Welcome to Tech Support Forum home to more then 136,000 problems solved. Issues have included: Spyware, Malware, Virus Issues, Windows, Microsoft, Linux, Networking, Security, Hardware, and Gaming Getting your problem solved is as easy as:
1. Registering for a free account
2. Asking your question
3. Receiving an answer

Registered members:
* Get free support
* Communicate privately with other members (PM).
* Removal of this message
* See fewer ads.
* And much more..

 


Want to know how to post a question? click here Having problems with spyware and pop-ups? First Steps
Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads
Reload this Page Re: This operation has been cancelled due to restrictions...
User Name
Password
Site Map Register Donate Rules Blogs Mark Forums Read


Resolved HJT Threads Resolved spyware and popup issues.

 
 
LinkBack Thread Tools
Old 12-29-2007, 12:13 PM   #1 (permalink)
Registered User
 
Join Date: Dec 2007
Posts: 5
OS: xp


Re: This operation has been cancelled due to restrictions...
I was/am having the same problem accessing my control panel as I received an error message stating "This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator."
I have followed the 5 steps posted in a former thread by eneles on 11-01-2007, 10:20 AM.
I have Windows XP Home Editon Version 2002 Service pack 2.
Please help me clean up my computer. THANKS!

Here is the DSS scan:

Deckard's System Scanner v20071014.68
Run by Kris on 2007-12-29 12:20:37
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
62: 2007-12-29 18:20:46 UTC - RP93 - Deckard's System Scanner Restore Point
61: 2007-12-29 05:53:02 UTC - RP92 - System Checkpoint
60: 2007-12-28 03:38:14 UTC - RP91 - Configured Finding Nemo: Nemo's Underwater World of Fun Special 
59: 2007-12-28 03:35:16 UTC - RP90 - Removed Raptor Audio 2.0
58: 2007-12-28 03:33:44 UTC - RP89 - Removed Get High Speed Internet!


-- First Restore Point --
1: 2007-10-18 01:37:10 UTC - RP32 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.

Percentage of Memory in Use: 78% (more than 75%).
Total Physical Memory: 510 MiB (512 MiB recommended).


-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2007-12-29 12:22:19
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\SYSTEM32\SMSS.EXE
C:\WINDOWS\SYSTEM32\WINLOGON.EXE
C:\WINDOWS\SYSTEM32\SERVICES.EXE
C:\WINDOWS\SYSTEM32\LSASS.EXE
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\SYSTEM32\LEXBCES.EXE
C:\WINDOWS\SYSTEM32\LEXPPS.EXE
C:\WINDOWS\SYSTEM32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
C:\Program Files\McAfee.com\VSO\mcvsrte.exe
C:\Program Files\McAfee.com\Personal Firewall\MpfService.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\SYSTEM32\FXSSVC.EXE
C:\Program Files\McAfee.com\VSO\McShield.exe
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\SYSTEM32\WINLOGON.EXE
C:\WINDOWS\SYSTEM32\WSCNTFY.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jucheck.exe
C:\Program Files\McAfee.com\VSO\McVSEscn.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\SYSTEM32\explore.exe
C:\Program Files\Real\RealPlayer\realplay.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\D-link AirPlus G DWL-G120 Wireless USB\120UTIL.exe
C:\Program Files\McAfee.com\VSO\mcvsftsn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\SYSTEM32\WINLOGON.EXE
C:\WINDOWS\SYSTEM32\wuauclt.exe
C:\Documents and Settings\Kris\Desktop\dss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R3 - Default URLSearchHook is missing
F0 - system.ini: Shell=Explorer.exe C:\WINDOWS\system32\printer.exe
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\printer.exe
O2 - BHO: ALOT eMusic Toolbar - {8260C2B8-E0D1-448a-B062-33D12D468BF0} - C:\Program Files\alot\bin\alot.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\Program Files\McAfee.com\VSO\mcvsshl.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: ALOT eMusic Toolbar - {8260C2B8-E0D1-448a-B062-33D12D468BF0} - C:\Program Files\alot\bin\alot.dll
O4 - HKLM\..\Run: [WinAVX] C:\WINDOWS\system32\WinAvXX.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [DoNotDelete] C:\WINDOWS\system32\explore.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0b\aoltray.exe
O4 - Global Startup: D-link AirPlus G DWL-G120 Wireless USB.lnk = C:\Program Files\D-link AirPlus G DWL-G120 Wireless USB\120UTIL.exe
O4 - Global Startup: info.exe
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableTaskMgr=1
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\AMV Convert Tool 3.70\AMVConverter\grab.html
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?39a8643fe42b4b11931002141737642f
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?39a8643fe42b4b11931002141737642f
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (file missing)
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Bryce\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://online.musicmatch.com (HKLM)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} () - http://ak.exe.imgfarm.com/images/noc...1.0.0.15-3.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub...sh/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\hanonvt.ini
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\SYSTEM32\LEXBCES.EXE
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - C:\Program Files\McAfee.com\VSO\McShield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\Program Files\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - C:\Program Files\McAfee.com\VSO\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\McAfee.com\Personal Firewall\MpfService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe


--
End of file - 8595 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 MPFIREWL - c:\windows\system32\drivers\mpfirewall.sys <Not Verified; McAfee Security; McAfee Personal Firewall Plus>
R2 ASCTRM - c:\windows\system32\drivers\asctrm.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver>
R3 PRISM_A02 (D-link AirPlus G DWL-G120 WLAN USB Driver) - c:\windows\system32\drivers\prisma02.sys <Not Verified; GlobespanVirata, Inc.; PRISM 802.11 Wireless LAN>

S3 DSproct - c:\program files\dellsupport\gtaction\triggers\dsproct.sys <Not Verified; Gteko Ltd.; processt>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 aawservice (Ad-Aware 2007 Service) - "c:\program files\lavasoft\ad-aware 2007\aawservice.exe" <Not Verified; Lavasoft AB; Ad-Aware 2007 Service>


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Scheduled Tasks -------------------------------------------------------------

2007-12-29 12:22:00 474 --a------ C:\WINDOWS\Tasks\McAfee.com Update Check (BRYCEANDEVAN-Jody).job
2007-12-29 12:20:00 474 --a------ C:\WINDOWS\Tasks\McAfee.com Update Check (BRYCEANDEVAN-Evan).job
2007-12-29 12:19:00 476 --a------ C:\WINDOWS\Tasks\McAfee.com Update Check (BRYCEANDEVAN-Paige).job
2007-12-29 12:18:00 476 --a------ C:\WINDOWS\Tasks\McAfee.com Update Check (DG3N4761-Owner).job
2007-12-29 12:18:00 474 --a------ C:\WINDOWS\Tasks\McAfee.com Update Check (BRYCEANDEVAN-Kris).job
2007-12-29 12:18:00 476 --a------ C:\WINDOWS\Tasks\McAfee.com Update Check (BRYCEANDEVAN-Bryce).job
2007-12-29 11:26:00 256 --a------ C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job
2007-12-28 19:51:00 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
2007-12-28 18:30:00 348 --a------ C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (BRYCEANDEVAN-Kris).job


-- Files created between 2007-11-29 and 2007-12-29 -----------------------------

2007-12-28 07:25:37 0 d-------- C:\ie-spyad_zo
2007-12-28 07:01:12 118784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL <Not Verified; Microsoft Corporation; MSSTDFMT Object Library>
2007-12-28 07:01:11 0 d-------- C:\Program Files\SpywareBlaster
2007-12-27 23:07:28 44928 --a------ C:\WINDOWS\system32\drivers\SDTHOOK.SYS <Not Verified; Panda Software; Panda® Antivirus>
2007-12-27 2303 8576 --a------ C:\WINDOWS\system32\drivers\idbkfocmqrxv.sys <Not Verified; Panda Software International; RKPavProc Driver>
2007-12-27 23:03:30 71 --a------ C:\WINDOWS\system32\pfdnnt_actions.sys
2007-12-27 23:03:30 8704 --a------ C:\WINDOWS\system32\pfdnnt.exe <Not Verified; Panda Software International; Panda Anti-malware>
2007-12-27 22:46:12 0 d-------- C:\WINDOWS\system32\ActiveScan
2007-12-27 22:46:10 0 d-------- C:\WINDOWS\LastGood
2007-12-27 22:39:21 381012 --a------ C:\Program Files\Uninstall Fun Web Products.dll <Not Verified; MyWebSearch.com; My Web Search Bar for Internet Explorer, FireFox, Netscape, email clients, and messenger clients>
2007-12-21 22:08:59 0 d-------- C:\Documents and Settings\Evan\Contacts
2007-12-18 20:11:01 0 d-------- C:\Documents and Settings\Jody\Application Data\FunWebProducts
2007-12-18 19:16:26 0 d-------- C:\Documents and Settings\Jody\Contacts
2007-12-18 19:15:39 0 d-------- C:\Documents and Settings\Jody\Application Data\alot
2007-12-17 2056 0 d-------- C:\Program Files\America Online 8.0b
2007-12-17 2009 0 d-------- C:\Documents and Settings\Kris\Application Data\MX
2007-12-07 16:50:37 0 d-------- C:\Documents and Settings\Paige\Application Data\alot
2007-12-01 2224 0 d-------- C:\Program Files\alot
2007-12-01 2224 0 d-------- C:\Documents and Settings\Kris\Application Data\alot
2007-12-01 2223 0 d-------- C:\Program Files\eMusic Download Manager
2007-11-30 03:05:23 0 d-------- C:\Program Files\Windows Live Favorites


-- Find3M Report ---------------------------------------------------------------

2007-12-28 01:20:20 0 d-------- C:\Program Files\Windows Live Toolbar
2007-12-28 01:15:13 0 d-------- C:\Program Files\QuickTime
2007-12-28 01:12:25 0 d-------- C:\Program Files\MSN Messenger
2007-12-28 01:11:55 0 d-------- C:\Program Files\Messenger
2007-12-28 0158 0 d-------- C:\Program Files\DellSupport
2007-12-28 0106 0 d-------- C:\Program Files\D-link AirPlus G DWL-G120 Wireless USB
2007-12-27 21:39:52 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-12-27 21:36:12 0 d-------- C:\Program Files\THQ
2007-12-27 21:34:24 0 d-------- C:\Program Files\Google
2007-12-17 20:09:31 0 d-------- C:\Program Files\Common Files\aolback
2007-12-17 20:09:06 0 d-------- C:\Program Files\AOL Companion
2007-12-17 20:08:48 0 d-------- C:\Program Files\Common Files\AOL
2007-12-17 20:07:18 0 d-------- C:\Program Files\Common Files\aolshare
2007-11-17 16:32:40 552 --a------ C:\WINDOWS\system32\d3d8caps.dat


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8260C2B8-E0D1-448a-B062-33D12D468BF0}]
08/10/2007 03:38 PM 551208 --a------ C:\Program Files\alot\bin\alot.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinAVX"="C:\WINDOWS\system32\WinAvXX.exe" []
"VSOCheckTask"="c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" [07/01/2004 03:15 PM]
"VirusScan Online"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" [08/17/2004 04:55 PM]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [11/19/2003 05:48 PM]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [06/30/2004 01:33 PM]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\McUpdate.exe" [08/17/2004 06:29 PM]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\McAgent.exe" [08/17/2004 06:26 PM]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [09/24/2006 02:24 AM]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [12/17/2007 08:07 PM]
"DoNotDelete"="C:\WINDOWS\system32\explore.exe" [08/25/2007 09:36 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 10:24 AM]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [01/19/2007 11:54 AM]

C:\Documents and Settings\Kris\Start Menu\Programs\Startup\
DESKTOP.INI [8/10/2004 1:04:12 PM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
America Online 8.0 Tray Icon.lnk - C:\Program Files\America Online 8.0b\aoltray.exe [12/17/2007 857 PM]
D-link AirPlus G DWL-G120 Wireless USB.lnk - C:\Program Files\D-link AirPlus G DWL-G120 Wireless USB\120UTIL.exe [12/27/2004 7:13:04 PM]
DESKTOP.INI [8/10/2004 1:04:12 PM]
info.exe [8/25/2007 9:36:53 AM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=1 (0x1)
"DisableTaskMgr"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoWindowsUpdate"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Shell"="Explorer.exe C:\WINDOWS\system32\printer.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\WINDOWS\system32\hanonvt.ini

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 8.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 8.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 8.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^autorun.exe]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\autorun.exe
backup=C:\WINDOWS\pss\autorun.exeCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Bryce^Start Menu^Programs^Startup^IMVU.lnk]
path=C:\Documents and Settings\Bryce\Start Menu\Programs\Startup\IMVU.lnk
backup=C:\WINDOWS\pss\IMVU.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Bryce^Start Menu^Programs^Startup^system.exe]
path=C:\Documents and Settings\Bryce\Start Menu\Programs\Startup\system.exe
backup=C:\WINDOWS\pss\system.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
"C:\Program Files\DellSupport\DSAgnt.exe" /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DSS]
C:\WINDOWS\BBSTORE\DSS\DSSAGENT.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
C:\WINDOWS\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
C:\WINDOWS\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
C:\WINDOWS\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelMeM]
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
c:\patrol\cp.exe ic.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\McUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
C:\PROGRA~1\MUSICM~1\MUSICM~3\mm_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe]
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\My Web Search Community Tools]
"C:\Program Files\MyWebSearch\bar\2.bin\m3IMPipe.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyWebSearch Email Plugin]
C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
"C:\Program Files\Dell\Media Experience\PCMService.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{146d39db-5765-11d9-985f-806d6172696f}]
AutoRun\command- D:\setup.exe

*Newly Created Service* - APPMGMT
*Newly Created Service* - IDBKFOCMQRXV
*Newly Created Service* - RKPAVPROC
*Newly Created Service* - SDTHOOK



-- End of Deckard's System Scanner: finished at 2007-12-29 12:23:25 ------------
Attached Files
File Type: txt extra.txt (19.2 KB, 2 views)
cakes is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Important Information
Join the #1 Tech Support Forum Today - It's Totally Free!

TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free.

Join TechSupportforum.com Today - Click Here

Old 01-02-2008, 06:19 AM   #2 (permalink)
Moderator, Analyst, Security Team
 
TheBruce1's Avatar
 
Join Date: Oct 2006
Location: Dłn Čideann,Scotland.
Posts: 5,093
OS: XP


Re: This operation has been cancelled due to restrictions...
Hello and welcome to TSF.

Apologises for the delay getting to your log. The helpers here are all volunteers and we have been very busy lately. If you are still having malware problems, follow instructions below.

==========================

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

============================

Please follow all instructions and in which order they come,if you have any questions,please ask before proceeding.Its important that you follow this through until i give you the all clear,a lack of symptoms does not mean that you are clean.

=========================

Please print out or copy this page to Notepad in order to assist you when carrying out the following instructions.

