|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
Thread Tools |
06-27-2008, 12:56 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 7
OS: XP Home
|
Please Help
I think I may have a variety of problems. I tried to follow all of the steps listed above, but I'm having problems connecting to the internet, soI was unable to complete the Panda scan.
I've tried to attach some screenshots to some of the new things popping up. I'm not sure which ones are real and which ones are viruses, but I thought I would show everything I've seen. I tried to run Spybot S&D, and it finds several coolWWW searches, and it says it fixed them. But as soon as I run it again, the same things are listed. Any help would be greatly appreciated. Deckard's System Scanner v20071014.68 |
|
     |
|
06-30-2008, 02:38 PM
|
#3 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 7
OS: XP Home
|
Re: Please Help
bump...
still looking for a little help here. I run my Spybot S&D and it shows the following items fixed, but the just come right back the next time I run it. ClientMan Virtumonde.dll Smitfraud ToolbarCC CoolWWWSearch (Several different ones) Microsoft.WindowsSecurityCenter.TaskManager |
|
|
|
|
06-30-2008, 06:11 PM
|
#4 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 25,569
OS: 2000 Pro; XP Pro; XP Home
|
Re: Please Help
Hello, and Welcome to TSF.
Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. --------------------------------------------------------------------------------------------- Download ComboFix from Here: * IMPORTANT !!! Place combofix.exe on your Desktop We will first use ComboFix to install the Microsoft Windows Recovery Console. The Windows Recovery Console will allow you to boot up into a special recovery mode if needed. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.
Post the log from ComboFix when you've accomplished that, along with a new HijackThis log. If you have any questions along the way, STOP and ask them before proceeding.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you.  Our help is voluntary, but this site needs donations to operate.
Please consider Donating to the Forum. Please do not ask for help via Private Message. Ask in the forums, so all may gain from the experience. |
|
|
|
|
07-02-2008, 02:45 AM
|
#5 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 7
OS: XP Home
|
Re: Please Help
First off, thank you very much for taking the time to help me. I attached the logs as requested. log.txt was from the ComboFix log main.txt is from the DSS log I also attached a screenshot of some pop-ups that came up when ComboFix re-booted my machine. ComboFix 08-06-30.2 - Mark 2008-07-02 5:21:52.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.524 [GMT -4:00] Running from: C:\Documents and Settings\Mark\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Mark\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\AntiSpywareMaster C:\Program Files\AntiSpywareMaster\asm.exe C:\Temp\1cb C:\Temp\1cb\syscheck.log C:\temp\tn3 C:\WINDOWS\accesss.exe C:\WINDOWS\astctl32.ocx C:\WINDOWS\avpcc.dll C:\WINDOWS\BMa778fff6.txt C:\WINDOWS\clrssn.exe C:\WINDOWS\cookies.ini C:\WINDOWS\cpan.dll C:\WINDOWS\ctfmon32.exe C:\WINDOWS\ctrlpan.dll C:\WINDOWS\default.htm C:\WINDOWS\directx32.exe C:\WINDOWS\dnsrelay.dll C:\WINDOWS\editpad.exe C:\WINDOWS\explore.exe C:\WINDOWS\explorer32.exe C:\WINDOWS\funniest.exe C:\WINDOWS\funny.exe C:\WINDOWS\gfmnaaa.dll C:\WINDOWS\helpcvs.exe C:\WINDOWS\iedll.exe C:\WINDOWS\iexplorer.exe C:\WINDOWS\inetinf.exe C:\WINDOWS\internet.exe