Welcome to Tech Support Forum home to more then 136,000 problems solved. Issues have included: Spyware, Malware, Virus Issues, Windows, Microsoft, Linux, Networking, Security, Hardware, and Gaming Getting your problem solved is as easy as:
1. Registering for a free account
2. Asking your question
3. Receiving an answer

Registered members:
* Get free support
* Communicate privately with other members (PM).
* Removal of this message
* See fewer ads.
* And much more..

 


Want to know how to post a question? click here Having problems with spyware and pop-ups? First Steps
Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads
Reload this Page Constant Pop-ups from IE - HJT Log Review Please
User Name
Password
Site Map Register Donate Rules Blogs Mark Forums Read


Resolved HJT Threads Resolved spyware and popup issues.

 
 
LinkBack Thread Tools
Old 01-02-2008, 07:39 PM   #1 (permalink)
Registered User
 
Join Date: Jan 2008
Posts: 9
OS: XP


Constant Pop-ups from IE - HJT Log Review Please
I am getting constant empty IE windows popping up. I am also getting a random processes running called sys#############.exe (a random string of numbers) or win###########.exe

I've run virus scans and Spybot Search and Destroy.

Any help you can be is appreciated.

Anthony


Logfile of HijackThis v1.97.3
Scan saved at 9:27:32 PM, on 1/2/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5346.0005)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\QW50aG9ueSBQaW5uYXZhaWEsIEpyLg\command.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Micro Focus\Net Express\Base\bin\mfds.exe
C:\Program Files\Network Monitor\netmon.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Dell\Solution Center\service.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\winshow.exe
C:\WINDOWS\Gwang.exe
C:\WINDOWS\aPPPATCH\spool32.exe
C:\Program Files\WinAble\winable.exe
C:\Program Files\Router\Router.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Palm\Hotsync.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\sys09131074573.exe
C:\Documents and Settings\anthony\My Documents\HijackThis.exe

R3 - URLSearchHook: URLSearch Class - {965A592F-8EFA-4250-8630-7960230792F1} - C:\WINDOWS\system32\cdsm32.dll (file missing)
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Documents and Settings\anthony\Application Data\Mozilla\Profiles\default\3hiq6oty.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\anthony\Application Data\Mozilla\Profiles\default\3hiq6oty.slt\prefs.js)
O2 - BHO: (no name) - {00000000-d9e3-4bc6-a0bd-3d0ca4be5271} - (no file)
O2 - BHO: (no name) - {00000012-890e-4aac-afd9-eff6954a34dd} - (no file)
O2 - BHO: (no name) - {029e02f0-a0e5-4b19-b958-7bf2db29fb13} - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {12F02779-6D88-4958-8AD3-83C12D86ADC7} - (no file)
O2 - BHO: (no name) - {1adbcce8-cf84-441e-9b38-afc7a19c06a4} - (no file)
O2 - BHO: (no name) - {2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71} - (no file)
O2 - BHO: (no name) - {477840F3-BA52-44D9-8E41-38D61CAA010F} - C:\WINDOWS\system32\egmulhxk.dll (file missing)
O2 - BHO: (no name) - {51641ef3-8a7a-4d84-8659-b0911e947cc8} - (no file)
O2 - BHO: (no name) - {53C330D6-A4AB-419B-B45D-FD4411C1FEF4} - (no file)
O2 - BHO: (no name) - {54645654-2225-4455-44A1-9F4543D34546} - (no file)
O2 - BHO: (no name) - {669695bc-a811-4a9d-8cdf-ba8c795f261e} - (no file)
O2 - BHO: (no name) - {6A6E50DC-BFA8-4B40-AB1B-159E03E829FD} - C:\WINDOWS\system32\lmf32v.dll
O2 - BHO: (no name) - {6abc861a-31e7-4d91-b43b-d3c98f22a5c0} - (no file)
O2 - BHO: winlink module - {6CC1C91A-AE8B-4373-A5B4-28BA1851E39A} - C:\Documents and Settings\anthony\Application Data\winlink\winlink.dll
O2 - BHO: (no name) - {944864a5-3916-46e2-96a9-a2e84f3f1208} - (no file)
O2 - BHO: (no name) - {a4a435cf-3583-11d4-91bd-0048546a1450} - (no file)
O2 - BHO: (no name) - {b8875bfe-b021-11d4-bfa8-00508b8e9bd3} - (no file)
O2 - BHO: (no name) - {bb936323-19fa-4521-ba29-eca6a121bc78} - (no file)
O2 - BHO: (no name) - {c2680e10-1655-4a0e-87f8-4259325a84b7} - (no file)
O2 - BHO: (no name) - {c4ca6559-2cf1-48b6-96b2-8340a06fd129} - (no file)
O2 - BHO: (no name) - {c5af2622-8c75-4dfb-9693-23ab7686a456} - (no file)
O2 - BHO: (no name) - {ca1d1b05-9c66-11d5-a009-000103c1e50b} - (no file)
O2 - BHO: (no name) - {d8efadf1-9009-11d6-8c73-608c5dc19089} - (no file)
O2 - BHO: (no name) - {e9147a0a-a866-4214-b47c-da821891240f} - (no file)
O2 - BHO: (no name) - {e9306072-417e-43e3-81d5-369490beef7c} - (no file)
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM32\hpztsb02.exe
O4 - HKLM\..\Run: [DellSC] C:\Program Files\Dell\Solution Center\service.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [fash] C:\WINDOWS\fash.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [{ZN}] C:\Documents and Settings\anthony\Local Settings\Temp\TICHD003.exe CHD003
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [winshow] "C:\WINDOWS\winshow.exe"
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu77.exe 61A847B5BBF72815358B2B27128065E9C084320161C4661227A755E9C2933154389A284662EA4EBF968951185EFC412806867680AEDE604D64C2661375FE0FB68AD6
O4 - HKLM\..\Run: [io43mvuiw4kj] C:\WINDOWS\io43mvuiw4kj.exe
O4 - HKLM\..\Run: [TMT] C:\WINDOWS\Gwang.exe
O4 - HKLM\..\Run: [sys09131074573] C:\WINDOWS\sys09131074573.exe
O4 - HKCU\..\Run: [Tbul] "C:\WINDOWS\aPPPATCH\spool32.exe" -vt yazb
O4 - HKCU\..\Run: [WinAble] C:\Program Files\WinAble\winable.exe
O4 - HKCU\..\Run: [Router] C:\Program Files\Router\Router.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: TA_Start.lnk = C:\Documents and Settings\anthony\Local Settings\Temp\TICHD003.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\Hotsync.exe
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Encarta Encyclopedia (HKLM)
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia (HKLM)
O9 - Extra button: Define (HKLM)
O9 - Extra 'Tools' menuitem: Define (HKLM)
O9 - Extra button: Research (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O9 - Extra button: Dell Home (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {A4639D2F-774E-11D3-A490-00C04F6843FB} (IEAnimBehaviorFactory Class) - http://download.microsoft.com/downlo...-US/msorun.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
apinn237 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Important Information
Join the #1 Tech Support Forum Today - It's Totally Free!

TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free.

Join TechSupportforum.com Today - Click Here

Old 01-04-2008, 09:28 PM   #2 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,757
OS: 2000 Pro; XP Pro; XP Home


Re: Constant Pop-ups from IE - HJT Log Review Please
Hello and Welcome.

Your version of HijackThis is badly outdated. Please delete it.

Next....

Please follow MicroBell's 5 Step process outlined here:

http://www.techsupportforum.com/secu...oval-help.html

After running through all the steps, please post the requested logs.

If you have trouble with one of the steps, simply move on to the next one, and make note of it in your reply.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-04-2008, 11:21 PM   #3 (permalink)
Registered User
 
Join Date: Jan 2008
Posts: 9
OS: XP


Re: Constant Pop-ups from IE - HJT Log Review Please
I ran through the process:

1) none of the programs listed on step 1 were on my machine
2)I was unable to run the scan in step 2. When I clicked on the run scan button, a IE window opened and nothing happened. No scan initalized
3) IE-Spyad generated this response:

WARNING - the URLs below were Not Imported
They may be invalid or you may be trying to
import into the "Current User" Key, and the
entries already exist in the "Local Machine" Key.
------------------------------------------------------------------------------------------------------
svideocodec.com
iwebland.com
iweb-commerce.com
hotfreebies.com
gpisoft.com
coolwebsearch.com
coolfreepages.com
coolfreepage.com

4)My PC is updated (SP2)

5) DSS Logs

Deckard's System Scanner v20071014.68
Run by anthony on 2008-01-05 00:55:03
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
59: 2008-01-05 05:55:51 UTC - RP183 - Deckard's System Scanner Restore Point
58: 2008-01-05 05:20:48 UTC - RP182 - Software Distribution Service 3.0
57: 2008-01-05 03:25:16 UTC - RP181 - System Checkpoint
56: 2008-01-04 03:05:06 UTC - RP180 - System Checkpoint
55: 2008-01-02 20:56:22 UTC - RP179 - Installed Microsoft Office Professional Edition 2003


-- First Restore Point --
1: 2007-11-12 07:32:31 UTC - RP125 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.

System Drive C: has 1.38 GiB (less than 15%) free.


-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-01-05 01:02:19
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.5346.5)
Boot mode: Normal

Running processes:
C:\WINDOWS\SYSTEM32\smss.exe
C:\WINDOWS\SYSTEM32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\SYSTEM32\services.exe
C:\WINDOWS\SYSTEM32\lsass.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\SYSTEM32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\QW50aG9ueSBQaW5uYXZhaWEsIEpyLg\command.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Micro Focus\Net Express\Base\BIN\MFDS.EXE
C:\Program Files\Network Monitor\netmon.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\SYSTEM32\wdfmgr.exe
C:\WINDOWS\SYSTEM32\alg.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\SYSTEM32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Documents and Settings\anthony\Desktop\dss.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R3 - URLSearchHook: URLSearch Class - {965A592F-8EFA-4250-8630-7960230792F1} - C:\WINDOWS\system32\cdsm32.dll (file missing)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\lpcywinp.exe,C:\WINDOWS\system32\userinit.exe
O2 - BHO: (no name) - {00000000-d9e3-4bc6-a0bd-3d0ca4be5271} - (no file)
O2 - BHO: (no name) - {00000012-890e-4aac-afd9-eff6954a34dd} - (no file)
O2 - BHO: (no name) - {029e02f0-a0e5-4b19-b958-7bf2db29fb13} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {12F02779-6D88-4958-8AD3-83C12D86ADC7} - (no file)
O2 - BHO: (no name) - {1adbcce8-cf84-441e-9b38-afc7a19c06a4} - (no file)
O2 - BHO: (no name) - {2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71} - (no file)
O2 - BHO: egmulhxk.msdn_hlp - {477840F3-BA52-44D9-8E41-38D61CAA010F} - C:\WINDOWS\system32\egmulhxk.dll (file missing)
O2 - BHO: (no name) - {51641ef3-8a7a-4d84-8659-b0911e947cc8} - (no file)
O2 - BHO: (no name) - {53C330D6-A4AB-419B-B45D-FD4411C1FEF4} - (no file)
O2 - BHO: (no name) - {54645654-2225-4455-44A1-9F4543D34546} - (no file)
O2 - BHO: (no name) - {669695bc-a811-4a9d-8cdf-ba8c795f261e} - (no file)
O2 - BHO: LinkTracker Class - {6A6E50DC-BFA8-4B40-AB1B-159E03E829FD} - C:\WINDOWS\SYSTEM32\lmf32v.dll
O2 - BHO: (no name) - {6abc861a-31e7-4d91-b43b-d3c98f22a5c0} - (no file)
O2 - BHO: winlink module - {6CC1C91A-AE8B-4373-A5B4-28BA1851E39A} - C:\Documents and Settings\anthony\Application Data\winlink\winlink.dll
O2 - BHO: (no name) - {944864a5-3916-46e2-96a9-a2e84f3f1208} - (no file)
O2 - BHO: (no name) - {a4a435cf-3583-11d4-91bd-0048546a1450} - (no file)
O2 - BHO: (no name) - {b8875bfe-b021-11d4-bfa8-00508b8e9bd3} - (no file)
O2 - BHO: (no name) - {bb936323-19fa-4521-ba29-eca6a121bc78} - (no file)
O2 - BHO: (no name) - {c2680e10-1655-4a0e-87f8-4259325a84b7} - (no file)
O2 - BHO: (no name) - {c4ca6559-2cf1-48b6-96b2-8340a06fd129} - (no file)
O2 - BHO: (no name) - {c5af2622-8c75-4dfb-9693-23ab7686a456} - (no file)
O2 - BHO: (no name) - {ca1d1b05-9c66-11d5-a009-000103c1e50b} - (no file)
O2 - BHO: (no name) - {d8efadf1-9009-11d6-8c73-608c5dc19089} - (no file)
O2 - BHO: (no name) - {e9147a0a-a866-4214-b47c-da821891240f} - (no file)
O2 - BHO: (no name) - {e9306072-417e-43e3-81d5-369490beef7c} - (no file)
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM32\hpztsb02.exe
O4 - HKLM\..\Run: [DellSC] C:\Program Files\Dell\Solution Center\service.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [fash] C:\WINDOWS\fash.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [{ZN}] C:\Documents and Settings\anthony\Local Settings\Temp\TICHD003.exe CHD003
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [winshow] "C:\WINDOWS\winshow.exe"
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu77.exe 61A847B5BBF72815358B2B27128065E9C084320161C4661227A755E9C2933154389A284662EA4EBF968951185EFC412806867680AEDE604D64C2661375FE0FB68AD6
O4 - HKLM\..\Run: [io43mvuiw4kj] C:\WINDOWS\io43mvuiw4kj.exe
O4 - HKLM\..\Run: [TMT] C:\WINDOWS\Gwang.exe
O4 - HKLM\..\Run: [sys09131074573] C:\WINDOWS\sys09131074573.exe
O4 - HKLM\..\RunOnce: [wextract_cleanup0] rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\anthony\LOCALS~1\Temp\IXP000.TMP\"
O4 - HKCU\..\Run: [Tbul] "C:\WINDOWS\aPPPATCH\spool32.exe" -vt yazb
O4 - HKCU\..\Run: [WinAble] C:\Program Files\WinAble\winable.exe
O4 - HKCU\..\Run: [Router] C:\Program Files\Router\Router.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [MSMSGS] C:\PROGRA~1\MESSEN~1\msmsgs.exe /background (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [MSMSGS] C:\PROGRA~1\MESSEN~1\msmsgs.exe /background (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [MSMSGS] C:\PROGRA~1\MESSEN~1\msmsgs.exe /background (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Printing Migration] rundll32.exe C:\WINDOWS\System32\spool\migrate.dll,ProcessWin9xNetworkPrinters (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MSMSGS] C:\PROGRA~1\MESSEN~1\msmsgs.exe /background (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [Printing Migration] rundll32.exe C:\WINDOWS\System32\spool\migrate.dll,ProcessWin9xNetworkPrinters (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: TA_Start.lnk = C:\Documents and Settings\anthony\Local Settings\Temp\TICHD003.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: HotSync Manager.lnk = ?
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {A4639D2F-774E-11D3-A490-00C04F6843FB} (IEAnimBehaviorFactory Class) - http://download.microsoft.com/downlo...-US/msorun.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O18 - Protocol: lid - {5C135180-9973-46D9-ABF4-148267CBB8BF} - C:\WINDOWS\SYSTEM32\msvidctl.dll
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL
O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL
O18 - Protocol: ndwiat - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\SYSTEM32\wiascr.dll
O18 - Filter: text/html - {DFAA31C8-A356-4313-9D95-5EDAB46C5070} - C:\WINDOWS\SYSTEM32\lmf32v.dll
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\QW50aG9ueSBQaW5uYXZhaWEsIEpyLg\command.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Micro Focus Directory Server (mf_CCITCP2) - Unknown owner - C:\Program Files\Micro Focus\Net Express\Base\BIN\MFDS.EXE
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: SavRoam - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe


--
End of file - 11904 bytes

-- File Associations -----------------------------------------------------------

.bat - batfile - DefaultIcon - C:\WINDOWS\SYSTEM32\SHELL32.DLL,-153
.com - comfile - DefaultIcon - C:\WINDOWS\SYSTEM32\SHELL32.DLL,2
.hlp - hlpfile - DefaultIcon - C:\WINDOWS\SYSTEM32\SHELL32.DLL,23
.ini - inifile - DefaultIcon - C:\PROGRAM FILES\SUPER NOTETAB\NOTETAB.EXE,1
.ini - inifile - shell\open\command - notepad.exe %1
.js - JSFile - DefaultIcon - C:\Program Files\Macromedia\Dreamweaver 4\Dreamweaver.exe,2
.js - JSFile - shell\open\command - "C:\Program Files\Macromedia\Dreamweaver 4\Dreamweaver.exe" "%1"
.reg - regfile - DefaultIcon - C:\WINDOWS\regedit.exe,1
.txt - txtfile - DefaultIcon - C:\PROGRAM FILES\SUPER NOTETAB\NOTETAB.EXE,1
.txt - txtfile - shell\open\command - notepad.exe %1
.vbs - VBSFile - DefaultIcon - C:\WINDOWS\System32\migicons.exe,11


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

All drivers whitelisted.