===========================

Download this file - http://download.bleepingcomputer.com...a/ComboFix.exe

* IMPORTANT !!! Place combofix.exe on your DesktopDo not run just yet, we will shortly

============================

Disconnect from the internet

=============================




Go to → Run → paste in the single line command & click OK
"%userprofile%\desktop\combofix.exe" /killall
When finished, it shall produce a log for you. Post that log & a fresh HJT log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

===========================

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

===========================

Reconnect to the internet and post the required logs

===========================
Logs Required
C:\Combofix.txt
Hijackthis log
__________________
Member of ASAP since 2007
Member of UNITE since 2008

**Notice to BT customers**
BT to dump Phorm, see Here for more information. No DPI

If we have helped you in anyway, please consider Donating
TheBruce1 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-04-2008, 05:56 PM   #3 (permalink)
Registered User
 
Join Date: Dec 2007
Posts: 5
OS: xp


Re: This operation has been cancelled due to restrictions...
ComboFix 08-01-05.1 - Kris 2008-01-04 17:56:36.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.245 [GMT -6:00]
Running from: C:\Documents and Settings\Kris\desktop\combofix.exe
Command switches used :: /killall
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\info.exe
C:\Documents and Settings\Bryce\Start Menu\Programs\Startup\info.exe
C:\Documents and Settings\Evan\Start Menu\Programs\Startup\info.exe
C:\Documents and Settings\Jody\Application Data\FunWebProducts
C:\Documents and Settings\Jody\Application Data\FunWebProducts\Data\Jody\avatar.dat
C:\Documents and Settings\Jody\Application Data\FunWebProducts\Data\Jody\zbucks.dat
C:\Documents and Settings\Jody\Start Menu\Programs\Startup\info.exe
C:\Documents and Settings\Kris\Application Data\FunWebProducts
C:\Documents and Settings\Kris\Application Data\FunWebProducts\Data\Kris\avatar.dat
C:\Documents and Settings\Kris\Application Data\FunWebProducts\Data\Kris\register.dat
C:\Documents and Settings\Kris\Application Data\FunWebProducts\Data\Kris\zbucks.dat
C:\Documents and Settings\Kris\Start Menu\Programs\Startup\info.exe
C:\Documents and Settings\Paige\Start Menu\Programs\Startup\info.exe
C:\Program Files\FunWebProducts
C:\Program Files\FunWebProducts\ScreenSaver\Images\03461DEC.urr
C:\Program Files\FunWebProducts\ScreenSaver\Images\3F4140B7.urr
C:\Program Files\FunWebProducts\Shared\Cache\CursorManiaBtn-new.html
C:\Program Files\FunWebProducts\Shared\Cache\CursorManiaBtn.html
C:\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn-new.html
C:\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
C:\Program Files\internet explorer\msimg32.dll
C:\Program Files\MyWebSearch
C:\Program Files\MyWebSearch\bar\3.bin\F3REPROX.DLL
C:\Program Files\MyWebSearch\bar\3.bin\M3SKIN.DLL
C:\Program Files\MyWebSearch\bar\3.bin\MWSBAR.DLL
C:\Program Files\MyWebSearch\bar\3.bin\MWSOEMON.EXE
C:\Program Files\MyWebSearch\bar\3.bin\MWSOESTB.DLL
C:\Program Files\MyWebSearch\bar\5.bin\F3BKGERR.JPG
C:\Program Files\MyWebSearch\bar\5.bin\F3BROVLY.DLL
C:\Program Files\MyWebSearch\bar\5.bin\F3CJPEG.DLL
C:\Program Files\MyWebSearch\bar\5.bin\F3DTACTL.DLL
C:\Program Files\MyWebSearch\bar\5.bin\F3HISTSW.DLL
C:\Program Files\MyWebSearch\bar\5.bin\F3HTMLMU.DLL
C:\Program Files\MyWebSearch\bar\5.bin\F3HTTPCT.DLL
C:\Program Files\MyWebSearch\bar\5.bin\F3IMSTUB.DLL
C:\Program Files\MyWebSearch\bar\5.bin\F3POPSWT.DLL
C:\Program Files\MyWebSearch\bar\5.bin\F3PSSAVR.SCR
C:\Program Files\MyWebSearch\bar\5.bin\F3REPROX.DLL
C:\Program Files\MyWebSearch\bar\5.bin\F3RESTUB.DLL
C:\Program Files\MyWebSearch\bar\5.bin\F3SCHMON.EXE
C:\Program Files\MyWebSearch\bar\5.bin\F3SCRCTR.DLL
C:\Program Files\MyWebSearch\bar\5.bin\F3SHLLVW.DLL
C:\Program Files\MyWebSearch\bar\5.bin\F3SPACER.WMV
C:\Program Files\MyWebSearch\bar\5.bin\F3WALLPP.DAT
C:\Program Files\MyWebSearch\bar\5.bin\F3WPHOOK.DLL
C:\Program Files\MyWebSearch\bar\5.bin\M3FFXTBR.JAR
C:\Program Files\MyWebSearch\bar\5.bin\M3FFXTBR.MANIFEST
C:\Program Files\MyWebSearch\bar\5.bin\M3HTML.DLL
C:\Program Files\MyWebSearch\bar\5.bin\M3IDLE.DLL
C:\Program Files\MyWebSearch\bar\5.bin\M3IMPIPE.EXE
C:\Program Files\MyWebSearch\bar\5.bin\M3MSG.DLL
C:\Program Files\MyWebSearch\bar\5.bin\M3NTSTBR.JAR
C:\Program Files\MyWebSearch\bar\5.bin\M3NTSTBR.MANIFEST
C:\Program Files\MyWebSearch\bar\5.bin\M3OUTLCN.DLL
C:\Program Files\MyWebSearch\bar\5.bin\M3PLUGIN.DLL
C:\Program Files\MyWebSearch\bar\5.bin\M3SKIN.DLL
C:\Program Files\MyWebSearch\bar\5.bin\M3SKPLAY.EXE
C:\Program Files\MyWebSearch\bar\5.bin\M3SLSRCH.EXE
C:\Program Files\MyWebSearch\bar\5.bin\M3SRCHMN.EXE
C:\Program Files\MyWebSearch\bar\5.bin\MWSBAR.DLL
C:\Program Files\MyWebSearch\bar\5.bin\MWSOEMON.EXE
C:\Program Files\MyWebSearch\bar\5.bin\MWSOEPLG.DLL
C:\Program Files\MyWebSearch\bar\5.bin\MWSOESTB.DLL
C:\Program Files\MyWebSearch\bar\5.bin\NPMYWEBS.DLL
C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\avatar.htm
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\bgfadel.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\bgfader.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\common-x.css
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\common.css
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\cornerbl.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\cornerbr.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\ext_def.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\ext_roll.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\include.js
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\index.htm
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\loader.htm
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\loading.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\logo.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\max_def.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\max_roll.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\min_def.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\min_roll.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\noflash.htm
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\res_def.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\res_roll.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\spacer.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\spacer.swf
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\topgrad.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\window.ico
C:\Program Files\MyWebSearch\bar\Cache\0001503E
C:\Program Files\MyWebSearch\bar\Cache\00C4210B
C:\Program Files\MyWebSearch\bar\Cache\00D9C93C.bin
C:\Program Files\MyWebSearch\bar\Cache\00D9D5FD.bin
C:\Program Files\MyWebSearch\bar\Cache\00D9FB39.bin
C:\Program Files\MyWebSearch\bar\Cache\00D9FC42.bin
C:\Program Files\MyWebSearch\bar\Cache\00D9FDAA.bin
C:\Program Files\MyWebSearch\bar\Cache\13B8D9DC.bin
C:\Program Files\MyWebSearch\bar\Cache\13B8EB12.bin
C:\Program Files\MyWebSearch\bar\Cache\13B90A61.bin
C:\Program Files\MyWebSearch\bar\Cache\13B90B3C.bin
C:\Program Files\MyWebSearch\bar\Cache\files.ini
C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S
C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S
C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S
C:\Program Files\MyWebSearch\bar\History\search2
C:\Program Files\MyWebSearch\bar\icons\CM.ICO
C:\Program Files\MyWebSearch\bar\icons\MFC.ICO
C:\Program Files\MyWebSearch\bar\icons\PSS.ICO
C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO
C:\Program Files\MyWebSearch\bar\icons\WB.ICO
C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO
C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S
C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S
C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S
C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S
C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S
C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S
C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S
C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S
C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S
C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S
C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S
C:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm
C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat
C:\Program Files\MyWebSearch\bar\Settings\setting2.htm
C:\Program Files\MyWebSearch\bar\Settings\setting2.htm.bak
C:\Program Files\MyWebSearch\bar\Settings\settings.dat
C:\Program Files\MyWebSearch\bar\Settings\settings.dat.bak
C:\Program Files\MyWebSearch\SrchAstt\3.bin\MWSSRCAS.DLL
C:\Program Files\MyWebSearch\SrchAstt\4.bin\MWSSRCAS.DLL
C:\Program Files\MyWebSearch\SrchAstt\5.bin\MWSSRCAS.DLL
C:\WINDOWS\system32\explore.exe
C:\WINDOWS\system32\f3PSSavr.scr

.
((((((((((((((((((((((((( Files Created from 2007-12-06 to 2008-01-06 )))))))))))))))))))))))))))))))
.

2008-01-04 17:55 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-04 17:50 . 2008-01-04 17:50 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-29 15:44 . 2007-12-29 15:44 <DIR> d-------- C:\Program Files\Citrix
2007-12-29 15:44 . 2007-12-29 15:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Citrix
2007-12-29 15:43 . 2007-12-29 15:43 60,968 --a------ C:\Documents and Settings\Kris\GoToAssistDownloadHelper.exe
2007-12-28 07:25 . 2007-12-28 07:25 <DIR> d-------- C:\ie-spyad_zo
2007-12-28 07:01 . 2007-12-28 07:07 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-12-28 07:01 . 2005-08-25 18:19 1,066,176 --a------ C:\WINDOWS\SYSTEM32\MSCOMCTL.OCX
2007-12-28 07:01 . 2005-08-25 18:18 118,784 --a------ C:\WINDOWS\SYSTEM32\MSSTDFMT.DLL
2007-12-28 07:01 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\SYSTEM32\MSINET.OCX
2007-12-27 23:07 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\SDTHOOK.SYS
2007-12-27 22:46 . 2007-12-28 01:31 <DIR> d-------- C:\WINDOWS\SYSTEM32\ActiveScan
2007-12-27 22:46 . 2007-12-27 22:46 30,590 --a------ C:\WINDOWS\SYSTEM32\pavas.ico
2007-12-27 22:46 . 2007-12-27 22:46 2,550 --a------ C:\WINDOWS\SYSTEM32\Uninstall.ico
2007-12-27 22:46 . 2007-12-27 22:46 1,406 --a------ C:\WINDOWS\SYSTEM32\Help.ico
2007-12-26 09:13 . 2001-08-17 14:02 9,600 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\hidusb.sys
2007-12-26 09:13 . 2001-08-17 14:02 9,600 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\hidusb.sys
2007-12-21 22:08 . 2007-12-22 13:26 <DIR> d-------- C:\Documents and Settings\Evan\Contacts
2007-12-18 19:16 . 2007-12-28 06:53 <DIR> d-------- C:\Documents and Settings\Jody\Contacts
2007-12-18 19:15 . 2007-12-18 19:15 <DIR> d-------- C:\Documents and Settings\Jody\Application Data\alot
2007-12-17 20:06 . 2007-12-17 20:09 <DIR> d-------- C:\Program Files\America Online 8.0b
2007-12-17 20:06 . 2007-12-17 20:06 <DIR> d-------- C:\Documents and Settings\Kris\Application Data\MX
2007-12-07 16:50 . 2007-12-07 16:50 <DIR> d-------- C:\Documents and Settings\Paige\Application Data\alot

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-04 23:26 --------- d-----w C:\Program Files\MSN Messenger
2008-01-01 18:10 --------- d-----w C:\Program Files\Google
2007-12-28 07:20 --------- d-----w C:\Program Files\Windows Live Toolbar
2007-12-28 07:15 --------- d-----w C:\Program Files\QuickTime
2007-12-28 07:06 --------- d-----w C:\Program Files\DellSupport
2007-12-28 07:06 --------- d-----w C:\Program Files\D-link AirPlus G DWL-G120 Wireless USB
2007-12-28 04:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2007-12-28 03:39 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-28 03:36 --------- d-----w C:\Program Files\THQ
2007-12-18 02:09 --------- d-----w C:\Program Files\Common Files\aolback
2007-12-18 02:09 --------- d-----w C:\Program Files\AOL Companion
2007-12-18 02:08 8,552 ----a-w C:\WINDOWS\system32\drivers\asctrm.sys
2007-12-18 02:08 --------- d-----w C:\Program Files\Common Files\AOL
2007-12-18 02:07 --------- d-----w C:\Program Files\Common Files\aolshare
2007-12-06 19:24 --------- d-----w C:\Documents and Settings\Kris\Application Data\alot
2007-12-02 04:06 --------- d-----w C:\Program Files\eMusic Download Manager
2007-12-02 04:06 --------- d-----w C:\Program Files\alot
2007-11-30 09:05 --------- d-----w C:\Program Files\Windows Live Favorites
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-05-05 02:09 774,144 ----a-w C:\Program Files\RngInterstitial.dll
1998-04-02 21:51 77,312 --sha-r C:\WINDOWS\ic.exe
1998-04-02 21:55 80,384 --sha-r C:\WINDOWS\icfire.exe
1997-07-23 16:03 11,338 --sha-r C:\WINDOWS\ts.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8260C2B8-E0D1-448a-B062-33D12D468BF0}]
2007-08-10 15:38 551208 --a------ C:\Program Files\alot\bin\alot.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BA52B914-B692-46C4-B683-905236F6F655}
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}
{8260C2B8-E0D1-448A-B062-33D12D468BF0}

[HKEY_CLASSES_ROOT\clsid\{8260c2b8-e0d1-448a-b062-33d12d468bf0}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 10:24 1694208]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:54 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VSOCheckTask"="c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" [2004-07-01 15:15 139264]
"VirusScan Online"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" [2004-08-17 16:55 180224]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 17:48 32881]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-06-30 13:33 1388544]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\McUpdate.exe" [2004-08-17 18:29 184320]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\McAgent.exe" [2004-08-17 18:26 245760]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-24 02:24 282624]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2007-12-17 20:07 26112]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll 2007-12-29 15:44 10792 C:\Program Files\Citrix\GoToAssist\480\g2awinlogon.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 8.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 8.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 8.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^autorun.exe]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\autorun.exe
backup=C:\WINDOWS\pss\autorun.exeCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Bryce^Start Menu^Programs^Startup^IMVU.lnk]
path=C:\Documents and Settings\Bryce\Start Menu\Programs\Startup\IMVU.lnk
backup=C:\WINDOWS\pss\IMVU.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Bryce^Start Menu^Programs^Startup^system.exe]
path=C:\Documents and Settings\Bryce\Start Menu\Programs\Startup\system.exe
backup=C:\WINDOWS\pss\system.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
--a------ 2007-03-15 10:09 460784 C:\Program Files\DellSupport\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DSS]
C:\WINDOWS\BBSTORE\DSS\DSSAGENT.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
--a------ 2007-05-17 23:30 1831936 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
--a------ 2005-09-20 09:32 77824 C:\WINDOWS\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
--a------ 2005-09-20 09:36 114688 C:\WINDOWS\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
--a------ 2005-09-20 09:35 94208 C:\WINDOWS\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelMeM]
--a------ 2003-09-03 20:12 221184 C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2006-09-25 13:54 229952 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
--a------ 1998-04-14 07:46 516192 c:\patrol\cp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
--a------ 2004-08-17 18:26 245760 c:\PROGRA~1\mcafee.com\agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
--a------ 2004-08-17 18:29 184320 C:\PROGRA~1\mcafee.com\agent\McUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
--a------ 2005-03-12 06:25 11776 C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
--a------ 2005-03-12 06:25 110592 C:\PROGRA~1\MUSICM~1\MUSICM~3\mm_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe]
--a------ 2004-08-22 15:31 1327104 C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\My Web Search Community Tools]
C:\Program Files\MyWebSearch\bar\2.bin\m3IMPipe.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyWebSearch Email Plugin]
C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
--------- 2004-04-11 20:15 290816 C:\Program Files\Dell\Media Experience\PCMService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-09-24 02:24 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