C:\WINDOWS\loader.exe C:\WINDOWS\msconfd.dll C:\WINDOWS\msspi.dll C:\WINDOWS\mssys.exe C:\WINDOWS\msupdate.exe C:\WINDOWS\mswsc10.dll C:\WINDOWS\mswsc20.dll C:\WINDOWS\mtwirl32.dll C:\WINDOWS\notepad32.exe C:\WINDOWS\olehelp.exe C:\WINDOWS\pskt.ini C:\WINDOWS\qttasks.exe C:\WINDOWS\quicken.exe C:\WINDOWS\rundll16.exe C:\WINDOWS\rundll32.vbe C:\WINDOWS\searchword.dll C:\WINDOWS\sistem.exe C:\WINDOWS\svchost32.exe C:\WINDOWS\svcinit.exe C:\WINDOWS\systeem.exe C:\WINDOWS\system32\_{a91550c1-2802-284b-4c9f-2bf554fe3791}.dll C:\WINDOWS\system32\CdKkRtwa.ini C:\WINDOWS\system32\CdKkRtwa.ini2 C:\WINDOWS\system32\cdmhospi.dll C:\WINDOWS\system32\drivers\intelidee.sys C:\WINDOWS\system32\f10 C:\WINDOWS\system32\f10\kscomdll3.exe C:\WINDOWS\system32\fMoVDJjl.ini C:\WINDOWS\system32\fMoVDJjl.ini2 C:\WINDOWS\system32\g46.exe C:\WINDOWS\system32\hljwugsf.bin C:\WINDOWS\system32\iyocnwmj.ini C:\WINDOWS\system32\jmwncoyi.dll C:\WINDOWS\system32\jvqjqgpg.dll C:\WINDOWS\system32\kpwnhyhc.dll C:\WINDOWS\system32\lsrulf.dll C:\WINDOWS\system32\lUttCJjl.ini C:\WINDOWS\system32\lUttCJjl.ini2 C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\MSINET.oca C:\WINDOWS\system32\msnav32.ax C:\WINDOWS\system32\olwwdeiv.dll C:\WINDOWS\system32\pac.txt C:\WINDOWS\system32\pewmuibb.ini C:\WINDOWS\system32\rwwnw64d.exe C:\WINDOWS\system32\tcntaxdm.exe C:\WINDOWS\system32\tcntrtdm.exe C:\WINDOWS\system32\vbqerees.ini C:\WINDOWS\system32\viedwwlo.ini C:\WINDOWS\system32\WFNUDJjl.ini C:\WINDOWS\system32\WFNUDJjl.ini2 C:\WINDOWS\system32\winpfz33.sys C:\WINDOWS\system32\xivivvjp.dll C:\WINDOWS\system32\xxywuUNE.dll C:\WINDOWS\system32\zxdnt3d.cfg C:\WINDOWS\systemcritical.exe C:\WINDOWS\time.exe C:\WINDOWS\users32.exe C:\WINDOWS\waol.exe C:\WINDOWS\win32e.exe C:\WINDOWS\win64.exe C:\WINDOWS\winajbm.dll C:\WINDOWS\window.exe C:\WINDOWS\winmgnt.exe C:\WINDOWS\x.exe C:\WINDOWS\xplugin.dll C:\WINDOWS\xxxvideo.hta C:\WINDOWS\y.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_INTELIDEE -------\Service_intelidee ((((((((((((((((((((((((( Files Created from 2008-06-02 to 2008-07-02 ))))))))))))))))))))))))))))))) . 2008-07-02 05:18 . 2008-07-02 05:18 49,168 --a------ C:\WINDOWS\system32\rswnw64o.exe 2008-07-02 05:14 . 2008-07-02 05:20 63,918 --a------ C:\WINDOWS\system32\{a91550c1-2802-284b-4c9f-2bf554fe3791}.dll-uninst.exe 2008-06-30 18:20 . 2008-06-30 18:20 3,082 --a------ C:\WINDOWS\system32\tmp.reg 2008-06-30 18:15 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-06-30 18:15 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-06-30 18:15 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe 2008-06-30 18:15 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-06-30 18:15 . 2008-06-23 23:34 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe 2008-06-30 18:15 . 2008-05-23 18:21 81,920 --a------ C:\WINDOWS\system32\404Fix.exe 2008-06-30 18:15 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-06-30 18:15 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-06-30 18:15 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-06-30 16:19 . 2008-06-30 16:19 167,976 --a------ C:\WINDOWS\system32\drivers\core.cache.dsk 2008-06-27 15:31 . 2008-06-27 15:31 <DIR> d-------- C:\Deckard 2008-06-27 15:21 . 2008-06-27 15:21 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-06-27 15:21 . 2008-06-30 16:14 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-27 12:02 . 2008-06-27 12:02 <DIR> d-------- C:\Program Files\Trend Micro 2008-06-26 20:39 . 2008-07-02 05:12 110,348 --a------ C:\WINDOWS\BMa778fff6.xml 2008-06-26 17:21 . 