|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
05-11-2008, 07:18 AM
|
#1 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 6
OS: windows xp
|
popups and running slow
my bf always goes to the ps3 forums and the other day when he went there the first thing he saw was a thing saying the site was hacked and since then weve had popups and its just been real slow. ive gone through myself and tried to clean it but its still goin on. any help would be greatly appreciated! thanks
Logfile of HijackThis v1.99.1 Scan saved at 9:16:13 AM, on 5/11/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Chad\Desktop\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [b07ed561] rundll32.exe "C:\WINDOWS\system32\bgbypjgd.dll",b O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll O16 - DPF: KenoPop! by pogo - http://game3.pogo.com/v/8.1.8.21/app...keno-en_US.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1203479944187 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
05-11-2008, 09:57 AM
|
#2 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 6
OS: windows xp
|
Re: popups and running slow
sorry forgot these
Deckard's System Scanner v20071014.68 Run by Chad on 2008-05-11 11:53:09 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 50: 2008-05-11 15:53:16 UTC - RP107 - Deckard's System Scanner Restore Point 49: 2008-05-10 17:14:19 UTC - RP106 - System Checkpoint 48: 2008-05-09 16:04:12 UTC - RP105 - System Checkpoint 47: 2008-05-08 13:52:44 UTC - RP104 - System Checkpoint 46: 2008-05-07 02:54:43 UTC - RP103 - System Checkpoint -- First Restore Point -- 1: 2008-05-04 01:55:00 UTC - RP58 - System Checkpoint Backed up registry hives. Performed disk cleanup. Total Physical Memory: 511 MiB (512 MiB recommended). -- HijackThis (run as Chad.exe) ------------------------------------------------ Unable to find log (file not found); running clone. -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-05-11 11:53:39 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Analog Devices\SoundMAX\SMax4.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\Chad\Desktop\dss.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {7F3EA905-DE65-4D00-BC1F-FF3A77F8CA30} - C:\WINDOWS\system32\wvUnOGwX.dll O2 - BHO: (no name) - {CDC07FFF-CCA7-47F3-87EE-A6225FEC3FE7} - C:\WINDOWS\system32\geBRjHwW.dll O2 - BHO: {b4c72910-2eac-9f8a-b1d4-64c0475cc39d} - {d93cc574-0c46-4d1b-a8f9-cae201927c4b} - C:\WINDOWS\system32\ahskbeyj.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [b07ed561] rundll32.exe "C:\WINDOWS\system32\bgbypjgd.dll",b O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user') O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: KenoPop! by pogo () - http://game3.pogo.com/v/8.1.8.21/app...keno-en_US.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} () - http://fpdownload.macromedia.com/get...irector/sw.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1203479944187 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O20 - Winlogon Notify: wvUnOGwX - C:\WINDOWS\system32\wvUnOGwX.dll O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NBService - Unknown owner - C:\Program Files\Nero\Nero 7\Nero O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 5981 bytes -- HijackThis Fixed Entries (C:\DOCUME~1\Chad\Desktop\HIJACK~1\backups\) ------- backup-20080505-152259-592 O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) backup-20080505-152259-862 O11 - Options group: [INTERNATIONAL] International* backup-20080505-152259-880 O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R2 Sentinel - c:\windows\system32\drivers\sentinel.sys <Not Verified; Rainbow Technologies, Inc.; Sentinel System Driver> R3 Pcouffin (Low level access layer for CD devices) - c:\windows\system32\drivers\pcouffin.sys <Not Verified; VSO Software; Patin couffin engine> S2 DS1410D - c:\windows\system32\drivers\ds1410d.sys (file missing) S3 Sntnlusb (Rainbow USB SuperPro) - c:\windows\system32\drivers\sntnlusb.sys <Not Verified; Rainbow Technologies Inc.; Rainbow Technologies USB Security Device Driver> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 ForceWare Intelligent Application Manager (IAM) - c:\program files\nvidia corporation\networkaccessmanager\bin\nsvcappflt.exe <Not Verified; ; app_filter Module> S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Files created between 2008-04-11 and 2008-05-11 ----------------------------- 2008-05-11 09:43:56 0 d-------- C:\Program Files\Panda Security 2008-05-11 09:24:45 0 d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-05-11 09:24:22 118784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL <Not Verified; Microsoft Corporation; MSSTDFMT Object Library> 2008-05-11 09:24:22 0 d-------- C:\Program Files\SpywareBlaster 2008-05-10 23:11:32 91712 --a------ C:\WINDOWS\system32\bgbypjgd.dll 2008-05-10 23:08:32 102464 --a------ C:\WINDOWS\system32\ahskbeyj.dll 2008-05-10 23:05:32 2112 --a------ C:\WINDOWS\system32\jmfwarxy.exe 2008-05-10 23:02:32 100416 --a------ C:\WINDOWS\system32\vskwqmkk.dll 2008-05-10 22:08:22 2112 --a------ C:\WINDOWS\system32\luupsewc.exe 2008-05-09 22:07:18 2112 --a------ C:\WINDOWS\system32\cxxayorx.exe 2008-05-09 22:04:19 102976 --a------ C:\WINDOWS\system32\hslmskly.dll 2008-05-09 22:01:18 98368 --a------ C:\WINDOWS\system32\qtwyshic.dll 2008-05-08 22:44:25 0 d-------- C:\Documents and Settings\Chad\Application Data\Sudden Games 2008-05-08 22:39:29 0 d-------- C:\Program Files\Yard Sale Junkie 2008-05-08 22:08:36 101440 --a------ C:\WINDOWS\system32\plqthkvg.dll 2008-05-08 22:02:36 2112 --a------ C:\WINDOWS\system32\jyhidxfh.exe 2008-05-08 21:59:41 99904 --a------ C:\WINDOWS\system32\puapvodk.dll 2008-05-07 22:07:40 2112 --a------ C:\WINDOWS\system32\fttkawho.exe 2008-05-07 22:04:40 106560 --a------ C:\WINDOWS\system32\ujpcacqy.dll 2008-05-07 21:58:40 105024 --a------ C:\WINDOWS\system32\rnhurjsy.dll 2008-05-06 22:28:58 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-05-06 22:28:54 0 d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-05-06 22  31 2112 --a------ C:\WINDOWS\system32\hdnxybim.exe2008-05-06 22:00:31 108608 --a------ C:\WINDOWS\system32\msknpedv.dll 2008-05-06 21:57:40 104512 --a------ C:\WINDOWS\system32\avylcfjn.dll 2008-05-05 22:02:52 107584 --a------ C:\WINDOWS\system32\jtowsuaf.dll 2008-05-05 21:57:02 104000 --a------ C:\WINDOWS\system32\qxruupyp.dll 2008-05-05 18:25:06 1160 --a------ C:\WINDOWS\mozver.dat 2008-05-05 08:54:53 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-05-05 07:45:17 107584 --a------ C:\WINDOWS\system32\atudfvtp.dll 2008-05-05 07:22:28 104000 --a------ C:\WINDOWS\system32\sxmhblpd.dll 2008-05-03 21:54:49 1106402 --ahs---- C:\WINDOWS\system32\WwHjRBeg.ini2 2008-05-03 21:54:43 281600 --a------ C:\WINDOWS\system32\geBRjHwW.dll 2008-05-03 21:49:41 45056 --a------ C:\WINDOWS\system32\wvUnOGwX.dll 2008-05-01 19:09:17 0 d-------- C:\Documents and Settings\All Users\Application Data\HipSoft 2008-05-01 19:08:54 0 d-------- C:\Program Files\Buildalot 2 Town Of The Year 2008-04-30 22:30:11 0 d-------- C:\Documents and Settings\All Users\Application Data\Gogii 2008-04-30 22:29:43 0 d-------- C:\Program Files\The Hidden Object Show 2008-04-26 23:24:48 0 dr-h----- C:\Documents and Settings\Chad\Recent 2008-04-26 23:23:59 0 d-------- C:\Documents and Settings\All Users\Application Data\Google 2008-04-26 06:11:23 0 --a------ C:\WINDOWS\nsreg.dat 2008-04-26 06:11:20 0 d-------- C:\Documents and Settings\Chad\Application Data\Mozilla 2008-04-25 14:42:51 0 d-------- C:\Documents and Settings\All Users\Application Data\Fugazo 2008-04-25 14:36:12 0 d-------- C:\Program Files\Cooking Academy 2008-04-23 09:10:57 0 d-------- C:\Documents and Settings\Chad\Application Data\Wildfire 2008-04-23 09:10:50 0 d-------- C:\Program Files\Tumblebugs 2 2008-04-21 22:34:19 0 d-------- C:\Documents and Settings\All Users\Application Data\Astar Games 2008-04-21 22:31:30 0 d-------- C:\Program Files\Ice Cream Mania 2008-04-19 01:13:19 0 d-------- C:\Documents and Settings\Chad\Application Data\Ludia 2008-04-19 01:13:19 0 d-------- C:\Documents and Settings\All Users\Application Data\Ludia 2008-04-14 19:03:44 4096 --a------ C:\WINDOWS\d3dx.dat 2008-04-14 18:59:11 0 d-------- C:\Program Files\Airport Mania 2008-04-13 00:22:28 52736 --a------ C:\WINDOWS\ipuninst.exe <Not Verified; Interplay Productions; Interplay Uninstaller for Windows 95> 2008-04-13 00:21:34 0 d-------- C:\Program Files\BlackIsle 2008-04-12 01:49:36 0 d-------- C:\Program Files\GSP -- Find3M Report --------------------------------------------------------------- 2008-05-05 18:41:00 0 d-------- C:\Documents and Settings\Chad\Application Data\PlayFirst 2008-04-27 18:36:43 0 d-------- C:\Program Files\Fashion Boutique 2008-04-27 14:30:34 0 d-------- C:\Documents and Settings\Chad\Application Data\mIRC 2008-04-22 12:31:25 0 d-------- C:\Program Files\mIRC 2008-04-20 20:23:37 0 d-------- C:\Documents and Settings\Chad\Application Data\Azureus 2008-04-12 01:49:36 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-04-10 21:32:02 0 d-------- C:\Program Files\Burger Shop 2008-04-09 21:52:27 0 d-------- C:\Program Files\Yahtzee Texas Hold Em 2008-04-08 09:04:09 0 d-------- C:\Documents and Settings\Chad\Application Data\Jane s Hotel Family Hero 2008-04-08 09:04:07 0 d-------- C:\Program Files\Janes Hotel Family Hero 2008-04-07 20:13:56 0 d-------- C:\Documents and Settings\Chad\Application Data\fltk.org 2008-04-04 09:07:17 0 d-------- C:\Documents and Settings\Chad\Application Data\Meridian93 2008-03-26 14:59:33 0 d-------- C:\Documents and Settings\Chad\Application Data\AdobeUM 2008-03-23 10:04:28 0 d-------- C:\Documents and Settings\Chad\Application Data\Yahoo! 