S3 GoToAssist;GoToAssist;"C:\Program Files\Citrix\GoToAssist\480\g2aservice.exe" Start=service []

.
Contents of the 'Scheduled Tasks' folder
"2007-12-29 01:51:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-01-04 22:26:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
"2008-01-06 00:16:04 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (BRYCEANDEVAN-Kris).job"
- c:\program files\mcafee.com\vso\mcmnhdlr.exe
"2008-01-06 00:21:00 C:\WINDOWS\Tasks\McAfee.com Update Check (BRYCEANDEVAN-Bryce).job"
- C:\PROGRA~1\mcafee.com\agent\mcupdate.ex
- C:\PROGRA~1\mcafee.com\agent
"2008-01-06 00:21:00 C:\WINDOWS\Tasks\McAfee.com Update Check (BRYCEANDEVAN-Evan).job"
- C:\PROGRA~1\mcafee.com\agent\mcupdate.ex
- C:\PROGRA~1\mcafee.com\agent
"2008-01-06 00:17:00 C:\WINDOWS\Tasks\McAfee.com Update Check (BRYCEANDEVAN-Jody).job"
- C:\PROGRA~1\mcafee.com\agent\mcupdate.ex
- C:\PROGRA~1\mcafee.com\agent
"2008-01-06 00:21:00 C:\WINDOWS\Tasks\McAfee.com Update Check (BRYCEANDEVAN-Kris).job"
- C:\PROGRA~1\mcafee.com\agent\mcupdate.ex
- C:\PROGRA~1\mcafee.com\agent
"2008-01-06 00:18:00 C:\WINDOWS\Tasks\McAfee.com Update Check (BRYCEANDEVAN-Paige).job"
- C:\PROGRA~1\mcafee.com\agent\mcupdate.ex
- C:\PROGRA~1\mcafee.com\agent
"2008-01-06 00:18:00 C:\WINDOWS\Tasks\McAfee.com Update Check (DG3N4761-Owner).job"
- c:\PROGRA~1\mcafee.com\agent\mcupdate.ex
- c:\PROGRA~1\mcafee.com\agent
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-05 18:16:24
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-05 18:21:22 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-06 00:21:18
.
2007-12-27 09:07:10 --- E O F ---


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:42:58 PM, on 1/5/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\fxssvc.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\PROGRA~1\mcafee.com\agent\McAgent.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Messenger\msmsgs.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\D-link AirPlus G DWL-G120 Wireless USB\120UTIL.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jucheck.exe
C:\WINDOWS\System32\svchost.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
O2 - BHO: ALOT eMusic Toolbar - {8260C2B8-E0D1-448a-B062-33D12D468BF0} - C:\Program Files\alot\bin\alot.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: ALOT eMusic Toolbar - {8260C2B8-E0D1-448a-B062-33D12D468BF0} - C:\Program Files\alot\bin\alot.dll
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0b\aoltray.exe
O4 - Global Startup: D-link AirPlus G DWL-G120 Wireless USB.lnk = ?
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...rch.jhtml?p=ZJ
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\AMV Convert Tool 3.70\AMVConverter\grab.html
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?39a8643fe42b4b11931002141737642f
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?39a8643fe42b4b11931002141737642f
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Bryce\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/noc...1.0.0.15-3.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\480\g2aservice.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 7182 bytes

Hope this is what you need.
cakes is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-05-2008, 01:38 PM   #4 (permalink)
Moderator, Analyst, Security Team
 
TheBruce1's Avatar
 
Join Date: Oct 2006
Location: Dłn Čideann,Scotland.
Posts: 5,093
OS: XP


Re: This operation has been cancelled due to restrictions...
Hello again cakes

Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs:

Java 2 Runtime Environment, SE v1.4.2_03

Reboot when done

=============================

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any)

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...rch.jhtml?p=ZJ
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/noc...1.0.0.15-3.cab

Please remember to close all other windows, including browsers then click Fix checked.

======================================

Open notepad and copy/paste the text in the quotebox below into it:

Quote:
File::
C:\WINDOWS\ic.exe
C:\WINDOWS\icfire.exe
C:\WINDOWS\ts.dll

Folder::
c:\patrol

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\My Web Search Community Tools]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyWebSearch Email Plugin]
Save this as CFscript




Refering to the picture above, drag CFscript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

================================

Install current version of Java. Older versions have vulnerabilities that malware can use to infect your system.

Updating Java:
  • Download the latest version of Java Runtime Environment (JRE) 6.
  • Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • Check the box that says: "Accept License Agreement".
  • The page will refresh.
  • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Then from your desktop double-click on jre-6-windowsi586-p.exe to install the newest version.

=================================

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.
  • The program will then begin downloading the latest definition files.
  • Once the files have been downloaded click on NEXT
  • Locate the Scan Settings button & configure to:
    • Scan using the following Anti-Virus database:
      • Extended
    • Scan Options:
      • Scan Archives
      • Scan Mail Bases
  • Click OK & have it scan My Computer
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply
* Turn off the real time scanner of any existing antivirus program while performing the online scan

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.

===========================

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

===========================
Logs Required
C:\Combofix.txt
Kaspersky scan report
Hijackthis log

An update on how your system is behaving.
__________________
Member of ASAP since 2007
Member of UNITE since 2008

**Notice to BT customers**
BT to dump Phorm, see Here for more information. No DPI

If we have helped you in anyway, please consider Donating
TheBruce1 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-10-2008, 08:36 PM   #5 (permalink)
Registered User
 
Join Date: Dec 2007
Posts: 5
OS: xp


Re: This operation has been cancelled due to restrictions...
My system still runs a little slow but I can access the control panel.
Am I supposed to add the logs as attachments?
cakes is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-11-2008, 06:28 AM   #6 (permalink)
Moderator, Analyst, Security Team
 
TheBruce1's Avatar
 
Join Date: Oct 2006
Location: Dłn Čideann,Scotland.
Posts: 5,093
OS: XP


Re: This operation has been cancelled due to restrictions...
No, post the logs as you have done previously.
__________________
Member of ASAP since 2007
Member of UNITE since 2008

**Notice to BT customers**
BT to dump Phorm, see Here for more information. No DPI

If we have helped you in anyway, please consider Donating
TheBruce1 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-14-2008, 08:26 AM   #7 (permalink)
Registered User
 
Join Date: Dec 2007
Posts: 5
OS: xp


Re: This operation has been cancelled due to restrictions...
ComboFix 08-01-05.1 - Kris 2008-01-10 9:38:11.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.242 [GMT -6:00]
Running from: C:\Documents and Settings\Kris\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Kris\Desktop\CFscript.txt
* Created a new restore point

FILE
C:\WINDOWS\ic.exe
C:\WINDOWS\icfire.exe
C:\WINDOWS\ts.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\patrol
c:\patrol\!cp.exe
c:\patrol\cp.exe
c:\patrol\cp.gif
c:\patrol\cp.hlp
c:\patrol\cpstart.hlp
c:\patrol\CYBER.BIN
c:\patrol\cyber.not
c:\patrol\cyber.yes
c:\patrol\CYBERP.INI
c:\patrol\dbadm.dll
c:\patrol\dllfind.exe
c:\patrol\msispin.dll
c:\patrol\readme.txt
c:\patrol\rsaci.rat
c:\patrol\safesurf.rat
c:\patrol\user.lst
C:\Program Files\FunWebProducts
C:\Program Files\FunWebProducts\Shared\Cache\CursorManiaBtn.html
C:\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
C:\Program Files\internet explorer\msimg32.dll
C:\Program Files\MyWebSearch
C:\Program Files\MyWebSearch\bar\1.bin\F3BKGERR.JPG
C:\Program Files\MyWebSearch\bar\1.bin\F3BROVLY.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR
C:\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE
C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3SHLLVW.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3SPACER.WMV
C:\Program Files\MyWebSearch\bar\1.bin\F3WALLPP.DAT
C:\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR
C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST
C:\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3IDLE.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE
C:\Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR
C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST
C:\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE
C:\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE
C:\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE
C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
C:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
C:\Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL
C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\avatar.htm
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\bgfadel.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\bgfader.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\common-x.css
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\common.css
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\cornerbl.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\cornerbr.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\ext_def.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\ext_roll.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\include.js
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\index.htm
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\loader.htm
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\loading.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\logo.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\max_def.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\max_roll.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\min_def.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\min_roll.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\noflash.htm
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\res_def.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\res_roll.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\spacer.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\spacer.swf
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\topgrad.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\window.ico
C:\Program Files\MyWebSearch\bar\Cache\051D102D
C:\Program Files\MyWebSearch\bar\Cache\051D15DA
C:\Program Files\MyWebSearch\bar\Cache\051D1926.bin
C:\Program Files\MyWebSearch\bar\Cache\051D1A5F.bin
C:\Program Files\MyWebSearch\bar\Cache\051D28F5.bin
C:\Program Files\MyWebSearch\bar\Cache\051D4816.bin
C:\Program Files\MyWebSearch\bar\Cache\051D49BC.bin
C:\Program Files\MyWebSearch\bar\Cache\0C3B643B.bin
C:\Program Files\MyWebSearch\bar\Cache\0C3B712B.bin
C:\Program Files\MyWebSearch\bar\Cache\0C3B72E1.bin
C:\Program Files\MyWebSearch\bar\Cache\0C3B9434.bin
C:\Program Files\MyWebSearch\bar\Cache\0C3B95E9.bin
C:\Program Files\MyWebSearch\bar\Cache\files.ini
C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S
C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S
C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S
C:\Program Files\MyWebSearch\bar\History\search2
C:\Program Files\MyWebSearch\bar\icons\CM.ICO
C:\Program Files\MyWebSearch\bar\icons\MFC.ICO
C:\Program Files\MyWebSearch\bar\icons\PSS.ICO
C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO
C:\Program Files\MyWebSearch\bar\icons\WB.ICO
C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO
C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S
C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S
C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S
C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S
C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S
C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S
C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S
C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S
C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S
C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S
C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S
C:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm
C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat
C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
C:\WINDOWS\ic.exe
C:\WINDOWS\icfire.exe
C:\WINDOWS\system32\f3PSSavr.scr
C:\WINDOWS\ts.dll

.
((((((((((((((((((((((((( Files Created from 2007-12-10 to 2008-01-10 )))))))))))))))))))))))))))))))
.

2008-01-04 17:55 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-04 17:50 . 2008-01-04 17:50 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-29 15:44 . 2007-12-29 15:44 <DIR> d-------- C:\Program Files\Citrix
2007-12-29 15:44 . 2007-12-29 15:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Citrix
2007-12-29 15:43 . 2007-12-29 15:43 60,968 --a------ C:\Documents and Settings\Kris\GoToAssistDownloadHelper.exe
2007-12-28 07:25 . 2007-12-28 07:25 <DIR> d-------- C:\ie-spyad_zo
2007-12-28 07:01 . 2007-12-28 07:07 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-12-28 07:01 . 2005-08-25 18:19 1,066,176 --a------ C:\WINDOWS\SYSTEM32\MSCOMCTL.OCX
2007-12-28 07:01 . 2005-08-25 18:18 118,784 --a------ C:\WINDOWS\SYSTEM32\MSSTDFMT.DLL
2007-12-28 07:01 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\SYSTEM32\MSINET.OCX
2007-12-27 23:07 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\SDTHOOK.SYS
2007-12-27 22:46 . 2007-12-28 01:31 <DIR> d-------- C:\WINDOWS\SYSTEM32\ActiveScan
2007-12-27 22:46 . 2007-12-27 22:46 30,590 --a------ C:\WINDOWS\SYSTEM32\pavas.ico
2007-12-27 22:46 . 2007-12-27 22:46 2,550 --a------ C:\WINDOWS\SYSTEM32\Uninstall.ico
2007-12-27 22:46 . 2007-12-27 22:46 1,406 --a------ C:\WINDOWS\SYSTEM32\Help.ico
2007-12-26 09:13 . 2001-08-17 14:02 9,600 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\hidusb.sys
2007-12-26 09:13 . 2001-08-17 14:02 9,600 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\hidusb.sys
2007-12-21 22:08 . 2007-12-22 13:26 <DIR> d-------- C:\Documents and Settings\Evan\Contacts
2007-12-18 19:16 . 2007-12-28 06:53 <DIR> d-------- C:\Documents and Settings\Jody\Contacts
2007-12-18 19:15 . 2007-12-18 19:15 <DIR> d-------- C:\Documents and Settings\Jody\Application Data\alot
2007-12-17 20:06 . 2007-12-17 20:09 <DIR> d-------- C:\Program Files\America Online 8.0b
2007-12-17 20:06 . 2007-12-17 20:06 <DIR> d-------- C:\Documents and Settings\Kris\Application Data\MX

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-07 17:24 --------- d-----w C:\Program Files\MSN Messenger
2008-01-01 18:10 --------- d-----w C:\Program Files\Google
2007-12-28 07:20 --------- d-----w C:\Program Files\Windows Live Toolbar
2007-12-28 07:15 --------- d-----w C:\Program Files\QuickTime
2007-12-28 07:06 --------- d-----w C:\Program Files\DellSupport
2007-12-28 07:06 --------- d-----w C:\Program Files\D-link AirPlus G DWL-G120 Wireless USB
2007-12-28 04:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2007-12-28 03:39 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-28 03:36 --------- d-----w C:\Program Files\THQ
2007-12-18 02:09 --------- d-----w C:\Program Files\Common Files\aolback
2007-12-18 02:09 --------- d-----w C:\Program Files\AOL Companion
2007-12-18 02:08 8,552 ----a-w C:\WINDOWS\system32\drivers\asctrm.sys
2007-12-18 02:08 --------- d-----w C:\Program Files\Common Files\AOL
2007-12-18 02:07 --------- d-----w C:\Program Files\Common Files\aolshare
2007-12-07 22:50 --------- d-----w C:\Documents and Settings\Paige\Application Data\alot
2007-12-06 19:24 --------- d-----w C:\Documents and Settings\Kris\Application Data\alot
2007-12-02 04:06 --------- d-----w C:\Program Files\eMusic Download Manager
2007-12-02 04:06 --------- d-----w C:\Program Files\alot
2007-11-30 09:05 --------- d-----w C:\Program Files\Windows Live Favorites
2007-11-14 07:26 450,560 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\jscript.dll
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\SYSTEM32\lsasrv.dll
2007-11-07 09:26 721,920 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\lsasrv.dll
2007-10-30 17:20 360,064 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\tcpip.sys
2007-10-30 10:16 3,058,688 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\SYSTEM32\quartz.dll
2007-10-29 22:43 1,287,680 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\quartz.dll
2007-10-27 23:40 227,328 ----a-w C:\WINDOWS\SYSTEM32\wmasf.dll
2007-10-27 23:40 227,328 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wmasf.dll
2007-10-26 03:36 8,454,656 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\shell32.dll
2007-10-11 06:13 96,256 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\inseng.dll
2007-10-11 06:13 659,456 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\wininet.dll
2007-10-11 06:13 615,424 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\urlmon.dll
2007-10-11 06:13 55,808 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\extmgr.dll
2007-10-11 06:13 532,480 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mstime.dll
2007-10-11 06:13 474,112 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\shlwapi.dll
2007-10-11 06:13 449,024 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtmled.dll
2007-10-11 06:13 39,424 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\pngfilt.dll
2007-10-11 06:13 357,888 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtmsft.dll
2007-10-11 06:13 251,392 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iepeers.dll
2007-10-11 06:13 205,312 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtrans.dll
2007-10-11 06:13 16,384 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\jsproxy.dll
2007-10-11 06:13 151,040 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\cdfview.dll
2007-10-11 06:13 146,432 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\msrating.dll
2007-10-11 06:13 1,494,528 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\shdocvw.dll
2007-10-11 06:13 1,054,208 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\danim.dll
2007-10-11 06:13 1,023,488 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\browseui.dll
2007-10-10 11:16 18,432 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iedw.exe
2007-05-05 02:09 774,144 ----a-w C:\Program Files\RngInterstitial.dll
.