2008-06-26 17:21 <DIR> d-------- C:\Program Files\Windows Defender 2008-06-26 13:58 . 2008-06-26 13:58 <DIR> d-------- C:\WINDOWS\system32\xsir 2008-06-26 13:58 . 2008-06-26 13:58 <DIR> d-------- C:\WINDOWS\system32\vec3 2008-06-26 13:58 . 2008-06-26 13:58 <DIR> d-------- C:\WINDOWS\system32\modtrux01 2008-06-26 13:58 . 2008-06-26 13:58 <DIR> d-------- C:\WINDOWS\system32\bam 2008-06-26 13:58 . 2008-06-26 13:58 <DIR> d-------- C:\Temp\syschk3 2008-06-26 13:58 . 2008-06-26 13:58 41,984 --a------ C:\WINDOWS\mrofinu572.exe.tmp 2008-06-26 13:58 . 2008-06-26 14:02 41,984 --a------ C:\WINDOWS\mrofinu572.exe 2008-06-26 13:58 . 2008-06-26 13:58 41,984 --a------ C:\WINDOWS\mrofinu1000106.exe 2008-06-26 13:58 . 2008-06-26 13:58 25,088 --a------ C:\WINDOWS\system32\qoMeCtTj.dll.vir 2008-06-25 08:12 . 2008-06-25 08:12 <DIR> d-------- C:\Documents and Settings\Mark\temp 2008-06-25 08:12 . 2008-06-25 08:12 <DIR> d-------- C:\Documents and Settings\Mark\Application Data\TeamViewer 2008-06-19 23:40 . 2008-06-19 23:40 90,073 --a------ C:\WINDOWS\system32\iftuyszv.exe 2008-06-11 06:58 . 2008-06-13 09:10 272,128 --a------ C:\WINDOWS\system32\drivers\bthport.sys 2008-06-11 06:58 . 2008-06-13 09:10 272,128 --------- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-09 17:45 . 2008-06-09 17:45 691,545 --a------ C:\WINDOWS\unins000.exe 2008-06-09 17:45 . 2008-06-09 17:45 2,557 --a------ C:\WINDOWS\unins000.dat . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-02 09:29 200,774 ----a-w C:\WINDOWS\system32\tcntaxdm.exe 2008-07-02 09:25 8,448 ----a-w C:\WINDOWS\cpan.dll 2008-06-30 22:09 --------- d-----w C:\Documents and Settings\Mark\Application Data\U3 2008-06-27 18:58 --------- d-----w C:\Program Files\UltimateBet 2008-06-27 18:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint 2008-06-26 18:29 --------- d-----w C:\Program Files\EndItAll 2008-06-26 18:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-06-24 16:50 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-06-18 13:03 --------- d-----w C:\Program Files\Apple Software Update 2008-06-09 21:51 --------- d-----w C:\Documents and Settings\Mark\Application Data\AdobeUM 2008-06-09 21:50 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-06-03 00:21 --------- d-----w C:\Program Files\Common Files\Adobe 2008-06-02 17:27 --------- d-----w C:\Documents and Settings\Mark\Application Data\AirSet Desktop Sync 2008-06-02 15:41 --------- d-----w C:\Program Files\Symantec 2008-06-02 15:40 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF 2008-06-02 15:40 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL 2008-06-02 15:40 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-06-02 15:40 10,671 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2008-05-27 13:28 370,176 ----a-w C:\WINDOWS\system32\{a91550c1-2802-284b-4c9f-2bf554fe3791}.dll 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-08 12:28 202,752 ------w C:\WINDOWS\system32\dllcache\rmcast.sys 2008-05-07 15:09 --------- d-----w C:\Documents and Settings\Mark\Application Data\TomTom 2008-05-07 15:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\TomTom 2008-05-07 15:07 --------- d-----w C:\Program Files\TomTom HOME 2 2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll 2008-05-07 05:18 1,287,680 ------w C:\WINDOWS\system32\dllcache\quartz.dll 2008-04-24 02:16 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-04-22 07:40 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-04-22 07:39 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-04-22 07:39 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-04-20 05:07 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll 2008-04-18 17:33 139,264 ----a-w C:\WINDOWS\system32\hpzjrd01.dll 2006-06-20 19:36 56 --sha-r C:\WINDOWS\system32\7B2E56DF65.