Welcome to Tech Support Forum home to more then 136,000 problems solved. Issues have included: Spyware, Malware, Virus Issues, Windows, Microsoft, Linux, Networking, Security, Hardware, and Gaming Getting your problem solved is as easy as:
1. Registering for a free account
2. Asking your question
3. Receiving an answer

Registered members:
* Get free support
* Communicate privately with other members (PM).
* Removal of this message
* See fewer ads.
* And much more..

 


Want to know how to post a question? click here Having problems with spyware and pop-ups? First Steps
Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads
Reload this Page Help...!! Pop ups and viruses....
User Name
Password
Site Map Register Donate Rules Blogs Mark Forums Read


Resolved HJT Threads Resolved spyware and popup issues.

 
 
LinkBack Thread Tools
Old 08-05-2007, 03:20 PM   #1 (permalink)
Registered User
 
Join Date: Aug 2007
Posts: 10
OS: Win XP


Help...!! Pop ups and viruses....
Hi, I think I have a lot of viruses and popups.. Please help me. It's slowing down my computer and it's affecting my internet explorer. Thanks in advance...! :)


Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 6:03:10 PM, on 8/5/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Mixer.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\Program Files\Ares Lite Edition\Ares.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\3M\PSNLite\PsnLite.exe
C:\PROGRA~1\3M\PSNLite\PSNGive.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Eric\Desktop\Yay\analyze.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\Program Files\AIM95\\DeadAIM.ocm",ExportedCheckODLs
O4 - HKLM\..\Run: [CTRegRun] C:\WINDOWS\CTRegRun.EXE
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\ctnotify.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares Lite Edition\Ares.exe" -h
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp /HIDEBL
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Post-itŪ Software Notes Lite.lnk = C:\Program Files\3M\PSNLite\PsnLite.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O16 - DPF: Video Poker - http://download.games.yahoo.com/game...s/y/vpt0_x.cab
O16 - DPF: Yahoo! Graffiti - http://download.games.yahoo.com/game...s/y/grt5_x.cab
O16 - DPF: Yahoo! Literati - http://download2.games.yahoo.com/gam...ts/y/tt5_x.cab
O16 - DPF: Yahoo! MahJong - http://download.games.yahoo.com/game...ts/y/ot0_x.cab
O16 - DPF: Yahoo! Word Racer - http://download.games.yahoo.com/game...ts/y/wt0_x.cab
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTS...gCode=en&pers=
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework...ex/TmHcmsX.CAB
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} (KX-HCM10 Control) - http://cam.cs.cmu.edu/kxhcm10.ocx
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - http://mail.cgsinc.com/iNotes6W.cab
O16 - DPF: {405BBF5B-2FD8-4614-AC51-D8566F635B94} (SafeWallet Class) - http://idsm.citadelprocessing.com/Sa.../WalletCab.CAB
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {58172624-85DD-4482-9E64-02ADCA637E96} - http://www.kungfuchess.com/activex/web591.cab
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/game...lugin11USA.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1186334110578
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.blizzard.com/register/wowbeta/si.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor...o.cab55579.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/game...Plugin9USA.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2873BC0F-45A5-4ECB-AC7F-126E7784A40E}: NameServer = 66.92.159.2,216.231.41.2
O20 - AppInit_DLLs: c:\windows\system32\pmnligf.dll
O20 - Winlogon Notify: mqoadur - C:\WINDOWS\SYSTEM32\mqoadur.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe

--
End of file - 8817 bytes
elau1026 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Sponsored Links
Old 08-06-2007, 06:48 PM   #2 (permalink)
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
 
sUBs's Avatar
 
Join Date: May 2005
Posts: 23,246
OS: N/A


Re: Help...!! Pop ups and viruses....
1. Download & Save this file to Desktop -> http://download.bleepingcomputer.com...a/ComboFix.exe

2. Double click on combofix.exe & follow the prompts.

3. When finished, it shall produce a log for you. Post that log & a fresh HJT log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall
__________________
sUBs is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-06-2007, 07:23 PM   #3 (permalink)
Registered User
 
Join Date: Aug 2007
Posts: 10
OS: Win XP


Re: Help...!! Pop ups and viruses....
Here is the ComboFix log:

ComboFix 07-08-07.2 - "Eric" 2007-08-06 22:00:42.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.533 [GMT -4:00]
* Created a new restore point


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\bold.log
C:\DOCUME~1\ALLUSE~1\APPLIC~1.\salesmonitor
C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinAntiVirus Pro 2007
C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinAntiVirus Pro 2007\Data\Abbr
C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinAntiVirus Pro 2007\Data\ActivationCode
C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinAntiVirus Pro 2007\Data\ProductCode
C:\DOCUME~1\Eric\APPLIC~1\tmp4CA.tmp.exe
C:\DOCUME~1\Eric\APPLIC~1\tmp4CC.tmp.exe
C:\DOCUME~1\Eric\APPLIC~1\tmp4CD.tmp.exe
C:\DOCUME~1\Eric\APPLIC~1\WinAntiVirus Pro 2007
C:\DOCUME~1\Eric\APPLIC~1\WinAntiVirus Pro 2007\avtasks.dat
C:\DOCUME~1\Eric\APPLIC~1\WinAntiVirus Pro 2007\CookieList.dat
C:\DOCUME~1\Eric\APPLIC~1\WinAntiVirus Pro 2007\history.db
C:\DOCUME~1\Eric\APPLIC~1\WinAntiVirus Pro 2007\Logs\update.log
C:\DOCUME~1\Eric\APPLIC~1\WinAntiVirus Pro 2007\Logs\wa7Support.log
C:\DOCUME~1\Eric\APPLIC~1\WinAntiVirus Pro 2007\Logs\winav.log
C:\DOCUME~1\Eric\APPLIC~1\WinAntiVirus Pro 2007\PGE.dat
C:\Program Files\Common Files\winantivirus pro 2007
C:\Program Files\outerinfo
C:\Program Files\outerinfo\Terms.rtf
C:\Program Files\wnsxs~1
C:\WINDOWS\icroso~1
C:\WINDOWS\system32\mqoadur.dll
C:\WINDOWS\system32\qwerty12.exe
C:\WINDOWS\system32\U5U617vR.exe
C:\WINDOWS\system32\wnsapisv32.exe
C:\WINDOWS\Tasks.\At25.job
C:\WINDOWS\Tasks.\At26.job
C:\WINDOWS\Tasks.\At27.job
C:\WINDOWS\Tasks.\At28.job
C:\WINDOWS\Tasks.\At29.job
C:\WINDOWS\Tasks.\At30.job
C:\WINDOWS\Tasks.\At31.job
C:\WINDOWS\Tasks.\At32.job
C:\WINDOWS\Tasks.\At33.job
C:\WINDOWS\Tasks.\At34.job
C:\WINDOWS\Tasks.\At35.job
C:\WINDOWS\Tasks.\At36.job
C:\WINDOWS\Tasks.\At37.job
C:\WINDOWS\Tasks.\At38.job
C:\WINDOWS\Tasks.\At39.job
C:\WINDOWS\Tasks.\At40.job
C:\WINDOWS\Tasks.\At41.job
C:\WINDOWS\Tasks.\At42.job
C:\WINDOWS\Tasks.\At43.job
C:\WINDOWS\Tasks.\At44.job
C:\WINDOWS\Tasks.\At45.job
C:\WINDOWS\Tasks.\At46.job
C:\WINDOWS\Tasks.\At47.job
C:\WINDOWS\Tasks.\At48.job
C:\WINDOWS\xhelper.dll
C:\WINDOWS\xmlhelper.dll
C:\WINDOWS\xmlhelper2.dll


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_DOMAINSERVICE
-------\LEGACY_FOPN
-------\DomainService


((((((((((((((((((((((((( Files Created from 2007-07-07 to 2007-08-07 )))))))))))))))))))))))))))))))


2007-08-06 22:12 105,428 --a------ C:\WINDOWS\system32\mljjh.exe
2007-08-06 21:58 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-05 13:15 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2007-08-05 13:15 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution
2007-08-05 13:09 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
2007-08-04 00:45 18 --a------ C:\WINDOWS\system32\dn184537be.dat
2007-08-04 00:40 13,380 --a------ C:\WINDOWS\system32\pmnligf.dll