((((((((((((((((((((((((((((( snapshot@2008-01-05_18.20.52.32 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-08 16:57:32 240,164 ----a-w C:\WINDOWS\PCHEALTH\HELPCTR\Config\Cache\Personal_32_1033.dat
+ 2008-01-08 16:57:32 240,164 ----a-w C:\WINDOWS\PCHEALTH\HELPCTR\Config\Cache\Personal_32_1033.dat.bak
- 2006-04-20 11:51:50 359,808 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\tcpip.sys
+ 2007-10-30 17:20:55 360,064 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\tcpip.sys
- 2007-12-02 23:00:05 18,684,536 ----a-w C:\WINDOWS\SYSTEM32\MRT.exe
+ 2008-01-02 18:21:36 17,642,616 ----a-w C:\WINDOWS\SYSTEM32\MRT.exe
- 2008-01-06 00:17:04 63,016 ----a-w C:\WINDOWS\SYSTEM32\PERFC009.DAT
+ 2008-01-10 15:28:18 63,016 ----a-w C:\WINDOWS\SYSTEM32\PERFC009.DAT
- 2008-01-06 00:17:04 402,406 ----a-w C:\WINDOWS\SYSTEM32\PERFH009.DAT
+ 2008-01-10 15:28:18 402,406 ----a-w C:\WINDOWS\SYSTEM32\PERFH009.DAT
- 2007-03-06 01:22:33 14,048 ------w C:\WINDOWS\SYSTEM32\spmsg.dll
+ 2007-03-06 01:22:36 14,048 ------w C:\WINDOWS\SYSTEM32\spmsg.dll
+ 2001-07-22 00:57:14 3,628 ----a-w C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\EPNDDE5D.DAT
+ 2001-08-18 04:34:10 11,776 ----a-w C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\EPNDRV01.DLL
+ 2001-08-18 04:36:16 61,952 ----a-w C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\EPNGUI40.DLL
+ 2001-08-18 04:36:16 1,388,032 ----a-w C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\EPNHTE5D.DLL
+ 2001-08-18 04:36:16 29,696 ----a-w C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\EPNUTX22.DLL
+ 2004-08-04 06:56:48 264,704 ----a-w C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\UNIDRV.DLL
+ 2004-08-04 06:56:48 197,120 ----a-w C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\UNIDRVUI.DLL
+ 2004-08-04 06:56:36 619,520 ----a-w C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\UNIRES.DLL
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8260C2B8-E0D1-448a-B062-33D12D468BF0}]
2007-08-10 15:38 551208 --a------ C:\Program Files\alot\bin\alot.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BA52B914-B692-46C4-B683-905236F6F655}
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}
{8260C2B8-E0D1-448A-B062-33D12D468BF0}

[HKEY_CLASSES_ROOT\clsid\{8260c2b8-e0d1-448a-b062-33d12d468bf0}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 10:24 1694208]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:54 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VSOCheckTask"="c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" [2004-07-01 15:15 139264]
"VirusScan Online"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" [2004-08-17 16:55 180224]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-06-30 13:33 1388544]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\McUpdate.exe" [2004-08-17 18:29 184320]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\McAgent.exe" [2004-08-17 18:26 245760]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-24 02:24 282624]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2007-12-17 20:07 26112]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll 2007-12-29 15:44 10792 C:\Program Files\Citrix\GoToAssist\480\g2awinlogon.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 8.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 8.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 8.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^autorun.exe]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\autorun.exe
backup=C:\WINDOWS\pss\autorun.exeCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Bryce^Start Menu^Programs^Startup^IMVU.lnk]
path=C:\Documents and Settings\Bryce\Start Menu\Programs\Startup\IMVU.lnk
backup=C:\WINDOWS\pss\IMVU.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Bryce^Start Menu^Programs^Startup^system.exe]
path=C:\Documents and Settings\Bryce\Start Menu\Programs\Startup\system.exe
backup=C:\WINDOWS\pss\system.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
--a------ 2007-03-15 10:09 460784 C:\Program Files\DellSupport\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DSS]
C:\WINDOWS\BBSTORE\DSS\DSSAGENT.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
--a------ 2007-05-17 23:30 1831936 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
--a------ 2005-09-20 09:32 77824 C:\WINDOWS\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
--a------ 2005-09-20 09:36 114688 C:\WINDOWS\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
--a------ 2005-09-20 09:35 94208 C:\WINDOWS\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelMeM]
--a------ 2003-09-03 20:12 221184 C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2006-09-25 13:54 229952 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
c:\patrol\cp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
--a------ 2004-08-17 18:26 245760 c:\PROGRA~1\mcafee.com\agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
--a------ 2004-08-17 18:29 184320 C:\PROGRA~1\mcafee.com\agent\McUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
--a------ 2005-03-12 06:25 11776 C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
--a------ 2005-03-12 06:25 110592 C:\PROGRA~1\MUSICM~1\MUSICM~3\mm_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe]
--a------ 2004-08-22 15:31 1327104 C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
--------- 2004-04-11 20:15 290816 C:\Program Files\Dell\Media Experience\PCMService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-09-24 02:24 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

S3 GoToAssist;GoToAssist;"C:\Program Files\Citrix\GoToAssist\480\g2aservice.exe" Start=service []

.
Contents of the 'Scheduled Tasks' folder
"2007-12-29 01:51:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-01-10 15:26:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
"2008-01-10 15:27:08 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (BRYCEANDEVAN-Kris).job"
- c:\program files\mcafee.com\vso\mcmnhdlr.exe
"2008-01-10 15:44:00 C:\WINDOWS\Tasks\McAfee.com Update Check (BRYCEANDEVAN-Bryce).job"
- C:\PROGRA~1\mcafee.com\agent\mcupdate.ex
- C:\PROGRA~1\mcafee.com\agent
"2008-01-10 15:43:00 C:\WINDOWS\Tasks\McAfee.com Update Check (BRYCEANDEVAN-Evan).job"
- C:\PROGRA~1\mcafee.com\agent\mcupdate.ex
- C:\PROGRA~1\mcafee.com\agent
"2008-01-10 15:42:00 C:\WINDOWS\Tasks\McAfee.com Update Check (BRYCEANDEVAN-Jody).job"
- C:\PROGRA~1\mcafee.com\agent\mcupdate.ex
- C:\PROGRA~1\mcafee.com\agent
"2008-01-10 15:42:00 C:\WINDOWS\Tasks\McAfee.com Update Check (BRYCEANDEVAN-Kris).job"
- C:\PROGRA~1\mcafee.com\agent\mcupdate.ex
- C:\PROGRA~1\mcafee.com\agent
"2008-01-10 15:40:00 C:\WINDOWS\Tasks\McAfee.com Update Check (BRYCEANDEVAN-Paige).job"
- C:\PROGRA~1\mcafee.com\agent\mcupdate.ex
- C:\PROGRA~1\mcafee.com\agent
"2008-01-10 15:43:00 C:\WINDOWS\Tasks\McAfee.com Update Check (DG3N4761-Owner).job"
- c:\PROGRA~1\mcafee.com\agent\mcupdate.ex
- c:\PROGRA~1\mcafee.com\agent
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-10 09:43:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-10 9:44:55
ComboFix-quarantined-files.txt 2008-01-10 15:44:26
ComboFix2.txt 2008-01-06 00:21:22
.
2008-01-10 09:03:24 --- E O F ---

Scan
----
Scanned: 161727
Detected: 3
Untreated: 3
Start time: 1/11/2008 3:32:56 PM
Duration: 0143
Finish time: 1/11/2008 4:39:39 PM
Signatures published: 1/10/2008 12:03:29 PM


Detected
--------
Status Object
------ ------
detected: Trojan program Trojan-Downloader.Win32.Agent.daz File: C:\WINDOWS\pss\autorun.exeCommon Startup
detected: Trojan program Trojan-Downloader.Win32.Agent.daz File: C:\WINDOWS\pss\system.exeStartup
detected: Trojan program Trojan-Downloader.Win32.Agent.bxx File: C:\WINDOWS\SYSTEM32\vtr357.dll//PE_Patch.UPX//UPX