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5ce45a44-ff8d-a3bf-588d-21bacee4e05e}] 2008-05-27 09:28 370176 --a------ C:\WINDOWS\system32\{a91550c1-2802-284b-4c9f-2bf554fe3791}.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-11 10:14 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 21:49 94208] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 21:46 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-10-14 21:50 114688] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-29 05:56 761947] "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 15:59 385024] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 18:30 517768] "{d56ec44d-e703-5423-0ce0-7034d6d1c5bd}"="C:\WINDOWS\system32\{a91550c1-2802-284b-4c9f-2bf554fe3791}.dll" [2008-05-27 09:28 370176] "SigmatelSysTrayApp"="stsystra.exe" [2005-09-10 00:19 393216 C:\WINDOWS\stsystra.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless] 2004-09-07 17:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Orb Networks\\Orb\\bin\\Orb.exe"= "C:\\Program Files\\Orb Networks\\Orb\\bin\\OrbTray.exe"= "C:\\Program Files\\Orb Networks\\Orb\\bin\\OrbStreamerClient.exe"= "C:\\Program Files\\Orb Networks\\Orb\\bin\\Orb3GPStreamerClient.exe"= "C:\\Program Files\\Orb Networks\\Orb\\bin\\OrbRMStreamerClient.exe"= "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "C:\\Program Files\\Abacast\\Abaclient.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\CyberLink\\PCM4Everio\\PCM4Everio.exe"= "C:\\Program Files\\CyberLink\\PCM4Everio\\EverioService.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "C:\\Documents and Settings\\Mark\\temp\\TeamViewer3\\TeamViewer.exe"= S3 PNDIS5;PNDIS5 NDIS Protocol Driver;D:\PNDIS5.SYS [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3b936b64-010d-11db-b948-001422accc7f}] \Shell\AutoRun\command - E:\setupSNK.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{56259b6b-88fe-11db-b989-001422accc7f}] \Shell\AutoRun\command - setupSNK.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ebb6e222-1bd8-11dd-ba42-001422accc7f}] \Shell\AutoRun\command - H:\InstallTomTomHOME.exe . Contents of the 'Scheduled Tasks' folder "2008-06-18 13:03:48 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-07-02 09:32:04 C:\WINDOWS\Tasks\MP Scheduled Scan.job" - C:\Program Files\Windows Defender\MpCmdRun.exe "2008-06-14 00:00:00 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Mark.job" - C:\PROGRA~1\NORTON~1\Navw32.exeh/TASK: . - - - - ORPHANS REMOVED - - - - BHO-{0B637764-3A97-4DFA-9130-E8D880CE6149} - C:\WINDOWS\system32\ljJDUNFW.dll BHO-{18EF6AAE-60C2-4F70-BCC0-64C404B196A7} - C:\WINDOWS\system32\ljJDVoMf.dll BHO-{51262B02-C48B-49FD-850E-40F0A5040E87} - C:\WINDOWS\system32\awtRkKdC.dll BHO-{BAEC3896-60E9-4ECC-B187-812E85659126} - C:\WINDOWS\system32\ljJCttUl.dll HKLM-Run-{BC-CC-CC-C5-DW} - c:\windows\system32\rwwnw64d.exe HKLM-Run-a44bcc6a - C:\WINDOWS\system32\jmwncoyi.dll HKLM-Run-BMa778fff6 - C:\WINDOWS\system32\cdmhospi.dll HKLM-Run-ExploreUpdSched - C:\WINDOWS\system32\tcntaxdm.exe ShellExecuteHooks-{9C28EAFB-FF50-4F42-8D39-A006129CC907} - (no file) scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Windows Defender\MsMpEng.