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-06 22:13 92702 --a------ C:\WINDOWS\system32\kbduiu.dll
2007-08-06 21:56 --------- d-------- C:\Program Files\Diablo II
2007-08-06 21:03 43520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
2007-08-03 16:01 --------- d-------- C:\Program Files\Warcraft III
2007-07-06 14:47 --------- d-------- C:\Program Files\Google
2007-06-29 18:02 --------- d-------- C:\Program Files\7-Zip
2007-06-12 15:36 --------- d-------- C:\DOCUME~1\Eric\APPLIC~1\Viewpoint
2007-06-09 11:32 --------- d-------- C:\Program Files\Viewpoint
2007-06-09 11:32 --------- d-------- C:\Program Files\AIM6
2007-06-09 11:30 --------- d-------- C:\DOCUME~1\Eric\APPLIC~1\Comodo
2007-06-09 11:07 --------- d-------- C:\Program Files\Comodo
2007-06-08 21:07 --------- d-------- C:\Program Files\Alwil Software
2007-06-08 20:47 192587 --a------ C:\WINDOWS\system32\mwinrndt.exe
2007-06-08 20:35 --------- d-------- C:\Program Files\Go!Zilla
2006-12-04 00:31 23 --a------ C:\WINDOWS\java\Packages\Data\UBNF1R9F.DAT
2006-12-04 00:31 1245 --a------ C:\WINDOWS\java\Packages\Data\AJ3ZN1ZZ.DAT
2006-03-29 20:56 2814 --a------ C:\WINDOWS\java\Packages\Data\7BN7VRFB.DAT
2006-03-29 20:56 23 --a------ C:\WINDOWS\java\Packages\Data\C9Z9JFLR.DAT
2006-03-29 17:50 23 --a------ C:\WINDOWS\java\Packages\Data\UVR13F5J.DAT
2006-03-29 17:50 1105 --a------ C:\WINDOWS\java\Packages\Data\AN9RB7RF.DAT
2006-02-04 05:01 23 --a------ C:\WINDOWS\java\Packages\Data\V7B577P3.DAT
2006-02-04 05:01 1105 --a------ C:\WINDOWS\java\Packages\Data\31VTBZTV.DAT
2004-01-22 23:57 2814 --a------ C:\WINDOWS\java\Packages\Data\PR57JNLB.DAT
2004-01-22 23:57 23 --a------ C:\WINDOWS\java\Packages\Data\TRP3JZBR.DAT
2004-01-21 18:56 23 --a------ C:\WINDOWS\java\Packages\Data\53N1JHBR.DAT
2004-01-21 18:56 1324 --a------ C:\WINDOWS\java\Packages\Data\HV133RHV.DAT
2004-01-21 18:50 23 --a------ C:\WINDOWS\java\Packages\Data\K6Y13DNX.DAT
2004-01-21 18:50 1105 --a------ C:\WINDOWS\java\Packages\Data\Z1BBNJ5Z.DAT
2003-12-12 00:50 1105 --a------ C:\WINDOWS\java\Packages\Data\TVLNLFF1.DAT
2003-06-06 01:09 1324 --a------ C:\WINDOWS\java\Packages\Data\P3LRBL3P.DAT
2003-04-22 19:40 2678 --a------ C:\WINDOWS\java\Packages\Data\XV713P75.DAT
2003-04-22 19:40 2678 --a------ C:\WINDOWS\java\Packages\Data\XRPB3XBH.DAT
2003-04-22 19:40 2678 --a------ C:\WINDOWS\java\Packages\Data\VRB1RPBH.DAT
2003-04-22 19:40 2678 --a------ C:\WINDOWS\java\Packages\Data\GNL7FFP3.DAT
2003-04-22 19:40 2678 --a------ C:\WINDOWS\java\Packages\Data\5F7T7DNH.DAT
2003-01-28 14:21 17144 --a------ C:\DOCUME~1\Eric\APPLIC~1\GDIPFONTCACHEV1.DAT
2003-01-17 12:22 3513 --a------ C:\Program Files\setuplog.txt
2003-01-16 13:10 23 --a------ C:\WINDOWS\java\Packages\Data\6LV793NX.DAT
2003-01-16 13:10 23 --a------ C:\WINDOWS\java\Packages\Data\4DRLV57D.DAT
2003-01-16 13:10 1299 --a------ C:\WINDOWS\java\Packages\Data\ZV3P3PBD.DAT
2003-01-16 13:10 1299 --a------ C:\WINDOWS\java\Packages\Data\7BV9V1RV.DAT
2002-06-17 13:48 538810 --a------ C:\Program Files\wait.bmp
2001-11-23 08:08 712704 -ra------ C:\WINDOWS\inf\OTHER\audio3d.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C-Media Mixer"="Mixer.exe" [2002-01-28 12:16 C:\WINDOWS\mixer.exe]
"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [2002-07-30 12:35]
"NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50]
"DeadAIM"="C:\Program Files\AIM95\\DeadAIM.ocm" [2003-02-24 16:11]
"CTRegRun"="C:\WINDOWS\CTRegRun.EXE" [1999-10-10 13:01]
"Disc Detector"="C:\Program Files\Creative\ShareDLL\ctnotify.exe" []
"type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe" [2004-06-03 04:51]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-14 19:05]
"COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2007-06-09 11:07]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-02-24 08:32]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ares"="C:\Program Files\Ares Lite Edition\Ares.exe" [2005-02-22 22:52]
"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [2002-08-28 23:41]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-04-27 17:17]
"BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" []
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-06 14:47]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-08-05 13:09:29]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04]
Post-itr Software Notes Lite.lnk - C:\Program Files\3M\PSNLite\PsnLite.exe [2003-10-09 15:08:32]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
@=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\kbduiu]
kbduiu.dll 2007-08-06 22:13 92702 C:\WINDOWS\system32\kbduiu.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=c:\windows\system32\pmnligf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\376@NXN5X72WT@]
C:\WINDOWS\System32\Qdxc4jKS.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

R0 Inspect;Comodo Network Engine;C:\WINDOWS\System32\DRIVERS\inspect.sys
R1 NPPTNT;NPPTNT;\??\C:\WINDOWS\System32\npptNT.sys
R2 NAVAPEL;NAVAPEL;\??\C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVAPEL.SYS
R2 Pctspk;PCTEL Speaker Phone;C:\WINDOWS\system32\pctspk.exe
R3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter;C:\WINDOWS\System32\DRIVERS\AN983.sys
R3 cmpci;C-Media PCI Audio Driver (WDM);C:\WINDOWS\System32\drivers\cmaudio.sys
R3 NAVAP;NAVAP;\??\C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVAP.sys
S3 AMDPCI;AMDPCI;\??\C:\DOCUME~1\Eric\LOCALS~1\Temp\AMDPCI.sys
S3 Bridge;MAC Bridge;C:\WINDOWS\System32\DRIVERS\bridge.sys
S3 BridgeMP;MAC Bridge Miniport;C:\WINDOWS\System32\DRIVERS\bridge.sys
S3 FTDIBUS;USB Serial Converter Driver;C:\WINDOWS\System32\drivers\ftdibus.sys
S3 FTSER2K;USB Serial Port Driver;C:\WINDOWS\System32\drivers\ftser2k.sys
S3 Ip6FwHlp;IPv6 Internet Connection Firewall;C:\WINDOWS\System32\svchost.exe -k netsvcs
S3 LucentSoftModem;Lucent Technologies Soft Modem;C:\WINDOWS\System32\DRIVERS\LTSM.sys
S3 nm;Network Monitor Driver;C:\WINDOWS\System32\DRIVERS\NMnt.sys
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\System32\drivers\npf.sys
S3 Ptserli;PCTEL Serial Device Driver for INTEL;C:\WINDOWS\System32\DRIVERS\ptserli.sys
S3 ROOTMODEM;Microsoft Legacy Modem Driver;C:\WINDOWS\System32\Drivers\RootMdm.sys
S3 USRpdA;U.S. Robotics 56K PCI Faxmodem Driver;C:\WINDOWS\System32\DRIVERS\USRpdA.sys


Contents of the 'Scheduled Tasks' folder
2007-08-05 22:36:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
2007-08-06 04:00:00 C:\WINDOWS\Tasks\At1.job - C:\WINDOWS\System32\6WVn3nnY.exe
2007-08-06 13:00:00 C:\WINDOWS\Tasks\At10.job - C:\WINDOWS\System32\6WVn3nnY.exe
2007-08-06 14:00:00 C:\WINDOWS\Tasks\At11.job
2007-08-06 15:00:00 C:\WINDOWS\Tasks\At12.job - C:\WINDOWS\System32\6WVn3nnY.exe
2007-08-06 16:00:00 C:\WINDOWS\Tasks\At13.job - C:\WINDOWS\System32\6WVn3nnY.exe
2007-08-06 17:00:00 C:\WINDOWS\Tasks\At14.job - C:\WINDOWS\System32\6WVn3nnY.exe
2007-08-06 18:00:00 C:\WINDOWS\Tasks\At15.job
2007-08-06 19:00:00 C:\WINDOWS\Tasks\At16.job - C:\WINDOWS\System32\6WVn3nnY.exe
2007-08-06 20:00:00 C:\WINDOWS\Tasks\At17.job
2007-08-06 21:00:00 C:\WINDOWS\Tasks\At18.job - C:\WINDOWS\System32\6WVn3nnY.exe
2007-08-06 22:00:00 C:\WINDOWS\Tasks\At19.job
2007-08-06 05:00:00 C:\WINDOWS\Tasks\At2.job - C:\WINDOWS\System32\6WVn3nnY.exe
2007-08-06 23:00:00 C:\WINDOWS\Tasks\At20.job - C:\WINDOWS\System32\6WVn3nnY.exe
2007-08-07 00:00:00 C:\WINDOWS\Tasks\At21.job - C:\WINDOWS\System32\6WVn3nnY.exe
2007-08-07 01:00:00 C:\WINDOWS\Tasks\At22.job - C:\WINDOWS\System32\6WVn3nnY.exe
2007-08-07 02:00:00 C:\WINDOWS\Tasks\At23.job - C:\WINDOWS\System32\6WVn3nnY.exe
2007-08-06 03:00:00 C:\WINDOWS\Tasks\At24.job - C:\WINDOWS\System32\6WVn3nnY.exe
2007-08-06 06:00:00 C:\WINDOWS\Tasks\At3.job - C:\WINDOWS\System32\6WVn3nnY.exe
2007-08-06 07:00:00 C:\WINDOWS\Tasks\At4.job - C:\WINDOWS\System32\6WVn3nnY.exe
2007-08-06 08:00:00 C:\WINDOWS\Tasks\At5.job - C:\WINDOWS\System32\6WVn3nnY.exe
2007-08-06 09:00:00 C:\WINDOWS\Tasks\At6.job - C:\WINDOWS\System32\6WVn3nnY.exe
2007-08-06 10:00:00 C:\WINDOWS\Tasks\At7.job
2007-08-06 11:00:00 C:\WINDOWS\Tasks\At8.job
2007-08-06 12:00:00 C:\WINDOWS\Tasks\At9.job - C:\WINDOWS\System32\6WVn3nnY.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-06 22:13:03
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-06 22:15:16 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-06 22:15

