ROOT\clsid\{a8fb8eb3-183b-4598-924d-86f0e5e37085}]
[HKEY_CLASSES_ROOT\PeoplePal Toolbar]
[HKEY_CLASSES_ROOT\TypeLib\{994D628D-4D22-4DB9-B6DB-F7D9F1635817}]
[HKEY_CLASSES_ROOT\PeoplePal Toolbar]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{A8FB8EB3-183B-4598-924D-86F0E5E37085}"= C:\Program Files\PeoplePC\Toolbar\PPCToolbar.dll [2006-01-24 15:07 220672]

[HKEY_CLASSES_ROOT\clsid\{a8fb8eb3-183b-4598-924d-86f0e5e37085}]
[HKEY_CLASSES_ROOT\PeoplePal Toolbar]
[HKEY_CLASSES_ROOT\TypeLib\{994D628D-4D22-4DB9-B6DB-F7D9F1635817}]
[HKEY_CLASSES_ROOT\PeoplePal Toolbar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 08:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 11:00 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-18 20:52 68856]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2006-10-24 16:10 4662776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunKistEM"="C:\Program Files\Digital Media Reader\shwiconem.exe" [2004-11-15 14:04 135168]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 19:24 32768]
"VTTimer"="VTTimer.exe" [2005-03-08 02:33 53248 C:\WINDOWS\system32\VTTimer.exe]
"Recguard"="%WINDIR%\SMINST\RECGUARD.EXE" [ ]
"AOL Spyware Protection"="C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe" [2004-10-18 16:42 79448]
"SoundMan"="SOUNDMAN.EXE" [2003-12-09 10:17 67584 C:\WINDOWS\SOUNDMAN.EXE]
"MCAgentExe"="C:\Program Files\mcafee.com\Agent\mcagent.exe" [2005-09-22 18:29 303104]
"MCUpdateExe"="c:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 12:05 212992]
"_AntiSpyware"="c:\progra~1\mcafee\MCAFEE~1\masalert.exe" [2006-01-06 15:14 327680]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-07-29 04:27 98304]
"AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [ ]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-08-25 08:27 185632]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"OOBEDDDemise"="cmd /x /c erase C:\WINDOWS\System32\oobe\msoobe.exe" [ ]

C:\Documents and Settings\Owner\Start Menu\Programs\Startup\
TypeItIn.lnk - C:\Program Files\TypeItIn\TypeItIn.exe [2007-12-04 00:07:54]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
America Online 9.0 Tray Icon.lnk - C:\Program Files\America Online 9.0\aoltray.exe [2008-01-09 17:23:04]
AOL Companion.lnk - C:\Program Files\AOL Companion\companion.exe [2008-01-09 17:24:03]
Printkey2000.lnk - C:\Program Files\PrintKey2000\Printkey2000.exe [2007-01-17 17:45:47]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\khfgfdb]
khfgfdb.dll

R1 ATMhelpr;ATMhelpr;C:\WINDOWS\system32\drivers\ATMhelpr.sys [1997-06-17 04:00]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4021e6df-0a2a-11da-b762-806d6172696f}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{deff3a65-0821-11da-8b7d-806d6172696f}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-13 02:34:44
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
OOBEDDDemise = cmd /x /c erase C:\WINDOWS\System32\oobe\msoobe.exe??????????????????????C?w????????????????????????? ??`???????????i?wis???????????H???????????????????????????*&?|l????&?|??-w?????????????????????????????????????`??????????????`??????????????|?&?|?????&?|B%?|???????????????????|?$?|??????-wC

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-13 2:35:13
ComboFix-quarantined-files.txt 2008-01-13 10:34:59
ComboFix2.txt 2008-01-11 00:01:48
ComboFix3.txt 2007-12-29 04:15:54
ComboFix4.txt 2007-12-29 03:58:19
ComboFix5.txt 2007-12-28 11:30:58
.
2008-01-10 11:02:51 --- E O F ---

KASPERSKY ONLINE SCANNER REPORT
Monday, January 14, 2008 4:40:22 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 14/01/2008
Kaspersky Anti-Virus database records: 511465


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\
E:\
F:\
G:\
H:\
I:\

Scan Statistics
Total number of scanned objects 76599
Number of viruses found 6
Number of infected objects 82
Number of suspicious objects 0
Duration of the scan process 01:03:30