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe C:\Program Files\Common Files\Symantec Shared\CCSETMGR.EXE C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe C:\Program Files\Common Files\Symantec Shared\CCEVTMGR.EXE C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\drivers\CDAC11BA.EXE C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Norton AntiVirus\NAVAPSVC.EXE C:\Program Files\Dell\QuickSet\NicConfigSvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMNTOR.EXE C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\rundll32.exe C:\Qoobox\Quarantine\C\WINDOWS\system32\rwwnw64d.exe.virWram1 C:\Qoobox\Quarantine\C\WINDOWS\system32\tcntaxdm.exe.vir* C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE . ************************************************************************** . Completion time: 2008-07-02 5:37:36 - machine was rebooted ComboFix-quarantined-files.txt 2008-07-02 09:36:26 Pre-Run: 7,776,907,264 bytes free Post-Run: 7,930,073,088 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons 315 --- E O F --- 2008-07-02 09:35:51 Deckard's System Scanner v20071014.68 Run by Mark on 2008-07-02 05:39:53 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as Mark.exe) ------------------------------------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 05:40:04, on 7/2/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\drivers\CDAC11BA.EXE C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\WINDOWS\stsystra.exe C:\WINDOWS\System32\Rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE c:\windows\system32\rwwnw64d.exe C:\WINDOWS\system32\tcntaxdm.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\Mark\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Mark.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.emgee.bravehost.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com...r/fix_homepage R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\System\blank.htm R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: gooochi browser optimizer - {5ce45a44-ff8d-a3bf-588d-21bacee4e05e} - C:\WINDOWS\system32\{a91550c1-2802-284b-4c9f-2bf554fe3791}.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file) O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [{d56ec44d-e703-5423-0ce0-7034d6d1c5bd}] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\{a91550c1-2802-284b-4c9f-2bf554fe3791}.dll" DllStart O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - Startup: Deewoo.lnk = C:\WINDOWS\system32\tcntaxdm.exe O4 - Startup: DW_Start.lnk = C:\WINDOWS\system32\rwwnw64d.exe O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/...oUploader5.cab O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab O16 - DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} (CMV5 Class) - http://coupons.smartsource.com/download/cscmv5X.cab O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://camera.clemson.edu/sikes/AxisCamControl.ocx O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart.com/photo/uploa...loadClient.cab O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx O16 - DPF: {BF985246-09BF-11D2-BE62-006097DF57F6} (SimCityX Control) - http://simcity.ea.com/play/classic/SimCityX.cab O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/...ploader4_5.cab O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: Roxio UPnP Renderer 9 - Unknown owner - C:\Program Files\Common Files\Sonic Shared\RoxioUPnPRenderer9.exe (file missing) O23 - Service: Roxio Upnp Server 9 - Unknown owner - C:\Program Files\Common Files\Sonic Shared\RoxioUpnpService9.exe (file