--- E O F ---




And here is the new HJT log:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 10:22:39 PM, on 8/6/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\3M\PSNLite\PsnLite.exe
C:\PROGRA~1\3M\PSNLite\PSNGive.exe
C:\WINDOWS\System32\RunDll32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Winamp\winamp.exe
C:\Documents and Settings\Eric\Desktop\Yay\analyze.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\Program Files\AIM95\\DeadAIM.ocm",ExportedCheckODLs
O4 - HKLM\..\Run: [CTRegRun] C:\WINDOWS\CTRegRun.EXE
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\ctnotify.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares Lite Edition\Ares.exe" -h
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp /HIDEBL
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Post-itŪ Software Notes Lite.lnk = C:\Program Files\3M\PSNLite\PsnLite.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O16 - DPF: Video Poker - http://download.games.yahoo.com/game...s/y/vpt0_x.cab
O16 - DPF: Yahoo! Graffiti - http://download.games.yahoo.com/game...s/y/grt5_x.cab
O16 - DPF: Yahoo! Literati - http://download2.games.yahoo.com/gam...ts/y/tt5_x.cab
O16 - DPF: Yahoo! MahJong - http://download.games.yahoo.com/game...ts/y/ot0_x.cab
O16 - DPF: Yahoo! Word Racer - http://download.games.yahoo.com/game...ts/y/wt0_x.cab
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTS...gCode=en&pers=
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework...ex/TmHcmsX.CAB
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} (KX-HCM10 Control) - http://cam.cs.cmu.edu/kxhcm10.ocx
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - http://mail.cgsinc.com/iNotes6W.cab
O16 - DPF: {405BBF5B-2FD8-4614-AC51-D8566F635B94} (SafeWallet Class) - http://idsm.citadelprocessing.com/Sa.../WalletCab.CAB
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {58172624-85DD-4482-9E64-02ADCA637E96} - http://www.kungfuchess.com/activex/web591.cab
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/game...lugin11USA.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1186334110578
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.blizzard.com/register/wowbeta/si.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor...o.cab55579.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/game...Plugin9USA.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2873BC0F-45A5-4ECB-AC7F-126E7784A40E}: NameServer = 66.92.159.2,216.231.41.2
O20 - AppInit_DLLs: c:\windows\system32\pmnligf.dll
O20 - Winlogon Notify: kbduiu - C:\WINDOWS\SYSTEM32\kbduiu.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe

--
End of file - 8826 bytes
elau1026 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-06-2007, 07:41 PM   #4 (permalink)
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
 
sUBs's Avatar
 
Join Date: May 2005
Posts: 23,246
OS: N/A


Re: Help...!! Pop ups and viruses....
Go to Start > Control Panel > Add or Remove Programs and uninstall the following programs:
  • ViewPoint
Please note any other programs that you dont recognize in that list in your next response

---------------


Do a HijackThis scan & place a check next to these items and select "Fix checked":

O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTS...gCode=en&pers=


---------------


Open notepad and copy/paste the text in the quotebox below into it:

Code:
http://www.techsupportforum.com/security-center/hijackthis-log-help/172292-help-pop-ups-viruses.html#post1018179
Collect::
C:\WINDOWS\system32\mljjh.exe
C:\WINDOWS\system32\pmnligf.dll
C:\WINDOWS\system32\kbduiu.dll
C:\WINDOWS\system32\mwinrndt.exe
File::
C:\WINDOWS\System32\6WVn3nnY.exe
C:\WINDOWS\system32\dn184537be.dat
C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\Tasks\At10.job
C:\WINDOWS\Tasks\At11.job
C:\WINDOWS\Tasks\At12.job
C:\WINDOWS\Tasks\At13.job
C:\WINDOWS\Tasks\At14.job
C:\WINDOWS\Tasks\At15.job
C:\WINDOWS\Tasks\At16.job
C:\WINDOWS\Tasks\At17.job
C:\WINDOWS\Tasks\At18.job
C:\WINDOWS\Tasks\At19.job
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\Tasks\At20.job
C:\WINDOWS\Tasks\At21.job
C:\WINDOWS\Tasks\At22.job
C:\WINDOWS\Tasks\At23.job
C:\WINDOWS\Tasks\At24.job
C:\WINDOWS\Tasks\At3.job
C:\WINDOWS\Tasks\At4.job
C:\WINDOWS\Tasks\At5.job
C:\WINDOWS\Tasks\At6.job
C:\WINDOWS\Tasks\At7.job
C:\WINDOWS\Tasks\At8.job
C:\WINDOWS\Tasks\At9.job
Folder::
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint
C:\Program Files\Viewpoint
Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\kbduiu]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\376@NXN5X72WT@]
Save this as "CFScript"




Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.

Additonally, ComboFix will generate a zipped file on your Desktop, called Submit [Date Time].zip
Please submit this file to:

http://www.bleepingcomputer.com/subm....php?channel=4

The file must be uploaded before proceeding to the next step.


---------------


Click here perform an online scan >> Online Scanner


---------------


In your next post, please include fresh logs from:
  1. Fresh Hijackthis log taken just before replying
  2. Online scan
  3. ComboFix's log
Please provide details of any problems you encountered whilst performing the above steps & update us on how the computer behaves now
__________________
sUBs is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-06-2007, 10:00 PM   #5 (permalink)
Registered User
 
Join Date: Aug 2007
Posts: 10
OS: Win XP


Re: Help...!! Pop ups and viruses....
------------
HijackThis log:
------------

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 12:55:05 AM, on 8/7/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\3M\PSNLite\PsnLite.exe
C:\PROGRA~1\3M\PSNLite\PSNGive.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Eric\Desktop\Yay\analyze.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\Program Files\AIM95\\DeadAIM.ocm",ExportedCheckODLs
O4 - HKLM\..\Run: [CTRegRun] C:\WINDOWS\CTRegRun.EXE
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\ctnotify.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares Lite Edition\Ares.exe" -h
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp /HIDEBL
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Post-itŪ Software Notes Lite.lnk = C:\Program Files\3M\PSNLite\PsnLite.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O16 - DPF: Video Poker - http://download.games.yahoo.com/game...s/y/vpt0_x.cab
O16 - DPF: Yahoo! Graffiti - http://download.games.yahoo.com/game...s/y/grt5_x.cab
O16 - DPF: Yahoo! Literati - http://download2.games.yahoo.com/gam...ts/y/tt5_x.cab
O16 - DPF: Yahoo! MahJong - http://download.games.yahoo.com/game...ts/y/ot0_x.cab
O16 - DPF: Yahoo! Word Racer - http://download.games.yahoo.com/game...ts/y/wt0_x.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework...ex/TmHcmsX.CAB
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} (KX-HCM10 Control) - http://cam.cs.cmu.edu/kxhcm10.ocx
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - http://mail.cgsinc.com/iNotes6W.cab
O16 - DPF: {405BBF5B-2FD8-4614-AC51-D8566F635B94} (SafeWallet Class) - http://idsm.citadelprocessing.com/Sa.../WalletCab.CAB
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {58172624-85DD-4482-9E64-02ADCA637E96} - http://www.kungfuchess.com/activex/web591.cab
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/game...lugin11USA.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1186334110578
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.blizzard.com/register/wowbeta/si.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor...o.cab55579.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/game...Plugin9USA.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2873BC0F-45A5-4ECB-AC7F-126E7784A40E}: NameServer = 66.92.159.2,216.231.41.2
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe

--
End of file - 8733 bytes



-----------------------------
Kaspersky Scan Log:

------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Tuesday, August 07, 2007 12:54:01 AM
Operating System: Microsoft Windows XP Professional, Service Pack 1 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 7/08/2007
Kaspersky Anti-Virus database records: 376305
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 52398
Number of viruses found: 22
Number of infected objects: 65 / 0
Number of suspicious objects: 4
Duration of the scan process: 01:16:02