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\AOL\ACS\1.0\ph Object is locked skipped

C:\Documents and Settings\All Users\Application Data\AOL\ACS\1.0\variable Object is locked skipped

C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0\idb\Apps.Lst Object is locked skipped

C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0\idb\main.idx Object is locked skipped

C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0\idb\sap.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0\idb\spool.lst Object is locked skipped

C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0\idb\STYLE.LST Object is locked skipped

C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0\idb\sysnews.lst Object is locked skipped

C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0\idb\Toolbar.lst Object is locked skipped

C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0\organize\gma2the7pwr Object is locked skipped

C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0\organize\gma2the7pwr.abi Object is locked skipped

C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0\organize\gma2the7pwr.aby Object is locked skipped

C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0\ShopAssist\DataStore\global\clientcache.adb Object is locked skipped

C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0\ShopAssist\DataStore\users\Gma2the7pwr.adb Object is locked skipped

C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0\storage\cache.db Object is locked skipped

C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0\storage\server.lock Object is locked skipped

C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0\storage\stderr.txt Object is locked skipped

C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0\storage\stdout.txt Object is locked skipped

C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Logs\TaskScheduler\McTskshd001.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\Owner\Desktop\musicbooboo\01 Track 1.wma Infected: Trojan-Downloader.WMA.Wimad.l skipped

C:\Documents and Settings\Owner\Desktop\musicbooboo\02 Track 2.wma Infected: Trojan-Downloader.WMA.Wimad.l skipped

C:\Documents and Settings\Owner\Desktop\musicbooboo\03 Track 3.wma Infected: Trojan-Downloader.WMA.Wimad.l skipped

C:\Documents and Settings\Owner\Desktop\musicbooboo\07 Track 7.wma Infected: Trojan-Downloader.WMA.Wimad.l skipped

C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Owner\ntuser.dat Object is locked skipped

C:\Documents and Settings\Owner\ntuser.dat.LOG Object is locked skipped

C:\Program Files\Common Files\AOL\ACS\US\static Object is locked skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\bsxoiqxu.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\cilocdxa.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\cslhdsjl.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\cvoxtele.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\cvuwqxlf.exe.vir Infected: Trojan-Downloader.Win32.Agent.gwe skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\dgeuybit.exe.vir Infected: Trojan-Downloader.Win32.Agent.gwe skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\dwhbladv.exe.vir Infected: Trojan-Downloader.Win32.Agent.gwe skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\eqxkqpet.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\eyevjbec.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\fxjqdsej.dll.vir Infected: not-a-virus:AdWare.Win32.SecToolBar.k skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\gfyywljj.exe.vir Infected: Trojan-Downloader.Win32.Agent.gwe skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\hoveapaa.exe.vir Infected: Trojan-Downloader.Win32.Agent.gwe skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\iuauuodu.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\joxyydpu.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\jwibkthg.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\lscdmhbo.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\nfjwlcdd.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\nqwcuqgp.exe.vir Infected: Trojan-Downloader.Win32.Agent.gwe skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\nvuvixxf.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.din skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\okqhrgsm.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\otajlvse.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\pmdxovpr.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\qjojhegs.exe.vir Infected: Trojan-Downloader.Win32.Agent.gwe skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\thtukqsq.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\tjhxvspw.exe.vir Infected: Trojan-Downloader.Win32.Agent.gwe skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\tmvroawd.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\twgseiqt.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\txehjesu.exe.vir Infected: Trojan-Downloader.Win32.Agent.gwe skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\ufqundev.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\uxedqvtq.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\vdayujmq.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\vjbxjdhr.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.din skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\vylelfgy.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\wccvmduu.exe.vir Infected: Trojan-Downloader.Win32.Agent.gwe skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\wdctanpw.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\wlcqqcmh.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\xuhfirpx.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\yvkotimc.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.din skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\yymvbwad.exe.vir Infected: Trojan-Downloader.Win32.Agent.gwe skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089294.exe Infected: Trojan-Downloader.Win32.Agent.gwe skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089295.exe Infected: Trojan-Downloader.Win32.Agent.gwe skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089296.exe Infected: Trojan-Downloader.Win32.Agent.gwe skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089297.exe Infected: Trojan-Downloader.Win32.Agent.gwe skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089298.exe Infected: Trojan-Downloader.Win32.Agent.gwe skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089299.exe Infected: Trojan-Downloader.Win32.Agent.gwe skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089300.exe Infected: Trojan-Downloader.Win32.Agent.gwe skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089301.exe Infected: Trojan-Downloader.Win32.Agent.gwe skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089302.exe Infected: Trojan-Downloader.Win32.Agent.gwe skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089303.exe Infected: Trojan-Downloader.Win32.Agent.gwe skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089304.exe Infected: Trojan-Downloader.Win32.Agent.gwe skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089307.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089308.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089310.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089311.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089314.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089315.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089316.dll Infected: not-a-virus:AdWare.Win32.SecToolBar.k skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089317.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089318.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089319.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089320.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089321.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089322.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.din skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089323.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089324.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089325.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089327.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089328.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089329.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089330.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089334.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089335.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089337.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.din skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089338.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089339.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089340.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089341.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP402\A0089342.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.din skipped