2008-03-22 21:03:20 0 d-------- C:\Program Files\Azureus 2008-03-22 19:55:39 0 d-------- C:\Documents and Settings\Chad\Application Data\funkitron 2008-03-21 10:33:59 0 d-------- C:\Documents and Settings\Chad\Application Data\WinWay 2008-03-18 17:47:56 0 d-------- C:\Documents and Settings\Chad\Application Data\MSN6 2008-03-17 23:32:21 0 d-------- C:\Program Files\Chuzzle Deluxe 2008-03-16 18:50:13 0 d-------- C:\Program Files\Yahtzee 2008-03-14 13:56:50 370 --a------ C:\WINDOWS\system32\vfw_32.reg 2008-03-14 13:00:47 0 d-------- C:\Program Files\Common Files\Adobe 2008-03-14 13:00:47 0 d-------- C:\Documents and Settings\Chad\Application Data\Adobe 2008-03-14 13:00:45 0 d-------- C:\Program Files\Common Files 2008-03-13 15:20:56 0 d-------- C:\Program Files\Purrfect Pet Shop 2008-03-13 01:25:39 0 d-------- C:\Documents and Settings\Chad\Application Data\Macromedia 2008-02-20 04:25:32 536 --a------ C:\WINDOWS\eReg.dat 2008-02-19 01:44:27 0 -rahs---- C:\MSDOS.SYS 2008-02-19 01:44:27 0 -rahs---- C:\IO.SYS 2008-02-19 01:44:27 0 --a------ C:\CONFIG.SYS 2008-02-19 01:44:27 0 --a------ C:\AUTOEXEC.BAT 2008-02-19 01:41:58 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat 2008-02-18 20:33:57 62 --ahs---- C:\Documents and Settings\Chad\Application Data\desktop.ini -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7F3EA905-DE65-4D00-BC1F-FF3A77F8CA30}] 05/03/2008 09:49 PM 45056 --a------ C:\WINDOWS\system32\wvUnOGwX.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CDC07FFF-CCA7-47F3-87EE-A6225FEC3FE7}] 05/03/2008 09:54 PM 281600 --a------ C:\WINDOWS\system32\geBRjHwW.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d93cc574-0c46-4d1b-a8f9-cae201927c4b}] 05/10/2008 11:08 PM 102464 --a------ C:\WINDOWS\system32\ahskbeyj.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [10/05/2006 09:25 AM] "SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [07/13/2006 09:12 AM] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [12/05/2007 02:41 AM] "NWEReboot"="" [] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [05/05/2008 08:48 AM] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [12/05/2007 02:41 AM] "b07ed561"="C:\WINDOWS\system32\bgbypjgd.dll" [05/10/2008 11:11 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [03/12/2007 03:49 PM] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 01:56 AM] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{7F3EA905-DE65-4D00-BC1F-FF3A77F8CA30}"= C:\WINDOWS\system32\wvUnOGwX.dll [05/03/2008 09:49 PM 45056] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wvUnOGwX] wvUnOGwX.dll 05/03/2008 09:49 PM 45056 C:\WINDOWS\system32\wvUnOGwX.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\geBRjHwW [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] -- End of Deckard's System Scanner: finished at 2008-05-11 11:54:42 ------------ ;*********************************************************************************************************************************************************************************** ANALYSIS: 2008-05-11 11:50:27 PROTECTIONS: 0 MALWARE: 60 SUSPECTS: 0 ;*********************************************************************************************************************************************************************************** PROTECTIONS Description Version Active Updated ;=================================================================================================================================================================================== ;=================================================================================================================================================================================== MALWARE Id Description Type Active Severity Disinfectable Disinfected Location ;=================================================================================================================================================================================== 00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.trafficmp.com/] 00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.trafficmp.com/] 00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.trafficmp.com/] 