Events
------
Time Name Status Reason
---- ---- ------ ------
1/11/2008 3:32:58 PM File: C:\Documents and Settings\Kris\My Documents\Activescan.txt ok scanned
1/11/2008 3:32:58 PM File: C:\Documents and Settings\Kris\My Documents\CFscript.txt ok scanned
1/11/2008 3:32:59 PM File: C:\Documents and Settings\Kris\My Documents\DESKTOP.INI ok scanned
1/11/2008 3:32:59 PM File: C:\Documents and Settings\Kris\My Documents\My Sharing Folders.lnk ok scanned
1/11/2008 3:32:59 PM File: C:\Documents and Settings\Kris\My Documents\spider.sav ok scanned
1/11/2008 3:32:59 PM File: C:\Documents and Settings\Kris\My Documents\Track04.cda ok scanned
1/11/2008 3:32:59 PM File: C:\Documents and Settings\Kris\My Documents\Various Artists_ZE Christmas Album_05_Christmas Wrapping.mp3 ok scanned
1/11/2008 3:32:59 PM File: C:\Documents and Settings\Kris\My Documents\AMV. files\01 I Love This Bar.amv ok scanned
1/11/2008 3:32:59 PM File: C:\Documents and Settings\Kris\My Documents\AMV. files\01 I Love This Bar.wma ok scanned
1/11/2008 3:33:00 PM File: C:\Documents and Settings\Kris\My Documents\AMV. files\01 Lose Yourself.m4p ok scanned
1/11/2008 3:33:00 PM File: C:\Documents and Settings\Kris\My Documents\AMV. files\03 Convoy.wma ok scanned
1/11/2008 3:33:00 PM File: C:\Documents and Settings\Kris\My Documents\AMV. files\15 15 Track 15.mp3 ok scanned
1/11/2008 3:33:00 PM File: C:\Documents and Settings\Kris\My Documents\AMV. files\15 15 Track 15.wma ok scanned
1/11/2008 3:33:01 PM File: C:\Documents and Settings\Kris\My Documents\AMV. files\big butts.mp3 ok scanned
1/11/2008 3:33:01 PM File: C:\Documents and Settings\Kris\My Documents\Corel User Files\WT12US.HST ok scanned
1/11/2008 3:33:01 PM File: C:\Documents and Settings\Kris\My Documents\Corel User Files\WT12US.UWL ok scanned
1/11/2008 3:33:01 PM File: C:\Documents and Settings\Kris\My Documents\Corel User Files\12\Projects.usr ok scanned
1/11/2008 3:33:01 PM File: C:\Documents and Settings\Kris\My Documents\Country Grammar\Ride Wit Me.m4p ok scanned
1/11/2008 3:33:01 PM File: C:\Documents and Settings\Kris\My Documents\My Music\07 Stronger 1.mp3 ok scanned
1/11/2008 3:33:01 PM File: C:\Documents and Settings\Kris\My Documents\My Music\AlbumArt_{08166482-EE5F-4EA6-9E12-E52FF6C99927}_Large.jpg ok scanned
1/11/2008 3:33:01 PM File: C:\Documents and Settings\Kris\My Documents\My Music\AlbumArt_{08166482-EE5F-4EA6-9E12-E52FF6C99927}_Small.jpg ok scanned
1/11/2008 3:33:01 PM File: C:\Documents and Settings\Kris\My Documents\My Music\AlbumArt_{279C9A85-C9A7-4E10-B145-EA4432388FD4}_Large.jpg ok scanned
1/11/2008 3:33:01 PM File: C:\Documents and Settings\Kris\My Documents\My Music\AlbumArt_{279C9A85-C9A7-4E10-B145-EA4432388FD4}_Small.jpg ok scanned
1/11/2008 3:33:02 PM File: C:\Documents and Settings\Kris\My Documents\My Music\AlbumArt_{5DDB9C46-E347-4EF1-B9C6-6E499C7B0461}_Large.jpg ok scanned
1/11/2008 3:33:02 PM File: C:\Documents and Settings\Kris\My Documents\My Music\AlbumArt_{5DDB9C46-E347-4EF1-B9C6-6E499C7B0461}_Small.jpg ok scanned
1/11/2008 3:33:02 PM File: C:\Documents and Settings\Kris\My Documents\My Music\AlbumArt_{6CB01A4E-81C2-4C76-BEA5-13F890A00E0A}_Large.jpg ok scanned
1/11/2008 3:33:02 PM File: C:\Documents and Settings\Kris\My Documents\My Music\AlbumArt_{6CB01A4E-81C2-4C76-BEA5-13F890A00E0A}_Small.jpg ok scanned
1/11/2008 3:33:02 PM File: C:\Documents and Settings\Kris\My Documents\My Music\AlbumArt_{7EF0BA4F-85D5-4222-83B0-85F65E0B155A}_Large.jpg ok scanned
1/11/2008 3:33:02 PM File: C:\Documents and Settings\Kris\My Documents\My Music\AlbumArt_{7EF0BA4F-85D5-4222-83B0-85F65E0B155A}_Small.jpg ok scanned
1/11/2008 3:33:02 PM File: C:\Documents and Settings\Kris\My Documents\My Music\AlbumArt_{9998C214-CDA7-4E92-8656-41B4F6A7F0CC}_Large.jpg ok scanned
1/11/2008 3:33:02 PM File: C:\Documents and Settings\Kris\My Documents\My Music\AlbumArt_{9998C214-CDA7-4E92-8656-41B4F6A7F0CC}_Small.jpg ok scanned
1/11/2008 3:33:02 PM File: C:\Documents and Settings\Kris\My Documents\My Music\AlbumArt_{E6D89BD8-1825-46B9-BB83-5862920C5141}_Large.jpg ok scanned
1/11/2008 3:33:02 PM File: C:\Documents and Settings\Kris\My Documents\My Music\AlbumArt_{E6D89BD8-1825-46B9-BB83-5862920C5141}_Small.jpg ok scanned
1/11/2008 3:33:02 PM File: C:\Documents and Settings\Kris\My Documents\My Music\AlbumArt_{F1A67107-DD9D-475E-A273-A0FC04A9C9C8}_Large.jpg ok scanned
1/11/2008 3:33:02 PM File: C:\Documents and Settings\Kris\My Documents\My Music\AlbumArt_{F1A67107-DD9D-475E-A273-A0FC04A9C9C8}_Small.jpg ok scanned
1/11/2008 3:33:02 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Barbie Girl.cda ok scanned
1/11/2008 3:33:02 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Barbie Girl.zip archive ZIP
1/11/2008 3:33:03 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Barbie Girl.zip/Barbie Girl.cda ok scanned
1/11/2008 3:33:03 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Barbie Girl.zip ok scanned
1/11/2008 3:33:03 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Big Kid-You Must Be Kidding -eAlbum-01-03 What Kind of Name Is- -mp3-192- - Sep 09, 2004 14.22.36.mp3 ok scanned
1/11/2008 3:33:03 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Charlie Robison - Good Times.mp3 ok scanned
1/11/2008 3:33:03 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Desktop.ini ok scanned
1/11/2008 3:33:03 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Holiday.cda ok scanned
1/11/2008 3:33:03 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Kimmie Rhodes - Love Me Like A Song.mp3 ok scanned
1/11/2008 3:33:03 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Musicmatch - It's Way Better With Plus!.mp3 ok scanned
1/11/2008 3:33:03 PM File: C:\Documents and Settings\Kris\My Documents\My Music\My Personal Moon.mp3 ok scanned
1/11/2008 3:33:03 PM File: C:\Documents and Settings\Kris\My Documents\My Music\NaturalFool(192k).mp3 ok scanned
1/11/2008 3:33:03 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Runaway Love.cda ok scanned
1/11/2008 3:33:03 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Sample Music.lnk ok scanned
1/11/2008 3:33:03 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Secondhand Jive - Lucky.mp3 ok scanned
1/11/2008 3:33:03 PM File: C:\Documents and Settings\Kris\My Documents\My Music\SIGHTLINES.mp3 ok scanned
1/11/2008 3:33:04 PM File: C:\Documents and Settings\Kris\My Documents\My Music\The Like Young - Worry A Lot - 192.mp3 ok scanned
1/11/2008 3:33:04 PM File: C:\Documents and Settings\Kris\My Documents\My Music\The Nitty Gritty Dirt Band - Party On The Mountain.mp3 ok scanned
1/11/2008 3:33:04 PM File: C:\Documents and Settings\Kris\My Documents\My Music\The Silos-Holding On To Life.mp3 ok scanned
1/11/2008 3:33:04 PM File: C:\Documents and Settings\Kris\My Documents\My Music\The-Cells_Silver-Cloud_192kbps.mp3 ok scanned
1/11/2008 3:33:04 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Library.itl ok scanned
1/11/2008 3:33:04 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music Library.xml ok scanned
1/11/2008 3:33:04 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\01\01\09\556716B2B5C73ABA-677EE6348A090911.itc ok scanned
1/11/2008 3:33:04 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\01\03\10\556716B2B5C73ABA-6F4189E7DB09EA31.itc ok scanned
1/11/2008 3:33:04 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\01\13\02\556716B2B5C73ABA-319B81A9563C12D1.itc ok scanned
1/11/2008 3:33:04 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\02\02\11\556716B2B5C73ABA-815FA567FD963B22.itc ok scanned
1/11/2008 3:33:04 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\02\14\06\556716B2B5C73ABA-0A824975222D06E2.itc ok scanned
1/11/2008 3:33:05 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\03\05\09\556716B2B5C73ABA-0A824975222CF953.itc ok scanned
1/11/2008 3:33:05 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\03\05\11\556716B2B5C73ABA-815FA567FD962B53.itc ok scanned
1/11/2008 3:33:05 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\03\10\14\556716B2B5C73ABA-319B81A9563C0EA3.itc ok scanned
1/11/2008 3:33:05 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\03\13\07\556716B2B5C73ABA-677EE6348A0907D3.itc ok scanned
1/11/2008 3:33:05 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\04\03\11\556716B2B5C73ABA-0A824975222D3B34.itc ok scanned
1/11/2008 3:33:05 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\04\08\13\556716B2B5C73ABA-0A824975222D2D84.itc ok scanned
1/11/2008 3:33:05 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\04\10\14\556716B2B5C73ABA-0A824975222CFEA4.itc ok scanned
1/11/2008 3:33:06 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\05\07\03\556716B2B5C73ABA-815FA567FD963375.itc ok scanned
1/11/2008 3:33:06 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\05\10\03\556716B2B5C73ABA-815FA567FD9623A5.itc ok scanned
1/11/2008 3:33:06 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\05\11\13\556716B2B5C73ABA-0A824975222D3DB5.itc ok scanned
1/11/2008 3:33:06 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\05\14\07\556716B2B5C73ABA-6F4189E7DB09D7E5.itc ok scanned
1/11/2008 3:33:06 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\06\00\06\556716B2B5C73ABA-56965E670111B606.itc ok scanned
1/11/2008 3:33:07 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\06\04\10\556716B2B5C73ABA-677EE6348A092A46.itc ok scanned
1/11/2008 3:33:07 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\06\07\09\556716B2B5C73ABA-F78EA0B1CC57D976.itc ok scanned
1/11/2008 3:33:07 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\07\00\03\556716B2B5C73ABA-0A824975222D3307.itc ok scanned
1/11/2008 3:33:07 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\07\02\00\556716B2B5C73ABA-58F075850FA12027.itc ok scanned
1/11/2008 3:33:07 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\07\02\01\556716B2B5C73ABA-CDA8F351AFFA6127.itc ok scanned
1/11/2008 3:33:07 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\07\07\10\556716B2B5C73ABA-0A824975222D1A77.itc ok scanned
1/11/2008 3:33:07 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\07\09\05\556716B2B5C73ABA-0A824975222D2597.itc ok scanned
1/11/2008 3:33:07 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\08\03\10\556716B2B5C73ABA-0A824975222D0A38.itc ok scanned
1/11/2008 3:33:07 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\08\05\10\556716B2B5C73ABA-0A824975222CEA58.itc ok scanned
1/11/2008 3:33:08 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\08\06\09\556716B2B5C73ABA-815FA567FD962968.itc ok scanned
1/11/2008 3:33:08 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\08\09\09\556716B2B5C73ABA-319B81A9563C0998.itc ok scanned
1/11/2008 3:33:08 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\09\04\10\556716B2B5C73ABA-677EE6348A092A49.itc ok scanned
1/11/2008 3:33:08 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\09\11\12\556716B2B5C73ABA-677EE6348A091CB9.itc ok scanned
1/11/2008 3:33:08 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\09\11\14\556716B2B5C73ABA-43D6CD074DE6EEB9.itc ok scanned
1/11/2008 3:33:08 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\10\02\02\556716B2B5C73ABA-54CAB02C6607322A.itc ok scanned
1/11/2008 3:33:08 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\10\04\05\556716B2B5C73ABA-0A824975222D254A.itc ok scanned
1/11/2008 3:33:08 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\11\05\04\556716B2B5C73ABA-D3B24C348C22645B.itc ok scanned
1/11/2008 3:33:08 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\11\06\08\556716B2B5C73ABA-F78EA0B1CC57D86B.itc ok scanned
1/11/2008 3:33:09 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\12\03\08\556716B2B5C73ABA-F78EA0B1CC57D83C.itc ok scanned
1/11/2008 3:33:09 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\12\04\03\556716B2B5C73ABA-0A824975222D134C.itc ok scanned
1/11/2008 3:33:09 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\12\14\06\556716B2B5C73ABA-D0C961B691DE16EC.itc ok scanned
1/11/2008 3:33:09 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\13\14\06\556716B2B5C73ABA-D0C961B691DE16ED.itc ok scanned
1/11/2008 3:33:09 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\14\02\09\556716B2B5C73ABA-43D6CD074DE6F92E.itc ok scanned
1/11/2008 3:33:09 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\14\06\05\556716B2B5C73ABA-0A824975222D056E.itc ok scanned
1/11/2008 3:33:09 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\15\00\04\556716B2B5C73ABA-0A824975222CF40F.itc ok scanned
1/11/2008 3:33:09 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\15\01\11\556716B2B5C73ABA-815FA567FD963B1F.itc ok scanned
1/11/2008 3:33:09 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\15\05\15\556716B2B5C73ABA-0A824975222CEF5F.itc ok scanned
1/11/2008 3:33:10 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Album Artwork\Local\556716B2B5C73ABA\15\15\06\556716B2B5C73ABA-319B81A9563C16FF.itc ok scanned
1/11/2008 3:33:10 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\01 It's my life.mp3 ok scanned
1/11/2008 3:33:10 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Alan Jackson\Who I Am\02 Livin' on Love.m4p ok scanned
1/11/2008 3:33:10 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Aqua\Aquarium\03 Barbie Girl (Radio) 1.mp3 ok scanned
1/11/2008 3:33:10 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Aqua\Aquarium\03 Barbie Girl (Radio) 2.mp3 ok scanned
1/11/2008 3:33:10 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Aqua\Aquarium\03 Barbie Girl (Radio).m4p ok scanned
1/11/2008 3:33:10 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Aqua\Aquarium\03 Barbie Girl (Radio).mp3 ok scanned
1/11/2008 3:33:11 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Baby Boy Da Prince featuring P. Town Moe\The Way I Live - Single\01 The Way I Live.m4p ok scanned
1/11/2008 3:33:11 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Big Butts\Unknown Album\15 15 Track 15.m4a ok scanned
1/11/2008 3:33:11 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Boston\Boston\01 More Than a Feeling.m4p ok scanned
1/11/2008 3:33:11 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Compilations\20th Century Masters - The Millennium Co\02 Baby Blue.m4p ok scanned
1/11/2008 3:33:11 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Compilations\8 Mile (Soundtrack from the Motion Pictu\01 Lose Yourself.m4p ok scanned
1/11/2008 3:33:12 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Compilations\Alan Jackson_ Greatest Hits, Vol. 2\It's Five O'Clock Somewhere.m4p ok scanned
1/11/2008 3:33:12 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Compilations\Brooks and Dunn_ The Greatest Hits Colle\My Maria.m4p ok scanned
1/11/2008 3:33:12 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Compilations\Bruce Hornsby_ Greatest Radio Hits\03 Every Little Kiss.m4p ok scanned
1/11/2008 3:33:12 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Compilations\Bruce Hornsby_ Greatest Radio Hits\04 The Valley Road.m4p ok scanned
1/11/2008 3:33:12 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Compilations\Complete Greatest Hits\05 Hot Blooded.m4a ok scanned
1/11/2008 3:33:12 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Compilations\Conway Twitty_ The #1 Hits Collection\Tight Fittin' Jeans (Single).m4p ok scanned
1/11/2008 3:33:12 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Compilations\Eddie Rabbit_ All Time Greatest Hits\01 I Love a Rainy Night.m4p ok scanned
1/11/2008 3:33:13 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Compilations\Eddie Rabbit_ All Time Greatest Hits\02 Drivin' My Life Away.m4p ok scanned
1/11/2008 3:33:13 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Compilations\George Strait's Greatest Hits\06 Amarillo by Morning.m4p ok scanned
1/11/2008 3:33:13 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Compilations\George Strait's Greatest Hits Volume Two\08 Ocean Front Property.m4p ok scanned
1/11/2008 3:33:13 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Compilations\Greatest Country Hits Of The '80s - Volu\06 Born To Boogie.m4a ok scanned
1/11/2008 3:33:13 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Compilations\Greatest Country Hits Of The '80s - Volu\09 Country Club.m4a ok scanned
1/11/2008 3:33:14 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Compilations\Greatest Hits\01 American Girl.m4p ok scanned
1/11/2008 3:33:14 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Compilations\Jerry Reed_ Super Hits\East Bound and Down.m4p ok scanned
1/11/2008 3:33:14 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Compilations\Johnny Lee_ Greatest Hits\01 Lookin' for Love.m4p ok scanned
1/11/2008 3:33:14 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Compilations\Kathy Mattea_ A Collection of Hits\06 Eighteen Wheels and a Dozen Roses.m4p ok scanned
1/11/2008 3:33:14 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Compilations\Kenny Rogers_ 20 Great Years\05 Coward of the County.m4p ok scanned
1/11/2008 3:33:15 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Compilations\Kenny Rogers_ 20 Great Years\09 Daytime Friends.m4p ok scanned
1/11/2008 3:33:15 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Compilations\Poison's Greatest Hits 1986-1996\01 Nothin' But A Good Time.m4a ok scanned
1/11/2008 3:33:15 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Compilations\Poison's Greatest Hits 1986-1996\02 Talk Dirty To Me.m4a ok scanned
1/11/2008 3:33:15 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Compilations\RCA Country Legends_ Restless Heart\08 The Bluest Eyes in Texas.m4p ok scanned
1/11/2008 3:33:15 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Compilations\Skynyrd's Innyrds\01 Sweet Home Alabama.m4a ok scanned
1/11/2008 3:33:16 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Compilations\The Best of C.W. McCall\03 Convoy.m4a ok scanned
1/11/2008 3:33:16 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Compilations\The Best of C.W. McCall\Convoy.m4p ok scanned
1/11/2008 3:33:16 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Compilations\Today's Top 10 Country\04 I Just Wanted You To Know-94_1.m4a ok scanned
1/11/2008 3:33:16 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Compilations\Today's Top 10 Country\10 Lifestyles Of The Not So Rich And.m4a ok scanned
1/11/2008 3:33:16 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Cyndi Lauper\She's So Unusual\01 Girls Just Want to Have Fun.m4a ok scanned
1/11/2008 3:33:16 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Cyndi Lauper\She's So Unusual\Girls Just Want to Have Fun.m4p ok scanned
1/11/2008 3:33:17 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Dan Seals\Certified Hits_ Dan Seals\Big Wheels In the Moonlight.m4p ok scanned
1/11/2008 3:33:17 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Daughtry\Daughtry\04 Over You.m4p ok scanned
1/11/2008 3:33:17 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Daughtry\Daughtry\05 Over You 1.mp3 ok scanned
1/11/2008 3:33:17 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Daughtry\Daughtry\05 Over You.mp3 ok scanned
1/11/2008 3:33:17 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Don Henley\Building the Perfect Beast\The Boys of Summer.m4p ok scanned
1/11/2008 3:33:17 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Eminem\8 Mile (Soundtrack from the Motion Pictu\Lose Yourself.m4p ok scanned
1/11/2008 3:33:18 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Fat Joe\Get It Poppin' - Single\01 Get It Poppin (Featuring Nelly).m4p ok scanned
1/11/2008 3:33:18 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Fergie\The Dutchess (Bonus Tracks)\01 Fergalicious (Edited Version).m4p ok scanned
1/11/2008 3:33:18 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Finger Eleven\Them vs. You vs. Me\01 Paralyzer.m4p ok scanned
1/11/2008 3:33:18 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Finger Eleven\Them vs. You vs. Me\06 Paralyzer 1.mp3 ok scanned
1/11/2008 3:33:18 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Finger Eleven\Them vs. You vs. Me\06 Paralyzer.mp3 ok scanned
1/11/2008 3:33:18 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Foo Fighters\There Is Nothing Left to Lose\02 Learn to Fly.m4a ok scanned
1/11/2008 3:33:19 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Foo Fighters\There Is Nothing Left to Lose\Learn to Fly.m4p ok scanned
1/11/2008 3:33:19 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Frankie Valli & The Four Seasons\The Very Best of Frankie Valli & The Fou\December, 1963 (Oh What a Night!).m4p ok scanned