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CliprexDVDPro3.zip/Uninstall.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CliprexDVDPro3.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\YazzleSudoku.zip/Yazzle1281OinUninstaller.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\YazzleSudoku.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\APTemp\AP0.exe Infected: Trojan-Downloader.Win32.VB.aya skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\APTemp\AP1.exe Infected: Trojan-Downloader.Win32.VB.aya skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\01300000.VBN Infected: Backdoor.Win32.VB.kb skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\01340000.VBN Infected: Backdoor.Win32.VB.kb skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\014C0000.VBN Infected: Trojan-Downloader.Win32.Agent.bls skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\01500000.VBN Infected: Trojan-Downloader.Win32.VB.awj skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\01500001.VBN Infected: Trojan-Downloader.Win32.VB.awj skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\01500002.VBN Infected: Trojan-Downloader.Win32.Agent.bls skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\01800000.VBN Infected: Trojan-Downloader.Win32.VB.awj skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\01800001.VBN Infected: Trojan-Downloader.Win32.VB.awj skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\01800002.VBN Infected: Trojan-Downloader.Win32.Agent.bls skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\01800003.VBN Infected: Trojan-Downloader.Win32.VB.awj skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\02700001.VBN Infected: Trojan-Downloader.Win32.Agent.bmg skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\03300000.VBN Infected: Trojan-Downloader.Win32.Agent.bmg skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\038C0000.VBN Infected: Trojan-Downloader.Win32.VB.aya skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\03A40000.VBN Infected: Trojan-Downloader.Win32.VB.aya skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\07800000.VBN Infected: Trojan-Dropper.Win32.FriJoiner.b skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\07840000.VBN Infected: Trojan-Dropper.Win32.FriJoiner.b skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\079C0000.VBN/BaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\079C0000.VBN/VaaaaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\079C0000.VBN/Baaaaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\079C0000.VBN ZIP: infected - 3 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\079C0000.VBN CryptZ: infected - 3 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\079C0001.VBN Infected: Trojan-Dropper.Win32.FriJoiner.b skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\07E40000.VBN Infected: Trojan-Dropper.Win32.FriJoiner.b skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08040000.VBN Infected: Trojan-Dropper.Win32.FriJoiner.b skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08040001.VBN Infected: Trojan-Dropper.Win32.FriJoiner.b skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08080001.VBN Infected: Trojan-Downloader.JS.Psyme.cz skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08080002.VBN Infected: Trojan-Dropper.Win32.FriJoiner.b skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\080C0000.VBN Infected: Trojan-Dropper.Win32.FriJoiner.b skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\080C0001.VBN Infected: Trojan-Dropper.Win32.FriJoiner.b skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08100000.VBN Infected: Trojan-Dropper.Win32.FriJoiner.b skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0A2C0000.VBN Infected: not-a-virus:AdWare.Win32.Virtumonde.kw skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0B3C0000.VBN Infected: Trojan-Downloader.Win32.Agent.brf skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0B3C0001.VBN Infected: Trojan-Downloader.Win32.Agent.brf skipped
C:\Documents and Settings\Eric\.housecall6.6\Quarantine\tmp275.tmp.exe.bac_a03864 Infected: Trojan-Downloader.Win32.Agent.bjk skipped
C:\Documents and Settings\Eric\.housecall6.6\Quarantine\tmp7E.tmp.exe.bac_a03864 Infected: Trojan.Win32.Agent.agv skipped
C:\Documents and Settings\Eric\.housecall6.6\Quarantine\tmp7F.tmp.exe.bac_a03864 Infected: Trojan.Win32.Agent.agv skipped
C:\Documents and Settings\Eric\.housecall6.6\Quarantine\yazzlesnet.exe.bac_a01904/data0002 Infected: Trojan-Downloader.Win32.PurityScan.eg skipped
C:\Documents and Settings\Eric\.housecall6.6\Quarantine\yazzlesnet.exe.bac_a01904 NSIS: infected - 1 skipped
C:\Documents and Settings\Eric\.housecall6.6\Quarantine\yazzlesnet.exe.bac_a01904 CryptFF.b: infected - 1 skipped
C:\Documents and Settings\Eric\Application Data\3M\PSNotes\PSNData Object is locked skipped
C:\Documents and Settings\Eric\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Eric\Desktop\Yay\backups\backup-20070805-175620-661.dll Infected: not-a-virus:AdWare.Win32.BHO.cz skipped
C:\Documents and Settings\Eric\Desktop\Yay\backups\backup-20070805-180011-549.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ke skipped
C:\Documents and Settings\Eric\Desktop\[4]-Submit_2007-08-06_231956.59.zip/pmnligf.dll Infected: Trojan-Downloader.Win32.ConHook.bg skipped
C:\Documents and Settings\Eric\Desktop\[4]-Submit_2007-08-06_231956.59.zip/mwinrndt.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.r skipped
C:\Documents and Settings\Eric\Desktop\[4]-Submit_2007-08-06_231956.59.zip ZIP: infected - 2 skipped
C:\Documents and Settings\Eric\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Eric\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Eric\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Eric\Local Settings\Temp\~DF8129.tmp Object is locked skipped
C:\Documents and Settings\Eric\Local Settings\Temp\~DFFFE2.tmp Object is locked skipped
C:\Documents and Settings\Eric\Local Settings\Temporary Internet Files\Content.IE5\C7W3GZ07\bind[1].com&t=1 Object is locked skipped
C:\Documents and Settings\Eric\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Eric\ntuser.dat Object is locked skipped
C:\Documents and Settings\Eric\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\QooBox\Quarantine\C\DOCUME~1\Eric\APPLIC~1\tmp4CA.tmp.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.kw skipped
C:\QooBox\Quarantine\C\DOCUME~1\Eric\APPLIC~1\tmp4CC.tmp.exe.vir Infected: Trojan.Win32.Agent.aoy skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\qwerty12.exe.vir Infected: Trojan.Win32.Agent.aoy skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\U5U617vR.exe.vir Infected: Backdoor.Win32.VB.kb skipped
C:\QooBox\Quarantine\C\WINDOWS\xmlhelper.dll.vir Infected: not-a-virus:AdWare.Win32.Agent.db skipped
C:\QooBox\Quarantine\C\WINDOWS\xmlhelper2.dll.vir Infected: not-a-virus:AdWare.Win32.Agent.db skipped
C:\QooBox\Quarantine\catchme2007-08-06_221300.26.zip/mqoadur.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ke skipped
C:\QooBox\Quarantine\catchme2007-08-06_221300.26.zip ZIP: infected - 1 skipped
C:\System Volume Information\_restore{A6FC00D1-ECFE-4287-A50D-ADA446A94347}\RP211\A0044533.dll Infected: not-a-virus:AdWare.Win32.BHO.cz skipped
C:\System Volume Information\_restore{A6FC00D1-ECFE-4287-A50D-ADA446A94347}\RP213\A0044570.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.kw skipped
C:\System Volume Information\_restore{A6FC00D1-ECFE-4287-A50D-ADA446A94347}\RP213\A0044571.exe Infected: Trojan.Win32.Agent.aoy skipped
C:\System Volume Information\_restore{A6FC00D1-ECFE-4287-A50D-ADA446A94347}\RP213\A0044573.dll Infected: not-a-virus:AdWare.Win32.Agent.db skipped
C:\System Volume Information\_restore{A6FC00D1-ECFE-4287-A50D-ADA446A94347}\RP213\A0044574.dll Infected: not-a-virus:AdWare.Win32.Agent.db skipped
C:\System Volume Information\_restore{A6FC00D1-ECFE-4287-A50D-ADA446A94347}\RP213\A0044576.exe Infected: Trojan.Win32.Agent.aoy skipped
C:\System Volume Information\_restore{A6FC00D1-ECFE-4287-A50D-ADA446A94347}\RP213\A0044577.exe Infected: Backdoor.Win32.VB.kb skipped
C:\System Volume Information\_restore{A6FC00D1-ECFE-4287-A50D-ADA446A94347}\RP213\A0044587.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ke skipped
C:\System Volume Information\_restore{A6FC00D1-ECFE-4287-A50D-ADA446A94347}\RP214\change.log Object is locked skipped
C:\WINDOWS\Debug\oakley.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Downloaded Program Files\popcaploader.dll Infected: not-a-virus:Downloader.Win32.PopCap.b skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\dllcache\wmipdskq.dll Infected: not-a-virus:AdWare.Win32.Hmt skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\wmipdskq.dll Infected: not-a-virus:AdWare.Win32.Hmt skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.



-------------------
ComboFix Log:
-------------------


ComboFix 07-08-07.2 - "Eric" 2007-08-06 23:20:00.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.268 [GMT -4:00]
Command switches used :: C:\Documents and Settings\Eric\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\WINDOWS\System32\6WVn3nnY.exe
C:\WINDOWS\system32\dn184537be.dat
C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\Tasks\At10.job
C:\WINDOWS\Tasks\At11.job
C:\WINDOWS\Tasks\At12.job
C:\WINDOWS\Tasks\At13.job
C:\WINDOWS\Tasks\At14.job
C:\WINDOWS\Tasks\At15.job
C:\WINDOWS\Tasks\At16.job
C:\WINDOWS\Tasks\At17.job
C:\WINDOWS\Tasks\At18.job
C:\WINDOWS\Tasks\At19.job
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\Tasks\At20.job
C:\WINDOWS\Tasks\At21.job
C:\WINDOWS\Tasks\At22.job
C:\WINDOWS\Tasks\At23.job
C:\WINDOWS\Tasks\At24.job
C:\WINDOWS\Tasks\At3.job
C:\WINDOWS\Tasks\At4.job
C:\WINDOWS\Tasks\At5.job
C:\WINDOWS\Tasks\At6.job
C:\WINDOWS\Tasks\At7.job
C:\WINDOWS\Tasks\At8.job
C:\WINDOWS\Tasks\At9.job