00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.trafficmp.com/] 00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.trafficmp.com/] 00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@trafficmp[2].txt 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.casalemedia.com/] 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.casalemedia.com/] 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.casalemedia.com/] 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.casalemedia.com/] 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.casalemedia.com/] 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@casalemedia[2].txt 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.casalemedia.com/] 00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.doubleclick.net/] 00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@doubleclick[1].txt 00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.atdmt.com/] 00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@atdmt[2].txt 00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.tradedoubler.com/] 00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@tradedoubler[1].txt 00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.fastclick.net/] 00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.fastclick.net/] 00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.fastclick.net/] 00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@fastclick[2].txt 00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.fastclick.net/] 00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@tribalfusion[2].txt 00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.tribalfusion.com/] 00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.mediaplex.com/] 00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.mediaplex.com/] 00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@mediaplex[1].txt 00147796 Cookie/Entrepreneur TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@entrepreneur[2].txt 00160284 Cookie/Findwhat TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@findwhat[1].txt 00167430 Cookie/myaffiliateprogram TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@www.myaffiliateprogram[1].txt 00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@com[3].txt 00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@com[1].txt 00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@com[2].txt 00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@com[4].txt 00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@xiti[2].txt 00167747 Cookie/Azjmp TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.azjmp.com/] 00167747 Cookie/Azjmp TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.azjmp.com/] 00167747 Cookie/Azjmp TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@azjmp[1].txt 00167747 Cookie/Azjmp TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@azjmp[3].txt 00167749 Cookie/Toplist TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@toplist[1].txt 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@statcounter[1].txt 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.statcounter.com/] 00168048 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@perf.overture[1].txt 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[2].txt 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[1].txt 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[ad.yieldmanager.com/click,AAAAAHkmBACzmQ0Ar3cEAAIAXAAAAP8AAAAGCAIABgP4AgYAa.cDAGWnBgAAAAAAAAAAAAAAAAAAAAAAAAAAAFw3JEgAAAAA,,http%3A%2F%2F85.12.43.83%2Ffls.geo%2Fus_728x90_1.html%3Fa%3Db%26aid%3D202020%26guid%3D91db01d10b1b46c3aad5b16665b69753%26uid%3D0a25aea2197d11ddb5c3202020cfffff%26rid%3Dggthnks%26url%3Dhttp%253a%252f%252fwww.gamepro.com%252fcommunity%252fforums%252findex.cfm%253faction%253dmessagelist%2526cat_id%253d23%2526topi,http://media.adrevolver.com/adrevolver/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[ad.yieldmanager.com/click,AAAAAHkmBACzmQ0Ar3cEAAIAXAAAAP8AAAAGCAIABgP4AgYAa.cDAGWnBgAAAAAAAAAAAAAAAAAAAAAAAAAAAFw3JEgAAAAA,,http%3A%2F%2F85.12.43.83%2Ffls.geo%2Fus_728x90_1.html%3Fa%3Db%26aid%3D202020%26guid%3D91db01d10b1b46c3aad5b16665b69753%26uid%3D0a25aea2197d11ddb5c3202020cfffff%26rid%3Dggthnks%26url%3Dhttp%253a%252f%252fwww.gamepro.com%252fcommunity%252fforums%252findex.cfm%253faction%253dmessagelist%2526cat_id%253d23%2526topi,http://media.adrevolver.com/adrevolver/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[ad.yieldmanager.com/click,AAAAAHkmBACMmA0Ar3cEAAIAdAAAAP8AAAAGCAIABgP4AgYAa.cDAGWnBgAAAAAAAAAAAAAAAAAAAAAAAAAAAKc4JEgAAAAA,,http%3A%2F%2F85.12.43.83%2Ffls.geo%2Fus_728x90_8.html%3Fa%3Db%26aid%3D202020%26guid%3D91db01d10b1b46c3aad5b16665b69753%26uid%3D0a25aea2197d11ddb5c3202020cfffff%26rid%3Dggthnks%26url%3Dhttp%253a%252f%252fpagead2.googlesyndication.com%252fpagead%252fads%253fclient%253dca-pub-0263065466324266%2526dt%253d12103,http://media.adrevolver.com/adrevolver/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[ad.yieldmanager.