1/11/2008 3:33:19 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Green Day\Holiday - Single\01 Holiday (Faded Ending) 1.mp3 ok scanned
1/11/2008 3:33:19 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Green Day\Holiday - Single\01 Holiday (Faded Ending).mp3 ok scanned
1/11/2008 3:33:19 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Green Day\Holiday - Single\Holiday (Faded Ending).m4p ok scanned
1/11/2008 3:33:20 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\House Of Pain\The Best of House of Pain and Everlast_\01 Jump Around.m4p ok scanned
1/11/2008 3:33:20 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Howie Day\Stop All the World Now\Collide.m4p ok scanned
1/11/2008 3:33:20 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Jet\Get Born\Look What You've Done.m4p ok scanned
1/11/2008 3:33:20 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\John Mellencamp\The Lonesome Jubilee\Cherry Bomb.m4p ok scanned
1/11/2008 3:33:20 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\John Mellencamp\Words & Music - John Mellencamp's Greate\Hurts So Good.m4p ok scanned
1/11/2008 3:33:20 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Justin Timberlake\FutureSex _ LoveSounds\09 Summer Love.m4p ok scanned
1/11/2008 3:33:21 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Kanye West\Graduation\03 Stronger.m4p ok scanned
1/11/2008 3:33:21 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Kanye West\Graduation\07 Stronger 1.mp3 ok scanned
1/11/2008 3:33:21 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Kanye West\Graduation\07 Stronger.mp3 ok scanned
1/11/2008 3:33:21 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Kelly Clarkson\Breakaway\Since U Been Gone.m4p ok scanned
1/11/2008 3:33:21 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Kenny Chesney\When the Sun Goes Down\When the Sun Goes Down.m4p ok scanned
1/11/2008 3:33:21 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Kenny Rogers\42 Ultimate Hits\2-05 Through the Years.m4p ok scanned
1/11/2008 3:33:21 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Lenny Kravitz\Baptism\Lady.m4p ok scanned
1/11/2008 3:33:21 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Lifehouse\Who We Are\02 First Time 1.mp3 ok scanned
1/11/2008 3:33:22 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Lifehouse\Who We Are\02 First Time MP3.mp3 ok scanned
1/11/2008 3:33:22 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Lifehouse\Who We Are\02 First Time.mp3 ok scanned
1/11/2008 3:33:22 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Ludacris\Release Therapy\02 Runaway Love 1.mp3 ok scanned
1/11/2008 3:33:22 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Ludacris\Release Therapy\02 Runaway Love.mp3 ok scanned
1/11/2008 3:33:22 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Ludacris\Release Therapy\13 Runaway Love.m4p ok scanned
1/11/2008 3:33:22 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Marie Osmond & Dan Seals\There's No Stopping Your Heart\06 Meet Me In Montana (With Dan Seal.m4p ok scanned
1/11/2008 3:33:22 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Maroon 5\It Won't Be Soon Before Long\02 Makes Me Wonder.m4p ok scanned
1/11/2008 3:33:22 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Maroon 5\It Won't Be Soon Before Long\04 Makes Me Wonder.mp3 ok scanned
1/11/2008 3:33:23 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Maroon 5\Songs About Jane\01 Harder to Breathe.m4p ok scanned
1/11/2008 3:33:23 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Mel McDaniel\Mel McDaniel_ Greatest Hits\01 Louisiana Saturday Night.m4p ok scanned
1/11/2008 3:33:23 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Mr. Brightside\Unknown Album\01 01 Track 1.m4a ok scanned
1/11/2008 3:33:23 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Nelly\Country Grammar\Ride Wit Me.m4p ok scanned
1/11/2008 3:33:23 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Nelly & Tim McGraw\Suit\Over and Over.m4p ok scanned
1/11/2008 3:33:23 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Nickelback\Photograph - Single\Photograph.m4p ok scanned
1/11/2008 3:33:24 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Nickelback\Savin' Me - Single\Savin' Me.m4p ok scanned
1/11/2008 3:33:24 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Ozzy Osbourne\The Essential Ozzy Osbourne\1-01 Crazy Train.m4p ok scanned
1/11/2008 3:33:24 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Rob Thomas\Lonely No More - Single\Lonely No More.m4p ok scanned
1/11/2008 3:33:24 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Santana\Into the Night (feat. Chad Kroeger) - Si\01 Into the Night (feat. Chad Kroege.m4p ok scanned
1/11/2008 3:33:25 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Santana\Into the Night (feat. Chad Kroeger) - Si\03 Into the Night (feat. Chad Kroe 1.mp3 ok scanned
1/11/2008 3:33:25 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Santana\Into the Night (feat. Chad Kroeger) - Si\03 Into the Night (feat. Chad Kroege.mp3 ok scanned
1/11/2008 3:33:25 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Shakira\Oral Fixation, Vol. 2\02 Hips Don't Lie (featuring Wyclef.mp3 ok scanned
1/11/2008 3:33:25 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Shakira\Oral Fixation, Vol. 2\03 Hips Don't Lie (featuring Wyclef.m4p ok scanned
1/11/2008 3:33:25 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Speed of Sound\Unknown Album\02 02 Track 2.m4a ok scanned
1/11/2008 3:33:25 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Starland Vocal Band\Starland Vocal Band\Afternoon Delight.m4p ok scanned
1/11/2008 3:33:25 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\The Bellamy Brothers\The Bellamy Brothers_ Greatest Hits, Vol\02 If I Said You Had a Beautiful Bod.m4p ok scanned
1/11/2008 3:33:25 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\The Fray\How to Save a Life\03 How to Save a Life.m4p ok scanned
1/11/2008 3:33:25 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\The Pussycat Dolls featuring Big Snoop D\Buttons - Single\01 Buttons.m4p ok scanned
1/11/2008 3:33:25 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Toby Keith\Shock'n Y'All\01 I Love This Bar.m4a ok scanned
1/11/2008 3:33:26 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Toby Keith\Shock'n Y'All\02 Whiskey Girl.m4a ok scanned
1/11/2008 3:33:26 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Tom T. Hall\The Definitive Collection_ Tom T. Hall\I Like Beer.m4p ok scanned
1/11/2008 3:33:26 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Unknown Artist\Unknown Album\01 It's my life.mp3 ok scanned
1/11/2008 3:33:26 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Unknown Artist\Unknown Album\01 Shook Me All Night Long.m4a ok scanned
1/11/2008 3:33:26 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Unknown Artist\Unknown Album\01 Track 01.m4a ok scanned
1/11/2008 3:33:26 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Unknown Artist\Unknown Album\05 Bust A Move.m4a ok scanned
1/11/2008 3:33:27 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Unknown Artist\Unknown Album\05 Track 05.m4a ok scanned
1/11/2008 3:33:27 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Unknown Artist\Unknown Album\10 Y&T.m4a ok scanned
1/11/2008 3:33:27 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Unknown Artist\Unknown Album\12 Brown Eyed girl.m4a ok scanned
1/11/2008 3:33:27 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Unknown Artist\Unknown Album\14 Family Tradition.m4a ok scanned
1/11/2008 3:33:27 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Unknown Artist\Unknown Album\16 Magic.m4a ok scanned
1/11/2008 3:33:28 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Usher\Confessions (Special Edition)\Caught Up.m4p ok scanned
1/11/2008 3:33:28 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Warrant\Dirty Rotten Filthy Stinking Rich\Down Boys.m4p ok scanned
1/11/2008 3:33:28 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Warrant\Dirty Rotten Filthy Stinking Rich\Sometimes She Cries.m4p ok scanned
1/11/2008 3:33:28 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\iTunes Music\Yeah\Unknown Album\07 07 Track 7.m4a ok scanned
1/11/2008 3:33:28 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Previous iTunes Libraries\iTunes 4 Music Library.itl ok scanned
1/11/2008 3:33:28 PM File: C:\Documents and Settings\Kris\My Documents\My Music\iTunes\Previous iTunes Libraries\Shortcut to iTunes.lnk ok scanned
1/11/2008 3:33:28 PM File: C:\Documents and Settings\Kris\My Documents\My Music\My Playlists\DMX_TempList (2).wpl ok scanned
1/11/2008 3:33:28 PM File: C:\Documents and Settings\Kris\My Documents\My Music\My Playlists\DMX_TempList.wpl ok scanned
1/11/2008 3:33:28 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Toby Keith\desktop.ini ok scanned
1/11/2008 3:33:28 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Toby Keith\Thumbs.db ok scanned
1/11/2008 3:33:28 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Toby Keith\Thumbs.db:encryptable ok scanned
1/11/2008 3:33:28 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Toby Keith\Shock'n Y'All\01 I Love This Bar.wma ok scanned
1/11/2008 3:33:28 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Toby Keith\Shock'n Y'All\02 Whiskey Girl.wma ok scanned
1/11/2008 3:33:29 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Toby Keith\Shock'n Y'All\AlbumArtSmall.jpg ok scanned
1/11/2008 3:33:29 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Toby Keith\Shock'n Y'All\AlbumArt_{303AD8A2-E947-487D-8AAB-419A1F5E1C6E}_Large.jpg ok scanned
1/11/2008 3:33:29 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Toby Keith\Shock'n Y'All\AlbumArt_{303AD8A2-E947-487D-8AAB-419A1F5E1C6E}_Small.jpg ok scanned
1/11/2008 3:33:29 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Toby Keith\Shock'n Y'All\desktop.ini ok scanned
1/11/2008 3:33:29 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Toby Keith\Shock'n Y'All\Folder.jpg ok scanned
1/11/2008 3:33:29 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Toby Keith\Shock'n Y'All\Thumbs.db ok scanned
1/11/2008 3:33:29 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Toby Keith\Shock'n Y'All\Thumbs.db:encryptable ok iChecker
1/11/2008 3:33:29 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Unknown Artist\desktop.ini ok scanned
1/11/2008 3:33:29 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Unknown Artist\Unknown Album (2-1-2007 4-29-43 PM)\01 Lose Yourself.wma ok scanned
1/11/2008 3:33:29 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Unknown Artist\Unknown Album (2-1-2007 4-29-43 PM)\02 Feralicious.wma ok scanned
1/11/2008 3:33:29 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Unknown Artist\Unknown Album (2-1-2007 4-29-43 PM)\03 Buttons.wma ok scanned
1/11/2008 3:33:29 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Unknown Artist\Unknown Album (2-1-2007 4-29-43 PM)\04 More Than a Feeling.wma ok scanned
1/11/2008 3:33:29 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Unknown Artist\Unknown Album (2-1-2007 4-29-43 PM)\desktop.ini ok scanned
1/11/2008 3:33:29 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Unknown Artist\Unknown Album (4-5-2007 10-14-19 PM)\01 holiday (3).wma ok scanned
1/11/2008 3:33:30 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Unknown Artist\Unknown Album (4-5-2007 10-14-19 PM)\01 holiday.wma ok scanned
1/11/2008 3:33:30 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Unknown Artist\Unknown Album (4-5-2007 10-14-19 PM)\02 Runaway love.wma ok scanned
1/11/2008 3:33:30 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Unknown Artist\Unknown Album (4-5-2007 10-14-19 PM)\03 Barbie Girl.wma ok scanned
1/11/2008 3:33:30 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Unknown Artist\Unknown Album (4-5-2007 10-14-19 PM)\desktop.ini ok scanned
1/11/2008 3:33:30 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Unknown Artist\Unknown Album (7-10-2007 9-36-54 PM)\02 Hips don't lie.wma ok scanned
1/11/2008 3:33:30 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Unknown Artist\Unknown Album (7-10-2007 9-36-54 PM)\04 makes me wonder.wma ok scanned
1/11/2008 3:33:30 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Unknown Artist\Unknown Album (7-10-2007 9-36-54 PM)\05 summer love.wma ok scanned
1/11/2008 3:33:30 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Unknown Artist\Unknown Album (7-10-2007 9-36-54 PM)\06 jump aroune.wma ok scanned
1/11/2008 3:33:30 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Unknown Artist\Unknown Album (7-10-2007 9-36-54 PM)\09 get it poppin.wma ok scanned
1/11/2008 3:33:30 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Unknown Artist\Unknown Album (7-10-2007 9-36-54 PM)\desktop.ini ok scanned
1/11/2008 3:33:31 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Unknown Artist\Unknown Album (7-18-2006 9-59-10 PM)\01 01 Track 1.wma ok scanned
1/11/2008 3:33:31 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Unknown Artist\Unknown Album (7-18-2006 9-59-10 PM)\02 02 Track 2.wma ok scanned
1/11/2008 3:33:31 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Unknown Artist\Unknown Album (7-18-2006 9-59-10 PM)\07 07 Track 7.wma ok scanned
1/11/2008 3:33:31 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Unknown Artist\Unknown Album (7-18-2006 9-59-10 PM)\15 15 Track 15.wma ok scanned
1/11/2008 3:33:31 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Unknown Artist\Unknown Album (7-18-2006 9-59-10 PM)\17 I like big butts.wma ok scanned
1/11/2008 3:33:31 PM File: C:\Documents and Settings\Kris\My Documents\My Music\Unknown Artist\Unknown Album (7-18-2006 9-59-10 PM)\desktop.ini ok scanned
1/11/2008 3:33:31 PM File: C:\Documents and Settings\Kris\My Documents\My Pictures\Desktop.ini ok scanned
1/11/2008 3:33:31 PM File: C:\Documents and Settings\Kris\My Documents\My Pictures\Sample Pictures.lnk ok scanned
1/11/2008 3:33:31 PM File: C:\Documents and Settings\Kris\My Documents\My PSP8 Files\Scripts-Restricted\BoundScript1.PspScript ok scanned
1/11/2008 3:33:31 PM File: C:\Documents and Settings\Kris\My Documents\My PSP8 Files\Scripts-Restricted\BoundScript2.PspScript ok scanned
1/11/2008 3:33:31 PM File: C:\Documents and Settings\Kris\My Documents\My PSP8 Files\Scripts-Restricted\BoundScript3.PspScript ok scanned
1/11/2008 3:33:31 PM File: C:\Documents and Settings\Kris\My Documents\My PSP8 Files\Scripts-Restricted\BoundScript4.PspScript ok scanned
1/11/2008 3:33:31 PM File: C:\Documents and Settings\Kris\My Documents\My PSP8 Files\Scripts-Restricted\BoundScript5.PspScript ok scanned
1/11/2008 3:33:31 PM File: C:\Documents and Settings\Kris\My Documents\My PSP8 Files\Scripts-Restricted\BoundScript6.PspScript ok scanned
1/11/2008 3:33:31 PM File: C:\Documents and Settings\Kris\My Documents\My PSP8 Files\Scripts-Restricted\BoundScript7.PspScript ok scanned
1/11/2008 3:33:31 PM File: C:\Documents and Settings\Kris\My Documents\My PSP8 Files\Scripts-Restricted\BoundScript8.PspScript ok scanned
1/11/2008 3:33:32 PM File: C:\Documents and Settings\Kris\My Documents\My PSP8 Files\Scripts-Restricted\BoundScript9.PspScript ok scanned
1/11/2008 3:33:32 PM File: C:\Documents and Settings\Kris\My Documents\My Videos\Desktop.ini ok scanned
1/11/2008 3:33:32 PM File: C:\Documents and Settings\Kris\My Documents\My Videos\Experience.mpg ok scanned
1/11/2008 3:33:32 PM File: C:\Documents and Settings\Kris\My Documents\My Videos\Thumbs.db ok scanned
1/11/2008 3:33:32 PM File: C:\Documents and Settings\Kris\My Documents\My Videos\Thumbs.db:encryptable ok iChecker
1/11/2008 3:33:33 PM Logical disk sector: C ok scanned
1/11/2008 3:33:34 PM Physical disk sector: \Device\HarddiskVolume3 ok scanned
1/11/2008 3:33:35 PM Physical disk sector: \Device\HarddiskVolume1 ok scanned
1/11/2008 3:33:35 PM Physical disk sector: \Device\Harddisk0\DR0 ok scanned
1/11/2008 3:33:35 PM File: C:\aaw7boot.log ok scanned
1/11/2008 3:33:35 PM File: C:\AUTOEXEC.BAT ok iChecker
1/11/2008 3:33:35 PM File: C:\BOOT.INI ok scanned
1/11/2008 3:33:36 PM File: C:\ComboFix.txt ok scanned
1/11/2008 3:33:36 PM File: C:\CONFIG.SYS ok iChecker
1/11/2008 3:33:36 PM File: C:\DELL.SDR ok scanned
1/11/2008 3:33:36 PM File: C:\DownloadLog.txt ok scanned
1/11/2008 3:33:36 PM File: C:\hemixer.dmp ok scanned
1/11/2008 3:33:36 PM File: C:\hiberfil.sys skipped locked
1/11/2008 3:33:36 PM File: C:\INFCACHE.1 ok scanned
1/11/2008 3:33:36 PM File: C:\IO.SYS ok iChecker
1/11/2008 3:33:36 PM File: C:\IO96BC~.TMP ok scanned
1/11/2008 3:33:36 PM File: C:\IPH.PH ok scanned
1/11/2008 3:33:36 PM File: C:\MSDOS.SYS ok iChecker
1/11/2008 3:33:37 PM File: C:\NTDETECT.COM ok scanned
1/11/2008 3:33:37 PM File: C:\NTLDR ok scanned
1/11/2008 3:33:37 PM File: C:\OQUIRRH.TXT ok scanned
1/11/2008 3:33:37 PM File: C:\OQUIRRH_SETUP.LOG ok scanned
1/11/2008 3:33:37 PM File: C:\pagefile.sys skipped locked
1/11/2008 3:33:37 PM File: C:\sqmdata00.sqm ok scanned
1/11/2008 3:33:37 PM File: C:\sqmdata01.sqm ok scanned
1/11/2008 3:33:37 PM File: C:\sqmdata02.sqm ok scanned
1/11/2008 3:33:37 PM File: C:\sqmdata03.sqm ok scanned
1/11/2008 3:33:37 PM File: C:\sqmdata04.sqm ok scanned
1/11/2008 3:33:37 PM File: C:\sqmdata05.sqm ok scanned
1/11/2008 3:33:37 PM File: C:\sqmdata06.sqm ok scanned
1/11/2008 3:33:37 PM File: C:\sqmdata07.sqm ok scanned
1/11/2008 3:33:37 PM File: C:\sqmdata08.sqm ok scanned
1/11/2008 3:33:37 PM File: C:\sqmdata09.sqm ok scanned
1/11/2008 3:33:37 PM File: C:\sqmdata10.sqm ok scanned
1/11/2008 3:33:37 PM File: C:\sqmdata11.sqm ok scanned
1/11/2008 3:33:37 PM File: C:\sqmdata12.sqm ok scanned
1/11/2008 3:33:37 PM File: C:\sqmdata13.sqm ok scanned
1/11/2008 3:33:37 PM File: C:\sqmdata14.sqm ok scanned
1/11/2008 3:33:37 PM File: C:\sqmdata15.sqm ok scanned
1/11/2008 3:33:38 PM File: C:\sqmdata16.sqm ok scanned
1/11/2008 3:33:38 PM File: C:\sqmdata17.sqm ok scanned
1/11/2008 3:33:38 PM File: C:\sqmdata18.sqm ok scanned
1/11/2008 3:33:38 PM File: C:\sqmdata19.sqm ok scanned
1/11/2008 3:33:38 PM File: C:\sqmnoopt00.sqm ok scanned
1/11/2008 3:33:38 PM File: C:\sqmnoopt01.sqm ok scanned
1/11/2008 3:33:38 PM File: C:\sqmnoopt02.sqm ok scanned
1/11/2008 3:33:38 PM File: C:\sqmnoopt03.sqm ok scanned
1/11/2008 3:33:38 PM File: C:\sqmnoopt04.sqm ok scanned
1/11/2008 3:33:38 PM File: C:\sqmnoopt05.sqm ok scanned
1/11/2008 3:33:38 PM File: C:\sqmnoopt06.sqm ok scanned
1/11/2008 3:33:38 PM File: C:\sqmnoopt07.sqm ok scanned
1/11/2008 3:33:38 PM File: C:\sqmnoopt08.sqm ok scanned
1/11/2008 3:33:38 PM File: C:\sqmnoopt09.sqm ok scanned
1/11/2008 3:33:38 PM File: C:\sqmnoopt10.sqm ok scanned
1/11/2008 3:33:38 PM File: C:\sqmnoopt11.sqm ok scanned
1/11/2008 3:33:38 PM File: C:\sqmnoopt12.sqm ok scanned
1/11/2008 3:33:38 PM File: C:\sqmnoopt13.sqm ok scanned
1/11/2008 3:33:38 PM File: C:\sqmnoopt14.sqm ok scanned
1/11/2008 3:33:38 PM File: C:\sqmnoopt15.sqm ok scanned
1/11/2008 3:33:38 PM File: C:\sqmnoopt16.sqm ok scanned
1/11/2008 3:33:38 PM File: C:\sqmnoopt17.sqm ok scanned
1/11/2008 3:33:38 PM File: C:\sqmnoopt18.sqm ok scanned
1/11/2008 3:33:38 PM File: C:\sqmnoopt19.sqm ok scanned
1/11/2008 3:33:38 PM File: C:\SystemInfo.ini ok scanned
1/11/2008 3:33:38 PM File: C:\the best movie ever.rtf ok scanned
1/11/2008 3:33:39 PM File: C:\Deckard\System Scanner\extra.txt ok scanned
1/11/2008 3:33:39 PM File: C:\Deckard\System Scanner\main.txt ok scanned
1/11/2008 3:33:39 PM File: C:\Deckard\System Scanner\moved.txt ok scanned
1/11/2008 3:33:39 PM File: C:\Deckard\System Scanner\backup\DOCUME~1\Kris\LOCALS~1\Temp\4f550403.exe ok scanned
1/11/2008 3:33:39 PM File: C:\Deckard\System Scanner\backup\DOCUME~1\Kris\LOCALS~1\Temp\5e16_appcompat.txt ok scanned
1/11/2008 3:33:39 PM File: C:\Deckard\System Scanner\backup\DOCUME~1\Kris\LOCALS~1\Temp\5F4E068.dmp ok scanned
1/11/2008 3:33:39 PM File: C:\Deckard\System Scanner\backup\DOCUME~1\Kris\LOCALS~1\Temp\8A56EAB7.TMP ok scanned
1/11/2008 3:33:39 PM File: C:\Deckard\System Scanner\backup\DOCUME~1\Kris\LOCALS~1\Temp\AAX1D.tmp ok scanned
1/11/2008 3:33:40 PM File: C:\Deckard\System Scanner\backup\DOCUME~1\Kris\LOCALS~1\Temp\AAX22.tmp ok scanned
1/11/2008 3:33:40 PM File: C:\Deckard\System Scanner\backup\DOCUME~1\Kris\LOCALS~1\Temp\AAX3.tmp ok scanned
1/11/2008 3:33:40 PM File: C:\Deckard\System Scanner\backup\DOCUME~1\Kris\LOCALS~1\Temp\AAX8.tmp ok scanned