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\bold.log
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-1108767434.mzv
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-1135556971.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-1165530491.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-1375613620.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-1648829976.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-1899323404.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-400696545.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-443689904.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-622297995.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-826513897.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\106896837.mzv
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\125870462.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\1383469248.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\1748523446.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\1842914311.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\1885017049.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\2051882696.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\396963827.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\705726423.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\906152529.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\URLCache.ini
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-1056531412.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-1808248853.mzv
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-220121683.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-400048984.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-480776955.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\1147295202.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\1551184263.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\1970057507.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\636170696.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\URLCache.ini
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1029747936.mtz
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1306044001.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1311145698.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1513774328.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1999704851.mtz
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-842504739.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\1333740445.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\1603222785.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\281493209.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\407034558.ini
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\479083432.mtz
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\URLCache.ini
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-1029747925.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-1083187125.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-1247830158.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-1312084298.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-1484115045.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-2059754657.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-2112389804.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-588305592.mtz
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-964215608.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\1085487388.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\1367955459.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\1458822214.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\1469791542.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\1542249177.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\1603222798.mtz
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\1628515306.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\2134591667.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\920665057.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\URLCache.ini
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\UpdateVersionList_v2.mtx
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-1022894383.mtj&p2=1&p3=00893526423193413133461311967013&p4=0
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-1108767434.mzv
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-1130649918.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-1135556971.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-1157302298.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-1157604420.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-1165530491.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-1358063859.mtj&p2=1&p3=05573116223801650475422016875089&p4=0
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-1375613620.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-1392838565.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-1516337578.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-1542025285.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-1648829976.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-1769552329.mtz
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-1771923624.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-1830751413.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-1860823040.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-1871182580.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-1899323404.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-1906701890.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-2034579467.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-2059436458.mtz
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-2086944636.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-2146499693.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-225470241.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-251762890.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-31966105.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-353991899.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-400696545.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-443689904.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-496237992.mtz
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-576398895.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-622297995.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-826513897.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-881875100.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-936665272.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-999622575.mzv
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\106896837.mzv
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\1230455189.mtz
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\125870462.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\1300531233.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\1383469248.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\1441272437.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\1507297759.mtz
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\1544102551.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\1563966285.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\1656948237.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\1668829688.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\169003729.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\1707239748.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\172280098.mtj&p2=1&p3=00893526423193413133461311967013&p4=0
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\172837871.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\1748523446.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\1842914311.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\1885017049.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\2035244762.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\2051882696.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\2059353971.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\2069372886.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\2072783038.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\2085810389.mtz
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\371414902.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\396963827.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\428599186.mtz
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\443931870.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\596714533.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\700165497.mtz
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\705726423.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\808057810.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\880205301.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\906152529.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\943270136.mtz
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\985100209.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\URLCache.ini
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\-1022782729.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\-1032397325.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\-1044610961.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\-1056531412.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\-1109370816.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\-1440437007.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\-1451242349.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\-1687196986.mtz
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\-1742613363.mtj&p2=1&p3=05573116223801650475422016875089&p4=0
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\-1769552322.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\-1808248853.mzv
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\-1923062664.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\-2107370987.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\-220121683.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\-359803410.mtj&p2=1&p3=00893526423193413133461311967013&p4=0
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\-400048984.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\-418549231.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\-445524603.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\-460411503.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\-480776955.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\-521535964.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\-618215282.mtz
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\-705735742.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\-85780338.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\1049390151.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\1147295202.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\115486959.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\1195939998.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\1348961649.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\136511223.mtj&p2=1&p3=05573116223801650475422016875089&p4=0
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\1434897116.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\1478958194.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\1524859613.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\1551184263.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\1576823685.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\1581774862.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\1603442935.mtz
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\1618519102.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\1645706366.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\1655265822.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\1675924357.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\1708215694.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\1737069128.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\17961501.mtj&p2=1&p3=00893526423193413133461311967013&p4=0
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\1817747924.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\1832818801.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\1969769369.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\1970057507.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\2049480714.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\2074365575.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\26077524.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\266338286.mtj&p2=1&p3=05573116223801650475422016875089&p4=0
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\297400595.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\324647410.mtj&p2=0&p3=00893526423193413133461311967013&p4=0
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\349171502.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\36524188.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\471197275.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\490027841.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\500853095.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\636170696.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\701298328.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\715969846.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\788102221.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\9006171.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\959259803.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\URLCache.ini
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\-1029747936.mtz
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\-1225496211.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\-1306044001.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\-1311145698.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\-1402706028.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\-1443731265.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\-1489138219.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\-1493200908.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\-1513774328.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\-156260664.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\-1677547288.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\-1999704851.mtz
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\-2017596067.mtz
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\-2053815139.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\-2084247722.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\-3847432.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\-446581749.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\-597614597.mtj&p2=1&p3=00893526423193413133461311967013&p4=0
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\-624469043.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\-664601570.mzv
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\-838504028.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\-842504739.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\-946926001.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\-959971680.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\-960028054.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\1069641392.mzv
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\1179616821.mtz
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\1216718129.mtz
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\1298506430.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\1316197598.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\1333740445.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\1414386234.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\1492189461.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\1495615586.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\1577513872.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\1603222785.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\1603442942.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\1653494572.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\1727607661.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\1793940285.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\1810117067.mtz
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\1897459136.mtj&p2=1&p3=00893526423193413133461311967013&p4=0
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\255554434.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\281493209.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\307331414.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\336536927.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\369400091.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\407034558.ini
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\459914786.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\472990771.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\479083432.mtz
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\788111763.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\934090300.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\URLCache.ini
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-1029747925.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-1083187125.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-1093920855.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-1100651534.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-1109942812.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-1130649907.mtz
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-1133459285.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-1139780094.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-1221521876.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-1247830158.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-1312084298.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-1349021649.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-140463457.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-1422837648.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-1484115045.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-1664171640.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-1679274866.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-1730244221.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-1762298891.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-1793505080.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-1811709498.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-1853616114.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-1918652891.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-1955114895.mzv
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-197575042.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-1980798106.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-2051242133.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-2059754657.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-2070067303.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-2090470658.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-2095438133.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-2100935936.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-2112389804.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-2142171799.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-216461735.mtj&p2=1&p3=00893526423193413133461311967013&p4=0
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-239255367.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-278382806.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-375968895.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-415212258.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-496238047.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-548817273.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-552372009.mtj&p2=1&p3=05573116223801650475422016875089&p4=0
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-588305592.mtz
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-640813200.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-658204792.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-793296710.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-847671522.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-849123731.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-858833059.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-884829904.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-930097922.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\-964215608.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\1085487388.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\1216718136.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\1233604551.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\129412401.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\1367955459.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\1458822214.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\1469791542.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\1477322753.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\1542249177.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\1542844753.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\1591040817.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\1598846322.mtj&p2=1&p3=05573116223801650475422016875089&p4=0
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\1603222798.mtz
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\1618528935.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\1628515306.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\1921485894.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\2072772721.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\2116982963.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\2134591667.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\2141810586.mtj&p2=0&p3=00893526423193413133461311967013&p4=0
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\278638064.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\330542538.mzv
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\42983420.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\459914795.mtz
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\474409157.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\585968866.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\588984354.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\637043202.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\700165474.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\717979141.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\733833406.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\762397312.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\920665057.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\934227222.swf
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\992266171.mts
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\URLCache.ini
C:\DOCUME~1\Eric\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\UpdateVersionList_v2.mtx
C:\Program Files\Viewpoint
C:\Program Files\Viewpoint\Viewpoint Media Player\AxMetaStream.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\AxMetaStream_0305000D.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\ClassIDs.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\ComponentMgr_0305001C.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\ComponentRegistry.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\AOLUserShell.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\JpegReader.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\Mts3Reader.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\SceneComponent.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\SreeDMMX.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\SWFView.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\VMPSpeech.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\WaveletReader.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\DownLoadHist.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\HostRegistry.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\MetaStreamConfig.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\MetaStreamID.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\MtsAxInstaller.exe
C:\Program Files\Viewpoint\Viewpoint Media Player\MTSDownloadSites.txt
C:\WINDOWS\system32\dn184537be.dat
C:\WINDOWS\system32\kbduiu.dll
C:\WINDOWS\system32\mljjh.exe
C:\WINDOWS\system32\mwinrndt.exe
C:\WINDOWS\system32\pmnligf.dll
C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\Tasks\At10.job
C:\WINDOWS\Tasks\At11.job
C:\WINDOWS\Tasks\At12.job
C:\WINDOWS\Tasks\At13.job
C:\WINDOWS\Tasks\At14.job
C:\WINDOWS\Tasks\At15.job
C:\WINDOWS\Tasks\At16.job
C:\WINDOWS\Tasks\At17.job
C:\WINDOWS\Tasks\At18.job
C:\WINDOWS\Tasks\At19.job
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\Tasks\At20.job
C:\WINDOWS\Tasks\At21.job
C:\WINDOWS\Tasks\At22.job
C:\WINDOWS\Tasks\At23.job
C:\WINDOWS\Tasks\At24.job
C:\WINDOWS\Tasks\At3.job
C:\WINDOWS\Tasks\At4.job
C:\WINDOWS\Tasks\At5.job
C:\WINDOWS\Tasks\At6.job
C:\WINDOWS\Tasks\At7.job
C:\WINDOWS\Tasks\At8.job
C:\WINDOWS\Tasks\At9.job


((((((((((((((((((((((((( Files Created from 2007-07-07 to 2007-08-07 )))))))))))))))))))))))))))))))


2007-08-06 21:58 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-05 13:15 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2007-08-05 13:15 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution
2007-08-05 13:09 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-06 22:41 --------- d-------- C:\Program Files\Diablo II
2007-08-06 22:31 --------- d-------- C:\Program Files\Google
2007-08-06 22:27 43520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
2007-08-03 16:01 --------- d-------- C:\Program Files\Warcraft III
2007-06-29 18:02 --------- d-------- C:\Program Files\7-Zip
2007-06-09 11:32 --------- d-------- C:\Program Files\AIM6
2007-06-09 11:30 --------- d-------- C:\DOCUME~1\Eric\APPLIC~1\Comodo
2007-06-09 11:07 --------- d-------- C:\Program Files\Comodo
2007-06-08 21:07 --------- d-------- C:\Program Files\Alwil Software
2007-06-08 20:35 --------- d-------- C:\Program Files\Go!Zilla
2006-12-04 00:31 23 --a------ C:\WINDOWS\java\Packages\Data\UBNF1R9F.DAT
2006-12-04 00:31 1245 --a------ C:\WINDOWS\java\Packages\Data\AJ3ZN1ZZ.DAT
2006-03-29 20:56 2814 --a------ C:\WINDOWS\java\Packages\Data\7BN7VRFB.DAT
2006-03-29 20:56 23 --a------ C:\WINDOWS\java\Packages\Data\C9Z9JFLR.DAT
2006-03-29 17:50 23 --a------ C:\WINDOWS\java\Packages\Data\UVR13F5J.DAT
2006-03-29 17:50 1105 --a------ C:\WINDOWS\java\Packages\Data\AN9RB7RF.DAT
2006-02-04 05:01 23 --a------ C:\WINDOWS\java\Packages\Data\V7B577P3.DAT
2006-02-04 05:01 1105 --a------ C:\WINDOWS\java\Packages\Data\31VTBZTV.DAT
2004-01-22 23:57 2814 --a------ C:\WINDOWS\java\Packages\Data\PR57JNLB.DAT
2004-01-22 23:57 23 --a------ C:\WINDOWS\java\Packages\Data\TRP3JZBR.DAT
2004-01-21 18:56 23 --a------ C:\WINDOWS\java\Packages\Data\53N1JHBR.DAT
2004-01-21 18:56 1324 --a------ C:\WINDOWS\java\Packages\Data\HV133RHV.DAT
2004-01-21 18:50 23 --a------ C:\WINDOWS\java\Packages\Data\K6Y13DNX.DAT
2004-01-21 18:50 1105 --a------ C:\WINDOWS\java\Packages\Data\Z1BBNJ5Z.DAT
2003-12-12 00:50 1105 --a------ C:\WINDOWS\java\Packages\Data\TVLNLFF1.DAT
2003-06-06 01:09 1324 --a------ C:\WINDOWS\java\Packages\Data\P3LRBL3P.DAT
2003-04-22 19:40 2678 --a------ C:\WINDOWS\java\Packages\Data\XV713P75.DAT
2003-04-22 19:40 2678 --a------ C:\WINDOWS\java\Packages\Data\XRPB3XBH.DAT
2003-04-22 19:40 2678 --a------ C:\WINDOWS\java\Packages\Data\VRB1RPBH.DAT
2003-04-22 19:40 2678 --a------ C:\WINDOWS\java\Packages\Data\GNL7FFP3.DAT
2003-04-22 19:40 2678 --a------ C:\WINDOWS\java\Packages\Data\5F7T7DNH.DAT
2003-01-28 14:21 17144 --a------ C:\DOCUME~1\Eric\APPLIC~1\GDIPFONTCACHEV1.DAT
2003-01-17 12:22 3513 --a------ C:\Program Files\setuplog.txt
2003-01-16 13:10 23 --a------ C:\WINDOWS\java\Packages\Data\6LV793NX.DAT
2003-01-16 13:10 23 --a------ C:\WINDOWS\java\Packages\Data\4DRLV57D.DAT
2003-01-16 13:10 1299 --a------ C:\WINDOWS\java\Packages\Data\ZV3P3PBD.DAT
2003-01-16 13:10 1299 --a------ C:\WINDOWS\java\Packages\Data\7BV9V1RV.DAT
2002-06-17 13:48 538810 --a------ C:\Program Files\wait.bmp
2001-11-23 08:08 712704 -ra------ C:\WINDOWS\inf\OTHER\audio3d.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C-Media Mixer"="Mixer.exe" [2002-01-28 12:16 C:\WINDOWS\mixer.exe]
"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [2002-07-30 12:35]
"NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50]
"DeadAIM"="C:\Program Files\AIM95\\DeadAIM.ocm" [2003-02-24 16:11]
"CTRegRun"="C:\WINDOWS\CTRegRun.EXE" [1999-10-10 13:01]
"Disc Detector"="C:\Program Files\Creative\ShareDLL\ctnotify.exe" []
"type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe" [2004-06-03 04:51]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-14 19:05]
"COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2007-06-09 11:07]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-02-24 08:32]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ares"="C:\Program Files\Ares Lite Edition\Ares.exe" [2005-02-22 22:52]
"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [2002-08-28 23:41]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-04-27 17:17]
"BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" []
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-06 14:47]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-08-05 13:09:29]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04]
Post-itr Software Notes Lite.lnk - C:\Program Files\3M\PSNLite\PsnLite.exe [2003-10-09 15:08:32]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
@=