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[ad.yieldmanager.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[ad.yieldmanager.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[ad.yieldmanager.com/click,AAAAAHkmBACMmA0Ar3cEAAIAdAAAAP8AAAAGCAIABgP4AgYAa.cDAGWnBgAAAAAAAAAAAAAAAAAAAAAAAAAAAKc4JEgAAAAA,,http%3A%2F%2F85.12.43.83%2Ffls.geo%2Fus_728x90_8.html%3Fa%3Db%26aid%3D202020%26guid%3D91db01d10b1b46c3aad5b16665b69753%26uid%3D0a25aea2197d11ddb5c3202020cfffff%26rid%3Dggthnks%26url%3Dhttp%253a%252f%252fpagead2.googlesyndication.com%252fpagead%252fads%253fclient%253dca-pub-0263065466324266%2526dt%253d12103,http://media.adrevolver.com/adrevolver/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[ad.yieldmanager.com/click,AAAAAHkmBACMmA0Ar3cEAAIAdAAAAP8AAAAGCAIABgP4AgYAa.cDAGWnBgAAAAAAAAAAAAAAAAAAAAAAAAAAAKc4JEgAAAAA,,http%3A%2F%2F85.12.43.83%2Ffls.geo%2Fus_728x90_8.html%3Fa%3Db%26aid%3D202020%26guid%3D91db01d10b1b46c3aad5b16665b69753%26uid%3D0a25aea2197d11ddb5c3202020cfffff%26rid%3Dggthnks%26url%3Dhttp%253a%252f%252fpagead2.googlesyndication.com%252fpagead%252fads%253fclient%253dca-pub-0263065466324266%2526dt%253d12103,http://media.adrevolver.com/adrevolver/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[ad.yieldmanager.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[ad.yieldmanager.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[ad.yieldmanager.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[ad.yieldmanager.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[ad.yieldmanager.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[ad.yieldmanager.com/click,AAAAAHkmBACzmQ0Ar3cEAAIAXAAAAP8AAAAGCAIABgP4AgYAa.cDAGWnBgAAAAAAAAAAAAAAAAAAAAAAAAAAAFw3JEgAAAAA,,http%3A%2F%2F85.12.43.83%2Ffls.geo%2Fus_728x90_1.html%3Fa%3Db%26aid%3D202020%26guid%3D91db01d10b1b46c3aad5b16665b69753%26uid%3D0a25aea2197d11ddb5c3202020cfffff%26rid%3Dggthnks%26url%3Dhttp%253a%252f%252fwww.gamepro.com%252fcommunity%252fforums%252findex.cfm%253faction%253dmessagelist%2526cat_id%253d23%2526topi,http://media.adrevolver.com/adrevolver/] 00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@apmebf[1].txt 00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.apmebf.com/] 00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@apmebf[2].txt 00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@apmebf[3].txt 00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@apmebf[5].txt 00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.burstnet.com/] 00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.burstnet.com/] 00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@burstnet[2].txt 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.serving-sys.com/] 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.serving-sys.com/] 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.serving-sys.com/] 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.serving-sys.com/] 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.serving-sys.com/] 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.serving-sys.com/] 00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.bs.serving-sys.com/] 00168097 Cookie/BurstBeacon TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[www.burstbeacon.com/] 00168097 Cookie/BurstBeacon TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@www.burstbeacon[2].txt 00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[server.iad.liveperson.net/] 00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[server.iad.liveperson.net/] 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.advertising.com/] 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.advertising.com/] 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.advertising.com/] 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@advertising[1].txt 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.advertising.com/] 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.advertising.com/] 00169287 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@media.adrevolver[7].txt 00169287 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@media.adrevolver[1].txt 00169287 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@media.adrevolver[3].txt 00169287 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@media.adrevolver[5].txt 00170304 Cookie/WebtrendsLive TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[statse.webtrendslive.