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service>
R2 cmdService (Command Service) - c:\windows\qw50ag9uesbqaw5uyxzhawesiepylg\command.exe
R2 mf_CCITCP2 (Micro Focus Directory Server) - "c:\program files\micro focus\net express\base\bin\mfds.exe"
R2 Network Monitor - c:\program files\network monitor\netmon.exe service


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Scheduled Tasks -------------------------------------------------------------

2008-01-05 00:04:02 360 --a------ C:\WINDOWS\Tasks\PCHealth Scheduler for Data Collection.job
2008-01-02 23:00:02 502 --a------ C:\WINDOWS\Tasks\Tune-up Application Start.job
2008-01-01 13:43:06 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
2005-06-05 20:24:36 416 --a------ C:\WINDOWS\Tasks\Symantec NetDetect.job


-- Files created between 2007-12-05 and 2008-01-05 -----------------------------

2008-01-05 00:29:31 0 d-------- C:\ie-spyad_zo
2008-01-05 00:25:55 0 d-------- C:\Program Files\SpywareBlaster
2008-01-05 00:20:59 0 d-------- C:\WINDOWS\LastGood
2008-01-03 21:47:07 0 d-------- C:\Program Files\MSECache
2008-01-02 21:17:53 0 --a------ C:\WINDOWS\sys09131074573.exe
2008-01-02 21:00:31 0 --a------ C:\WINDOWS\win3202107457313.exe
2008-01-02 17:35:06 0 d-------- C:\Program Files\Common Files\L&H
2008-01-02 17:23:28 0 d-------- C:\Program Files\Microsoft ActiveSync
2008-01-02 15:58:56 0 d-------- C:\Program Files\Microsoft.NET
2008-01-02 15:37:24 0 dr-h----- C:\MSOCache
2007-12-18 18:25:08 11008 --a------ C:\WINDOWS\xxxvideo.exe
2007-12-18 17:55:43 14848 --a------ C:\WINDOWS\eventlowg.dll
2007-12-18 17:55:42 9984 --a------ C:\WINDOWS\daxtime.dll
2007-12-18 17:55:41 25856 --a------ C:\WINDOWS\system32\msole32.exe
2007-12-18 17:55:41 12800 --a------ C:\WINDOWS\liqui.dll
2007-12-18 17:55:40 17152 --a------ C:\WINDOWS\liqui-Uninstaller.exe
2007-12-18 17:55:40 26624 --a------ C:\WINDOWS\liqui.exe
2007-12-18 17:55:40 13312 --a------ C:\WINDOWS\fhfmm.exe
2007-12-18 17:55:39 29440 --a------ C:\WINDOWS\xadbrk.exe
2007-12-18 17:55:39 20224 --a------ C:\WINDOWS\xadbrk.dll
2007-12-18 17:55:39 12800 --a------ C:\WINDOWS\fhfmm-Uninstaller.exe
2007-12-18 17:55:38 26880 --a------ C:\WINDOWS\xadbrk_.exe
2007-12-18 17:55:37 24832 --a------ C:\WINDOWS\kkcomp.exe
2007-12-18 17:55:37 31488 --a------ C:\WINDOWS\kkcomp.dll
2007-12-18 17:55:36 30208 --a------ C:\WINDOWS\kkcomp$.exe
2007-12-18 17:55:35 19200 --a------ C:\WINDOWS\liqad.exe
2007-12-18 17:55:35 8192 --a------ C:\WINDOWS\liqad.dll
2007-12-18 17:55:35 17920 --a------ C:\WINDOWS\liqad$.exe
2007-12-18 17:55:30 11776 --a------ C:\WINDOWS\jd2002.dll
2007-12-18 17:55:30 9728 --a------ C:\WINDOWS\adbar.dll
2007-12-18 17:55:29 29952 --a------ C:\WINDOWS\system32\ESHOPEE.exe
2007-12-18 17:55:29 25600 --a------ C:\WINDOWS\spredirect.dll
2007-12-18 17:55:27 0 d-------- C:\Program Files\e-zshopper
2007-12-18 17:55:23 0 d-------- C:\Program Files\amsys
2007-12-18 17:55:21 15360 --a------ C:\WINDOWS\aconti.exe
2007-12-18 17:55:20 25600 --a------ C:\WINDOWS\ie_32.exe
2007-12-18 17:55:18 0 d-------- C:\WINDOWS\system32\acespy
2007-12-18 17:55:18 11520 --a------ C:\WINDOWS\system32\ace16win.dll
2007-12-18 17:55:17 0 d-------- C:\Program Files\Accoona
2007-12-18 17:55:16 17920 --a------ C:\WINDOWS\ngd.dll
2007-12-18 17:55:13 18176 --a------ C:\WINDOWS\dp0.dll
2007-12-18 17:55:12 4 --a------ C:\WINDOWS\system32\stfv.bin
2007-12-18 17:55:10 0 d-------- C:\Program Files\p2pnetworks
2007-12-18 17:55:05 18688 --a------ C:\WINDOWS\vxddsk.exe
2007-12-18 17:55:05 0 d-------- C:\Program Files\akl
2007-12-18 17:55:04 29184 --a------ C:\WINDOWS\system32\wml.exe
2007-12-18 17:55:04 15360 --a------ C:\WINDOWS\system32\vxddsk.exe
2007-12-18 17:55:03 27392 --a------ C:\WINDOWS\wml.exe
2007-12-18 17:55:02 17664 --a------ C:\WINDOWS\flt.dll
2007-12-18 17:55:02 10496 --a------ C:\WINDOWS\7search.dll
2007-12-18 17:55:02 15360 --a------ C:\WINDOWS\764.exe
2007-12-18 17:55:01 29952 --a------ C:\WINDOWS\pbar.dll
2007-12-18 17:54:45 0 d-------- C:\Program Files\3721
2007-12-18 00:02:44 0 --a------ C:\WINDOWS\Gwang.exe
2007-12-18 00:01:45 12 --a------ C:\WINDOWS\system32\dpqaqlqx.bin
2007-12-17 23:58:27 0 d-------- C:\WINDOWS\system32\ineWc02
2007-12-17 23:58:13 36352 --a------ C:\WINDOWS\winshow.exe <Not Verified; ; winshow>
2007-12-14 21:58:10 0 d-------- C:\Program Files\Router
2007-12-13 20:33:41 0 d-------- C:\Program Files\WinAble
2007-12-06 02:45:30 0 d-------- C:\Program Files\Temporary


-- Find3M Report ---------------------------------------------------------------

2007-12-19 00:30:28 1100 --a------ C:\WINDOWS\system32\d3d8caps.dat
2007-12-17 23:59:34 41723 ---hs---- C:\Program Files\Common Files\Yazzle1549OinUninstaller.exe
2007-11-27 08:58:44 687592 --a------ C:\WINDOWS\system32\atmtd.dll
2007-11-27 08:58:32 0 d-------- C:\Program Files\Network Monitor
2007-11-27 08:58:26 0 d-------- C:\Program Files\InetGet2
2007-11-25 23:46:54 0 d-------- C:\Program Files\?ppPatch
2007-11-06 17:09:06 0 d-------- C:\Program Files\iTunes
2007-11-06 17:05:58 0 d-------- C:\Program Files\QuickTime
2007-10-25 08:24:20 53760 --a------ C:\WINDOWS\b122.exe


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00000000-d9e3-4bc6-a0bd-3d0ca4be5271}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00000012-890e-4aac-afd9-eff6954a34dd}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{029e02f0-a0e5-4b19-b958-7bf2db29fb13}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1adbcce8-cf84-441e-9b38-afc7a19c06a4}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{477840F3-BA52-44D9-8E41-38D61CAA010F}]
C:\WINDOWS\system32\egmulhxk.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{51641ef3-8a7a-4d84-8659-b0911e947cc8}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53C330D6-A4AB-419B-B45D-FD4411C1FEF4}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54645654-2225-4455-44A1-9F4543D34546}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{669695bc-a811-4a9d-8cdf-ba8c795f261e}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6A6E50DC-BFA8-4B40-AB1B-159E03E829FD}]
11/17/2004 12:42 PM 155648 --a------ C:\WINDOWS\system32\lmf32v.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6abc861a-31e7-4d91-b43b-d3c98f22a5c0}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6CC1C91A-AE8B-4373-A5B4-28BA1851E39A}]
10/30/2003 08:34 AM 35840 --a------ C:\Documents and Settings\anthony\Application Data\winlink\winlink.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{944864a5-3916-46e2-96a9-a2e84f3f1208}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a4a435cf-3583-11d4-91bd-0048546a1450}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b8875bfe-b021-11d4-bfa8-00508b8e9bd3}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bb936323-19fa-4521-ba29-eca6a121bc78}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c2680e10-1655-4a0e-87f8-4259325a84b7}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c4ca6559-2cf1-48b6-96b2-8340a06fd129}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c5af2622-8c75-4dfb-9693-23ab7686a456}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ca1d1b05-9c66-11d5-a009-000103c1e50b}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d8efadf1-9009-11d6-8c73-608c5dc19089}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e9147a0a-a866-4214-b47c-da821891240f}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e9306072-417e-43e3-81d5-369490beef7c}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SystemTray"="SysTray.Exe" [08/23/2001 12:00 PM C:\WINDOWS\SYSTEM32\systray.exe]
"Microsoft Works Portfolio"="C:\Program Files\Microsoft Works\WksSb.exe" [08/10/2000 12:00 PM]
"AdaptecDirectCD"="C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" [09/02/2002 09:06 PM]
"LoadPowerProfile"="powrprof.dll" [08/04/2004 03:56 AM C:\WINDOWS\SYSTEM32\powrprof.dll]
"HPDJ Taskbar Utility"="C:\WINDOWS\SYSTEM32\hpztsb02.exe" [01/30/2001 02:14 PM]
"DellSC"="C:\Program Files\Dell\Solution Center\service.exe" [11/22/2000 11:20 AM]
"WorksFUD"="C:\Program Files\Microsoft Works\wkfud.exe" [08/10/2000 12:00 PM]
"fash"="C:\WINDOWS\fash.exe" []
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [02/29/2004 04:44 PM]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [03/12/2004 03:18 PM]
"OrderReminder"="C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [01/30/2006 04:00 AM]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [07/07/2006 06:15 PM]
"itype"="C:\Program Files\Microsoft IntelliType Pro\itype.exe" [07/07/2006 07:14 PM]
"{ZN}"="C:\Documents and Settings\anthony\Local Settings\Temp\TICHD003.exe" []
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [10/10/2007 07:51 PM]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [10/19/2007 08:16 PM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [11/02/2007 06:36 PM]
"winshow"="C:\WINDOWS\winshow.exe" [12/17/2007 11:58 PM]
"runner1"="C:\WINDOWS\mrofinu77.exe" []
"io43mvuiw4kj"="C:\WINDOWS\io43mvuiw4kj.exe" []
"TMT"="C:\WINDOWS\Gwang.exe" []
"sys09131074573"="C:\WINDOWS\sys09131074573.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="" []
"Tbul"="C:\WINDOWS\aPPPATCH\spool32.exe" [11/25/2007 11:46 PM]
"WinAble"="C:\Program Files\WinAble\winable.exe" [12/13/2007 08:33 PM]
"Router"="C:\Program Files\Router\Router.exe" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 03:56 AM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"wextract_cleanup0"=rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\anthony\LOCALS~1\Temp\IXP000.TMP\"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"Printing Migration"=rundll32.exe C:\WINDOWS\System32\spool\migrate.dll,ProcessWin9xNetworkPrinters

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"MSMSGS"=C:\PROGRA~1\MESSEN~1\msmsgs.exe /background

C:\Documents and Settings\anthony\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [9/23/2001 10:02:00 PM]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="C:\WINDOWS\system32\lpcywinp.exe,C:\WINDOWS\system32\userinit.exe"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{17c5cce0-14a5-11dc-8678-009027d5d4f8}]
AutoRun\command- F:\LaunchU3.exe -a

*Newly Created Service* - CLR_OPTIMIZATION_V2.0.50727_32

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\^RNA]
rundll rnasetup.dll,installoptionalcomponent rna

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:WIN9X /user /install
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:IE50 /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:IE50 /user /install



-- End of Deckard's System Scanner: finished at 2008-01-05 01:04:04 ------------

extra.txt is attached

Thanks for the help
Attached Files
File Type: txt extra.txt (22.4 KB, 2 views)
apinn237 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-04-2008, 11:52 PM   #4 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,757
OS: 2000 Pro; XP Pro; XP Home


Re: Constant Pop-ups from IE - HJT Log Review Please
Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

Is your Symantec AntiVirus subscription current?

---------------------------------------------------------------------------------------------
  1. Download ComboFix from one of these locations:

    Link 1
    Link 2
    Link 3

    * IMPORTANT !!! Place combofix.exe on your Desktop
  2. Disconnect from the internet....pull the plug!
  3. Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
  4. Go to -> Run -> paste in the following single line command & click OK

    "%userprofile%\desktop\combofix.exe" /killall



  5. Follow the prompts. Type "1" and press Enter to begin the scan.
  6. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
  7. When finished, it shall produce a log for you. Post that log in your next reply

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

    ---------------------------------------------------------------------------------------------
  8. Ensure your AntiVirus and AntiSpyware applications are re-enabled. A reboot should have done this.
  9. Re-establish an internet connection.
  10. Please download HijackThis to your desktop

    Alternate link

    Double-click on the file you just downloaded.
    Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis

    Upon install, HijackThis should open for you.

    Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe

    1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'.
    2. If you don't get the intro screen, just hit Scan and then click on Save log.
    3. Post the hijackthis.log file here. Do not fix anything in HijackThis since they may be harmless.


    ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-05-2008, 10:37 PM   #5 (permalink)
Registered User
 
Join Date: Jan 2008
Posts: 9
OS: XP


Re: Constant Pop-ups from IE - HJT Log Review Please
My virus protection is up to date