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

R0 Inspect;Comodo Network Engine;C:\WINDOWS\System32\DRIVERS\inspect.sys
R1 NPPTNT;NPPTNT;\??\C:\WINDOWS\System32\npptNT.sys
R2 NAVAPEL;NAVAPEL;\??\C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVAPEL.SYS
R2 Pctspk;PCTEL Speaker Phone;C:\WINDOWS\system32\pctspk.exe
R3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter;C:\WINDOWS\System32\DRIVERS\AN983.sys
R3 cmpci;C-Media PCI Audio Driver (WDM);C:\WINDOWS\System32\drivers\cmaudio.sys
R3 NAVAP;NAVAP;\??\C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVAP.sys
S3 AMDPCI;AMDPCI;\??\C:\DOCUME~1\Eric\LOCALS~1\Temp\AMDPCI.sys
S3 Bridge;MAC Bridge;C:\WINDOWS\System32\DRIVERS\bridge.sys
S3 BridgeMP;MAC Bridge Miniport;C:\WINDOWS\System32\DRIVERS\bridge.sys
S3 FTDIBUS;USB Serial Converter Driver;C:\WINDOWS\System32\drivers\ftdibus.sys
S3 FTSER2K;USB Serial Port Driver;C:\WINDOWS\System32\drivers\ftser2k.sys
S3 Ip6FwHlp;IPv6 Internet Connection Firewall;C:\WINDOWS\System32\svchost.exe -k netsvcs
S3 LucentSoftModem;Lucent Technologies Soft Modem;C:\WINDOWS\System32\DRIVERS\LTSM.sys
S3 nm;Network Monitor Driver;C:\WINDOWS\System32\DRIVERS\NMnt.sys
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\System32\drivers\npf.sys
S3 Ptserli;PCTEL Serial Device Driver for INTEL;C:\WINDOWS\System32\DRIVERS\ptserli.sys
S3 ROOTMODEM;Microsoft Legacy Modem Driver;C:\WINDOWS\System32\Drivers\RootMdm.sys
S3 USRpdA;U.S. Robotics 56K PCI Faxmodem Driver;C:\WINDOWS\System32\DRIVERS\USRpdA.sys


Contents of the 'Scheduled Tasks' folder
2007-08-05 22:36:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-06 23:27:47
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-06 23:29:46 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-06 23:29
C:\ComboFix2.txt ... 2007-08-06 22:15

--- E O F ---
elau1026 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-06-2007, 10:11 PM   #6 (permalink)
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
 
sUBs's Avatar
 
Join Date: May 2005
Posts: 23,246
OS: N/A


Re: Help...!! Pop ups and viruses....
Please upload this file:

C:\WINDOWS\system32\wbem\wmipdskq.dll

to this website: http://www.bleepingcomputer.com/subm....php?channel=4

Kindly include a link to this topic in the message
__________________
sUBs is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-07-2007, 06:08 AM   #7 (permalink)
Registered User
 
Join Date: Aug 2007
Posts: 10
OS: Win XP


Re: Help...!! Pop ups and viruses....
I submitted that dll file to the website as per your directions.

I also forgot to mention that my Windows Explorer had an error right after I performed the CFScript => ComboFix task in your second reply. Windows Explorer said that it needed to close and was sorry for the inconvenience.
elau1026 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-07-2007, 07:41 AM   #8 (permalink)
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
 
sUBs's Avatar
 
Join Date: May 2005
Posts: 23,246
OS: N/A


Re: Help...!! Pop ups and viruses....
wmipdskq.dll appears to be a false positive from Kaspersky. We'll ignore those files. Besides that one time, did Windows Explorer experience further errors?


------------


Open notepad and copy/paste the text in the quotebox below into it:

Code:
@echo off
if exist "%temp%\log.txt" del "%temp%\log.txt"

for %%g in (
"C:\Documents and Settings\Eric\Desktop\[4]-Submit_2007-08-06_231956.59.zip"
"C:\WINDOWS\Downloaded Program Files\popcaploader.dll"
) do (
del /a/f %%g >nul 2>&1
if exist %%g echo.%%g>>"%temp%\log.txt"
)

for %%g in (
"C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery"
"C:\Documents and Settings\Eric\.housecall6.6\Quarantine"
"C:\Documents and Settings\Eric\Desktop\Yay\backups"
%systemdrive%\Qoobox
) do (
rd /s/q %%g >nul 2>&1
if exist %%g echo.%%g>>"%temp%\log.txt"
)
if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!

echo.GetObject("winmgmts:" ^& "{impersonationLevel=impersonate}!\\" ^& "." ^& "\root\default").Get("SystemRestore").Disable("")>SR.vbs
echo.GetObject("winmgmts:" ^& "{impersonationLevel=impersonate}!\\" ^& "." ^& "\root\default").Get("SystemRestore").Enable("")>>SR.vbs
wscript SR.vbs

(
echo.REGEDIT4&echo.
echo.[hkey_current_user\software\microsoft\windows\currentversion\explorer\advanced]
echo."hidden"=dword:00000002
echo."hidefileext"=dword:00000001
echo."showsuperhidden"=dword:00000000
)>rehide.reg

regedit /s rehide.reg
del rehide.reg SR.vbs
nircmd wait 7000
del %0
Save this as fix.bat Choose to "Save type as - All Files"
It should look like this:
Double click on fix.bat & allow it to run

Post back to tell me what it says. Also tell me how the machine is behaving now
__________________
sUBs is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-07-2007, 08:10 AM   #9 (permalink)
Registered User
 
Join Date: Aug 2007
Posts: 10
OS: Win XP


Re: Help...!! Pop ups and viruses....
It ran and then said "Deleted Successfully!" then closed.

Besides that time, Windows explorer did have an error a few times prior. I would say 3, 4 times at least in the past week. My machine is also running slower than expected. IE takes a longer time to load than usual, and I get a warning for low virtual memory very often, which only happened recently.
elau1026 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-07-2007, 08:39 AM   #10 (permalink)
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
 
sUBs's Avatar
 
Join Date: May 2005
Posts: 23,246
OS: N/A


Re: Help...!! Pop ups and viruses....
Download & run this -> http://www.techsupportforum.com/sect...eckard/dss.exe

Post the logs it produces.
__________________
sUBs is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-07-2007, 09:50 AM   #11 (permalink)
Registered User
 
Join Date: Aug 2007
Posts: 10
OS: Win XP


Re: Help...!! Pop ups and viruses....
Deckard's System Scanner v20070804.61
Run by Eric on 2007-08-07 at 12:43:53
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 2 Restore Point(s) --
2: 2007-08-07 16:44:11 UTC - RP216 - Deckard's System Scanner Restore Point
1: 2007-08-07 15:08:00 UTC - RP215 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as Eric.exe) ------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:48:54 PM, on 8/7/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\3M\PSNLite\PsnLite.exe
C:\PROGRA~1\3M\PSNLite\PSNGive.exe
C:\Program Files\AIM95\aim.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Eric\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Eric.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\Program Files\AIM95\\DeadAIM.ocm",ExportedCheckODLs
O4 - HKLM\..\Run: [CTRegRun] C:\WINDOWS\CTRegRun.EXE
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\ctnotify.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares Lite Edition\Ares.exe" -h
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp /HIDEBL
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Post-itŪ Software Notes Lite.lnk = C:\Program Files\3M\PSNLite\PsnLite.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O16 - DPF: Video Poker - http://download.games.yahoo.com/game...s/y/vpt0_x.cab
O16 - DPF: Yahoo! Graffiti - http://download.games.yahoo.com/game...s/y/grt5_x.cab
O16 - DPF: Yahoo! Literati - http://download2.games.yahoo.com/gam...ts/y/tt5_x.cab
O16 - DPF: Yahoo! MahJong - http://download.games.yahoo.com/game...ts/y/ot0_x.cab
O16 - DPF: Yahoo! Word Racer - http://download.games.yahoo.com/game...ts/y/wt0_x.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework...ex/TmHcmsX.CAB
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} (KX-HCM10 Control) - http://cam.cs.cmu.edu/kxhcm10.ocx
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - http://mail.cgsinc.com/iNotes6W.cab
O16 - DPF: {405BBF5B-2FD8-4614-AC51-D8566F635B94} (SafeWallet Class) - http://idsm.citadelprocessing.com/Sa.../WalletCab.CAB
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {58172624-85DD-4482-9E64-02ADCA637E96} - http://www.kungfuchess.com/activex/web591.cab
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/game...lugin11USA.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1186334110578
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.blizzard.com/register/wowbeta/si.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor...o.cab55579.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/game...Plugin9USA.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2873BC0F-45A5-4ECB-AC7F-126E7784A40E}: NameServer = 66.92.159.2,216.231.41.2
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe

--
End of file - 8604 bytes

-- File Associations -----------------------------------------------------------

.cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 NPPTNT - c:\windows\system32\npptnt.sys <Not Verified; INCA Internet Co., Ltd.; nProtect NPSC Kernel Mode Driver for NT>
R3 catchme - c:\docume~1\eric\locals~1\temp\catchme.sys (file missing)

S3 AMDPCI - c:\docume~1\eric\locals~1\temp\amdpci.sys (file missing)
S3 NPF (NetGroup Packet Filter Driver) - c:\windows\system32\drivers\npf.sys <Not Verified; CACE Technologies; WinPcap Netgroup Packet Filter Driver>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 EPSONStatusAgent2 (EPSON Printer Status Agent2) - c:\program files\common files\epson\ebapi\sagent2.exe <Not Verified; SEIKO EPSON CORPORATION; EPSON Bidirectional Printer>