Statistics
----------
Object Scanned Detected Untreated Deleted Moved to Quarantine Archives Packed files Password protected Corrupted
------ ------- -------- --------- ------- ------------------- -------- ------------ ------------------ ---------
All objects 340 0 0 0 0 1 0 0 0
My Documents 268 0 0 0 0 1 0 0 0
Local Disk (C:) 72 0 0 0 0 0 0 0 0


Settings
--------
Parameter Value
--------- -----
Security Level Recommended
Action Prompt for action when the scan is complete
Run mode Manually
File types Scan all filesLogfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:24:22 PM, on 1/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\fxssvc.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\PROGRA~1\mcafee.com\agent\McAgent.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\D-link AirPlus G DWL-G120 Wireless USB\120UTIL.exe
C:\WINDOWS\System32\svchost.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\Citrix\GoToAssist\480\G2AProcessFactory.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\Citrix\GoToAssist\480\G2AProcessFactory.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: ALOT eMusic Toolbar - {8260C2B8-E0D1-448a-B062-33D12D468BF0} - C:\Program Files\alot\bin\alot.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: ALOT eMusic Toolbar - {8260C2B8-E0D1-448a-B062-33D12D468BF0} - C:\Program Files\alot\bin\alot.dll
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-21-3312275069-991171138-941568493-1007\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Jody')
O4 - HKUS\S-1-5-21-3312275069-991171138-941568493-1007\..\Run: [DoNotDelete] C:\WINDOWS\system32\explore.exe (User 'Jody')
O4 - HKUS\S-1-5-21-3312275069-991171138-941568493-1007\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'Jody')
O4 - HKUS\S-1-5-21-3312275069-991171138-941568493-1008\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'Bryce')
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0b\aoltray.exe
O4 - Global Startup: D-link AirPlus G DWL-G120 Wireless USB.lnk = ?
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...rch.jhtml?p=ZJ
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\AMV Convert Tool 3.70\AMVConverter\grab.html
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?39a8643fe42b4b11931002141737642f
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?39a8643fe42b4b11931002141737642f
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Bryce\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\480\g2aservice.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 8099 bytes

Scan only new and changed files No
Scan archives All
Scan embedded OLE objects All
Skip if object is larger than No
Skip if scan takes longer than No
Parse email formats No
Scan password-protected archives No
Enable iChecker technology Yes
Enable iSwift technology Yes
Record information about dangerous objects to program statistics Yes
cakes is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-14-2008, 10:19 AM   #8 (permalink)
Moderator, Analyst, Security Team
 
TheBruce1's Avatar
 
Join Date: Oct 2006
Location: Dłn Čideann,Scotland.
Posts: 5,093
OS: XP


Re: This operation has been cancelled due to restrictions...
Open notepad and copy/paste the text in the quotebox below into it:

Quote:
KillAll::

File::
C:\WINDOWS\pss\autorun.exe
C:\WINDOWS\pss\system.exe
C:\WINDOWS\SYSTEM32\vtr357.dll

Folder::
C:\Program Files\MyWebSearch

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
[-HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^autorun.exe]
[-HKLM\~\startupfolder\C:^Documents and Settings^Bryce^Start Menu^Programs^Startup^system.exe]
Save this as CFscript







Refering to the picture above, drag CFscript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to

======================

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Updating Java:
  • Download the latest version of Java Runtime Environment (JRE) 6u4.
  • Scroll down to where it says "The Java SE Runtime Environment (JRE) allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • In the pull down menu next to Platform select Windows
  • Check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement"
  • Click Continue
  • Click on the link to download Windows Offline Installation and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u4-windowsi586-p.exe to install the newest version.

======================

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

======================
Logs Required
C:\Combofix.txt
Hijackthis log
__________________
Member of ASAP since 2007
Member of UNITE since 2008

**Notice to BT customers**
BT to dump Phorm, see Here for more information. No DPI

If we have helped you in anyway, please consider Donating
Last edited by TheBruce1; 01-14-2008 at 10:23 AM.
TheBruce1 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-16-2008, 09:00 AM   #9 (permalink)
Registered User
 
Join Date: Dec 2007
Posts: 5
OS: xp


Re: This operation has been cancelled due to restrictions...
ComboFix 08-01-09.2 - Kris 2008-01-16 10:37:12.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.141 [GMT -6:00]
Running from: C:\Documents and Settings\Kris\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Kris\Desktop\CFscript.txt
* Created a new restore point

FILE
C:\WINDOWS\pss\autorun.exe
C:\WINDOWS\pss\system.exe
C:\WINDOWS\SYSTEM32\vtr357.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\FunWebProducts
C:\Program Files\FunWebProducts\Shared\Cache\CursorManiaBtn.html
C:\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
C:\Program Files\internet explorer\msimg32.dll
C:\Program Files\MyWebSearch
C:\Program Files\MyWebSearch\bar\1.bin\F3BKGERR.JPG
C:\Program Files\MyWebSearch\bar\1.bin\F3BROVLY.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR
C:\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE
C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3SHLLVW.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3SPACER.WMV
C:\Program Files\MyWebSearch\bar\1.bin\F3WALLPP.DAT
C:\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR
C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST
C:\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3IDLE.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE
C:\Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR
C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST
C:\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE
C:\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE
C:\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE
C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
C:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
C:\Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL
C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\avatar.htm
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\bgfadel.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\bgfader.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\common-x.css
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\common.css
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\cornerbl.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\cornerbr.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\ext_def.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\ext_roll.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\include.js
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\index.htm
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\loader.htm
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\loading.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\logo.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\max_def.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\max_roll.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\min_def.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\min_roll.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\noflash.htm
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\res_def.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\res_roll.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\spacer.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\spacer.swf
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\topgrad.gif
C:\Program Files\MyWebSearch\bar\Avatar\COMMON\window.ico
C:\Program Files\MyWebSearch\bar\Cache\16D3681C
C:\Program Files\MyWebSearch\bar\Cache\16D37163
C:\Program Files\MyWebSearch\bar\Cache\16D37599
C:\Program Files\MyWebSearch\bar\Cache\16D376C2.bin
C:\Program Files\MyWebSearch\bar\Cache\16D37877.bin
C:\Program Files\MyWebSearch\bar\Cache\16D380A5.bin
C:\Program Files\MyWebSearch\bar\Cache\16D3818F.bin
C:\Program Files\MyWebSearch\bar\Cache\16D38E51.bin
C:\Program Files\MyWebSearch\bar\Cache\16D39016.bin
C:\Program Files\MyWebSearch\bar\Cache\files.ini
C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S
C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S
C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S
C:\Program Files\MyWebSearch\bar\History\search2
C:\Program Files\MyWebSearch\bar\icons\CM.ICO
C:\Program Files\MyWebSearch\bar\icons\MFC.ICO
C:\Program Files\MyWebSearch\bar\icons\PSS.ICO
C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO
C:\Program Files\MyWebSearch\bar\icons\WB.ICO
C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO
C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S
C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S
C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S
C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S
C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S
C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S
C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S
C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S
C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S
C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S
C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S
C:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm
C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat
C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
C:\WINDOWS\system32\f3PSSavr.scr

.
((((((((((((((((((((((((( Files Created from 2007-12-17 to 2008-01-17 )))))))))))))))))))))))))))))))
.