Attached are the two log files

ComboFix 08-01-06.4 - anthony 2008-01-06 0:12:32.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.249 [GMT -5:00]
Running from: C:\Documents and Settings\anthony\desktop\combofix.exe
Command switches used :: /killall
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data.\winantispyware 2007
C:\Documents and Settings\All Users\Application Data.\winantispyware 2007\Data\Abbr
C:\Documents and Settings\All Users\Application Data.\winantispyware 2007\Data\ProductCode
C:\Documents and Settings\All Users\Application Data\WinAntiSpyware 2007\Data\Abbr
C:\Documents and Settings\All Users\Application Data\WinAntiSpyware 2007\Data\ProductCode
C:\Documents and Settings\anthony\Application Data\macromedia\Flash Player\#SharedObjects\H55S6C7H\www.broadcaster.com
C:\Documents and Settings\anthony\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\anthony\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\Documents and Settings\anthony\Application Data\WinAntiSpyware 2006
C:\Documents and Settings\anthony\Application Data\WinAntiSpyware 2006\Logs\update.log
C:\Documents and Settings\anthony\Application Data\WinAntiSpyware 2007
C:\Documents and Settings\anthony\Application Data\WinAntiSpyware 2007\Logs\update.log
C:\Documents and Settings\anthony\Start Menu\Programs\Startup\ta_start.lnk
C:\Documents and Settings\LocalService\Application Data\NetMon
C:\Documents and Settings\LocalService\Application Data\NetMon\domains.txt
C:\Documents and Settings\LocalService\Application Data\NetMon\log.txt
C:\Program Files\3721
C:\Program Files\3721\assist\asbar.dll
C:\Program Files\3721\helper.dll
C:\Program Files\Accoona
C:\Program Files\Accoona\ASearchAssist.dll
C:\Program Files\akl
C:\Program Files\akl\akl.dll
C:\Program Files\akl\akl.exe
C:\Program Files\akl\curlog.htm
C:\Program Files\akl\keylog.txt
C:\Program Files\akl\readme.txt
C:\Program Files\akl\uninstall.exe
C:\Program Files\akl\unsetup.dat
C:\Program Files\akl\unsetup.exe
C:\Program Files\amsys
C:\Program Files\amsys\awmsg.dat
C:\Program Files\amsys\mfc42.dll
C:\Program Files\amsys\msvcrt.dll
C:\Program Files\amsys\unins000.dat
C:\Program Files\amsys\unis000.exe
C:\Program Files\amsys\winam.dat
C:\Program Files\Common Files\stem~1
C:\Program Files\Common Files\winantispyware 2007
C:\Program Files\Common Files\winantispyware 2007\err.log
C:\Program Files\Common Files\Yazzle1549OinAdmin.exe
C:\Program Files\Common Files\Yazzle1549OinUninstaller.exe
C:\Program Files\e-zshopper
C:\Program Files\e-zshopper\BarLcher.dll
C:\Program Files\inetget2
C:\Program Files\network monitor
C:\Program Files\network monitor\netmon.exe
C:\Program Files\p2pnetworks
C:\Program Files\p2pnetworks\amp2pl.exe
C:\Program Files\Router
C:\Program Files\Router\UnInstall.exe
C:\Program Files\Temporary
C:\Program Files\WinAble
C:\Program Files\WinAble\winable.exe
C:\Program Files\winantispyware 2006 free
C:\Program Files\winantispyware 2006 free\sr.log
C:\Program Files\winantispyware 2007
C:\Program Files\WinAntiSpyware 2007\Activate.dat
C:\Program Files\WinAntiSpyware 2007\appupdate.dat
C:\Program Files\WinAntiSpyware 2007\AsAgents.xml
C:\Program Files\winantispyware 2007\AutoProcess.dat
C:\Program Files\winantispyware 2007\bnlink.dat
C:\Program Files\WinAntiSpyware 2007\database\enemies.dat
C:\Program Files\WinAntiSpyware 2007\database\knownfiles.dat
C:\Program Files\winantispyware 2007\database\TEBase.dat
C:\Program Files\winantispyware 2007\database\vbpv.dat
C:\Program Files\WinAntiSpyware 2007\dbupdate.dat
C:\Program Files\winantispyware 2007\lapv.dat
C:\Program Files\winantispyware 2007\license.rtf
C:\Program Files\winantispyware 2007\manual.pdf
C:\Program Files\winantispyware 2007\manual.url
C:\Program Files\WinAntiSpyware 2007\monstate.dat
C:\Program Files\WinAntiSpyware 2007\ps.dat
C:\Program Files\WinAntiSpyware 2007\pv.dat
C:\Program Files\WinAntiSpyware 2007\quaratine.dat\#post_quarantine
C:\Program Files\winantispyware 2007\readme.rtf
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\21b204f4d7c44fafd4da48af\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\21b204f4d7c44fafd4da48af\#startup
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\2b1e55a94bef464e1fd92dbe\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\2b1e55a94bef464e1fd92dbe\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\309f0c0764c54bd75bedf0b5\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\309f0c0764c54bd75bedf0b5\#startup
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\31592b54cbc04b59c4ca2e89\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\31592b54cbc04b59c4ca2e89\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\3161f64a59b9420f63d92694\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\3161f64a59b9420f63d92694\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\342d32e5739f4fb321f224a5\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\342d32e5739f4fb321f224a5\#startup
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\3683507ff70d4095561e13a8\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\3683507ff70d4095561e13a8\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\38830725a881423d05f7e887\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\38830725a881423d05f7e887\#startup
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\3ac8162b95e341e8f81762b1\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\3ac8162b95e341e8f81762b1\#startup
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\41c1bdbe6fe240c9de467e9d\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\41c1bdbe6fe240c9de467e9d\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\453754cae24d4e9f7d5ad9be\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\453754cae24d4e9f7d5ad9be\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\46a0fbf66d814b61f9b58d98\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\46a0fbf66d814b61f9b58d98\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\53a5dbec06614c3df7ccf194\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\53a5dbec06614c3df7ccf194\#startup
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\58c5d5d34fa24baf56e54695\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\58c5d5d34fa24baf56e54695\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\58c5d5d34fa24baf56e54695\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\67bd4b89506147cb3560d285\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\67bd4b89506147cb3560d285\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\6a4ca109516341842f05f689\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\6a4ca109516341842f05f689\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\6bcb78a910544f3497f09eb0\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\6bcb78a910544f3497f09eb0\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\6d6a290d788042541b1dc89e\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\6d6a290d788042541b1dc89e\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\70f5fd72997d4019fcbfc087\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\70f5fd72997d4019fcbfc087\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\737eb869f0554797492e0c98\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\737eb869f0554797492e0c98\#startup
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\7acc884db8e241f27746e0bc\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\7acc884db8e241f27746e0bc\#startup
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\8775b51e56dc49c7bcdb568c\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\8775b51e56dc49c7bcdb568c\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\8a5690b889d146c95f585a85\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\8a5690b889d146c95f585a85\#startup
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\8c956d3962a3470d2697d2b5\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\8c956d3962a3470d2697d2b5\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\8d145fac778540fd10ac14aa\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\8d145fac778540fd10ac14aa\#startup
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\921977dc01da49948fffd7b2\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\921977dc01da49948fffd7b2\#startup
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\92b27d394d9d45f11cdc68af\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\92b27d394d9d45f11cdc68af\#startup
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\9c3722cd7c3d40b1b763b68b\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\9c3722cd7c3d40b1b763b68b\#startup
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\a37b1a5b4dd247b98b2a36a1\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\a37b1a5b4dd247b98b2a36a1\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\a4049761620740bc65df2caa\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\a4049761620740bc65df2caa\#startup
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\a7a6e99d381b42d15f79d3a9\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\a7a6e99d381b42d15f79d3a9\#startup
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\ac01ae953c1b4d8540cc79b2\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\ac01ae953c1b4d8540cc79b2\#startup
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\ae65e03d2fe444e13b6aa7b5\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\ae65e03d2fe444e13b6aa7b5\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\b40b473534a449dd480e3f87\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\b40b473534a449dd480e3f87\#startup
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\b7164a647fdd48f1fc1b0c89\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\b7164a647fdd48f1fc1b0c89\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\bb003e02e1c8404e8638fa96\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\bb003e02e1c8404e8638fa96\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\c0bca07083764e1374ae4896\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\c0bca07083764e1374ae4896\#startup
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\c4978f523de9489a198e7d82\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\c4978f523de9489a198e7d82\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\c6e37c3acabc444bd55c1aad\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\c6e37c3acabc444bd55c1aad\#startup
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\cb17b6fda64249138c821cac\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\cb17b6fda64249138c821cac\#startup
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\cd8e4dbe8c664826c7db5db1\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\cd8e4dbe8c664826c7db5db1\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\ceeaa5b8e96547b5f49e08b5\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\ceeaa5b8e96547b5f49e08b5\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\d3aaa2b78f844a367862b9a0\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\d3aaa2b78f844a367862b9a0\#startup
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\d7c28bd1bcd94a97e54ca295\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\d7c28bd1bcd94a97e54ca295\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\db54a7db3e7d4a87b14071ab\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\db54a7db3e7d4a87b14071ab\#startup
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\dea386f41fb04d9c3c022b96\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\dea386f41fb04d9c3c022b96\#startup
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\dfc41455a6244549d2057eb9\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\dfc41455a6244549d2057eb9\#startup
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\ea021214af4549f0be0a1884\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\ea021214af4549f0be0a1884\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\ea021214af4549f0be0a1884\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\f3c13d0837e24f8fdc4f3d92\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\f3c13d0837e24f8fdc4f3d92\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\f3c13d0837e24f8fdc4f3d92\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\f55a0e856ae149b940c8158b\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\63302afaa35545a5ab1e43b3\f55a0e856ae149b940c8158b\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\826b27483b79447a29c68b89\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\826b27483b79447a29c68b89\4bcf00b7853e48c2c55d4589\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\826b27483b79447a29c68b89\4bcf00b7853e48c2c55d4589\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\826b27483b79447a29c68b89\4bcf00b7853e48c2c55d4589\#name
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\826b27483b79447a29c68b89\9ed9530af28141444e58bf8c\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\826b27483b79447a29c68b89\9ed9530af28141444e58bf8c\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\826b27483b79447a29c68b89\9ed9530af28141444e58bf8c\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\826b27483b79447a29c68b89\cbbf2e63232f43b8a14d3b91\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\826b27483b79447a29c68b89\cbbf2e63232f43b8a14d3b91\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\826b27483b79447a29c68b89\cbbf2e63232f43b8a14d3b91\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\b31cdc70c06d459e63339a8a\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\b31cdc70c06d459e63339a8a\19047a76dad94746f7573a8e\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\b31cdc70c06d459e63339a8a\19047a76dad94746f7573a8e\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\b31cdc70c06d459e63339a8a\19047a76dad94746f7573a8e\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\b31cdc70c06d459e63339a8a\3d6278d88c2c4e74e11f83ba\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\b31cdc70c06d459e63339a8a\3d6278d88c2c4e74e11f83ba\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\b31cdc70c06d459e63339a8a\3d6278d88c2c4e74e11f83ba\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\b31cdc70c06d459e63339a8a\86e634c2ddfb4345a3c657ba\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\b31cdc70c06d459e63339a8a\86e634c2ddfb4345a3c657ba\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\b31cdc70c06d459e63339a8a\86e634c2ddfb4345a3c657ba\#name
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\b31cdc70c06d459e63339a8a\f7c4009b9e5a469c8b7a67aa\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\b31cdc70c06d459e63339a8a\f7c4009b9e5a469c8b7a67aa\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\b31cdc70c06d459e63339a8a\f7c4009b9e5a469c8b7a67aa\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\05ecf14a0b4e4ce881181790\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\05ecf14a0b4e4ce881181790\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\05ecf14a0b4e4ce881181790\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\05ecf14a0b4e4ce881181790\anthony
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\0c0a09df80bd43e72d28bba8\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\0c0a09df80bd43e72d28bba8\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\0c0a09df80bd43e72d28bba8\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\0c687fe8f50f4bedb1b1beb2\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\0c687fe8f50f4bedb1b1beb2\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\0c687fe8f50f4bedb1b1beb2\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\0c687fe8f50f4bedb1b1beb2\anthony
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\1377a2980c304826693d9cb1\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\1377a2980c304826693d9cb1\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\1377a2980c304826693d9cb1\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\13e4bb43aed3407523bd99bc\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\13e4bb43aed3407523bd99bc\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\13e4bb43aed3407523bd99bc\#name
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\1601945809044faf39746884\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\1601945809044faf39746884\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\1601945809044faf39746884\#name
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\161671e4c3704d1fe5b0f0b0\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\161671e4c3704d1fe5b0f0b0\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\161671e4c3704d1fe5b0f0b0\#name
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\23d2c026fd9c47f26b4556a4\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\23d2c026fd9c47f26b4556a4\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\23d2c026fd9c47f26b4556a4\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\25538c3a30bb45f12826e18d\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\25538c3a30bb45f12826e18d\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\25538c3a30bb45f12826e18d\#name
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\26204ce20420413d2f16e29d\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\26204ce20420413d2f16e29d\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\26204ce20420413d2f16e29d\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\26ada0a61ae6459edd0c28aa\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\26ada0a61ae6459edd0c28aa\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\26ada0a61ae6459edd0c28aa\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\26ada0a61ae6459edd0c28aa\anthony
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\287039509ebf47b138ac7c88\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\287039509ebf47b138ac7c88\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\287039509ebf47b138ac7c88\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\287039509ebf47b138ac7c88\anthony
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\2eb686c54f4040a026c459af\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\2eb686c54f4040a026c459af\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\2eb686c54f4040a026c459af\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\2eb686c54f4040a026c459af\anthony
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\34927d9399da46e3dba750b5\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\34927d9399da46e3dba750b5\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\34927d9399da46e3dba750b5\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\35f56fa9cc1e44158788e79b\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\35f56fa9cc1e44158788e79b\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\35f56fa9cc1e44158788e79b\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\35f56fa9cc1e44158788e79b\anthony
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\425c8bdbd80042dfe057feb3\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\425c8bdbd80042dfe057feb3\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\425c8bdbd80042dfe057feb3\#name
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\425c8bdbd80042dfe057feb3\anthony
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\4868221e4ca84dc30e9fa68c\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\4868221e4ca84dc30e9fa68c\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\4868221e4ca84dc30e9fa68c\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\4868221e4ca84dc30e9fa68c\anthony
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\51eff925d5a547862b70149b\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\51eff925d5a547862b70149b\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\51eff925d5a547862b70149b\#name
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\523932f30083417d9d56cf92\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\523932f30083417d9d56cf92\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\523932f30083417d9d56cf92\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\523932f30083417d9d56cf92\anthony
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\5d02b5682ced4eea9793aaab\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\5d02b5682ced4eea9793aaab\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\5d02b5682ced4eea9793aaab\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\5d02b5682ced4eea9793aaab\anthony
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\5e83e085abfa430b182f12b6\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\5e83e085abfa430b182f12b6\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\5e83e085abfa430b182f12b6\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\606b70159ff048c07ce1c791\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\606b70159ff048c07ce1c791\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\606b70159ff048c07ce1c791\#name
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\606b70159ff048c07ce1c791\anthony
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\6f63e997129c453e0d55cb99\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\6f63e997129c453e0d55cb99\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\6f63e997129c453e0d55cb99\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\6f63e997129c453e0d55cb99\anthony
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\718e86497e3c422db8eaf4a4\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\718e86497e3c422db8eaf4a4\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\718e86497e3c422db8eaf4a4\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\7349ca27c4ce4d0f842dfda0\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\7349ca27c4ce4d0f842dfda0\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\7349ca27c4ce4d0f842dfda0\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\73874d2bd8334cb60693049a\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\73874d2bd8334cb60693049a\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\73874d2bd8334cb60693049a\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\7471d676d6c14cfd7b2a8e8b\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\7471d676d6c14cfd7b2a8e8b\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\7471d676d6c14cfd7b2a8e8b\#name
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\7749cca5256b4158d5fcb699\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\7749cca5256b4158d5fcb699\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\7749cca5256b4158d5fcb699\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\78559a6351524b2b7234a6b8\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\78559a6351524b2b7234a6b8\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\78559a6351524b2b7234a6b8\#name
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\78bf682f721749f86f0b36b9\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\78bf682f721749f86f0b36b9\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\78bf682f721749f86f0b36b9\#name
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\7915a87c45ed42eaef03038d\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\7915a87c45ed42eaef03038d\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\7915a87c45ed42eaef03038d\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\79abf6d2cd3349fb333f449d\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\79abf6d2cd3349fb333f449d\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\79abf6d2cd3349fb333f449d\#name
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\7e2e13f6f53e4a2d033354a9\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\7e2e13f6f53e4a2d033354a9\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\7e2e13f6f53e4a2d033354a9\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\7e2e13f6f53e4a2d033354a9\anthony
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\878ac6a1fc9b43848f17efa4\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\878ac6a1fc9b43848f17efa4\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\878ac6a1fc9b43848f17efa4\#name
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\8c8a714c1c8e4e16cb6a50a5\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\8c8a714c1c8e4e16cb6a50a5\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\8c8a714c1c8e4e16cb6a50a5\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\929c413322b64e05dcf999a3\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\929c413322b64e05dcf999a3\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\929c413322b64e05dcf999a3\#name
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\929c413322b64e05dcf999a3\anthony
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\94fdb47dd97b47f7772993be\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\94fdb47dd97b47f7772993be\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\94fdb47dd97b47f7772993be\#name
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\94fdb47dd97b47f7772993be\anthony
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\9757ec2e810540d20b0afea4\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\9757ec2e810540d20b0afea4\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\9757ec2e810540d20b0afea4\#name
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\9757ec2e810540d20b0afea4\anthony
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\993df90213ca4693357c869f\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\993df90213ca4693357c869f\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\993df90213ca4693357c869f\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\9a37dda7041b498fddbe3aa2\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\9a37dda7041b498fddbe3aa2\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\9a37dda7041b498fddbe3aa2\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\9b130339c0074d738c59aa94\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\9b130339c0074d738c59aa94\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\9b130339c0074d738c59aa94\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\9ef4b832e623435d871e05af\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\9ef4b832e623435d871e05af\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\9ef4b832e623435d871e05af\#name
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\a138621f655c45bbf834588f\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\a138621f655c45bbf834588f\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\a138621f655c45bbf834588f\#name
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\a29ddb789ca34f79df07709b\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\a29ddb789ca34f79df07709b\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\a29ddb789ca34f79df07709b\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\aa3ec91186544d1de7a969ad\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\aa3ec91186544d1de7a969ad\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\aa3ec91186544d1de7a969ad\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\ab9ed2d61e8b404da0cc0e95\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\ab9ed2d61e8b404da0cc0e95\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\ab9ed2d61e8b404da0cc0e95\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\ad36f89c81d74a497af06e92\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\ad36f89c81d74a497af06e92\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\ad36f89c81d74a497af06e92\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\ad36f89c81d74a497af06e92\anthony
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\b21bddc2f6bb40cf103c4681\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\b21bddc2f6bb40cf103c4681\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\b21bddc2f6bb40cf103c4681\#name
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\b21bddc2f6bb40cf103c4681\anthony
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\b72d580bc90245580ee93ca4\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\b72d580bc90245580ee93ca4\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\b72d580bc90245580ee93ca4\#name
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\c30a10a21c95405b7d87b493\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\c30a10a21c95405b7d87b493\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\c30a10a21c95405b7d87b493\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\c30a10a21c95405b7d87b493\anthony
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\cb8244bd859e4a6a6544ceb6\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\cb8244bd859e4a6a6544ceb6\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\cb8244bd859e4a6a6544ceb6\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\cbb259c34f614730483ccfb8\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\cbb259c34f614730483ccfb8\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\cbb259c34f614730483ccfb8\#name
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\cbb259c34f614730483ccfb8\anthony
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\cf3b43aeead44f1cef989288\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\cf3b43aeead44f1cef989288\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\cf3b43aeead44f1cef989288\#name
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\cf3b43aeead44f1cef989288\anthony
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\d05fd5854b4e40b31bba0aac\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\d05fd5854b4e40b31bba0aac\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\d05fd5854b4e40b31bba0aac\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\d4c0392286424ece6bbd72ab\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\d4c0392286424ece6bbd72ab\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\d4c0392286424ece6bbd72ab\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\d4c0392286424ece6bbd72ab\anthony
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\d5e48a0283a043afa039579e\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\d5e48a0283a043afa039579e\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\d5e48a0283a043afa039579e\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\d710726c4f614d149686b6bd\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\d710726c4f614d149686b6bd\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\d710726c4f614d149686b6bd\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\d799cefe45f84c6e92515598\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\d799cefe45f84c6e92515598\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\d799cefe45f84c6e92515598\#name
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\daee7773d4e74f52d9e865b2\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\daee7773d4e74f52d9e865b2\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\daee7773d4e74f52d9e865b2\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\dc33a61c5c2d4e35f9ebaeb6\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\dc33a61c5c2d4e35f9ebaeb6\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\dc33a61c5c2d4e35f9ebaeb6\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\e1ed5749032f4d10389cee8f\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\e1ed5749032f4d10389cee8f\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\e1ed5749032f4d10389cee8f\#name
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\e76c31902e3541d5e0a572b9\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\e76c31902e3541d5e0a572b9\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\e76c31902e3541d5e0a572b9\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\f4f086e8a0d041a367dc3d81\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\f4f086e8a0d041a367dc3d81\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\f4f086e8a0d041a367dc3d81\#name
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\f69a35ddcf9d46d0bd4cf3b3\#data
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\f69a35ddcf9d46d0bd4cf3b3\#internal
C:\Program Files\WinAntiSpyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\f69a35ddcf9d46d0bd4cf3b3\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\f7a9ce4456e0450098efd69c\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\f7a9ce4456e0450098efd69c\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\f7a9ce4456e0450098efd69c\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\98bb2d6865eb442acdf0e681\d7863651b53c4d8a470fb68e\f7a9ce4456e0450098efd69c\anthony
C:\Program Files\WinAntiSpyware 2007\scanlog.xml
C:\Program Files\winantispyware 2007\shellext.xml
C:\Program Files\WinAntiSpyware 2007\sr.log
C:\Program Files\WinAntiSpyware 2007\Summary.dat
C:\Program Files\WinAntiSpyware 2007\support.url
C:\Program Files\WinAntiSpyware 2007\tasks.dat
C:\Program Files\winantispyware 2007\threatnet.dat
C:\Program Files\WinAntiSpyware 2007\unins000.dat
C:\Program Files\WinAntiSpyware 2007\unwizard.xml
C:\Program Files\WinAntiSpyware 2007\up.dat
C:\Program Files\WinAntiSpyware 2007\updater.dat
C:\Program Files\winantispyware 2007\WAS7.url
C:\Program Files\WinAntiSpyware 2007\WAS7.xml
C:\temp\0b9
C:\temp\0b9\tmpTF.log
C:\Temp\abW9
C:\temp\iee
C:\temp\iee\tmpZTF.log
C:\Temp\tpBe12
C:\WINDOWS\764.exe
C:\WINDOWS\7search.dll
C:\WINDOWS\absolute key logger.lnk
C:\WINDOWS\aconti.exe
C:\WINDOWS\aconti.log
C:\WINDOWS\acontidialer.txt
C:\WINDOWS\adbar.dll
C:\WINDOWS\b104.exe
C:\WINDOWS\b122.exe
C:\WINDOWS\daxtime.dll
C:\WINDOWS\default.htm
C:\WINDOWS\dp0.dll
C:\WINDOWS\eventlowg.dll
C:\WINDOWS\fhfmm-Uninstaller.exe
C:\WINDOWS\fhfmm.exe
C:\WINDOWS\flt.dll
C:\WINDOWS\hosts
C:\WINDOWS\ie_32.exe
C:\WINDOWS\jd2002.dll
C:\WINDOWS\kkcomp$.exe
C:\WINDOWS\kkcomp.dll
C:\WINDOWS\kkcomp.exe
C:\WINDOWS\liqad$.exe
C:\WINDOWS\liqad.dll
C:\WINDOWS\liqad.exe
C:\WINDOWS\liqui-Uninstaller.exe
C:\WINDOWS\liqui.dll
C:\WINDOWS\liqui.exe
C:\WINDOWS\mscore.dll
C:\WINDOWS\ngd.dll
C:\WINDOWS\pbar.dll
C:\WINDOWS\QW50aG9ueSBQaW5uYXZhaWEsIEpyLg\
C:\WINDOWS\QW50aG9ueSBQaW5uYXZhaWEsIEpyLg\\asappsrv.dll
C:\WINDOWS\QW50aG9ueSBQaW5uYXZhaWEsIEpyLg\\command.exe
C:\WINDOWS\QW50aG9ueSBQaW5uYXZhaWEsIEpyLg\\kqcXu36Rym1kuqcRsrt1uqHPKHDVM0.vbs
C:\WINDOWS\QW50aG9ueSBQaW5uYXZhaWEsIEpyLg\command.exe
C:\WINDOWS\spredirect.dll
C:\WINDOWS\start.exe
C:\WINDOWS\system32\ace16win.dll
C:\WINDOWS\system32\acespy
C:\WINDOWS\system32\acespy\__acelog.ndx
C:\WINDOWS\system32\acespy\systune.exe
C:\WINDOWS\system32\atmtd.dll
C:\WINDOWS\system32\atmtd.dll._
C:\WINDOWS\system32\din.ip
C:\WINDOWS\system32\dpqaqlqx.bin
C:\WINDOWS\system32\drivers\blank.gif
C:\WINDOWS\system32\drivers\box_2.gif
C:\WINDOWS\system32\drivers\button_buynow.gif
C:\WINDOWS\system32\drivers\button_freescan.gif
C:\WINDOWS\system32\drivers\cell_bg.gif
C:\WINDOWS\system32\drivers\cell_footer.gif
C:\WINDOWS\system32\drivers\cell_header_block.gif
C:\WINDOWS\system32\drivers\cell_header_remove.gif
C:\WINDOWS\system32\drivers\cell_header_scan.gif
C:\WINDOWS\system32\drivers\detect.htm
C:\WINDOWS\system32\drivers\download_btn.jpg
C:\WINDOWS\system32\drivers\download_now_btn.gif
C:\WINDOWS\system32\drivers\footer_back.jpg
C:\WINDOWS\system32\drivers\header_1.gif
C:\WINDOWS\system32\drivers\header_2.gif
C:\WINDOWS\system32\drivers\header_3.gif
C:\WINDOWS\system32\drivers\header_4.gif
C:\WINDOWS\system32\drivers\header_red_bg.gif
C:\WINDOWS\system32\drivers\header_red_free_scan.gif
C:\WINDOWS\system32\drivers\header_red_free_scan_bg.gif
C:\WINDOWS\system32\drivers\header_red_protect_your_pc.gif
C:\WINDOWS\system32\drivers\infected.gif
C:\WINDOWS\system32\drivers\main_back.gif
C:\WINDOWS\system32\drivers\product_2_header.gif
C:\WINDOWS\system32\drivers\product_2_name_small.gif
C:\WINDOWS\system32\drivers\product_features.gif
C:\WINDOWS\system32\drivers\pt.htm
C:\WINDOWS\system32\drivers\rating.gif
C:\WINDOWS\system32\drivers\s_detect.htm
C:\WINDOWS\system32\drivers\screenshot.jpg
C:\WINDOWS\system32\drivers\sep_hor.gif
C:\WINDOWS\system32\drivers\sep_vert.gif
C:\WINDOWS\system32\drivers\shadow.jpg
C:\WINDOWS\system32\drivers\shadow_bg.gif
C:\WINDOWS\system32\drivers\spacer.gif
C:\WINDOWS\system32\drivers\star.gif
C:\WINDOWS\system32\drivers\star_gray.gif
C:\WINDOWS\system32\drivers\star_gray_small.gif
C:\WINDOWS\system32\drivers\star_small.gif
C:\WINDOWS\system32\drivers\style.css
C:\WINDOWS\system32\drivers\v.gif
C:\WINDOWS\system32\drivers\warning_icon.gif
C:\WINDOWS\system32\drivers\win_logo.gif
C:\WINDOWS\system32\drivers\x.gif
C:\WINDOWS\system32\ESHOPEE.exe
C:\WINDOWS\system32\FTPx.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\msole32.exe
C:\WINDOWS\system32\o02PrEz
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\ppatch~1
C:\WINDOWS\system32\rMa02yy
C:\WINDOWS\system32\stfv.bin
C:\WINDOWS\system32\sznf.ascii
C:\WINDOWS\system32\vxddsk.exe
C:\WINDOWS\system32\windows.scr
C:\WINDOWS\system32\wml.exe
C:\WINDOWS\uninst2.htm
C:\WINDOWS\uninstall_nmon.vbs
C:\WINDOWS\unist1.htm
C:\WINDOWS\vxddsk.exe
C:\WINDOWS\winshow.exe
C:\WINDOWS\wml.exe
C:\WINDOWS\wr.txt
C:\WINDOWS\xadbrk.dll
C:\WINDOWS\xadbrk.exe
C:\WINDOWS\xadbrk_.exe
C:\WINDOWS\xxxvideo.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_CMDSERVICE
-------\LEGACY_NETWORK_MONITOR
-------\cmdService
-------\Network Monitor