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP405\change.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\Internet.evt Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.
of Trend Micro HijackThis v2.0.2
Scan saved at 3:49:30 AM, on 1/15/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\VTTimer.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\progra~1\mcafee\MCAFEE~1\masalert.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\America Online 9.0\aoltray.exe
C:\Program Files\AOL Companion\companion.exe
C:\Program Files\PrintKey2000\Printkey2000.exe
C:\Program Files\TypeItIn\TypeItIn.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\America Online 9.0\waol.exe
C:\Program Files\America Online 9.0\shellmon.exe
C:\Program Files\America Online 9.0\aolwbspd.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.greatdaygames.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: PeoplePC ScamGuard - {7E3659A6-4BC5-4d93-B3FD-8B5ACC2FEDED} - C:\Program Files\PeoplePC\Toolbar\ScamGrd.dll
O2 - BHO: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - C:\Program Files\PeoplePC\Toolbar\PPCToolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - C:\Program Files\PeoplePC\Toolbar\PPCToolbar.dll
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [MCAgentExe] C:\Program Files\mcafee.com\Agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [_AntiSpyware] c:\progra~1\mcafee\MCAFEE~1\masalert.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [OOBEDDDemise] cmd /x /c erase C:\WINDOWS\System32\oobe\msoobe.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - Startup: TypeItIn.lnk = C:\Program Files\TypeItIn\TypeItIn.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: Printkey2000.lnk = C:\Program Files\PrintKey2000\Printkey2000.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.aol.com
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10...I.cab55579.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {26FCCDF9-A7E1-452A-A73D-7BF7B4D0BA6C} (AOL Pictures Uploader Class) - http://o.aolcdn.com/pictures/ap/Reso...s.10.5.0.4.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} (PogoWebLauncher Control) - http://www.pogo.com/cdl/launcher/Pog...rInstaller.CAB
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10...y.cab55579.cab
O16 - DPF: {40AC0F29-DF27-4711-B279-48B1F83A66AB} (AtlBoxWordCtlAttrib Class) - http://kraisoft.com/files/online/aquacade.cab
O16 - DPF: {41ACD49D-1974-791A-0981-AA9872721044} (Ganymede Board Games) - http://67.15.101.3/g_bin/eng/boards_2_0_0_34.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10...t.cab55579.cab
O16 - DPF: {6FE79ACA-A498-45E5-8BC4-1B9F380CE468} (Abx(gh) Control) - http://aolsvc.aol.com/onlinegames/qadummy/abxgh.cab
O16 - DPF: {7CCAD6DD-DD0B-440B-91FF-7670F5AADC21} (SpinTop Games Launcher) - http://aolsvc.aol.com/onlinegames/fr...esLauncher.cab
O16 - DPF: {9085316E-42BA-11D4-BAA3-0080C8D7ED4A} (GameDesire JungleHunter) - http://67.15.101.3/g_bin/eng/hunter_2_0_0_26.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {A1FE3DEF-CF77-11D4-8340-0080C8D7ED4A} (GameDesire Pinball Pirate) - http://67.15.101.3/g_bin/eng/pirate_2_0_0_29.cab
O16 - DPF: {A7196C8E-35A5-4FF0-9E46-E28918B5CAF6} (GameDesire Domino) - http://67.15.101.3/g_bin/eng/domino_2_0_0_33.cab
O16 - DPF: {A9ED6AA2-D9D4-4D71-9586-E293E2E3580B} (GameDesire Marbles&Diamonds&Runes) - http://67.15.101.3/g_bin/eng/marbles_2_0_0_31.cab
O16 - DPF: {AC120B1D-9411-4111-AF52-118052D85D45} (GameDesire Darts Games) - http://67.15.101.3/g_bin/eng/darts_2_0_0_40.cab
O16 - DPF: {AD7013FF-1D9A-4F36-94A6-3CD408A663F9} (GameDesire BreakOut) - http://67.15.101.3/g_bin/eng/breakout_2_0_0_28.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab
O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - http://aolsvc.aol.com/onlinegames/fr...g.1.0.0.33.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/sh...26/mcgdmgr.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://aolsvc.aol.com/onlinegames/gh...ylomplayer.cab
O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames...l.cab56649.cab
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/bingame/pacz/def...andaonline.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10...y.cab55579.cab
O16 - DPF: {E23FABEE-12E3-33DA-DA12-195DAC123984} (GameDesire Mahjong) - http://67.15.101.3/g_bin/eng/mahjong_2_0_0_29.cab
O16 - DPF: {FC4CAF5F-91BD-4DD9-ADC1-F3C737E37BC4} (CPlayFirstSweetopiaControl Object) - http://aolsvc.aol.com/onlinegames/fr...a.1.0.0.22.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C2} (GameDesire Pool 9) - http://67.15.101.3/g_bin/eng/billard9_2_0_0_32.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C4} (GameDesire Pool Training) - http://67.15.101.3/g_bin/eng/billardt_2_0_0_34.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{ABBCE440-EABF-420E-9E63-1AB382A9D8B6}: NameServer = 205.188.146.145
O20 - Winlogon Notify: khfgfdb - khfgfdb.dll (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 11398 bytes
Cathy95820 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 01-15-2008, 09:36 AM   #26 (permalink)
Moderator, Analyst, Security Team
 