2008-01-16 10:35 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-11 15:28 . 2008-01-17 07:04 2,211,360 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.dat
2008-01-11 15:28 . 2008-01-17 07:03 30,644 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.idx
2008-01-11 15:28 . 2008-01-17 07:06 15,904 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox2.dat
2008-01-11 15:28 . 2008-01-17 07:03 2,516 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox2.idx
2008-01-11 15:22 . 2008-01-11 15:22 <DIR> d-------- C:\Program Files\Kaspersky Lab
2008-01-11 15:22 . 2008-01-17 07:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-01-11 15:21 . 2008-01-11 15:21 <DIR> d-------- C:\KAV
2008-01-11 15:05 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\SYSTEM32\javacpl.cpl
2008-01-11 15:04 . 2008-01-11 15:04 <DIR> d-------- C:\Program Files\Common Files\Java
2008-01-04 17:50 . 2008-01-04 17:50 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-29 15:44 . 2007-12-29 15:44 <DIR> d-------- C:\Program Files\Citrix
2007-12-29 15:44 . 2007-12-29 15:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Citrix
2007-12-29 15:43 . 2007-12-29 15:43 60,968 --a------ C:\Documents and Settings\Kris\GoToAssistDownloadHelper.exe
2007-12-28 07:25 . 2007-12-28 07:25 <DIR> d-------- C:\ie-spyad_zo
2007-12-28 07:01 . 2007-12-28 07:07 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-12-28 07:01 . 2005-08-25 18:19 1,066,176 --a------ C:\WINDOWS\SYSTEM32\MSCOMCTL.OCX
2007-12-28 07:01 . 2005-08-25 18:18 118,784 --a------ C:\WINDOWS\SYSTEM32\MSSTDFMT.DLL
2007-12-28 07:01 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\SYSTEM32\MSINET.OCX
2007-12-27 23:07 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\SDTHOOK.SYS
2007-12-27 22:46 . 2007-12-28 01:31 <DIR> d-------- C:\WINDOWS\SYSTEM32\ActiveScan
2007-12-27 22:46 . 2007-12-27 22:46 30,590 --a------ C:\WINDOWS\SYSTEM32\pavas.ico
2007-12-27 22:46 . 2007-12-27 22:46 2,550 --a------ C:\WINDOWS\SYSTEM32\Uninstall.ico
2007-12-27 22:46 . 2007-12-27 22:46 1,406 --a------ C:\WINDOWS\SYSTEM32\Help.ico
2007-12-26 09:13 . 2001-08-17 14:02 9,600 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\hidusb.sys
2007-12-26 09:13 . 2001-08-17 14:02 9,600 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\hidusb.sys
2007-12-21 22:08 . 2007-12-22 13:26 <DIR> d-------- C:\Documents and Settings\Evan\Contacts
2007-12-18 19:16 . 2007-12-28 06:53 <DIR> d-------- C:\Documents and Settings\Jody\Contacts
2007-12-18 19:15 . 2007-12-18 19:15 <DIR> d-------- C:\Documents and Settings\Jody\Application Data\alot
2007-12-17 20:06 . 2007-12-17 20:09 <DIR> d-------- C:\Program Files\America Online 8.0b
2007-12-17 20:06 . 2007-12-17 20:06 <DIR> d-------- C:\Documents and Settings\Kris\Application Data\MX

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-15 01:41 --------- d-----w C:\Program Files\MSN Messenger
2008-01-11 21:05 --------- d-----w C:\Program Files\Java
2008-01-01 18:10 --------- d-----w C:\Program Files\Google
2007-12-28 07:20 --------- d-----w C:\Program Files\Windows Live Toolbar
2007-12-28 07:15 --------- d-----w C:\Program Files\QuickTime
2007-12-28 07:06 --------- d-----w C:\Program Files\DellSupport
2007-12-28 07:06 --------- d-----w C:\Program Files\D-link AirPlus G DWL-G120 Wireless USB
2007-12-28 04:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2007-12-28 03:39 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-28 03:36 --------- d-----w C:\Program Files\THQ
2007-12-18 02:09 --------- d-----w C:\Program Files\Common Files\aolback
2007-12-18 02:09 --------- d-----w C:\Program Files\AOL Companion
2007-12-18 02:08 8,552 ----a-w C:\WINDOWS\system32\drivers\asctrm.sys
2007-12-18 02:08 --------- d-----w C:\Program Files\Common Files\AOL
2007-12-18 02:07 --------- d-----w C:\Program Files\Common Files\aolshare
2007-12-07 22:50 --------- d-----w C:\Documents and Settings\Paige\Application Data\alot
2007-12-06 19:24 --------- d-----w C:\Documents and Settings\Kris\Application Data\alot
2007-12-02 04:06 --------- d-----w C:\Program Files\eMusic Download Manager
2007-12-02 04:06 --------- d-----w C:\Program Files\alot
2007-11-30 09:05 --------- d-----w C:\Program Files\Windows Live Favorites
2007-05-05 02:09 774,144 ----a-w C:\Program Files\RngInterstitial.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8260C2B8-E0D1-448a-B062-33D12D468BF0}]
2007-08-10 15:38 551208 --a------ C:\Program Files\alot\bin\alot.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BA52B914-B692-46C4-B683-905236F6F655}
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}
{8260C2B8-E0D1-448A-B062-33D12D468BF0}

[HKEY_CLASSES_ROOT\clsid\{8260c2b8-e0d1-448a-b062-33d12d468bf0}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 10:24 1694208]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:54 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VSOCheckTask"="c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" [2004-07-01 15:15 139264]
"VirusScan Online"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" [2004-08-17 16:55 180224]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-06-30 13:33 1388544]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\McUpdate.exe" [2004-08-17 18:29 184320]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\McAgent.exe" [2004-08-17 18:26 245760]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-24 02:24 282624]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2007-12-17 20:07 26112]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe" [2007-11-19 14:40 231952]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll 2007-12-29 15:44 10792 C:\Program Files\Citrix\GoToAssist\480\g2awinlogon.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 8.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 8.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 8.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Bryce^Start Menu^Programs^Startup^IMVU.lnk]
path=C:\Documents and Settings\Bryce\Start Menu\Programs\Startup\IMVU.lnk
backup=C:\WINDOWS\pss\IMVU.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
--a------ 2007-03-15 10:09 460784 C:\Program Files\DellSupport\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DSS]
C:\WINDOWS\BBSTORE\DSS\DSSAGENT.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
--a------ 2007-05-17 23:30 1831936 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
--a------ 2005-09-20 09:32 77824 C:\WINDOWS\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
--a------ 2005-09-20 09:36 114688 C:\WINDOWS\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
--a------ 2005-09-20 09:35 94208 C:\WINDOWS\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelMeM]
--a------ 2003-09-03 20:12 221184 C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2006-09-25 13:54 229952 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
--a------ 2004-08-17 18:26 245760 c:\PROGRA~1\mcafee.com\agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
--a------ 2004-08-17 18:29 184320 C:\PROGRA~1\mcafee.com\agent\McUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
--a------ 2005-03-12 06:25 11776 C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
--a------ 2005-03-12 06:25 110592 C:\PROGRA~1\MUSICM~1\MUSICM~3\mm_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe]
--a------ 2004-08-22 15:31 1327104 C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
--------- 2004-04-11 20:15 290816 C:\Program Files\Dell\Media Experience\PCMService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-09-24 02:24 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

S3 GoToAssist;GoToAssist;"C:\Program Files\Citrix\GoToAssist\480\g2aservice.exe" Start=service []

.
Contents of the 'Scheduled Tasks' folder
"2008-01-12 01:51:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-01-17 12:26:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
"2008-01-17 13:04:54 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (BRYCEANDEVAN-Kris).job"
- c:\program files\mcafee.com\vso\mcmnhdlr.exe
"2008-01-17 13:09:00 C:\WINDOWS\Tasks\McAfee.com Update Check (BRYCEANDEVAN-Bryce).job"
- C:\PROGRA~1\mcafee.com\agent\mcupdate.ex
- C:\PROGRA~1\mcafee.com\agent
"2008-01-17 13:11:00 C:\WINDOWS\Tasks\McAfee.com Update Check (BRYCEANDEVAN-Evan).job"
- C:\PROGRA~1\mcafee.com\agent\mcupdate.ex
- C:\PROGRA~1\mcafee.com\agent
"2008-01-17 13:11:00 C:\WINDOWS\Tasks\McAfee.com Update Check (BRYCEANDEVAN-Jody).job"
- C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
- C:\PROGRA~1\mcafee.com\agent
"2008-01-17 13:10:00 C:\WINDOWS\Tasks\McAfee.com Update Check (BRYCEANDEVAN-Kris).job"
- C:\PROGRA~1\mcafee.com\agent\mcupdate.ex
- C:\PROGRA~1\mcafee.com\agent
"2008-01-17 13:10:00 C:\WINDOWS\Tasks\McAfee.com Update Check (BRYCEANDEVAN-Paige).job"
- C:\PROGRA~1\mcafee.com\agent\mcupdate.ex
- C:\PROGRA~1\mcafee.com\agent
"2008-01-17 13:08:00 C:\WINDOWS\Tasks\McAfee.com Update Check (DG3N4761-Owner).job"
- c:\PROGRA~1\mcafee.com\agent\mcupdate.ex
- c:\PROGRA~1\mcafee.com\agent
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-17 07:05:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:55:56 AM, on 1/17/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
c:\program files\mcafee.com\agent\mcagent.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\D-link AirPlus G DWL-G120 Wireless USB\120UTIL.exe
C:\WINDOWS\System32\svchost.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: ALOT eMusic Toolbar - {8260C2B8-E0D1-448a-B062-33D12D468BF0} - C:\Program Files\alot\bin\alot.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: ALOT eMusic Toolbar - {8260C2B8-E0D1-448a-B062-33D12D468BF0} - C:\Program Files\alot\bin\alot.dll
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0b\aoltray.exe
O4 - Global Startup: D-link AirPlus G DWL-G120 Wireless USB.lnk = ?
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...rch.jhtml?p=ZJ
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\AMV Convert Tool 3.70\AMVConverter\grab.html
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?39a8643fe42b4b11931002141737642f
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?39a8643fe42b4b11931002141737642f
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Bryce\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\480\g2aservice.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 7393 bytes

hidden files: 0

**************************************************************************
.
Completion time: 2008-01-17 7:12:05 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-17 13:12:00
ComboFix2.txt 2008-01-10 15:44:56
.
2008-01-10 09:03:24 --- E O F ---
cakes is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-16-2008, 12:35 PM   #10 (permalink)
Moderator, Analyst, Security Team
 
TheBruce1's Avatar
 
Join Date: Oct 2006
Location: Dłn Čideann,Scotland.
Posts: 5,093
OS: XP


Re: This operation has been cancelled due to restrictions...
Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any)

O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...rch.jhtml?p=ZJ


Please remember to close all other windows, including browsers then click Fix checked.

======================

Well done,your logs are clean.

Click start>run>type(or copy/paste command into run box):

ComboFix /u

Click ok.

=======================

Clear IE6 cookies

*Open IE and click Tools
*Click on Internet Options
*Click on General Tab
*Click on Delte Temp Files & Cookies buttons.


Clear IE7 cookies

*On the Internet Explorer 7 Tools menu, click Internet Options. The Internet Options box should open to the General tab.
*On the General tab, in the Browsing History, click the Delete button. This will delete all the files that are currently stored in your cache [that includes cookies too].
*Click OK, and then click OK again.

=========================

MICROSOFT UPDATES

1.Click Start,Run, type sysdm.cpl, and then press OK.
2.Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended).

Microsoft updates are released every second Tuesday of each month,what is called "Patch Tuesday".

------------------------------------------------------------------------------------------

Useful Information and Programs to keep you safe.

TrendProtect is a FREE browser plug-in that helps you avoid Web pages with unwanted content and hidden threats. TrendProtect rates the current page and pages listed in Google, MSN, and Yahoo search results. You can use the rating to decide if you want to visit or avoid a given Web page. To rate Web pages, TrendProtect refers to an extensive database that covers the following information for billions of Web pages:

* Content category
* Phishing scam detection
* Site reputation
* Page reputation

WOT Free helps you avoid disingenuous Internet content by allowing you to learn from others' experiences. WOT shows you website reputations on your browser, telling you how much other users trust a website. This helps you make better decisions while browsing and avoid phishing, malware, and other types of fraud. Reputations can also be added to web search results, Gmail, Wikipedia, and other selected sites.

WOT reputations are computed mainly from user testimonies. Sharing your knowledge with others is just a click away, without ever having to leave the site. We also collect data from hundreds of other sources (including PhishTank) to quickly warn you of emerging threats. Currently, WOT knows over 12 million websites.
Note:Only compatible with Firefox 1.5 and higher.

Only install one of the above

--------------------------------------------------------------------------------------

Alternate Browsers
Try the following free alternate browsers rather than Internet Explorer
Avant
Firefox
Opera
K-Meleon

------------------------------------------------------------------------------------------

Free Antispyware Products
SuperAntiSpyware
AVG Antispyware Free
Ad-Aware
Spybot S&D
Download SpywareBlaster 3.5.1 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items.
Download Spyware Guard to catch and block spyware before it can execute.

------------------------------------------------------------------

IE-Spyad™ is a freeware utility that places more than 4000 dubious websites and domains in the Internet Explorer Restricted List.

Download and installation instructions for IE-Spyad™ Here

-----------------------------------------

The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file.

If your having trouble downloading & extracting,see link below for guidance:
http://www.mvps.org/winhelp2002/hosts2.htm

Once you have extracted the host file,double click on it and a new window will open.

Double-click on mvps.batand follow the prompts

---------------------------------------------------------------

Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here:
Using Winpatrol to protect your computer.

----------------------------------------

SnoopFree is a programme that informs you when another programme is wanting to log your keystrokes or read your screen.Only for XP users.

Update all these programs regularly. Without regular updates you will not be protected when new malicious programs are released.

==============================================

Also, please take a look at these well written articles:

PC Safety and Security--What Do I Need?

HOW DID I GET INFECTED IN THE FIRST PLACE? by Tony Klein
THE ANTI-SPYWARE TUTORIAL
MAKING INTERNET EXPLORER SAFER
Understanding and Using Firewalls

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Please reply to this thread once more,as we may mark this as resolved,thanks.
__________________
Member of ASAP since 2007
Member of UNITE since 2008

**Notice to BT customers**
BT to dump Phorm, see Here for more information. No DPI

If we have helped you in anyway, please consider Donating
TheBruce1 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
 

« Previous Thread | Next Thread »

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off



All times are GMT -7. The time now is 04:17 AM.

Contact Us - Tech Support Forum - Archive - Privacy Statement - Top


Copyright 2001 - 2009, Tech Support Forum
Home Tips Plus | Outdoor Basecamp | Automotive Support Forum

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85