((((((((((((((((((((((((( Files Created from 2007-12-06 to 2008-01-06 )))))))))))))))))))))))))))))))
.

2008-01-06 00:11 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-05 01:17 . 2008-01-05 01:17 <DIR> d-------- C:\WINDOWS\Apps
2008-01-05 00:29 . 2008-01-05 00:29 <DIR> d-------- C:\ie-spyad_zo
2008-01-05 00:25 . 2008-01-05 00:25 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-01-03 21:47 . 2008-01-03 21:47 <DIR> d-------- C:\Program Files\MSECache
2008-01-02 18:07 . 2003-06-18 17:31 17,920 --a------ C:\WINDOWS\SYSTEM32\mdimon.dll
2008-01-02 17:35 . 2008-01-02 17:35 <DIR> d-------- C:\Program Files\Common Files\L&H
2008-01-02 17:23 . 2008-01-02 17:23 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2008-01-02 15:58 . 2008-01-02 15:58 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-01-02 15:37 . 2008-01-02 15:37 <DIR> dr-h----- C:\MSOCache
2007-12-18 00:01 . 2007-12-18 00:01 4 --a------ C:\WINDOWS\SYSTEM32\jpewocmz.ini
2007-12-17 23:58 . 2007-12-17 23:58 <DIR> d-------- C:\WINDOWS\SYSTEM32\ineWc02

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-26 04:46 --------- d-----w C:\Program Files\?ppPatch
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-06 22:09 --------- d-----w C:\Program Files\iTunes
2007-11-06 22:05 --------- d-----w C:\Program Files\QuickTime
2002-09-01 01:48 271 --sh--w C:\Program Files\desktop.ini
2002-09-01 01:48 23,357 ---h--w C:\Program Files\folder.htt
2007-06-28 06:03 6,369 --sh--w C:\WINDOWS\SYSTEM32\pqppo.bak1
2007-07-04 06:14 6,369 --sh--w C:\WINDOWS\SYSTEM32\utsru.bak1
2007-06-28 16:49 6,598 --sh--w C:\WINDOWS\SYSTEM32\pqppo.ini2
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{477840F3-BA52-44D9-8E41-38D61CAA010F}]
C:\WINDOWS\system32\egmulhxk.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6A6E50DC-BFA8-4B40-AB1B-159E03E829FD}]
2004-11-17 12:42 155648 --a------ C:\WINDOWS\system32\lmf32v.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6CC1C91A-AE8B-4373-A5B4-28BA1851E39A}]
2003-10-30 08:34 35840 --a------ C:\Documents and Settings\anthony\Application Data\winlink\winlink.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="" []
"Tbul"="C:\WINDOWS\aPPPATCH\spool32.exe" [2007-11-25 23:46 72704]
"Router"="C:\Program Files\Router\Router.exe" [ ]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SystemTray"="SysTray.Exe" [2001-08-23 12:00 3072 C:\WINDOWS\SYSTEM32\systray.exe]
"Microsoft Works Portfolio"="C:\Program Files\Microsoft Works\WksSb.exe" [2000-08-10 12:00 311350]
"AdaptecDirectCD"="C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-09-02 21:06 684032]
"LoadPowerProfile"="powrprof.dll" [2004-08-04 03:56 17408 C:\WINDOWS\SYSTEM32\powrprof.dll]
"HPDJ Taskbar Utility"="C:\WINDOWS\SYSTEM32\hpztsb02.exe" [2001-01-30 14:14 192512]
"DellSC"="C:\Program Files\Dell\Solution Center\service.exe" [2000-11-22 11:20 331776]
"WorksFUD"="C:\Program Files\Microsoft Works\wkfud.exe" [2000-08-10 12:00 24576]
"fash"="C:\WINDOWS\fash.exe" [ ]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-02-29 16:44 66680]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2004-03-12 15:18 124128]
"OrderReminder"="C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-01-30 04:00 98304]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2006-07-07 18:15 600896]
"itype"="C:\Program Files\Microsoft IntelliType Pro\itype.exe" [2006-07-07 19:14 576320]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-10-19 20:16 286720]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-02 18:36 267048]
"sys09131074573"="C:\WINDOWS\sys09131074573.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\PROGRA~1\MESSEN~1\msmsgs.exe" [2004-10-13 11:24 1694208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Printing Migration"="C:\WINDOWS\System32\spool\migrate.dll" [2001-08-23 12:00 30208]

C:\Documents and Settings\anthony\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2001-09-23 22:02:00]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Works Calendar Reminders.lnk - C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2000-08-10 12:00:00]

R2 mf_CCITCP2;Micro Focus Directory Server;"C:\Program Files\Micro Focus\Net Express\Base\bin\mfds.exe" [2003-04-11 01:38]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{17c5cce0-14a5-11dc-8678-009027d5d4f8}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\^RNA]
rundll rnasetup.dll,installoptionalcomponent rna

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:WIN9X /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:WIN9X /user /install
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:IE50 /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:IE50 /user /install
.
Contents of the 'Scheduled Tasks' folder
"2008-01-06 04:00:02 C:\WINDOWS\Tasks\Tune-up Application Start.job"
"2008-01-06 05:20:08 C:\WINDOWS\Tasks\PCHealth Scheduler for Data Collection.job"
- C:\WINDOWS\PCHEALTH\SUPPORT\PCHSCHD.EXE
"2005-06-06 01:24:36 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\PROGRAM FILES\SYMANTEC\LIVEUPDATE\NDETECT.EXE
"2008-01-01 18:43:06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-06 00:23:59
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-06 0:26:43 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-06 05:26:40
.
2008-01-05 05:33:32 --- E O F ---


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:33:31 AM, on 1/6/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5346.0005)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Micro Focus\Net Express\Base\bin\mfds.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Dell\Solution Center\service.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\aPPPATCH\spool32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Palm\Hotsync.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R3 - URLSearchHook: URLSearch Class - {965A592F-8EFA-4250-8630-7960230792F1} - C:\WINDOWS\system32\cdsm32.dll (file missing)
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Documents and Settings\ANTHONY\Application Data\Mozilla\Profiles\default\3hiq6oty.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\ANTHONY\Application Data\Mozilla\Profiles\default\3hiq6oty.slt\prefs.js)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: egmulhxk.msdn_hlp - {477840F3-BA52-44D9-8E41-38D61CAA010F} - C:\WINDOWS\system32\egmulhxk.dll (file missing)
O2 - BHO: LinkTracker Class - {6A6E50DC-BFA8-4B40-AB1B-159E03E829FD} - C:\WINDOWS\system32\lmf32v.dll
O2 - BHO: winlink module - {6CC1C91A-AE8B-4373-A5B4-28BA1851E39A} - C:\Documents and Settings\anthony\Application Data\winlink\winlink.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM32\hpztsb02.exe
O4 - HKLM\..\Run: [DellSC] C:\Program Files\Dell\Solution Center\service.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [fash] C:\WINDOWS\fash.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [sys09131074573] C:\WINDOWS\sys09131074573.exe
O4 - HKCU\..\Run: [Tbul] "C:\WINDOWS\aPPPATCH\spool32.exe" -vt yazb
O4 - HKCU\..\Run: [Router] C:\Program Files\Router\Router.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [MSMSGS] C:\PROGRA~1\MESSEN~1\msmsgs.exe /background (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [MSMSGS] C:\PROGRA~1\MESSEN~1\msmsgs.exe /background (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [MSMSGS] C:\PROGRA~1\MESSEN~1\msmsgs.exe /background (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Printing Migration] rundll32.exe C:\WINDOWS\System32\spool\migrate.dll,ProcessWin9xNetworkPrinters (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MSMSGS] C:\PROGRA~1\MESSEN~1\msmsgs.exe /background (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [Printing Migration] rundll32.exe C:\WINDOWS\System32\spool\migrate.dll,ProcessWin9xNetworkPrinters (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\Hotsync.exe
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Dell Home - {08DCFC6C-B6E4-480C-95A4-FC64F37B787E} - http://www.dellnet.com (file missing) (HKCU)
O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Micro Focus Directory Server (mf_CCITCP2) - Unknown owner - C:\Program Files\Micro Focus\Net Express\Base\bin\mfds.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 8644 bytes
Attached Files
File Type: txt log.txt (59.4 KB, 1 views)
File Type: txt HJT Log.txt (8.4 KB, 1 views)
Last edited by tetonbob; 01-05-2008 at 11:22 PM.
apinn237 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-05-2008, 11:42 PM   #6 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,757
OS: 2000 Pro; XP Pro; XP Home


Re: Constant Pop-ups from IE - HJT Log Review Please
Please look for this folder:

2007-11-26 04:46 --------- d-----w C:\Program Files\?ppPatch

The ? can be any character, may appear as A. You can tell if it's the folder we're looking for by checking it's properties. Right click, and check the creation date. It should match what's above in green.

Let me know the contents of this folder, please.

--------------------------------------------------------------------------------------------------

Open notepad and copy/paste the text in the quotebox below into it:

Quote:
http://www.techsupportforum.com/security-center/hijackthis-log-help/208148-constant-pop-ups-ie-hjt-log-review-please.html#post1249982

File::
C:\WINDOWS\SYSTEM32\jpewocmz.ini
C:\WINDOWS\SYSTEM32\pqppo.bak1
C:\WINDOWS\SYSTEM32\utsru.bak1
C:\WINDOWS\SYSTEM32\pqppo.ini2

Folder::
C:\WINDOWS\SYSTEM32\ineWc02

DirLook::
C:\WINDOWS\Apps
C:\Documents and Settings\anthony\Application Data\winlink

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{477840F3-BA52-44D9-8E41-38D61CAA010F}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6A6E50DC-BFA8-4B40-AB1B-159E03E829FD}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6CC1C91A-AE8B-4373-A5B4-28BA1851E39A}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"=-
"Tbul"=-
"Router"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"fash"=-
"sys09131074573"=-

Collect::
C:\WINDOWS\system32\lmf32v.dll
C:\Documents and Settings\anthony\Application Data\winlink\winlink.dll
C:\WINDOWS\aPPPATCH\spool32.exe
Save this as CFScript.txt




Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis.

Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file.

---------------------------------------------------------------------------------------------

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-06-2008, 06:02 PM   #7 (permalink)
Registered User
 
Join Date: Jan 2008
Posts: 9
OS: XP


Re: Constant Pop-ups from IE - HJT Log Review Please
The folder AppPatch is empty
The ComboFix Log has been posted to bleeping computer

Here are the other log files:

ComboFix 08-01-06.4 - anthony 2008-01-06 19:47:48.2 - FAT32x86
Running from: C:\Documents and Settings\anthony\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\anthony\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\SYSTEM32\jpewocmz.ini
C:\WINDOWS\SYSTEM32\pqppo.bak1
C:\WINDOWS\SYSTEM32\pqppo.ini2
C:\WINDOWS\SYSTEM32\utsru.bak1
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\anthony\Application Data\winlink\winlink.dll
C:\WINDOWS\aPPPATCH\spool32.exe
C:\WINDOWS\SYSTEM32\ineWc02
C:\WINDOWS\SYSTEM32\jpewocmz.ini
C:\WINDOWS\system32\lmf32v.dll
C:\WINDOWS\SYSTEM32\pqppo.bak1
C:\WINDOWS\SYSTEM32\pqppo.ini2
C:\WINDOWS\SYSTEM32\utsru.bak1

.
((((((((((((((((((((((((( Files Created from 2007-12-07 to 2008-01-07 )))))))))))))))))))))))))))))))
.

2008-01-06 00:30 . 2008-01-06 00:30 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-06 00:11 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-05 01:17 . 2008-01-05 01:17 <DIR> d-------- C:\WINDOWS\Apps
2008-01-05 00:29 . 2008-01-05 00:29 <DIR> d-------- C:\ie-spyad_zo
2008-01-05 00:25 . 2008-01-05 00:25 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-01-03 21:47 . 2008-01-03 21:47 <DIR> d-------- C:\Program Files\MSECache
2008-01-02 18:07 . 2003-06-18 17:31 17,920 --a------ C:\WINDOWS\SYSTEM32\mdimon.dll
2008-01-02 17:35 . 2008-01-02 17:35 <DIR> d-------- C:\Program Files\Common Files\L&H
2008-01-02 17:23 . 2008-01-02 17:23 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2008-01-02 15:58 . 2008-01-02 15:58 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-01-02 15:37 . 2008-01-02 15:37 <DIR> dr-h----- C:\MSOCache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-26 04:46 --------- d-----w C:\Program Files\?ppPatch
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\SYSTEM32\quartz.dll
2007-10-29 22:43 1,287,680 ------w C:\WINDOWS\SYSTEM32\dllcache\quartz.dll
2007-10-27 22:40 227,328 ----a-w C:\WINDOWS\SYSTEM32\wmasf.dll
2007-10-27 22:40 227,328 ----a-w C:\WINDOWS\SYSTEM32\dllcache\wmasf.dll
2007-10-26 03:36 8,454,656 ------w C:\WINDOWS\SYSTEM32\dllcache\shell32.dll
2002-09-01 01:48 271 --sh--w C:\Program Files\desktop.ini
2002-09-01 01:48 23,357 ---h--w C:\Program Files\folder.htt
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

---- Directory of C:\Documents and Settings\anthony\Application Data\winlink ----

2006-03-27 23:32 3617 --a------ C:\Documents and Settings\anthony\Application Data\winlink\keywords.dat
2003-10-30 08:34 35840 --a------ C:\Documents and Settings\anthony\Application Data\winlink\winlink.dll

---- Directory of C:\WINDOWS\Apps ----



((((((((((((((((((((((((((((( snapshot@2008-01-06_ 0.26.14.38 )))))))))))))))))))))))))))))))))))))))))
.
+ 2000-08-31 13:00:00 163,328 ----a-w C:\WINDOWS\ERDNT\subs\F3M\ERDNT.EXE
- 2008-01-06 05:23:26 10,600,448 ----a-w C:\WINDOWS\Temporary Internet Files\Content.IE5\index.dat
+ 2008-01-06 05:32:04 10,600,448 ----a-w C:\WINDOWS\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SystemTray"="SysTray.Exe" [2001-08-23 12:00 3072 C:\WINDOWS\SYSTEM32\systray.exe]
"Microsoft Works Portfolio"="C:\Program Files\Microsoft Works\WksSb.exe" [2000-08-10 12:00 311350]
"AdaptecDirectCD"="C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-09-02 21:06 684032]
"LoadPowerProfile"="powrprof.dll" [2004-08-04 03:56 17408 C:\WINDOWS\SYSTEM32\powrprof.dll]
"HPDJ Taskbar Utility"="C:\WINDOWS\SYSTEM32\hpztsb02.exe" [2001-01-30 14:14 192512]
"DellSC"="C:\Program Files\Dell\Solution Center\service.exe" [2000-11-22 11:20 331776]
"WorksFUD"="C:\Program Files\Microsoft Works\wkfud.exe" [2000-08-10 12:00 24576]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-02-29 16:44 66680]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2004-03-12 15:18 124128]
"OrderReminder"="C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-01-30 04:00 98304]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2006-07-07 18:15 600896]
"itype"="C:\Program Files\Microsoft IntelliType Pro\itype.exe" [2006-07-07 19:14 576320]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-10-19 20:16 286720]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-02 18:36 267048]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\PROGRA~1\MESSEN~1\msmsgs.exe" [2004-10-13 11:24 1694208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Printing Migration"="C:\WINDOWS\System32\spool\migrate.dll" [2001-08-23 12:00 30208]