TheBruce1's Avatar
 
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 3,247
OS: XP


Re: Browser's got mind of own
Hi Cathy

Kaspersky found infected music files that will be removed using Combofix, Kaspersky flagged these infections as Trojan-Downloader.WMA.Wimad more information on this infection can be found Here .

Remember P2P programs such as Limewire maybe safe, but what you are download may not be the case.

================================

Open notepad and copy/paste the text in the quotebox below into it:

Quote:
KillAll::

File::
C:\Documents and Settings\Owner\Desktop\musicbooboo\01 Track 1.wma
C:\Documents and Settings\Owner\Desktop\musicbooboo\02 Track 2.wma
C:\Documents and Settings\Owner\Desktop\musicbooboo\03 Track 3.wma
C:\Documents and Settings\Owner\Desktop\musicbooboo\07 Track 7.wma
C:\WINDOWS\system32\epnmvvnb.ini

Folder::
C:\Program Files\Viewpoint
C:\Program Files\Common Files\Symantec Shared
C:\Documents and Settings\All Users\Application Data\Viewpoint
C:\Program Files\PeoplePC
C:\Program Files\PeoplePC Accelerated(2)

DirLook::
C:\WINDOWS\databecker222ceprog01


Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A8FB8EB3-183B-4598-924D-86F0E5E37085}]
[-HKEY_CLASSES_ROOT\clsid\{a8fb8eb3-183b-4598-924d-86f0e5e37085}]
[-HKEY_CLASSES_ROOT\PeoplePal Toolbar]
[-HKEY_CLASSES_ROOT\TypeLib\{994D628D-4D22-4DB9-B6DB-F7D9F1635817}]
[-HKEY_CLASSES_ROOT\PeoplePal Toolbar]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{A8FB8EB3-183B-4598-924D-86F0E5E37085}"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\khfgfdb]
Save this as CFscript






Refering to the picture above, drag CFscript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

===========================

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Updating Java:
  • Download the latest version of Java Runtime Environment (JRE) 6u4.
  • Scroll down to where it says "The Java SE Runtime Environment (JRE) allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • In the pull down menu next to Platform select Windows
  • Check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement"
  • Click Continue
  • Click on the link to download Windows Offline Installation and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u4-windowsi586-p.exe to install the newest version.