S3 rpcapd (Remote Packet Capture Protocol v.0 (experimental)) - "c:\program files\winpcap\rpcapd.exe" -d -f "c:\program files\winpcap\rpcapd.ini" <Not Verified; CACE Technologies; Remote Packet Capture Daemon>
S4 Creative Service for CDROM Access - c:\windows\system32\ctsvccda.exe (file missing)


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Scheduled Tasks -------------------------------------------------------------

2007-08-05 18:36:00 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job


-- Files created between 2007-07-07 and 2007-08-07 -----------------------------

2007-08-07 12:46:40 0 d-------- C:\Program Files\Trend Micro
2007-08-06 23:32:35 0 d-------- C:\WINDOWS\System32\Kaspersky Lab
2007-08-06 23:32:33 0 d-------- C:\WINDOWS\LastGood
2007-08-05 13:15:44 0 d-------- C:\WINDOWS\System32\SoftwareDistribution
2007-08-05 13:09:29 0 d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2007-08-04 00:45:09 0 dr------- C:\Documents and Settings\LocalService\Favorites


-- Find3M Report ---------------------------------------------------------------

2007-08-07 12:21:10 0 d-------- C:\Program Files\Diablo II
2007-08-07 11:37:03 43520 --a------ C:\WINDOWS\System32\CmdLineExt03.dll
2007-08-06 22:31:07 0 d-------- C:\Program Files\Google
2007-08-06 22:05:19 0 d-a------ C:\Program Files\Common Files
2007-08-03 16:01:32 0 d-------- C:\Program Files\Warcraft III
2007-06-29 18:02:17 0 d-------- C:\Program Files\7-Zip
2007-06-09 11:32:59 0 d-------- C:\Program Files\AIM6
2007-06-09 11:30:05 0 d-------- C:\Documents and Settings\Eric\Application Data\Comodo
2007-06-09 11:07:39 0 d-------- C:\Program Files\Comodo
2007-06-08 21:07:44 0 d-------- C:\Program Files\Alwil Software
2007-06-08 20:35:30 0 d-------- C:\Program Files\Go!Zilla


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C-Media Mixer"="Mixer.exe" [01/28/2002 12:16 PM C:\WINDOWS\mixer.exe]
"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [07/30/2002 12:35 PM]
"NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [07/09/2001 12:50 PM]
"DeadAIM"="C:\Program Files\AIM95\\DeadAIM.ocm" [02/24/2003 04:11 PM]
"CTRegRun"="C:\WINDOWS\CTRegRun.EXE" [10/10/1999 01:01 PM]
"Disc Detector"="C:\Program Files\Creative\ShareDLL\ctnotify.exe" []
"type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe" [06/03/2004 04:51 AM]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [02/16/2007 10:54 AM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [03/14/2007 07:05 PM]
"COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [06/09/2007 11:07 AM]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [02/24/2005 08:32 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ares"="C:\Program Files\Ares Lite Edition\Ares.exe" [02/22/2005 10:52 PM]
"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [08/28/2002 11:41 PM]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [04/27/2007 05:17 PM]
"BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" []
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [07/06/2007 02:47 PM]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [8/5/2007 1:09:29 PM]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2/13/2001 2:01:04 AM]
Post-itr Software Notes Lite.lnk - C:\Program Files\3M\PSNLite\PsnLite.exe [10/9/2003 3:08:32 PM]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
@=

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background




-- End of Deckard's System Scanner: finished at 2007-08-07 at 12:49:27 ---------
elau1026 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-07-2007, 09:52 AM   #12 (permalink)
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
 
sUBs's Avatar
 
Join Date: May 2005
Posts: 23,246
OS: N/A


Re: Help...!! Pop ups and viruses....
Where's extra.txt ?
__________________
sUBs is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-07-2007, 09:57 AM   #13 (permalink)
Registered User
 
Join Date: Aug 2007
Posts: 10
OS: Win XP


Re: Help...!! Pop ups and viruses....
I don't see an extra.txt anywhere on the desktop.
elau1026 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-07-2007, 09:58 AM   #14 (permalink)
Registered User
 
Join Date: Aug 2007
Posts: 10
OS: Win XP


Re: Help...!! Pop ups and viruses....
Never mind, I found it.

Deckard's System Scanner v20070804.61
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Professional (build 2600) SP 1.0
Architecture: X86; Language: English

CPU 0: AMD Athlon(TM) XP 1700+
Percentage of Memory in Use: 29%
Physical Memory (total/avail): 767.51 MiB / 539.61 MiB
Pagefile Memory (total/avail): 1494.16 MiB / 1202.64 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1968.23 MiB

A: is Removable (No Media)
C: is Fixed (NTFS) - 55.89 GiB total, 25.57 GiB free.
D: is CDROM (CDFS)
E: is CDROM (No Media)


-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Eric\Application Data
CLASSPATH=.;C:\Program Files\Java\j2re1.4.1_01\lib\ext\QTJava.zip
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=ERICLAU
ComSpec=C:\WINDOWS\system32\cmd.exe
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Eric
LOGONSERVER=\\ERICLAU
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;C:\Program Files\QuickTime\QTSystem
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 8 Stepping 0, AuthenticAMD
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0800
ProgramFiles=C:\Program Files
PROMPT=$P$G
QTJAVA=C:\Program Files\Java\j2re1.4.1_01\lib\ext\QTJava.zip
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\Eric\LOCALS~1\Temp
TMP=C:\DOCUME~1\Eric\LOCALS~1\Temp
USERDOMAIN=ERICLAU
USERNAME=Eric
USERPROFILE=C:\Documents and Settings\Eric
windir=C:\WINDOWS


-- User Profiles ---------------------------------------------------------------

Eric (admin)


-- Add/Remove Programs ---------------------------------------------------------

--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\News\CTNews.isu"
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
AC3Filter (remove only) --> C:\Program Files\AC3Filter\uninstall.exe
Ad-aware 6 Personal --> C:\PROGRA~1\Lavasoft\AD-AWA~1\UNWISE.EXE C:\PROGRA~1\Lavasoft\AD-AWA~1\INSTALL.LOG
Adobe Acrobat 5.0 --> C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.isu" -c"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.dll"
Adobe Download Manager (Remove Only) --> "C:\Program Files\Common Files\Adobe\ESD\uninst.exe"
Adobe Flash Player ActiveX --> C:\WINDOWS\System32\Macromed\Flash\uninstall_activeX.exe
Adobe Photoshop 7.0 --> C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Adobe\Photoshop 7.0\Uninst.isu" -c"C:\Program Files\Adobe\Photoshop 7.0\Uninst.dll"
Advanced Networking Pack for Windows XP --> C:\WINDOWS\$NtUninstallKB817778$\spuninst\spuninst.exe
Ahead Nero - Burning Rom --> C:\WINDOWS\UNNERO.exe /UNINSTALL
AIM 6 --> C:\Program Files\AIM6\uninst.exe
AOL Instant Messenger --> C:\Program Files\AIM95\uninstll.exe -LOG= C:\Program Files\AIM95\install.log -OEM=
Apple Software Update --> MsiExec.exe /I{A260B422-70E1-41E2-957D-F76FA21266D5}
Ares 1.8.1 --> "C:\Program Files\Ares Lite Edition\uninstall.exe"
BitTornado 0.3.18 --> C:\Program Files\BitTornado\uninst.exe
COMODO Firewall Pro --> C:\Program Files\Comodo\Firewall\fwconfig.exe -uninstalln
Core FTP Lite 1.3 --> C:\PROGRA~1\CoreFTP\UNWISE.EXE C:\PROGRA~1\CoreFTP\INSTALL.LOG
DeadAIM --> MsiExec.exe /I{25AF0BD1-DF07-4447-8E91-28E99617C556}
Diablo II --> C:\WINDOWS\DIIUnin.exe C:\WINDOWS\DIIUnin.dat
Disc2Phone --> MsiExec.exe /I{FFAB5ABB-8AAB-42E2-847F-1743E51E01E9}
DivX 5.0.2 Bundle --> C:\WINDOWS\unvise32.exe C:\Program Files\DivX\uninstal.log
DivX Pro Codec --> C:\WINDOWS\unvise32.exe C:\Program Files\DivX\DivX Pro Bundle.log
EPSON Printer Software --> C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /R
ffdshow (remove only) --> "C:\Program Files\ffdshow\uninstall.exe"
FTDI USB Serial Converter Drivers --> C:\WINDOWS\System32\ftdiunin.exe C:\WINDOWS\System32\ftdiun2k.ini
Google Toolbar for Internet Explorer --> MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Toolbar for Internet Explorer --> regsvr32 /u /s "c:\program files\google\googletoolbar1.dll"
Google Updater --> "C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
Gunbound Revolution --> "c:\ijji\ENGLISH\Gunbound Revolution\unins000.exe"
HighMAT Extension to Microsoft Windows XP CD Writing Wizard --> MsiExec.exe /X{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}
HijackThis 2.0.0 --> "C:\Documents and Settings\Eric\Desktop\Yay\HijackThis.exe" /uninstall
iPod for Windows 2006-06-28 --> C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{BD57EA4D-026E-4F08-9B93-080E282B81FE} /l1033
iTunes --> MsiExec.exe /I{AB90749C-7422-4580-8A7A-66CC5E9E5F98}
Java 2 Runtime Environment Standard Edition v1.2.2 --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\JavaSoft\JRE\1.2\Uninst.isu"
Java 2 Runtime Environment, SE v1.4.1_01 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1666FA7C-CB5F-11D6-A78C-00B0D079AF64}\Setup.exe"
Java 2 SDK, SE v1.4.1_01 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1666FA7F-CB5F-11D6-A78C-00B0D079AF64}\setup.exe" Anytext
Java Web Start --> "C:\Program Files\Java Web Start\uninst-javaws.exe"
Kaspersky Online Scanner --> C:\WINDOWS\System32\KASPER~1\KASPER~1\kavuninstall.exe
KlprMon --> C:\PROGRA~1\CMU\KlprMon\UNWISE.EXE C:\PROGRA~1\CMU\KlprMon\INSTALL.LOG
LAVA! Player --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\LAVA Player\LAVA25.isu"
LiveUpdate 1.7 (Symantec Corporation) --> C:\Program Files\\Symantec\LiveUpdate\LSETUP.EXE /U
Microsoft Global IME for Office XP (Traditional Chinese) --> MsiExec.exe /X{57530F0E-5897-42C8-B57A-34F9B8BA4843}
Microsoft Office Professional Edition 2003 --> MsiExec.exe /I{91110409-6000-11D3-8CFE-0150048383C9}
Microsoft Office XP Professional with FrontPage --> MsiExec.exe /I{90280409-6000-11D3-8CFE-0050048383C9}
mp3-2-wav converter 1.14 --> C:\WINDOWS\iun506.exe C:\Program Files\Mp3 File Editor\plugins\\irunin_mp32wav.ini
NJStar Chinese WP --> C:\Program Files\NJStar Chinese WP\uninst.exe
NVIDIA Drivers --> C:\WINDOWS\System32\nvudisp.exe UninstallGUI
Outlook Express Q837009 --> C:\WINDOWS\oeuninst.exe C:\WINDOWS\INF\Q837009.inf
PCI Audio Driver --> cmuninst.exe
Post-itŪ Software Notes Lite --> "C:\Program Files\3M\PSNLite\Uninstall.exe" -Prog"C:\Program Files\3M\PSNLite\PsnLite.exe" -INI"C:\Program Files\3M\PSNLite\uninst.ini"
PowerDVD --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall
QuickTime --> MsiExec.exe /I{5E863175-E85D-44A6-8968-82507D34AE7F}
Shockwave --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
Spybot - Search & Destroy 1.4 --> "C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Starcraft --> C:\WINDOWS\SCunin.exe C:\WINDOWS\SCunin.dat
Symantec AntiVirus Client --> MsiExec.exe /X{0EFC6259-3AD8-4CD2-BC57-D4937AF5CC0E}
The Ur-Quan Masters 0.4.0 --> C:\Program Files\The Ur-Quan Masters\uninst.exe
Ventrilo Client --> MsiExec.exe /I{789289CA-F73A-4A16-A331-54D498CE069F}
Warcraft III: All Products --> C:\WINDOWS\War3Unin.exe C:\WINDOWS\War3Unin.dat
Winamp (remove only) --> "C:\Program Files\Winamp\UninstWA.exe"
Windows Blaster Worm Removal Tool (KB833330) --> C:\WINDOWS\$NtUninstallKB833330$\spuninst\spuninst.exe
Windows Media Encoder 9 Series --> msiexec.exe /I {E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
Windows Media Encoder 9 Series --> MsiExec.exe /I{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
WinPcap 3.1 --> C:\Program Files\WinPcap\uninstall.exe
WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe


-- Application Event Log -------------------------------------------------------

Event ID #301013: Error
Event Submitted/Written: 08/06/2007 11:22:21 PM
Event Source: Application Error
Event Description:
Faulting application explorer.exe, version 6.0.2800.1106, faulting module ntdll.dll, version 5.1.2600.1217, fault address 0x00033905.

Event ID #301012: Error
Event Submitted/Written: 08/06/2007 11:10:17 PM
Event Source: Application Hang
Event Description:
Hanging application IEXPLORE.EXE, version 6.0.2800.1106, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Event ID #301005: Error
Event Submitted/Written: 08/06/2007 05:44:45 PM
Event Source: Application Error
Event Description:
Faulting application game.exe, version 1.0.11.46, faulting module game.exe, version 1.0.11.46, fault address 0x00014053.

Event ID #300999: Error
Event Submitted/Written: 08/06/2007 10:50:52 AM
Event Source: Application Hang
Event Description:
Hanging application IEXPLORE.EXE, version 6.0.2800.1106, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Event ID #300996: Error
Event Submitted/Written: 08/05/2007 05:54:42 PM
Event Source: Application Error
Event Description:
Faulting application explorer.exe, version 6.0.2800.1106, faulting module unknown, version 0.0.0.0, fault address 0x00000012.



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event ID #38565: Error
Event Submitted/Written: 08/07/2007 00:42:14 PM
Event Source: DCOM
Event Description:
DCOM got error "%%1058" attempting to start the service StiSvc with arguments ""
in order to run the server:
{A1F4E726-8CF1-11D1-BF92-0060081ED811}

Event ID #38564: Warning
Event Submitted/Written: 08/07/2007 11:28:01 AM
Event Source: Dhcp
Event Description:
Your computer was not able to renew its address from the network (from the
DHCP Server) for the Network Card with network address 00036D1D2366. The following
error occurred:
%%121.
Your computer will continue to try and obtain an address on its own from
the network address (DHCP) server.

Event ID #38563: Error
Event Submitted/Written: 08/07/2007 11:27:56 AM
Event Source: DCOM
Event Description:
DCOM got error "%%1058" attempting to start the service StiSvc with arguments ""
in order to run the server:
{A1F4E726-8CF1-11D1-BF92-0060081ED811}

Event ID #38557: Error
Event Submitted/Written: 08/07/2007 11:07:10 AM
Event Source: DCOM
Event Description:
DCOM got error "%%1058" attempting to start the service StiSvc with arguments ""
in order to run the server:
{A1F4E726-8CF1-11D1-BF92-0060081ED811}

Event ID #38556: Error
Event Submitted/Written: 08/07/2007 11:07:10 AM
Event Source: DCOM
Event Description:
DCOM got error "%%1058" attempting to start the service StiSvc with arguments ""
in order to run the server:
{A1F4E726-8CF1-11D1-BF92-0060081ED811}



-- End of Deckard's System Scanner: finished at 2007-08-07 at 12:49:27 ---------
elau1026 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-07-2007, 10:02 AM   #15 (permalink)
Registered User
 
Join Date: Aug 2007
Posts: 10
OS: Win XP


Re: Help...!! Pop ups and viruses....
I also experienced something strange just now.. after I used the search function for extra.txt, I noticed my desktop was covered with .tmp files of MS Word documents. I recognize these as variations of ones I have on my computer... I had to delete them all just now (about 100 of them).
elau1026 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-07-2007, 10:11 AM   #16 (permalink)
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
 
sUBs's Avatar
 
Join Date: May 2005
Posts: 23,246
OS: N/A


Re: Help...!! Pop ups and viruses....
Quote:
Besides that time, Windows explorer did have an error a few times prior. I would say 3, 4 times at least in the past week. My machine is also running slower than expected. IE takes a longer time to load than usual, and I get a warning for low virtual memory very often, which only happened recently.
These are matters that happened before we began. Now that the malware is removed, they should be a thing of the past.

Quote:
Percentage of Memory in Use: 29%
Physical Memory (total/avail): 767.51 MiB / 539.61 MiB
Pagefile Memory (total/avail): 1494.16 MiB / 1202.64 MiB
Virtual Memory (total/ avail): 2047.88 MiB / 1968.23 MiB
You have plenty of memory. No worries about that. I recommend that you upgrade your browser to IE7. It's much more secure.


----------


Of the stuff Kaspersky found, C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\ is your antivirus program's quarantine cache. You should delete the contents. Please use Symantec's guide to remove the files from quarantine. http://service1.symantec.com/SUPPORT...on=1#_Section1


----------------------


Now that your system is clean, kindly follow these simple steps in order to keep your computer clean and secure:

  1. CLEAR & RESET SYSTEM RESTORE'S CACHE - (System Volume Information folder)
    Go to Start → Run → type control sysdm.cpl,,4 & press Enter
    • Tick on the checkbox - Turn off System Restore on all drives
    • Click Apply
    Turn it back 'On' by unticking the same checkbox & click OK


  2. ANTIVIRUS SOFTWARE
    It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

    See this link for a listing of some online & their stand-alone antivirus programs:

    Virus, Spyware, and Malware Protection and Removal Resources → http://www.bleepingcomputer.com/forums/topict405.html

    It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.


  3. FIREWALL
    Without a firewall your computer is succeptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here → http://www.bleepingcomputer.com/forums/tutorial60.html


  4. Microsoft Windows Update → http://www.windowsupdate.com
    Visit regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.


  5. SPYBOT - SEARCH & DESTROY
    Download and install Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here → http://www.bleepingcomputer.com/forums/tutorial43.html

  6. AD-AWARE
    Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here → http://www.bleepingcomputer.com/forums/tutorial48.html


  7. SPYWAREBLASTER
    SpywareBlaster prevents the installation of malicious ActiveX, adware, browser hijackers, dialers, and other potentially unwanted software. Blocks spyware/tracking cookies & restricts the actions of potentially unwanted sites.

    Unlike other programs, SpywareBlaster does not have to remain running in the background. A tutorial on installing & using this product can be found here → http://www.bleepingcomputer.com/forums/tutorial49.html


  8. IE-SPYAD
    IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. A tutorial on installing this product can be found here http://www.spywarewarrior.com/uiuc/resource.htm

Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.
  • http://www.trillian.cc → Trillian or http://www.miranda-im.com → Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)

  • http://www.mozilla.org/products/firefox/ - Firefox - Use this alternate browser. Whilst Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness.

  • http://java.com/en/index.jsp - Sun's Java - It's much more secure than Microsoft's Java Virtual Machine.

  • http://toolbar.google.com/ - Google Toolbar - Get the free google toolbar to help stop pop up windows.

  • http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT.

    ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.

    NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.

To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein - http://computercops.biz/postlite7736-.html

After doing all these, your system will be optimised against future threats.

It's okay to delete the Hijack This folder in a couple weeks if everything is working okay.
Have a safe & happy computing day.

Kindly respond to this thread once more so we can mark this thread as resolved.
__________________
sUBs is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-07-2007, 10:20 AM   #17 (permalink)
Registered User
 
Join Date: Aug 2007
Posts: 10
OS: Win XP


Re: Help...!! Pop ups and viruses....
Thank you so much! :)
elau1026 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
 

« Previous Thread | Next Thread »

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off



All times are GMT -7. The time now is 03:02 PM.

Contact Us - Tech Support Forum - Archive - Privacy Statement - Top


Copyright 2001 - 2009, Tech Support Forum
Home Tips Plus | Outdoor Basecamp | Automotive Support Forum

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84