C:\Documents and Settings\anthony\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2001-09-23 22:02:00]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Works Calendar Reminders.lnk - C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2000-08-10 12:00:00]

R2 mf_CCITCP2;Micro Focus Directory Server;"C:\Program Files\Micro Focus\Net Express\Base\bin\mfds.exe" [2003-04-11 01:38]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{17c5cce0-14a5-11dc-8678-009027d5d4f8}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

*Newly Created Service* - CATCHME

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\^RNA]
rundll rnasetup.dll,installoptionalcomponent rna

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:WIN9X /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:WIN9X /user /install
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:IE50 /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:IE50 /user /install
.
Contents of the 'Scheduled Tasks' folder
"2008-01-06 04:00:02 C:\WINDOWS\Tasks\Tune-up Application Start.job"
"2008-01-07 00:34:02 C:\WINDOWS\Tasks\PCHealth Scheduler for Data Collection.job"
- C:\WINDOWS\PCHEALTH\SUPPORT\PCHSCHD.EXE
"2005-06-06 01:24:36 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\PROGRAM FILES\SYMANTEC\LIVEUPDATE\NDETECT.EXE
"2008-01-01 18:43:06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-06 19:51:42
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-06 19:52:31
ComboFix-quarantined-files.txt 2008-01-07 00:52:28
ComboFix2.txt 2008-01-06 05:26:46
.
2008-01-05 05:33:32 --- E O F ---


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:57:07 PM, on 1/6/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5346.0005)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Micro Focus\Net Express\Base\bin\mfds.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Dell\Solution Center\service.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Palm\Hotsync.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R3 - URLSearchHook: URLSearch Class - {965A592F-8EFA-4250-8630-7960230792F1} - C:\WINDOWS\system32\cdsm32.dll (file missing)
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Documents and Settings\ANTHONY\Application Data\Mozilla\Profiles\default\3hiq6oty.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\ANTHONY\Application Data\Mozilla\Profiles\default\3hiq6oty.slt\prefs.js)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM32\hpztsb02.exe
O4 - HKLM\..\Run: [DellSC] C:\Program Files\Dell\Solution Center\service.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [MSMSGS] C:\PROGRA~1\MESSEN~1\msmsgs.exe /background (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [MSMSGS] C:\PROGRA~1\MESSEN~1\msmsgs.exe /background (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [MSMSGS] C:\PROGRA~1\MESSEN~1\msmsgs.exe /background (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Printing Migration] rundll32.exe C:\WINDOWS\System32\spool\migrate.dll,ProcessWin9xNetworkPrinters (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MSMSGS] C:\PROGRA~1\MESSEN~1\msmsgs.exe /background (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [Printing Migration] rundll32.exe C:\WINDOWS\System32\spool\migrate.dll,ProcessWin9xNetworkPrinters (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\Hotsync.exe
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Dell Home - {08DCFC6C-B6E4-480C-95A4-FC64F37B787E} - http://www.dellnet.com (file missing) (HKCU)
O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Micro Focus Directory Server (mf_CCITCP2) - Unknown owner - C:\Program Files\Micro Focus\Net Express\Base\bin\mfds.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 8016 bytes
Attached Files
File Type: txt HJT Log.txt (7.8 KB, 1 views)
File Type: txt ComboFix.txt (8.2 KB, 1 views)
Last edited by tetonbob; 01-06-2008 at 06:36 PM.
apinn237 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-06-2008, 06:44 PM   #8 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,757
OS: 2000 Pro; XP Pro; XP Home


Re: Constant Pop-ups from IE - HJT Log Review Please
Quote:
The folder AppPatch is empty
2007-11-26 04:46 --------- d-----w C:\Program Files\?ppPatch

Ok, thanks. Delete it, please. It's a remnant of this infection

---------------------------------------------------------------------------------------------

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries if they exist (make sure you do not miss any) and click Fix Checked

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R3 - URLSearchHook: URLSearch Class - {965A592F-8EFA-4250-8630-7960230792F1} - C:\WINDOWS\system32\cdsm32.dll (file missing)

Close HijackThis now.

---------------------------------------------------------------------------------------------

Open notepad and copy/paste the text in the quotebox below into it:

Quote:
http://www.techsupportforum.com/security-center/hijackthis-log-help/208148-constant-pop-ups-ie-hjt-log-review-please.html
Folder::
C:\Documents and Settings\anthony\Application Data\winlink

Collect::
C:\Documents and Settings\anthony\Application Data\winlink\keywords.dat


Save this as CFScript.txt




Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis.

Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file.

---------------------------------------------------------------------------------------------

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Updating Java:
  • Download the latest version of Java Runtime Environment (JRE) 6 u3 and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u3-windowsi586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH Checked
      • Applications and Applets
        Trace and Log Files
    • Click OK on Delete Temporary Files Window
      Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
    • Click OK to leave the Temporary Files Window
    • Click OK to leave the Java Control Panel.

---------------------------------------------------------------------------------------------

Please run this online scan to help look for remnants.

First, Go to Start>Control Panel>Add/Remove Programs and remove Kaspersky online scanner if present prior to downloading the most up-to-date one.

Next, establish an internet connection & perform an online scan using Internet Explorer at Kaspersky Online Scanner

http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html

Answer Yes, when prompted to install an ActiveX component.
  • The program will then begin downloading the latest definition files.
  • Once the files have been downloaded click on NEXT
  • Locate the Scan Settings button & configure to:
    • Scan using the following Anti-Virus database:
      • Extended
    • Scan Options:
      • Scan Archives
      • Scan Mail Bases
  • Click OK & have it scan My Computer
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply
* Turn off the real time scanner of any existing antivirus program while performing the online scan

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

---------------------------------------------------------------------------------------------

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-07-2008, 02:55 PM   #9 (permalink)
Registered User
 
Join Date: Jan 2008
Posts: 9
OS: XP


Re: Constant Pop-ups from IE - HJT Log Review Please
Here are the new logs:

ComboFix 08-01-06.4 - anthony 2008-01-06 22:24:22.3 - FAT32x86
Running from: C:\Documents and Settings\anthony\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\anthony\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\anthony\Application Data\winlink
C:\Documents and Settings\anthony\Application Data\winlink\keywords.dat

.
((((((((((((((((((((((((( Files Created from 2007-12-07 to 2008-01-07 )))))))))))))))))))))))))))))))
.

2008-01-06 00:30 . 2008-01-06 00:30 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-06 00:11 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-05 01:17 . 2008-01-05 01:17 <DIR> d-------- C:\WINDOWS\Apps
2008-01-05 00:29 . 2008-01-05 00:29 <DIR> d-------- C:\ie-spyad_zo
2008-01-05 00:25 . 2008-01-05 00:25 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-01-03 21:47 . 2008-01-03 21:47 <DIR> d-------- C:\Program Files\MSECache
2008-01-02 18:07 . 2003-06-18 17:31 17,920 --a------ C:\WINDOWS\SYSTEM32\mdimon.dll
2008-01-02 17:35 . 2008-01-02 17:35 <DIR> d-------- C:\Program Files\Common Files\L&H
2008-01-02 17:23 . 2008-01-02 17:23 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2008-01-02 15:58 . 2008-01-02 15:58 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-01-02 15:37 . 2008-01-02 15:37 <DIR> dr-h----- C:\MSOCache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\SYSTEM32\quartz.dll
2007-10-29 22:43 1,287,680 ------w C:\WINDOWS\SYSTEM32\dllcache\quartz.dll
2007-10-27 22:40 227,328 ----a-w C:\WINDOWS\SYSTEM32\wmasf.dll
2007-10-27 22:40 227,328 ----a-w C:\WINDOWS\SYSTEM32\dllcache\wmasf.dll
2007-10-26 03:36 8,454,656 ------w C:\WINDOWS\SYSTEM32\dllcache\shell32.dll
2002-09-01 01:48 271 --sh--w C:\Program Files\desktop.ini
2002-09-01 01:48 23,357 ---h--w C:\Program Files\folder.htt
.

((((((((((((((((((((((((((((( snapshot@2008-01-06_ 0.26.14.38 )))))))))))))))))))))))))))))))))))))))))
.
+ 2000-08-31 13:00:00 163,328 ----a-w C:\WINDOWS\ERDNT\subs\F3M\ERDNT.EXE
- 2008-01-06 05:23:26 10,600,448 ----a-w C:\WINDOWS\Temporary Internet Files\Content.IE5\index.dat
+ 2008-01-07 01:16:48 32,768 --sha-w C:\WINDOWS\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SystemTray"="SysTray.Exe" [2001-08-23 12:00 3072 C:\WINDOWS\SYSTEM32\systray.exe]
"Microsoft Works Portfolio"="C:\Program Files\Microsoft Works\WksSb.exe" [2000-08-10 12:00 311350]
"AdaptecDirectCD"="C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-09-02 21:06 684032]
"LoadPowerProfile"="powrprof.dll" [2004-08-04 03:56 17408 C:\WINDOWS\SYSTEM32\powrprof.dll]
"HPDJ Taskbar Utility"="C:\WINDOWS\SYSTEM32\hpztsb02.exe" [2001-01-30 14:14 192512]
"DellSC"="C:\Program Files\Dell\Solution Center\service.exe" [2000-11-22 11:20 331776]
"WorksFUD"="C:\Program Files\Microsoft Works\wkfud.exe" [2000-08-10 12:00 24576]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-02-29 16:44 66680]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2004-03-12 15:18 124128]
"OrderReminder"="C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-01-30 04:00 98304]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2006-07-07 18:15 600896]
"itype"="C:\Program Files\Microsoft IntelliType Pro\itype.exe" [2006-07-07 19:14 576320]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-10-19 20:16 286720]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-02 18:36 267048]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\PROGRA~1\MESSEN~1\msmsgs.exe" [2004-10-13 11:24 1694208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Printing Migration"="C:\WINDOWS\System32\spool\migrate.dll" [2001-08-23 12:00 30208]

C:\Documents and Settings\anthony\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2001-09-23 22:02:00]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Works Calendar Reminders.lnk - C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2000-08-10 12:00:00]

R2 mf_CCITCP2;Micro Focus Directory Server;"C:\Program Files\Micro Focus\Net Express\Base\bin\mfds.exe" [2003-04-11 01:38]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{17c5cce0-14a5-11dc-8678-009027d5d4f8}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

*Newly Created Service* - CATCHME

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\^RNA]
rundll rnasetup.dll,installoptionalcomponent rna

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:WIN9X /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:WIN9X /user /install
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:IE50 /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:IE50 /user /install
.
Contents of the 'Scheduled Tasks' folder
"2008-01-06 04:00:02 C:\WINDOWS\Tasks\Tune-up Application Start.job"
"2008-01-07 03:28:42 C:\WINDOWS\Tasks\PCHealth Scheduler for Data Collection.job"
- C:\WINDOWS\PCHEALTH\SUPPORT\PCHSCHD.EXE
"2005-06-06 01:24:36 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\PROGRAM FILES\SYMANTEC\LIVEUPDATE\NDETECT.EXE
"2008-01-01 18:43:06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-06 22:29:17
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-06 22:30:00
ComboFix-quarantined-files.txt 2008-01-07 03:29:58
ComboFix3.txt 2008-01-06 05:26:46
ComboFix2.txt 2008-01-07 00:52:32
.
2008-01-05 05:33:32 --- E O F ---


-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Monday, January 07, 2008 4:49:19 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 7/01/2008
Kaspersky Anti-Virus database records: 503378
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
Z:\

Scan Statistics:
Total number of scanned objects: 131992
Number of viruses found: 36
Number of infected objects: 94
Number of suspicious objects: 2
Duration of the scan process: 07:23:30