missing) O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing) O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe O23 - Service: stllssvr - Unknown owner - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing) O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe -- End of file - 12641 bytes -- Files created between 2008-06-02 and 2008-07-02 ----------------------------- 2008-07-02 05:21:27 0 d-------- C:\cmdcons 2008-07-02 05:19:45 68096 --a------ C:\WINDOWS\zip.exe 2008-07-02 05:19:45 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor> 2008-07-02 05:19:45 98816 --a------ C:\WINDOWS\sed.exe 2008-07-02 05:19:45 80412 --a------ C:\WINDOWS\grep.exe 2008-07-02 05:19:45 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; > 2008-07-02 05:19:44 49152 --a------ C:\WINDOWS\VFind.exe 2008-07-02 05:19:44 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists> 2008-07-02 05:19:44 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller> 2008-07-02 05:18:39 49168 --a------ C:\WINDOWS\system32\rswnw64o.exe <Not Verified; ; Browser Driver> 2008-06-30 18:20:44 3082 --a------ C:\WINDOWS\system32\tmp.reg 2008-06-30 18:15:39 25600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-06-30 18:15:39 86528 --a------ C:\WINDOWS\system32\VACFix.exe <Not Verified; S!Ri.URZ; VACFix> 2008-06-30 18:15:39 82944 --a------ C:\WINDOWS\system32\IEDFix.exe <Not Verified; S!Ri.URZ; IEDFix> 2008-06-30 18:15:39 81920 --a------ C:\WINDOWS\system32\404Fix.exe <Not Verified; S!Ri.URZ; 404Fix> 2008-06-30 18:15:38 289144 --a------ C:\WINDOWS\system32\VCCLSID.exe <Not Verified; S!Ri; > 2008-06-30 18:15:38 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS> 2008-06-30 18:15:38 51200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-06-30 18:15:36 53248 --a------ C:\WINDOWS\system32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility> 2008-06-27 15:21:25 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-27 15:21:09 0 d-------- C:\Program Files\SpywareBlaster 2008-06-27 12:02:24 0 d-------- C:\Program Files\Trend Micro 2008-06-26 17:21:21 0 d-------- C:\Program Files\Windows Defender 2008-06-26 14:35:47 0 dr-h----- C:\Documents and Settings\Mark\Recent 2008-06-26 13:58:49 41984 --a------ C:\WINDOWS\mrofinu1000106.exe 2008-06-26 13:58:42 0 d-------- C:\WINDOWS\system32\xsir 2008-06-26 13:58:42 0 d-------- C:\WINDOWS\system32\vec3 2008-06-26 13:58:42 0 d-------- C:\WINDOWS\system32\bam 2008-06-26 13:58:42 41984 --a------ C:\WINDOWS\mrofinu572.exe 2008-06-26 13:58:35 0 d-------- C:\WINDOWS\system32\modtrux01 2008-06-25 08:12:22 0 d-------- C:\Documents and Settings\Mark\Application Data\TeamViewer 2008-06-25 08:12:07 0 d-------- C:\Documents and Settings\Mark\temp 2008-06-19 23:40:58 90073 --a------ C:\WINDOWS\system32\iftuyszv.exe <Not Verified; Microsoft; XML Media> 2008-06-09 17:45:55 691545 --a------ C:\WINDOWS\unins000.exe 2008-06-09 17:45:55 2557 --a------ C:\WINDOWS\unins000.dat -- Find3M Report --------------------------------------------------------------- 2008-06-30 18:09:35 0 d-------- C:\Documents and Settings\Mark\Application Data\U3 2008-06-27 14:58:38 0 d-------- C:\Program Files\UltimateBet 2008-06-26 15  14 0 d-------- C:\Program Files\Common Files2008-06-26 14:29:01 0 d-------- C:\Program Files\EndItAll 2008-06-24 12:50:32 0 d-------- C:\Program Files\Common Files\Symantec Shared 2008-06-18 09:03:45 0 d-------- C:\Program Files\Apple Software Update 2008-06-09 17:51:19 0 d-------- C:\Documents and Settings\Mark\Application Data\AdobeUM 2008-06-02 20:21:18 0 d-------- C:\Program Files\Co |