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.ads.pointroll.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.ads.pointroll.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.ads.pointroll.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.ads.pointroll.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.ads.pointroll.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.ads.pointroll.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.ads.pointroll.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.ads.pointroll.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@ads.pointroll[1].txt 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.ads.pointroll.com/] 00170550 Cookie/Humanclick TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@hc2.humanclick[2].txt 00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@overture[2].txt 00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.overture.com/] 00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@realmedia[2].txt 00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.realmedia.com/] 00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.realmedia.com/] 00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.realmedia.com/] 00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.realmedia.com/] 00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.realmedia.com/] 00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@questionmarket[2].txt 00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.questionmarket.com/] 00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.questionmarket.com/] 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.zedo.com/] 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.zedo.com/] 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.zedo.com/] 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@zedo[1].txt 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.zedo.com/] 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.zedo.com/] 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.zedo.com/] 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.zedo.com/] 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.zedo.com/] 00173520 Cookie/Bluestreak TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@bluestreak[2].txt 00173520 Cookie/Bluestreak TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.bluestreak.com/] 00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.adrevolver.com/] 00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.adrevolver.com/] 00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.adrevolver.com/] 00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.adrevolver.com/] 00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@adrevolver[2].txt 00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.adultfriendfinder.com/] 00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.adultfriendfinder.com/] 00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@adultfriendfinder[4].txt 00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@adultfriendfinder[1].txt 00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@adultfriendfinder[3].txt 00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.adultfriendfinder.com/] 00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@target[2].txt 00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@target[3].txt 00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@target[5].txt 00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@target[1].txt 00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.atwola.com/] 00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@atwola[2].txt 00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@atwola[3].txt 00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@atwola[1].txt 00286738 Cookie/Cgi-bin TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@www1.addfreestats[1].txt 00293517 Cookie/AdDynamix TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@ads.addynamix[1].txt 00293517 Cookie/AdDynamix TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.ads.addynamix.com/] 00382737 HackTool/Zapgon.A HackTools No 0 No No D:\Programs\mIRC6.12Invision2.0.rar[mIRC6.12Invision2.0\Invision\Stdio.dll] 00431644 Trj/Agent.DIL Virus/Trojan No 0 Yes No F:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP65\A0012948.exe 01185375 Application/Psexec.A HackTools No 0 