Infected Object Name / Virus Name / Last Action
C:\WINDOWS\SYSTEM\bho001.dll Infected: not-a-virus:AdWare.Win32.IGetNet.f skipped
C:\WINDOWS\SYSTEM\rsp001.dll Infected: not-a-virus:AdWare.Win32.IGetNet.f skipped
C:\WINDOWS\Temporary Internet Files\AntiPhishing\6729BBF9-D54C-48CB-A4D7-AD400339D808.dat Object is locked skipped
C:\WINDOWS\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\WINDOWS\SYSTEM32\msbb.dll Infected: not-a-virus:AdWare.Win32.180Solutions skipped
C:\WINDOWS\SYSTEM32\Xcite.dll Infected: not-a-virus:AdWare.Win32.BrowsePal.b skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\config\system.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\software.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\default.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\Internet.evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SECURITY Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SYSTEM Object is locked skipped
C:\WINDOWS\SYSTEM32\config\DEFAULT Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SAM Object is locked skipped
C:\WINDOWS\SYSTEM32\cm1.dll Infected: not-a-virus:AdWare.Win32.ClientMan skipped
C:\WINDOWS\SYSTEM32\NLNP13.dll Infected: not-a-virus:AdWare.Win32.IGetNet skipped
C:\WINDOWS\SYSTEM32\KVI_111.dll Infected: not-a-virus:AdWare.Win32.Sahat.g skipped
C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\SYSTEM32\lwz.dll Infected: not-a-virus:AdWare.Win32.F1Organizer.l skipped
C:\WINDOWS\SYSTEM32\msbb1.dll Infected: not-a-virus:AdWare.Win32.180Solutions skipped
C:\WINDOWS\SYSTEM32\h323log.txt Object is locked skipped
C:\WINDOWS\SYSTEM32\ctbv2.dll Infected: not-a-virus:AdWare.Win32.Sahat.g skipped
C:\WINDOWS\SYSTEM32\emesx.dll Infected: not-a-virus:AdWare.Win32.F1Organizer.s skipped
C:\WINDOWS\SYSTEM32\lmf32.dll Infected: not-a-virus:AdWare.Win32.Suggestor.f skipped
C:\WINDOWS\SYSTEM32\MSView.exe Infected: Trojan-Dropper.Win32.Agent.og skipped
C:\WINDOWS\SYSTEM32\SHAgent.dll Infected: not-a-virus:AdWare.Win32.Sahat.g skipped
C:\WINDOWS\SYSTEM32\ctbv2.dlltmp Infected: not-a-virus:AdWare.Win32.Sahat.g skipped
C:\WINDOWS\SYSTEM32\downloader_mind_silent.exe Infected: not-a-virus:AdWare.Win32.BrowsePal.b skipped
C:\WINDOWS\SYSTEM32\OMsetup.exe Infected: not-a-virus:AdWare.Win32.ClientMan skipped
C:\WINDOWS\SYSTEM32\nostalgia.dll Infected: Trojan-Dropper.Win32.Agent.og skipped
C:\WINDOWS\SYSTEM32\sahagent1003.exe/data0002 Infected: not-a-virus:AdWare.Win32.Sahat.g skipped
C:\WINDOWS\SYSTEM32\sahagent1003.exe NSIS: infected - 1 skipped
C:\WINDOWS\SYSTEM32\Xcite.exe Infected: not-a-virus:AdWare.Win32.BrowsePal.b skipped
C:\WINDOWS\SYSTEM32\nostalgia1.dll Infected: Trojan-Dropper.Win32.Agent.og skipped
C:\WINDOWS\SYSTEM32\HyperLinker.exe Infected: not-a-virus:AdWare.Win32.MDH.a skipped
C:\WINDOWS\SYSTEM32\PreUninstall.exe Infected: not-a-virus:AdWare.Win32.Suggestor.f skipped
C:\WINDOWS\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\WINDOWS\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\WINDOWS\SchedLog.Txt Object is locked skipped
C:\WINDOWS\jawa32.ocx Infected: not-a-virus:AdWare.Win32.Suggestor.a skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{26DFA3B7-3429-47B7-9022-ACAB3D3ED3A1}.bin Object is locked skipped
C:\WINDOWS\HyperLinker.exe Infected: not-a-virus:AdWare.Win32.MDH.a skipped
C:\Program Files\Norton AntiVirus\Quarantine\57F5310A.exe Infected: Email-Worm.Win32.Sircam.c skipped
C:\Program Files\Norton AntiVirus\Quarantine\580502F8.exe Infected: Email-Worm.Win32.Sircam.c skipped
C:\Program Files\Norton AntiVirus\Quarantine\65A63ABB.exe Infected: Email-Worm.Win32.Sircam.c skipped
C:\Program Files\Norton AntiVirus\Quarantine\580502F8.js Infected: Exploit.JS.ActiveXComponent skipped
C:\Program Files\Norton AntiVirus\Quarantine\258B66CD.js Infected: Exploit.JS.ActiveXComponent skipped
C:\Program Files\Norton AntiVirus\Quarantine\73021C8A.js Infected: Exploit.JS.ActiveXComponent skipped
C:\Program Files\Norton AntiVirus\Quarantine\0F3C37AF.js Infected: Exploit.JS.ActiveXComponent skipped
C:\Program Files\Micro Focus\Net Express\Base\BIN\journal.dat Object is locked skipped
C:\QooBox\Quarantine\C\Documents and Settings\anthony\Application Data\winlink\winlink.dll.vir Infected: Trojan-Downloader.Win32.WinShow.bh skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\Yazzle1549OinAdmin.exe.vir Infected: Trojan-Downloader.Win32.PurityScan.fg skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\Yazzle1549OinUninstaller.exe.vir/data0001 Infected: not-a-virus:AdWare.Win32.PurityScan.gp skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\Yazzle1549OinUninstaller.exe.vir NSIS: infected - 1 skipped
C:\QooBox\Quarantine\C\Program Files\WinAble\winable.exe.vir Infected: Trojan-Downloader.Win32.Adload.ni skipped
C:\QooBox\Quarantine\C\Program Files\Network Monitor\netmon.exe.vir Infected: not-a-virus:Monitor.Win32.NetMon.a skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\lmf32v.dll.vir Infected: not-a-virus:AdWare.Win32.Suggestor.m skipped
C:\QooBox\Quarantine\C\WINDOWS\b122.exe.vir Infected: Trojan-Downloader.Win32.Agent.erf skipped
C:\QooBox\Quarantine\C\WINDOWS\b104.exe.vir/stream/data0002 Infected: Trojan-Downloader.Win32.Small.buy skipped
C:\QooBox\Quarantine\C\WINDOWS\b104.exe.vir/stream/data0004 Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\QooBox\Quarantine\C\WINDOWS\b104.exe.vir/stream Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\QooBox\Quarantine\C\WINDOWS\b104.exe.vir NSIS: infected - 3 skipped
C:\QooBox\Quarantine\C\WINDOWS\QW50aG9ueSBQaW5uYXZhaWEsIEpyLg\command.exe.vir Infected: not-a-virus:AdWare.Win32.CommAd.a skipped
C:\QooBox\Quarantine\C\WINDOWS\QW50aG9ueSBQaW5uYXZhaWEsIEpyLg\asappsrv.dll.vir Infected: not-a-virus:AdWare.Win32.CommAd.a skipped
C:\QooBox\Quarantine\C\WINDOWS\mscore.dll.vir Infected: not-a-virus:AdWare.Win32.WebSearch.k skipped
C:\QooBox\Quarantine\C\WINDOWS\winshow.exe.vir Infected: Trojan-Downloader.Win32.VB.bvj skipped
C:\QooBox\Quarantine\C\WINDOWS\AppPatch\spool32.exe.vir Infected: Trojan-Downloader.Win32.PurityScan.ey skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\019C0000.VBN Infected: Trojan-Downloader.Win32.VB.bzi skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07840000.VBN Infected: Trojan.Win32.VB.azo skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07840001.VBN Infected: Trojan-Downloader.Win32.VB.bzi skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07800000.VBN Infected: Trojan-Clicker.Win32.VB.vx skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\056C0000.VBN Infected: Trojan-Downloader.Win32.VB.bzi skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07500000.VBN Infected: Trojan-Downloader.Win32.Agent.gdi skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07500001.VBN/data0006 Infected: Trojan-Downloader.Win32.VB.bto skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07500001.VBN NSIS: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07500001.VBN CryptZ: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07500002.VBN Infected: Trojan-Downloader.Win32.VB.bwb skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\03540000.VBN Infected: Trojan-Downloader.Win32.Delf.dlk skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Attune.zip/RemoveMM.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Attune.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\anthony\ntuser.dat Object is locked skipped
C:\Documents and Settings\anthony\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\anthony\Desktop\[4]-Submit_2008-01-06@19.47.zip/winlink.dll.vir Infected: Trojan-Downloader.Win32.WinShow.bh skipped
C:\Documents and Settings\anthony\Desktop\[4]-Submit_2008-01-06@19.47.zip/spool32.exe.vir Infected: Trojan-Downloader.Win32.PurityScan.ey skipped
C:\Documents and Settings\anthony\Desktop\[4]-Submit_2008-01-06@19.47.zip/lmf32v.dll.vir Infected: not-a-virus:AdWare.Win32.Suggestor.m skipped
C:\Documents and Settings\anthony\Desktop\[4]-Submit_2008-01-06@19.47.zip ZIP: infected - 3 skipped
C:\Documents and Settings\anthony\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\anthony\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\anthony\.jpi_cache\jar\1.0\jvmsecman.jar-69ee0dc2-79b62021.zip/vlocal.class Infected: Trojan-Downloader.Java.Agent.f skipped
C:\Documents and Settings\anthony\.jpi_cache\jar\1.0\jvmsecman.jar-69ee0dc2-79b62021.zip ZIP: infected - 1 skipped
C:\Documents and Settings\anthony\.jpi_cache\jar\1.0\jvmsecman.jar-69ee0e0e-1645cfe2.zip/vlocal.class Infected: Trojan-Downloader.Java.Agent.f skipped
C:\Documents and Settings\anthony\.jpi_cache\jar\1.0\jvmsecman.jar-69ee0e0e-1645cfe2.zip ZIP: infected - 1 skipped
C:\Documents and Settings\anthony\.jpi_cache\jar\1.0\jvmsecman.jar-6b26dca8-61fa3b09.zip/vlocal.class Infected: Trojan-Downloader.Java.Agent.f skipped
C:\Documents and Settings\anthony\.jpi_cache\jar\1.0\jvmsecman.jar-6b26dca8-61fa3b09.zip ZIP: infected - 1 skipped
C:\Documents and Settings\anthony\.jpi_cache\jar\1.0\jvmsecman.jar-69ee0e0e-352bf04f.zip/vlocal.class Infected: Trojan-Downloader.Java.Agent.f skipped
C:\Documents and Settings\anthony\.jpi_cache\jar\1.0\jvmsecman.jar-69ee0e0e-352bf04f.zip ZIP: infected - 1 skipped
C:\Documents and Settings\anthony\.jpi_cache\jar\1.0\jvmsecman.jar-69ee0d96-4ba970b8.zip/vlocal.class Infected: Trojan-Downloader.Java.Agent.f skipped
C:\Documents and Settings\anthony\.jpi_cache\jar\1.0\jvmsecman.jar-69ee0d96-4ba970b8.zip ZIP: infected - 1 skipped
C:\Documents and Settings\anthony\.jpi_cache\jar\1.0\jvmsecman.jar-69ee0d96-2b63bc29.zip/vlocal.class Infected: Trojan-Downloader.Java.Agent.f skipped
C:\Documents and Settings\anthony\.jpi_cache\jar\1.0\jvmsecman.jar-69ee0d96-2b63bc29.zip ZIP: infected - 1 skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\System Volume Information\_restore{88D5E18B-7797-4E49-833C-E64F0051DECE}\RP185\A0008192.exe Infected: Trojan-Downloader.Win32.PurityScan.fg skipped
C:\System Volume Information\_restore{88D5E18B-7797-4E49-833C-E64F0051DECE}\RP185\A0008193.exe/data0001 Infected: not-a-virus:AdWare.Win32.PurityScan.gp skipped
C:\System Volume Information\_restore{88D5E18B-7797-4E49-833C-E64F0051DECE}\RP185\A0008193.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{88D5E18B-7797-4E49-833C-E64F0051DECE}\RP185\A0008196.exe Infected: Trojan-Downloader.Win32.Agent.erf skipped
C:\System Volume Information\_restore{88D5E18B-7797-4E49-833C-E64F0051DECE}\RP185\A0008197.exe/stream/data0002 Infected: Trojan-Downloader.Win32.Small.buy skipped
C:\System Volume Information\_restore{88D5E18B-7797-4E49-833C-E64F0051DECE}\RP185\A0008197.exe/stream/data0004 Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{88D5E18B-7797-4E49-833C-E64F0051DECE}\RP185\A0008197.exe/stream Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{88D5E18B-7797-4E49-833C-E64F0051DECE}\RP185\A0008197.exe NSIS: infected - 3 skipped
C:\System Volume Information\_restore{88D5E18B-7797-4E49-833C-E64F0051DECE}\RP185\A0008199.exe Infected: not-a-virus:AdWare.Win32.CommAd.a skipped
C:\System Volume Information\_restore{88D5E18B-7797-4E49-833C-E64F0051DECE}\RP185\A0008203.exe Infected: Trojan-Downloader.Win32.Adload.ni skipped
C:\System Volume Information\_restore{88D5E18B-7797-4E49-833C-E64F0051DECE}\RP185\A0008215.exe Infected: not-a-virus:Monitor.Win32.NetMon.a skipped
C:\System Volume Information\_restore{88D5E18B-7797-4E49-833C-E64F0051DECE}\RP185\A0008217.DLL Infected: not-a-virus:AdWare.Win32.CommAd.a skipped
C:\System Volume Information\_restore{88D5E18B-7797-4E49-833C-E64F0051DECE}\RP185\A0008255.dll Infected: not-a-virus:AdWare.Win32.WebSearch.k skipped
C:\System Volume Information\_restore{88D5E18B-7797-4E49-833C-E64F0051DECE}\RP185\A0008256.exe Infected: Trojan-Downloader.Win32.VB.bvj skipped
C:\System Volume Information\_restore{88D5E18B-7797-4E49-833C-E64F0051DECE}\RP186\A0008318.DLL Infected: Trojan-Downloader.Win32.WinShow.bh skipped
C:\System Volume Information\_restore{88D5E18B-7797-4E49-833C-E64F0051DECE}\RP186\A0008319.exe Infected: Trojan-Downloader.Win32.PurityScan.ey skipped
C:\System Volume Information\_restore{88D5E18B-7797-4E49-833C-E64F0051DECE}\RP186\A0008320.dll Infected: not-a-virus:AdWare.Win32.Suggestor.m skipped
C:\System Volume Information\_restore{88D5E18B-7797-4E49-833C-E64F0051DECE}\RP189\change.log Object is locked skipped

Scan process completed.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:53:00 PM, on 1/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5346.0005)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Micro Focus\Net Express\Base\bin\mfds.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Dell\Solution Center\service.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Palm\Hotsync.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe

N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Documents and Settings\ANTHONY\Application Data\Mozilla\Profiles\default\3hiq6oty.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\ANTHONY\Application Data\Mozilla\Profiles\default\3hiq6oty.slt\prefs.js)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM32\hpztsb02.exe
O4 - HKLM\..\Run: [DellSC] C:\Program Files\Dell\Solution Center\service.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [MSMSGS] C:\PROGRA~1\MESSEN~1\msmsgs.exe /background (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [MSMSGS] C:\PROGRA~1\MESSEN~1\msmsgs.exe /background (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [MSMSGS] C:\PROGRA~1\MESSEN~1\msmsgs.exe /background (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Printing Migration] rundll32.exe C:\WINDOWS\System32\spool\migrate.dll,ProcessWin9xNetworkPrinters (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MSMSGS] C:\PROGRA~1\MESSEN~1\msmsgs.exe /background (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [Printing Migration] rundll32.exe C:\WINDOWS\System32\spool\migrate.dll,ProcessWin9xNetworkPrinters (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\Hotsync.exe
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Dell Home - {08DCFC6C-B6E4-480C-95A4-FC64F37B787E} - http://www.dellnet.com (file missing) (HKCU)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_02) -
O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Micro Focus Directory Server (mf_CCITCP2) - Unknown owner - C:\Program Files\Micro Focus\Net Express\Base\bin\mfds.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 8433 bytes
Attached Files
File Type: txt ComboFix.txt (7.4 KB, 1 views)
File Type: txt Kaspersky Log.txt (33.5 KB, 1 views)
File Type: txt HJT Log.txt (8.2 KB, 1 views)
Last edited by tetonbob; 01-07-2008 at 03:44 PM.
apinn237 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-07-2008, 03:58 PM   #10 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,757
OS: 2000 Pro; XP Pro; XP Home


Re: Constant Pop-ups from IE - HJT Log Review Please
A bit more work to do....

Open notepad and copy/paste the text in the quotebox below into it:

Quote:
http://www.techsupportforum.com/security-center/hijackthis-log-help/208148-constant-pop-ups-ie-hjt-log-review-please.html
Collect::
C:\WINDOWS\SYSTEM\bho001.dll
C:\WINDOWS\SYSTEM\rsp001.dll
C:\WINDOWS\SYSTEM32\msbb.dll
C:\WINDOWS\SYSTEM32\Xcite.dll
C:\WINDOWS\SYSTEM32\cm1.dll
C:\WINDOWS\SYSTEM32\NLNP13.dll
C:\WINDOWS\SYSTEM32\KVI_111.dll
C:\WINDOWS\SYSTEM32\lwz.dll
C:\WINDOWS\SYSTEM32\msbb1.dll
C:\WINDOWS\SYSTEM32\ctbv2.dll
C:\WINDOWS\SYSTEM32\emesx.dll
C:\WINDOWS\SYSTEM32\lmf32.dll
C:\WINDOWS\SYSTEM32\MSView.exe
C:\WINDOWS\SYSTEM32\SHAgent.dll
C:\WINDOWS\SYSTEM32\ctbv2.dlltmp
C:\WINDOWS\SYSTEM32\downloader_mind_silent.exe
C:\WINDOWS\SYSTEM32\OMsetup.exe
C:\WINDOWS\SYSTEM32\nostalgia.dll
C:\WINDOWS\SYSTEM32\sahagent1003.exe
C:\WINDOWS\SYSTEM32\Xcite.exe
C:\WINDOWS\SYSTEM32\nostalgia1.dll
C:\WINDOWS\SYSTEM32\HyperLinker.exe
C:\WINDOWS\SYSTEM32\PreUninstall.exe
C:\WINDOWS\jawa32.ocx
C:\WINDOWS\HyperLinker.exe
Save this as CFScript.txt




Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis.

Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file.

---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-07-2008, 06:51 PM   #11 (permalink)
Registered User
 
Join Date: Jan 2008
Posts: 9
OS: XP


Re: Constant Pop-ups from IE - HJT Log Review Please
New Log file

ComboFix 08-01-06.4 - anthony 2008-01-07 20:44:29.4 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.121 [GMT -5:00]
Running from: C:\Documents and Settings\anthony\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\anthony\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\HyperLinker.exe
C:\WINDOWS\jawa32.ocx
C:\WINDOWS\SYSTEM\bho001.dll
C:\WINDOWS\SYSTEM\rsp001.dll
C:\WINDOWS\SYSTEM32\cm1.dll
C:\WINDOWS\SYSTEM32\ctbv2.dll
C:\WINDOWS\SYSTEM32\ctbv2.dlltmp
C:\WINDOWS\SYSTEM32\downloader_mind_silent.exe
C:\WINDOWS\SYSTEM32\emesx.dll
C:\WINDOWS\SYSTEM32\HyperLinker.exe
C:\WINDOWS\SYSTEM32\KVI_111.dll
C:\WINDOWS\SYSTEM32\lmf32.dll
C:\WINDOWS\SYSTEM32\lwz.dll
C:\WINDOWS\SYSTEM32\msbb.dll
C:\WINDOWS\SYSTEM32\msbb1.dll
C:\WINDOWS\SYSTEM32\MSView.exe
C:\WINDOWS\SYSTEM32\NLNP13.dll
C:\WINDOWS\SYSTEM32\nostalgia.dll
C:\WINDOWS\SYSTEM32\nostalgia1.dll
C:\WINDOWS\SYSTEM32\OMsetup.exe
C:\WINDOWS\SYSTEM32\PreUninstall.exe
C:\WINDOWS\SYSTEM32\sahagent1003.exe
C:\WINDOWS\SYSTEM32\SHAgent.dll
C:\WINDOWS\SYSTEM32\Xcite.dll
C:\WINDOWS\SYSTEM32\Xcite.exe

.
((((((((((((((((((((((((( Files Created from 2007-12-08 to 2008-01-08 )))))))))))))))))))))))))))))))
.

2008-01-06 22:56 . 2008-01-06 22:56 <DIR> d-------- C:\WINDOWS\SYSTEM32\Kaspersky Lab
2008-01-06 22:56 . 2008-01-06 22:56 <DIR> d-------- C:\WINDOWS\LastGood
2008-01-06 22:56 . 2008-01-06 22:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-01-06 22:50 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\SYSTEM32\javacpl.cpl
2008-01-06 22:48 . 2008-01-06 22:48 <DIR> d-------- C:\Program Files\Common Files\Java
2008-01-06 00:30 . 2008-01-06 00:30 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-06 00:11 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-05 01:17 . 2008-01-05 01:17 <DIR> d-------- C:\WINDOWS\Apps
2008-01-05 00:29 . 2008-01-05 00:29 <DIR> d-------- C:\ie-spyad_zo
2008-01-05 00:25 . 2008-01-05 00:25 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-01-03 21:47 . 2008-01-03 21:47 <DIR> d-------- C:\Program Files\MSECache
2008-01-02 18:07 . 2003-06-18 17:31 17,920 --a------ C:\WINDOWS\SYSTEM32\mdimon.dll
2008-01-02 17:35 . 2008-01-02 17:35 <DIR> d-------- C:\Program Files\Common Files\L&H
2008-01-02 17:23 . 2008-01-02 17:23 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2008-01-02 15:58 . 2008-01-02 15:58 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-01-02 15:37 . 2008-01-02 15:37 <DIR> dr-h----- C:\MSOCache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\SYSTEM32\quartz.dll
2007-10-29 22:43 1,287,680 ------w C:\WINDOWS\SYSTEM32\dllcache\quartz.dll
2007-10-27 22:40 227,328 ----a-w C:\WINDOWS\SYSTEM32\wmasf.dll
2007-10-27 22:40 227,328 ----a-w C:\WINDOWS\SYSTEM32\dllcache\wmasf.dll
2007-10-26 03:36 8,454,656 ------w C:\WINDOWS\SYSTEM32\dllcache\shell32.dll
2002-09-01 01:48 271 --sh--w C:\Program Files\desktop.ini
2002-09-01 01:48 23,357 ---h--w C:\Program Files\folder.htt
.