=========================

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

========================
Logs Required
C:\Combofix.txt
Hijackthis log
__________________
Member of ASAP since 2007
Member of UNITE since 2008

**Notice to BT customers**
Trial of BT-Phorm spyware to start 30th September, 2008- for more information please visit No DPI website for more information.



Phorm, previously known as 121Media were responsible for the Apropos rootkit, see Here for more information on said rootkit.


If we have helped you in anyway,please consider Donating
TheBruce1 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 01-18-2008, 02:24 AM   #27 (permalink)
TSF Enthusiast
 
Cathy95820's Avatar
 
Join Date: Dec 2007
Location: Sacramento, CA
Posts: 1,069
OS: Windows XP Svs.Pk 2


Re: Browser's got mind of own
Hey Bruce!

You are a mind reader too?! Wow! How did you know my java was messed up lol

But first, and with respect to the LimeWire and FrostWires. When I first learned about them I was excited and going for "old" 70's/80's tunes", but I assure you the "novelty" has worn off and I rarely use them anymore. Thank you for reminding me of their dangers. I will steer clear. The health of my computer is way more valuable than anything either p2p could offer.

I hope now the java is good, I am going to pogo now to check it out.

Here are the 2 scans/logs

ComboFix 08-01-10.2 - Owner 2008-01-17 21:36:51.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.232 [GMT -8:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFscript.txt
* Created a new restore point

FILE
C:\Documents and Settings\Owner\Desktop\musicbooboo\01 Track 1.wma
C:\Documents and Settings\Owner\Desktop\musicbooboo\02 Track 2.wma
C:\Documents and Settings\Owner\Desktop\musicbooboo\03 Track 3.wma
C:\Documents and Settings\Owner\Desktop\musicbooboo\07 Track 7.wma
C:\WINDOWS\system32\epnmvvnb.ini
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Viewpoint
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\ComponentRegistry.ini
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\HostRegistry.ini
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\MetaStreamConfig.ini
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\MetaStreamID.ini
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\MTSDownloadSites.txt
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-1054744159.mtx
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-1257552095.712536053
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-1476482372.712535979
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-1550700062.mtx
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-1675323418.713836840
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-1744624506.713836803
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-1767541886.713836716
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-1792851963.712535981
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-672059697.swf
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-681648789.swf
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-685991849.712535954
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-708065856.713836749
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-716026614.swf
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-722332322.swf
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-732913299.712536002
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-763019087.713836937
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-876210660.swf
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-96559883.mtx
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-982966253.swf
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\1359340714.swf
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\1461440338.712535953
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\1564877131.712535908
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\167327189.swf
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\385814962.712536011
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\501688438.712536046
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\7824269.swf
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\URLCache.ini
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-1041161462.mtx
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-1216699398.mtx
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-1588488936.swf
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-167467785.712535921
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-1697589072.swf
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-1735078747.713836821
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-2040853405.mtx
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-273135243.swf
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-378119151.712535947
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-583022627.712535910
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-64727112.swf
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-787478019.712535915
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-834282027.swf
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-982355842.712536070
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\1024896942.swf
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\1136233701.swf
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\1176327029.713836865
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\1220223377.712535992
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\1247495568.712535999
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\1304666343.712536034
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\2011164905.swf
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\2109637194.swf
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\244359852.swf
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\290547230.swf
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\346281577.713836896
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\512589962.712536028
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\570073743.713863076
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\683328582.swf
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\768763562.712535994
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\828983867.swf
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\860502393.712536026
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\925975223.mtx
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\URLCache.ini
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1140250495.713836908
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1149444489.712536068
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1219180738.713836830
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1270717649.mtx
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1438713594.mtx
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1610302144.712536009
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1651440994.712535931
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1679726538.swf
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1801392204.712535990
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1817435829.712536059
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1819899927.mtx
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-2034384745.713836872
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-207333975.mtx
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-2108356295.712535989
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-243470204.712536022
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-300725744.mtx
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-41890203.712536041
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-582640680.712536049
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-668285516.mtx
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-72580264.mtx
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-764272172.712535942
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-920335986.mtx
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-98025972.swf
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\1229517749.712535939
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\1385903037.713836769
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\143415706.712536017
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\1520622600.712535996
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\172992995.mtx
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\191653710.swf
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\346840136.mtx
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\407034558.ini
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\434599021.mtx
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experi