((((((((((((((((((((((((((((( snapshot@2008-01-06_ 0.26.14.38 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-05 05:36:32 32,768 --sha-w C:\WINDOWS\Application Data\Microsoft\Feeds Cache\index.dat
+ 2008-01-07 03:55:50 32,768 --sha-w C:\WINDOWS\Application Data\Microsoft\Feeds Cache\index.dat
- 2008-01-06 05:20:38 262,144 ---ha-w C:\WINDOWS\Application Data\Microsoft\Windows\UsrClass.dat
+ 2008-01-08 01:38:42 524,288 ---ha-w C:\WINDOWS\Application Data\Microsoft\Windows\UsrClass.dat
+ 2000-08-31 13:00:00 163,328 ----a-w C:\WINDOWS\ERDNT\subs\F3M\ERDNT.EXE
- 2003-02-20 21:42:34 24,677 ------w C:\WINDOWS\SYSTEM32\java.exe
+ 2007-09-25 03:30:28 135,168 ----a-w C:\WINDOWS\SYSTEM32\java.exe
- 2003-02-20 21:42:34 28,775 ------w C:\WINDOWS\SYSTEM32\javaw.exe
+ 2007-09-25 03:30:30 135,168 ----a-w C:\WINDOWS\SYSTEM32\javaw.exe
+ 2007-09-25 04:31:42 139,264 ----a-w C:\WINDOWS\SYSTEM32\javaws.exe
+ 2005-05-24 17:27:16 213,048 ----a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 20:47:20 94,208 ----a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 20:49:54 950,272 ----a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
- 2008-01-06 05:23:26 10,600,448 ----a-w C:\WINDOWS\Temporary Internet Files\Content.IE5\index.dat
+ 2008-01-07 03:42:50 114,688 --sha-w C:\WINDOWS\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SystemTray"="SysTray.Exe" [2001-08-23 12:00 3072 C:\WINDOWS\SYSTEM32\systray.exe]
"Microsoft Works Portfolio"="C:\Program Files\Microsoft Works\WksSb.exe" [2000-08-10 12:00 311350]
"AdaptecDirectCD"="C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-09-02 21:06 684032]
"LoadPowerProfile"="powrprof.dll" [2004-08-04 03:56 17408 C:\WINDOWS\SYSTEM32\powrprof.dll]
"HPDJ Taskbar Utility"="C:\WINDOWS\SYSTEM32\hpztsb02.exe" [2001-01-30 14:14 192512]
"DellSC"="C:\Program Files\Dell\Solution Center\service.exe" [2000-11-22 11:20 331776]
"WorksFUD"="C:\Program Files\Microsoft Works\wkfud.exe" [2000-08-10 12:00 24576]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-02-29 16:44 66680]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2004-03-12 15:18 124128]
"OrderReminder"="C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-01-30 04:00 98304]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2006-07-07 18:15 600896]
"itype"="C:\Program Files\Microsoft IntelliType Pro\itype.exe" [2006-07-07 19:14 576320]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-10-19 20:16 286720]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-02 18:36 267048]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\PROGRA~1\MESSEN~1\msmsgs.exe" [2004-10-13 11:24 1694208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Printing Migration"="C:\WINDOWS\System32\spool\migrate.dll" [2001-08-23 12:00 30208]

C:\Documents and Settings\anthony\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2001-09-23 22:02:00]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Works Calendar Reminders.lnk - C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2000-08-10 12:00:00]

R2 mf_CCITCP2;Micro Focus Directory Server;"C:\Program Files\Micro Focus\Net Express\Base\bin\mfds.exe" [2003-04-11 01:38]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{17c5cce0-14a5-11dc-8678-009027d5d4f8}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\^RNA]
rundll rnasetup.dll,installoptionalcomponent rna

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:WIN9X /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:WIN9X /user /install
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:IE50 /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:IE50 /user /install
.
Contents of the 'Scheduled Tasks' folder
"2008-01-06 04:00:02 C:\WINDOWS\Tasks\Tune-up Application Start.job"
"2008-01-08 01:34:04 C:\WINDOWS\Tasks\PCHealth Scheduler for Data Collection.job"
- C:\WINDOWS\PCHEALTH\SUPPORT\PCHSCHD.EXE
"2005-06-06 01:24:36 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\PROGRAM FILES\SYMANTEC\LIVEUPDATE\NDETECT.EXE
"2008-01-01 18:43:06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-07 20:48:09
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-07 20:48:57
ComboFix-quarantined-files.txt 2008-01-08 01:48:54
ComboFix4.txt 2008-01-06 05:26:46
ComboFix3.txt 2008-01-07 00:52:32
ComboFix2.txt 2008-01-07 03:30:02
.
2008-01-05 05:33:32 --- E O F ---
Attached Files
File Type: txt ComboFix.txt (9.7 KB, 1 views)
Last edited by tetonbob; 01-07-2008 at 08:15 PM.
apinn237 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-07-2008, 08:18 PM   #12 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,757
OS: 2000 Pro; XP Pro; XP Home


Re: Constant Pop-ups from IE - HJT Log Review Please
Download and scan with SUPERAntiSpyware Free for Home Users
  • Double-click SUPERAntiSpyware.exe and use the default settings for installation.
  • An icon will be created on your desktop. Double-click that icon to launch the program.
  • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)
  • Under "Configuration and Preferences", click the Preferences button.
  • Click the Scanning Control tab.
  • Under Scanner Options make sure the following are checked (leave all others unchecked):
    • Close browsers before scanning.
    • Scan for tracking cookies.
    • Terminate memory threats before quarantining.
  • Click the "Close" button to leave the control center screen.
  • Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
  • On the left, make sure you check C:\Fixed Drive.
  • On the right, under "Complete Scan", choose Perform Complete Scan.
  • Click "Next" to start the scan. Please be patient while it scans your computer.
  • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  • Make sure everything has a checkmark next to it and click "Next".
  • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  • If asked if you want to reboot, click "Yes".
  • To retrieve the removal information after reboot, launch SUPERAntispyware again.
    • Click Preferences, then click the Statistics/Logs tab.
    • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    • Please copy and paste the Scan Log results in your next reply.
  • Click Close to exit the program.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-08-2008, 03:15 PM   #13 (permalink)
Registered User
 
Join Date: Jan 2008
Posts: 9
OS: XP


Re: Constant Pop-ups from IE - HJT Log Review Please
SuperAntiSpyware Log

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 01/08/2008 at 02:22 AM

Application Version : 3.9.1008

Core Rules Database Version : 3376
Trace Rules Database Version: 1370

Scan type : Complete Scan
Total Scan Time : 03:39:31

Memory items scanned : 448
Memory threats detected : 0
Registry items scanned : 6763
Registry threats detected : 40
File items scanned : 99077
File threats detected : 378

Trojan.Downloader-Gen/VX2
HKLM\Software\Classes\CLSID\{00000000-5eb9-11d5-9d45-009027c14662}
HKCR\CLSID\{00000000-5EB9-11D5-9D45-009027C14662}
HKCR\CLSID\{00000000-5EB9-11D5-9D45-009027C14662}
HKCR\CLSID\{00000000-5EB9-11D5-9D45-009027C14662}\InprocServer32
HKCR\CLSID\{00000000-5EB9-11D5-9D45-009027C14662}\InprocServer32#ThreadingModel
HKCR\CLSID\{00000000-5EB9-11D5-9D45-009027C14662}\ProgID
HKCR\CLSID\{00000000-5EB9-11D5-9D45-009027C14662}\Programmable
HKCR\CLSID\{00000000-5EB9-11D5-9D45-009027C14662}\TypeLib
HKCR\CLSID\{00000000-5EB9-11D5-9D45-009027C14662}\VersionIndependentProgID
C:\WINDOWS\VX2.DLL

Adware.WINSHOW
HKLM\Software\Classes\CLSID\{6CC1C918-AE8B-4373-A5B4-28BA1851E39A}
HKCR\CLSID\{6CC1C918-AE8B-4373-A5B4-28BA1851E39A}
HKCR\CLSID\{6CC1C918-AE8B-4373-A5B4-28BA1851E39A}
HKCR\CLSID\{6CC1C918-AE8B-4373-A5B4-28BA1851E39A}\InprocServer32
HKCR\CLSID\{6CC1C918-AE8B-4373-A5B4-28BA1851E39A}\InprocServer32#ThreadingModel
HKCR\CLSID\{6CC1C918-AE8B-4373-A5B4-28BA1851E39A}\ProgID
HKCR\CLSID\{6CC1C918-AE8B-4373-A5B4-28BA1851E39A}\Programmable
HKCR\CLSID\{6CC1C918-AE8B-4373-A5B4-28BA1851E39A}\TypeLib
HKCR\CLSID\{6CC1C918-AE8B-4373-A5B4-28BA1851E39A}\VersionIndependentProgID
C:\DOCUMENTS AND SETTINGS\ANTHONY\APPLICATION DATA\WINSHOW\WINSHOW.DLL

Adware.Second Thought
HKLM\Software\Classes\CLSID\{965A592F-8EFA-4250-8630-7960230792F1}
HKCR\CLSID\{965A592F-8EFA-4250-8630-7960230792F1}
HKCR\CLSID\{965A592F-8EFA-4250-8630-7960230792F1}
HKCR\CLSID\{965A592F-8EFA-4250-8630-7960230792F1}\InprocServer32
HKCR\CLSID\{965A592F-8EFA-4250-8630-7960230792F1}\InprocServer32#ThreadingModel
HKCR\CLSID\{965A592F-8EFA-4250-8630-7960230792F1}\ProgID
HKCR\CLSID\{965A592F-8EFA-4250-8630-7960230792F1}\Programmable
HKCR\CLSID\{965A592F-8EFA-4250-8630-7960230792F1}\TypeLib
HKCR\CLSID\{965A592F-8EFA-4250-8630-7960230792F1}\VersionIndependentProgID
C:\WINDOWS\SYSTEM32\CDSM32.DLL

Unclassified.Unknown Origin
HKLM\Software\Classes\CLSID\{D6C296DE-402D-417f-9D10-431273FE15A5}
HKCR\CLSID\{D6C296DE-402D-417F-9D10-431273FE15A5}
HKCR\CLSID\{D6C296DE-402D-417F-9D10-431273FE15A5}
HKCR\CLSID\{D6C296DE-402D-417F-9D10-431273FE15A5}\InprocServer32
HKCR\CLSID\{D6C296DE-402D-417F-9D10-431273FE15A5}\InprocServer32#ThreadingModel
HKCR\CLSID\{D6C296DE-402D-417F-9D10-431273FE15A5}\ProgID
HKCR\CLSID\{D6C296DE-402D-417F-9D10-431273FE15A5}\Programmable
HKCR\CLSID\{D6C296DE-402D-417F-9D10-431273FE15A5}\TypeLib
HKCR\CLSID\{D6C296DE-402D-417F-9D10-431273FE15A5}\VersionIndependentProgID
C:\WINDOWS\SYSTEM32\NDSFC.DLL
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser#{FE6BC4EF-5676-484B-88AE-883323913256}
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser#{FE6BC4EF-5676-484B-88AE-883323913256}
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser#{FE6BC4EF-5676-484B-88AE-883323913256}
HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser#{FE6BC4EF-5676-484B-88AE-883323913256}
C:\QOOBOX\QUARANTINE\C\WINDOWS\QW50AG9UESBQAW5UYXZHAWESIEPYLG\COMMAND.EXE.VIR
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88D5E18B-7797-4E49-833C-E64F0051DECE}\RP185\A0008199.EXE

Adware.Tracking Cookie
C:\Documents and Settings\anthony\Cookies\anthony@questionmarket[2].txt
C:\Documents and Settings\anthony\Cookies\anthony@tribalfusion[1].txt
C:\Documents and Settings\anthony\Cookies\anthony@eas.apm.emediate[1].txt
C:\Documents and Settings\anthony\Cookies\anthony@statcounter[1].txt
C:\Documents and Settings\anthony\Cookies\anthony@ads.revsci[1].txt
C:\Documents and Settings\anthony\Cookies\anthony@tremor.adbureau[2].txt
C:\Documents and Settings\anthony\Cookies\anthony@protect.spyguardpro[3].txt
C:\Documents and Settings\anthony\Cookies\anthony@doubleclick[1].txt
C:\Documents and Settings\anthony\Cookies\anthony@zedo[2].txt
C:\Documents and Settings\anthony\Cookies\anthony@advertising[2].txt
C:\Documents and Settings\anthony\Cookies\anthony@fastclick[1].txt
C:\Documents and Settings\anthony\Cookies\anthony@rotator.adjuggler[2].txt
C:\Documents and Settings\anthony\Cookies\anthony@protect.spyguardpro[1].txt
C:\Documents and Settings\anthony\Cookies\anthony@interclick[2].txt
C:\Documents and Settings\anthony\Cookies\anthony@adbrite[2].txt
C:\Documents and Settings\anthony\Cookies\anthony@adrevolver[1].txt
C:\Documents and Settings\anthony\Cookies\anthony@traffic.buyservices[1].txt
C:\Documents and Settings\anthony\Cookies\anthony@electronicarts.112.2o7[1].txt
C:\Documents and Settings\anthony\Cookies\anthony@ads.adbrite[1].txt
C:\Documents and Settings\anthony\Cookies\anthony@revsci[1].txt
C:\Documents and Settings\anthony\Cookies\anthony@ads.pointroll[1].txt
C:\Documents and Settings\anthony\Cookies\anthony@buycom.122.2o7[1].txt
C:\Documents and Settings\anthony\Cookies\anthony@atdmt[1].txt
C:\Documents and Settings\anthony\Cookies\anthony@pandasoftware.112.2o7[1].txt
C:\Documents and Settings\anthony\Cookies\anthony@media.adrevolver[1].txt
C:\Documents and Settings\anthony\Cookies\anthony@ad.yieldmanager[4].txt
C:\WINDOWS\Cookies\anyuser@doubleclick[1].txt
C:\WINDOWS\Cookies\anyuser@windowsmedia[1].txt
C:\WINDOWS\Cookies\anyuser@clickagents[1].txt
C:\WINDOWS\Cookies\anyuser@hg1.hitbox[2].txt
C:\WINDOWS\Cookies\anyuser@targetnet[1].txt
C:\WINDOWS\Cookies\anyuser@bluestreak[1].txt
C:\WINDOWS\Cookies\anyuser@pennyweb[2].txt
C:\WINDOWS\Cookies\anyuser@valueclick[1].txt
C:\WINDOWS\Cookies\anyuser@atdmt[2].txt
C:\WINDOWS\Cookies\anyuser@adorigin[1].txt
C:\WINDOWS\Cookies\anyuser@tribalfusion[1].txt
C:\WINDOWS\Cookies\anyuser@superstats[1].txt
C:\WINDOWS\Cookies\anyuser@www.clickedyclick[1].txt
C:\WINDOWS\Cookies\anyuser@ehg-sportsline.hitbox[2].txt
C:\WINDOWS\Cookies\anyuser@banserv.internetfuel[1].txt
C:\WINDOWS\Cookies\anyuser@questionmarket[1].txt
C:\WINDOWS\Cookies\anyuser@phg.hitbox[1].txt
C:\WINDOWS\Cookies\anyuser@paycounter[1].txt
C:\WINDOWS\Cookies\anyuser@hitbox[1].txt
C:\WINDOWS\Cookies\anyuser@advertising[1].txt
C:\WINDOWS\Cookies\anyuser@doubleclick[2].txt
C:\WINDOWS\Cookies\anyuser@thisbanner[2].txt
C:\WINDOWS\Cookies\anyuser@www.riverbelle[1].txt
C:\WINDOWS\Cookies\anyuser@mediaplex[1].txt
C:\WINDOWS\Cookies\anyuser@search.clickfinders[2].txt
C:\WINDOWS\Cookies\anyuser@servedby.advertising[1].txt
C:\WINDOWS\Cookies\anyuser@fastclick[1].txt
C:\WINDOWS\Cookies\anyuser@www.adorigin[2].txt
C:\WINDOWS\Cookies\anyuser@rd.advertising[1].txt
C:\WINDOWS\Cookies\anyuser@adserv.internetfuel[2].txt
C:\WINDOWS\Cookies\anyuser@webpdp.gator[1].txt
C:\WINDOWS\Cookies\anyuser@atdmt[3].txt
C:\WINDOWS\Cookies\anyuser@statse.webtrendslive[1].txt
C:\WINDOWS\Cookies\anyuser@valueclick[2].txt
C:\WINDOWS\Cookies\anyuser@tripod[1].txt
C:\WINDOWS\Cookies\anyuser@ad-annex[2].txt
C:\WINDOWS\Cookies\anyuser@hc2.humanclick[1].txt
C:\WINDOWS\Cookies\anyuser@w107.hitbox[1].txt
C:\WINDOWS\Cookies\anyuser@stats.surfaid.ihost[1].txt
C:\WINDOWS\Cookies\anyuser@phg.hitbox[2].txt
C:\WINDOWS\Cookies\anyuser@www.commission-junction[1].txt
C:\WINDOWS\Cookies\anyuser@www.qksrv[2].txt
C:\WINDOWS\Cookies\anyuser@fortunecity[2].txt
C:\WINDOWS\Cookies\anyuser@advertising[2].txt
C:\WINDOWS\Cookies\anyuser@clickagents[2].txt

C:\WINDOWS\Cookies\anyuser@www.foxcounter[1].txt
C:\WINDOWS\Cookies\anyuser@amazingmedia[1].txt
C:\WINDOWS\Cookies\anyuser@ehg-espn.hitbox[2].txt
C:\WINDOWS\Cookies\anyuser@fastclick[3].txt
C:\WINDOWS\Cookies\anyuser@linksynergy[2].txt
C:\WINDOWS\Cookies\anyuser@hg1.hitbox[3].txt
C:\WINDOWS\Cookies\anyuser@cz7.clickzs[1].txt
C:\WINDOWS\Cookies\anyuser@ehg-ignitemedia.hitbox[2].txt
C:\WINDOWS\Cookies\anyuser@cz8.clickzs[2].txt
C:\WINDOWS\Cookies\anyuser@macromedia[1].txt
C:\WINDOWS\Cookies\anyuser@questionmarket[3].txt
C:\WINDOWS\Cookies\anyuser@w117.hitbox[1].txt
C:\WINDOWS\Cookies\anyuser@bluestreak[3].txt
C:\WINDOWS\Cookies\anyuser@hitbox[3].txt
C:\WINDOWS\Cookies\anyuser@mediaplex[2].txt
C:\WINDOWS\Cookies\anyuser@webpdp.gator[3].txt
C:\WINDOWS\Cookies\anyuser@ehg.hitbox[1].txt
C:\WINDOWS\Cookies\anyuser@cz4.clickzs[1].txt
C:\WINDOWS\Cookies\anyuser@ad-flow[1].txt
C:\WINDOWS\Cookies\anyuser@php.offshoreclicks[1].txt
C:\WINDOWS\Cookies\anyuser@cz6.clickzs[1].txt
C:\WINDOWS\Cookies\anyuser@ads.coolquiz[2].txt
C:\WINDOWS\Cookies\anyuser@money-earn.tripod[1].txt
C:\WINDOWS\Cookies\anyuser@c1.zedo[1].txt
C:\WINDOWS\Cookies\anyuser@zedo.musiccity[1].txt
C:\WINDOWS\Cookies\anyuser@zedo[2].txt
C:\WINDOWS\Cookies\anyuser@targetnet[3].txt
C:\WINDOWS\Cookies\anyuser@paycounter[2].txt
C:\WINDOWS\Cookies\anyuser@webpower[1].txt
C:\WINDOWS\Cookies\anyuser@54.clickthebutton[2].txt
C:\WINDOWS\Cookies\anyuser@addynamix[2].txt
C:\WINDOWS\Cookies\anyuser@ehg-sportsline.hitbox[1].txt
C:\WINDOWS\Cookies\anyuser@counter16.sextracker[2].txt
C:\WINDOWS\Cookies\anyuser@windowsmedia[3].txt
C:\WINDOWS\Cookies\anyuser@ad.doubleclick[2].txt
C:\WINDOWS\Cookies\anyuser@adserv.internetfuel[3].txt
C:\WINDOWS\Cookies\anyuser@fastclick[4].txt
C:\WINDOWS\Cookies\anyuser@cz3.clickzs[1].txt
C:\WINDOWS\Cookies\anyuser@servedby.advertising[3].txt
C:\Documents and Settings\anthony\Cookies\anthony@ad.yieldmanager[2].txt
C:\Documents and Settings\anthony\Cookies\anthony@ad.yieldmanager[1].txt
C:\Documents and Settings\default\Cookies\anyuser@doubleclick[1].txt
C:\Documents and Settings\default\Cookies\anyuser@windowsmedia[1].txt
C:\Documents and Settings\default\Cookies\anyuser@clickagents[1].txt
C:\Documents and Settings\default\Cookies\anyuser@hg1.hitbox[2].txt
C:\Documents and Settings\default\Cookies\anyuser@targetnet[1].txt
C:\Documents and Settings\default\Cookies\anyuser@bluestreak[1].txt
C:\Documents and Settings\default\Cookies\anyuser@pennyweb[2].txt
C:\Documents and Settings\default\Cookies\anyuser@valueclick[1].txt
C:\Documents and Settings\default\Cookies\anyuser@atdmt[2].txt
C:\Documents and Settings\default\Cookies\anyuser@adorigin[1].txt
C:\Documents and Settings\default\Cookies\anyuser@tribalfusion[1].txt
C:\Documents and Settings\default\Cookies\anyuser@superstats[1].txt
C:\Documents and Settings\default\Cookies\anyuser@www.clickedyclick[1].txt
C:\Documents and Settings\default\Cookies\anyuser@ehg-sportsline.hitbox[2].txt
C:\Documents and Settings\default\Cookies\anyuser@banserv.internetfuel[1].txt
C:\Documents and Settings\default\Cookies\anyuser@questionmarket[1].txt
C:\Documents and Settings\default\Cookies\anyuser@phg.hitbox[1].txt
C:\Documents and Settings\default\Cookies\anyuser@paycounter[1].txt
C:\Documents and Settings\default\Cookies\anyuser@hitbox[1].txt
C:\Documents and Settings\default\Cookies\anyuser@advertising[1].txt
C:\Documents and Settings\default\Cookies\anyuser@doubleclick[2].txt
C:\Documents and Settings\default\Cookies\anyuser@thisbanner[2].txt
C:\Documents and Settings\default\Cookies\anyuser@www.riverbelle[1].txt
C:\Documents and Settings\default\Cookies\anyuser@mediaplex[1].txt
C:\Documents and Settings\default\Cookies\anyuser@search.clickfinders[2].txt
C:\Documents and Settings\default\Cookies\anyuser@servedby.advertising[1].txt
C:\Documents and Settings\default\Cookies\anyuser@fastclick[1].txt
C:\Documents and Settings\default\Cookies\anyuser@www.adorigin[2].txt
C:\Documents and Settings\default\Cookies\anyuser@rd.advertising[1].txt
C:\Documents and Settings\default\Cookies\anyuser@adserv.internetfuel[2].txt
C:\Documents and Settings\default\Cookies\anyuser@webpdp.gator[1].txt
C:\Documents and Settings\default\Cookies\anyuser@atdmt[3].txt
C:\Documents and Settings\default\Cookies\anyuser@statse.webtrendslive[1].txt
C:\Documents and Settings\default\Cookies\anyuser@valueclick[2].txt
C:\Documents and Settings\default\Cookies\anyuser@tripod[1].txt
C:\Documents and Settings\default\Cookies\anyuser@ad-annex[2].txt
C:\Documents and Settings\default\Cookies\anyuser@hc2.humanclick[1].txt
C:\Documents and Settings\default\Cookies\anyuser@w107.hitbox[1].txt
C:\Documents and Settings\default\Cookies\anyuser@stats.surfaid.ihost[1].txt
C:\Documents and Settings\default\Cookies\anyuser@phg.hitbox[2].txt
C:\Documents and Settings\default\Cookies\anyuser@www.commission-junction[1].txt
C:\Documents and Settings\default\Cookies\anyuser@www.qksrv[2].txt
C:\Documents and Settings\default\Cookies\anyuser@fortunecity[2].txt
C:\Documents and Settings\default\Cookies\anyuser@advertising[2].txt
C:\Documents and Settings\default\Cookies\anyuser@clickagents[2].txt
C:\Documents and Settings\default\Cookies\anyuser@www.foxcounter[1].txt
C:\Documents and Settings\default\Cookies\anyuser@amazingmedia[1].txt
C:\Documents and Settings\default\Cookies\anyuser@ehg-espn.hitbox[2].txt
C:\Documents and Settings\default\Cookies\anyuser@fastclick[3].txt
C:\Documents and Settings\default\Cookies\anyuser@linksynergy[2].txt
C:\Documents and Settings\default\Cookies\anyuser@hg1.hitbox[3].txt
C:\Documents and Settings\default\Cookies\anyuser@cz7.clickzs[1].txt
C:\Documents and Settings\default\Cookies\anyuser@ehg-ignitemedia.hitbox[2].txt
C:\Documents and Settings\default\Cookies\anyuser@cz8.clickzs[2].txt
C:\Documents and Settings\default\Cookies\anyuser@macromedia[1].txt
C:\Documents and Settings\default\Cookies\anyuser@questionmarket[3].txt
C:\Documents and Settings\default\Cookies\anyuser@w117.hitbox[1].txt
C:\Documents and Settings\default\Cookies\anyuser@bluestreak[3].txt
C:\Documents and Settings\default\Cookies\anyuser@hitbox[3].txt
C:\Documents and Settings\default\Cookies\anyuser@mediaplex[2].txt
C:\Documents and Settings\default\Cookies\anyuser@webpdp.gator[3].txt
C:\Documents and Settings\default\Cookies\anyuser@ehg.hitbox[1].txt
C:\Documents and Settings\default\Cookies\anyuser@cz4.clickzs[1].txt
C:\Documents and Settings\default\Cookies\anyuser@ad-flow[1].txt
C:\Documents and Settings\default\Cookies\anyuser@php.offshoreclicks[1].txt
C:\Documents and Settings\default\Cookies\anyuser@cz6.clickzs[1].txt
C:\Documents and Settings\default\Cookies\anyuser@ads.coolquiz[2].txt
C:\Documents and Settings\default\Cookies\anyuser@money-earn.tripod[1].txt
C:\Documents and Settings\default\Cookies\anyuser@c1.zedo[1].txt
C:\Documents and Settings\default\Cookies\anyuser@zedo.musiccity[1].txt
C:\Documents and Settings\default\Cookies\anyuser@zedo[2].txt
C:\Documents and Settings\default\Cookies\anyuser@targetnet[4].txt
C:\Documents and Settings\default\Cookies\anyuser@targetnet[3].txt
C:\Documents and Settings\default\Cookies\anyuser@paycounter[2].txt
C:\Documents and Settings\default\Cookies\anyuser@webpower[1].txt
C:\Documents and Settings\default\Cookies\anyuser@54.clickthebutton[2].txt
C:\Documents and Settings\default\Cookies\anyuser@addynamix[2].txt
C:\Documents and Settings\default\Cookies\anyuser@ehg-sportsline.hitbox[1].txt
C:\Documents and Settings\default\Cookies\anyuser@windowsmedia[3].txt
C:\Documents and Settings\default\Cookies\anyuser@ad.doubleclick[2].txt
C:\Documents and Settings\default\Cookies\anyuser@adserv.internetfuel[3].txt
C:\Documents and Settings\default\Cookies\anyuser@fastclick[4].txt
C:\Documents and Settings\default\Cookies\anyuser@cz3.clickzs[1].txt
C:\Documents and Settings\default\Cookies\anyuser@servedby.advertising[3].txt
C:\Documents and Settings\default\Cookies\anyuser@ad.wedoo[1].txt
C:\Documents and Settings\default\Cookies\anyuser@clickagents[3].txt
C:\Documents and Settings\default\Cookies\anyuser@fortunecity[1].txt
C:\Documents and Settings\default\Cookies\anyuser@mediaplex[4].txt
C:\Documents and Settings\default\Cookies\anyuser@hg1.hitbox[4].txt
C:\Documents and Settings\default\Cookies\anyuser@addynamix[3].txt
C:\Documents and Settings\default\Cookies\anyuser@linksynergy[3].txt
C:\Documents and Settings\default\Cookies\anyuser@click-fr[1].txt
C:\Documents and Settings\default\Cookies\anyuser@questionmarket[4].txt
C:\Documents and Settings\default\Cookies\anyuser@pennyweb[3].txt
C:\Documents and Settings\default\Cookies\anyuser@advertising[4].txt
C:\Documents and Settings\default\Cookies\anyuser@fastclick[5].txt
C:\Documents and Settings\default\Cookies\anyuser@hitbox[4].txt
C:\Documents and Settings\default\Cookies\anyuser@cz8.clickzs[1].txt
C:\Documents and Settings\default\Cookies\anyuser@realmedia[1].txt
C:\Documents and Settings\default\Cookies\anyuser@sexlist[4].txt
C:\Documents and Settings\default\Cookies\anyuser@bluestreak[2].txt
C:\Documents and Settings\default\Cookies\anyuser@statse.webtrendslive[2].txt
C:\Documents and Settings\default\Cookies\anyuser@ru4[1].txt
C:\Documents and Settings\default\Cookies\anyuser@ads.adsag[1].txt
C:\Documents and Settings\default\Cookies\anyuser@weborama[1].txt
C:\Documents and Settings\default\Cookies\anyuser@ehg.hitbox[3].txt
C:\Documents and Settings\default\Cookies\anyuser@tribalfusion[2].txt
C:\Documents and Settings\default\Cookies\anyuser@www.mediadevil[2].txt
C:\Documents and Settings\default\Cookies\anyuser@nandomedia[1].txt
C:\Documents and Settings\default\Cookies\anyuser@tpl1.realtracker[1].txt
C:\Documents and Settings\default\Cookies\anyuser@pointroll[2].txt
C:\Documents and Settings\default\Cookies\anyuser@zedo[3].txt
C:\Documents and Settings\default\Cookies\default@doubleclick[1].txt
C:\Documents and Settings\default\Cookies\anyuser@ads4.clearchannel[2].txt
C:\Documents and Settings\default\Cookies\anyuser@adserver[1].txt
C:\Documents and Settings\default\Cookies\anyuser@windowsmedia[2].txt
C:\Documents and Settings\default\Cookies\anyuser@overture[1].txt
C:\Documents and Settings\default\Cookies\anyuser@paycounter[4].txt
C:\Documents and Settings\default\Cookies\anyuser@adserv.internetfuel[4].txt
C:\Documents and Settings\default\Cookies\anyuser@pathfinder[1].txt
C:\Documents and Settings\default\Cookies\anyuser@mediamgr.ugo[2].txt
C:\Documents and Settings\default\Cookies\anyuser@ehg-espn.hitbox[1].txt
C:\Documents and Settings\default\Cookies\anyuser@webpdp.gator[4].txt
C:\Documents and Settings\default\Cookies\anyuser@focusin.ads.targetnet[1].txt
C:\Documents and Settings\default\Cookies\anyuser@ad.doubleclick[3].txt
C:\Documents and Settings\default\Cookies\anyuser@thisbanner[3].txt
C:\Documents and Settings\default\Cookies\anyuser@ehg-ignitemedia.hitbox[1].txt
C:\Documents and Settings\default\Cookies\anyuser@members.tripod[1].txt
C:\Documents and Settings\default\Cookies\anyuser@54.clickthebutton[3].txt
C:\Documents and Settings\default\Cookies\anyuser@mrudolf.tripod[1].txt
C:\Documents and Settings\default\Cookies\anyuser@counter8.sextracker[3].txt
C:\Documents and Settings\default\Cookies\anyuser@www.clickheretofind[1].txt
C:\Documents and Settings\default\Cookies\anyuser@fortunecity.co[1].txt
C:\Documents and Settings\default\Cookies\anyuser@ehg-sportsline.hitbox[3].txt
C:\Documents and Settings\default\Cookies\anyuser@servedby.advertising[2].txt
C:\Documents and Settings\default\Cookies\anyuser@fastclick[2].txt
C:\Documents and Settings\default\Cookies\anyuser@fl01.ct2.comclick[2].txt
C:\Documents and Settings\default\Cookies\anyuser@ads.as4x.tmcs[1].txt

Adware.MyWay
C:\Program Files\MyWay\myBar\History\search
C:\Program Files\MyWay\myBar\History
C:\Program Files\MyWay\myBar\Settings\prevcfg.htm
C:\Program Files\MyWay\myBar\Settings
C:\Program Files\MyWay\myBar\1.bin
C:\Program Files\MyWay\myBar
C:\Program Files\MyWay

Worm.MSVC32
C:\WINDOWS\SYSTEM\MSVC32.EXE

SeekSeek (DefaultSearch)
C:\WINDOWS\MWSVM.EXE

Adware.k8l
C:\PROGRAM FILES\ACCESSORIES\RTEMECOQ.HTML

Adware.ClickSpring/Yazzle
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\COMMON FILES\YAZZLE1549OINADMIN.EXE.VIR
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\COMMON FILES\YAZZLE1549OINUNINSTALLER.EXE.VIR

Adware.StarsDoor
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\WINABLE\WINABLE.EXE.VIR
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88D5E18B-7797-4E49-833C-E64F0051DECE}\RP185\A0008203.EXE

Trojan.NetMon/DNSChange
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\NETWORK MONITOR\NETMON.EXE.VIR
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88D5E18B-7797-4E49-833C-E64F0051DECE}\RP185\A0008215.EXE

Trojan.FavoriteMan Variant
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\EMESX.DLL.VIR
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88D5E18B-7797-4E49-833C-E64F0051DECE}\RP190\A0008532.DLL

Adware.SearchAssistant
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\PREUNINSTALL.EXE.VIR
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88D5E18B-7797-4E49-833C-E64F0051DECE}\RP190\A0008544.EXE

Adware.ShopAtHomeAgent
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\SAHAGENT1003.EXE.VIR

Trojan.Unknown Origin
C:\QOOBOX\QUARANTINE\C\WINDOWS\UNINSTALL_NMON.VBS.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\B104.EXE.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\QW50AG9UESBQAW5UYXZHAWESIEPYLG\KQCXU36RYM1KUQCRSRT1UQHPKHDVM0.VBS.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\UNIST1.HTM.VIR
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88D5E18B-7797-4E49-833C-E64F0051DECE}\RP185\A0008195.VBS
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88D5E18B-7797-4E49-833C-E64F0051DECE}\RP185\A0008197.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88D5E18B-7797-4E49-833C-E64F0051DECE}\RP185\A0008218.VBS

Adware.Adservs
C:\QOOBOX\QUARANTINE\C\WINDOWS\QW50AG9UESBQAW5UYXZHAWESIEPYLG\ASAPPSRV.DLL.VIR
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88D5E18B-7797-4E49-833C-E64F0051DECE}\RP185\A0008217.DLL

Unclassified.Unknown Origin/System
C:\QOOBOX\QUARANTINE\C\WINDOWS\UNINST2.HTM.VIR

Adware.ClickSpring
C:\QOOBOX\QUARANTINE\C\WINDOWS\APPPATCH\SPOOL32.EXE.VIR
C:\SYSTEM VOLUME INFORMATION\_RESTORE{88D5E18B-7797-4E49-833C-E64F0051DECE}\RP186\A0008319.EXE
apinn237 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-08-2008, 05:46 PM   #14 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,757
OS: 2000 Pro; XP Pro; XP Home


Re: Constant Pop-ups from IE - HJT Log Review Please
Post a new HijackThis log, and let me know how the machine is behaving.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-08-2008, 06:40 PM   #15 (permalink)
Registered User
 
Join Date: Jan 2008
Posts: 9
OS: XP


Re: Constant Pop-ups from IE - HJT Log Review Please
The machine seems to be a lot happier



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:38:39 PM, on 1/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5346.0005)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Micro Focus\Net Express\Base\bin\mfds.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Dell\Solution Center\service.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Palm\Hotsync.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Documents and Settings\ANTHONY\Application Data\Mozilla\Profiles\default\3hiq6oty.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\ANTHONY\Application Data\Mozilla\Profiles\default\3hiq6oty.slt\prefs.js)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM32\hpztsb02.exe
O4 - HKLM\..\Run: [DellSC] C:\Program Files\Dell\Solution Center\service.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [MSMSGS] C:\PROGRA~1\MESSEN~1\msmsgs.exe /background (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [MSMSGS] C:\PROGRA~1\MESSEN~1\msmsgs.exe /background (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [MSMSGS] C:\PROGRA~1\MESSEN~1\msmsgs.exe /background (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Printing Migration] rundll32.exe C:\WINDOWS\System32\spool\migrate.dll,ProcessWin9xNetworkPrinters (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MSMSGS] C:\PROGRA~1\MESSEN~1\msmsgs.exe /background (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [Printing Migration] rundll32.exe C:\WINDOWS\System32\spool\migrate.dll,ProcessWin9xNetworkPrinters (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\Hotsync.exe
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Dell Home - {08DCFC6C-B6E4-480C-95A4-FC64F37B787E} - http://www.dellnet.com (file missing) (HKCU)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_02) -
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Micro Focus Directory Server (mf_CCITCP2) - Unknown owner - C:\Program Files\Micro Focus\Net Express\Base\bin\mfds.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 8831 bytes
apinn237 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-08-2008, 06:56 PM   #16 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,757
OS: 2000 Pro; XP Pro; XP Home


Re: Constant Pop-ups from IE - HJT Log Review Please
Looks good from where I'm sitting also.

One little detail to take care of.

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries if they exist (make sure you do not miss any) and click Fix Checked

O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_02) -

Close HijackThis now.

---------------------------------------------------------------------------------------------

Your logs appear clean.You should be good to go. We still have a few items to address.

Go to -> Run -> copy/paste in the following single line command & click OK

combofix /u



This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points.

Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps and use the following free programs:
  • Microsoft Windows Update - http://www.windowsupdate.com
    Visit regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

  • SpywareBlaster to help prevent spyware from installing in the first place.
    • Install & update SpywareBlaster with the latest definitions.
      After you have updated, click the button - enable protection for all unprotected items
  • SpywareGuard to catch and block spyware before it can execute.
  • IE-SpyAd - IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impairs attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. An installation tutorial is available here.

  • MVPS HOST FILE
    The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.
    • Download Host.zip to your desktop.
    • From your Desktop right-click (hosts.zip) and select:
      Extract All from the menu.
    • Click Next, click Next, select the option:
      "Show Extracted files", click Finish
    • This will open the newly created hosts folder on your Desktop.
    • Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
    • Once updated you should see another prompt that the task was completed.
  • ANTIVIRUS SOFTWARE
    It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. It is imperative that you update your antivirus software at least once a week (even more if you wish). If you do not update your antivirus software then it will not be able to catch new malware that may have come out.

    Do not install more than one AntiVirus program because they will conflict with each other.

  • FIREWALL
    If you do not have a firewall, here are a couple of great free ones available for personal use. Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here

    Do not install more than one firewall program because they will conflict with each other.

Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer

Here are some additional utilities that will further enhance your safety.
  • http://www.trillian.cc ? Trillian or http://www.miranda-im.com ? Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)

  • http://www.mozilla.org/products/firefox/ - Firefox - Use this alternate browser. While Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness.

  • http://java.com/en/index.jsp - Sun's Java - It's much more secure than Microsoft's Java Virtual Machine.

  • http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT.

    ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.

    NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.


In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles
If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it.

Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-08-2008, 07:19 PM   #17 (permalink)
Registered User
 
Join Date: Jan 2008
Posts: 9
OS: XP


Re: Constant Pop-ups from IE - HJT Log Review Please
Thanks for all your help!!
apinn237 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
 

« Previous Thread | Next Thread »

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off



All times are GMT -7. The time now is 03:17 AM.

Contact Us - Tech Support Forum - Archive - Privacy Statement - Top


Copyright 2001 - 2009, Tech Support Forum
Home Tips Plus | Outdoor Basecamp | Automotive Support Forum

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85