Yes No F:\System Volume Information\_restore{1BCD3441-2466-4383-840E-D92E22F5ECDA}\RP131\A0135148.EXE 01196325 Cookie/Enhance TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@enhance[1].txt 01262593 Application/NirCmd.A HackTools No 0 Yes No F:\System Volume Information\_restore{1BCD3441-2466-4383-840E-D92E22F5ECDA}\RP132\A0135368.com 01262593 Application/NirCmd.A HackTools No 0 No No F:\System Volume Information\_restore{1BCD3441-2466-4383-840E-D92E22F5ECDA}\RP132\A0135343.exe[327882R2FWJFW\nircmd.cfexe] 01262593 Application/NirCmd.A HackTools No 0 No No F:\System Volume Information\_restore{1BCD3441-2466-4383-840E-D92E22F5ECDA}\RP132\A0135343.exe[327882R2FWJFW\nircmd.com] 01262593 Application/NirCmd.A HackTools No 0 Yes No F:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP65\A0010020.exe 01308048 Adware/TTC Adware No 0 Yes No F:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP65\A0013731.exe 01308049 Adware/TTC Adware No 0 No No F:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP65\A0013731.exe[TTC.dll] 01606636 Cookie/Adserver TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@adserver.easyad[1].txt 01606636 Cookie/Adserver TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.adserver.easyad.info/] 01658945 Adware/TTC Adware No 0 No No F:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP65\A0013731.exe[folder.js] 02688464 Adware/DnsInsider Adware No 0 Yes No F:\System Volume Information\_restore{1BCD3441-2466-4383-840E-D92E22F5ECDA}\RP103\A0096109.exe 02887528 Cookie/AdvancedCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[advancedcleaner.com/] 02887528 Cookie/AdvancedCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[advancedcleaner.com/] 02887528 Cookie/AdvancedCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.advancedcleaner.com/] 02887528 Cookie/AdvancedCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.advancedcleaner.com/] 02887528 Cookie/AdvancedCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.advancedcleaner.com/] 02887528 Cookie/AdvancedCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.advancedcleaner.com/] 02887528 Cookie/AdvancedCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.advancedcleaner.com/] 02887528 Cookie/AdvancedCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt[.advancedcleaner.com/] 02887528 Cookie/AdvancedCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@advancedcleaner[2].txt 02887528 Cookie/AdvancedCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\Chad\Cookies\chad@advancedcleaner[1].txt 02937437 Spyware/Virtumonde Spyware Yes 2 Yes No C:\WINDOWS\SYSTEM32\WVUNOGWX.DLL 02938505 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\atudfvtp.dll 02938505 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\jtowsuaf.dll 02938511 Trj/Proxy.BF Virus/Trojan No 1 Yes No C:\WINDOWS\system32\avylcfjn.dll 02938531 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\sxmhblpd.dll 02938531 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\qxruupyp.dll 02938570 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\rnhurjsy.dll 02938581 Spyware/Virtumonde Spyware No 1 Yes No C:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP103\A0022106.dll 02940808 Spyware/Virtumonde Spyware No 1 Yes No C:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP104\A0022137.dll 02940861 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\ujpcacqy.dll 02940899 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\msknpedv.dll ;=================================================================================================================================================================================== SUSPECTS Sent Location ;=================================================================================================================================================================================== ;=================================================================================================================================================================================== VULNERABILITIES Id Severity Description ;=================================================================================================================================================================================== 170904 HIGH MS07-043 ;=================================================================================================================================================================================== |
|
|
|
|
05-14-2008, 04:28 AM
|
#3 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: popups and running slow
Hello and welcome to TSF.
Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. ======== Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear, a lack of symptoms does not mean that it is no longer present. Please Do Not Attach logs to your posts unless you are advised to do so. ========= Please print out or copy this page to Notepad in order to assist you when carrying out the following instructions. ========= Download SDFix and save it to your Desktop. Double click SDFix.exe and it will extract the files to %systemdrive% (Drive that contains the Windows Directory, typically C:SDFix) Please then reboot your computer in Safe Mode by doing the following :
======== Please visit this webpage for instructions for downloading and running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery mode. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. Once the Recovery Console is installed using ComboFix, you should see a message that says: The Recovery Console was successfully installed.  Please continue as follows: Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Click Yes to allow ComboFix to continue scanning for malware. When the tool is finished, it will produce a report for you. ======== Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ======== Logs Required Report.txt C:\Combofix.txt Hijackthis Log Also, why is there no antivirus installed? |
|
|
|
|
05-14-2008, 07:00 PM
|
#4 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 6
OS: windows xp
|
Re: popups and running slow
i didnt realize that the avg didnt protect against other stuff i thought it did it all :/
heres the logs SDFix: Version 1.182 Run by Administrator on Wed 05/14/2008 at 04:07 PM Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Checking Services : Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting Checking Files : No Trojan Files Found Removing Temp Files ADS Check : Final Check : catchme 0.3.1359.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-14 16:14:33 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a347scsi\Config\jdgg40] scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}] "DisplayName"="Alcohol 120%" scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Azureus\\Azureus.exe"="C:\\Program Files\\Azureus\\Azureus.exe:*:Enabled:Azureus" "C:\\Program Files\\mIRC\\mirc.exe"="C:\\Program Files\\mIRC\\mirc.exe:*:Enabled:mIRC" "C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"="C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe:*:Enabled:MySpaceIM" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" Remaining Files : File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes : Thu 21 Feb 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp" Finished! ComboFix 08-05-12.1 - Chad 2008-05-14 20:45:57.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.207 [GMT -4:00] Running from: C:\Documents and Settings\Chad\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Chad\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\cookies.ini C:\WINDOWS\pskt.ini C:\WINDOWS\system32\acfuuhkx.ini C:\WINDOWS\system32\adllhcip.ini C:\WINDOWS\system32\ahskbeyj.dll C:\WINDOWS\system32\aqbqscoh.ini C:\WINDOWS\system32\atudfvtp.dll C:\WINDOWS\system32\avylcfjn.dll C:\WINDOWS\system32\bqrlmamx.dll C:\WINDOWS\system32\bxoiveim.ini C:\WINDOWS\system32\dgjpybgb.ini C:\WINDOWS\system32\ehbkrrnn.ini C:\WINDOWS\system32\gdeowptj.dll C:\WINDOWS\system32\geBRjHwW.dll C:\WINDOWS\system32\heekscgj.dll C:\WINDOWS\system32\hidgsfqo.dll C:\WINDOWS\system32\hslmskly.dll C:\WINDOWS\system32\icdnaajt.dll C:\WINDOWS\system32\jnkfalmr.dll C:\WINDOWS\system32\jtowsuaf.dll C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\mpslpqvu.ini C:\WINDOWS\system32\msknpedv.dll C:\WINDOWS\system32\plqthkvg.dll C:\WINDOWS\system32\puapvodk.dll C:\WINDOWS\system32\qtwyshic.dll C:\WINDOWS\system32\qxruupyp.dll C:\WINDOWS\system32\rmlafknj.ini C:\WINDOWS\system32\rnhurjsy.dll C:\WINDOWS\system32\sxmhblpd.dll C:\WINDOWS\system32\tckclmkk.ini C:\WINDOWS\system32\ujpcacqy.dll C:\WINDOWS\system32\vjxpfocn.dll C:\WINDOWS\system32\vskwqmkk.dll C:\WINDOWS\system32\wikyutvv.ini C:\WINDOWS\system32\wvUnOGwX.dll C:\WINDOWS\system32\WwHjRBeg.ini C:\WINDOWS\system32\WwHjRBeg.ini2 C:\WINDOWS\system32\wyibdbws.ini . ((((((((((((((((((((((((( Files Created from 2008-04-15 to 2008-05-15 ))))))))))))))))))))))))))))))) . 2008-05-14 20:44 . 2008-05-14 20:44 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG 2008-05-14 16:03 . 2008-05-14 16:03 <DIR> d-------- C:\WINDOWS\ERUNT 2008-05-14 16:02 . 2008-05-14 16:02 <DIR> d-------- C:\Documents and Settings\Administrator 2008-05-14 16:02 . 2008-05-14 20:44 1,024 --ah----- C:\Documents and Settings\Administrator\NtUser.dat.LOG 2008-05-14 15:04 . 2008-05-14 16:16 <DIR> d-------- C:\SDFix 2008-05-13 23:07 . 2008-05-13 23:07 2,112 --a------ C:\WINDOWS\system32\gvnysygp.exe 2008-05-12 23:10 . 2008-05-12 23:10 2,112 --a------ C:\WINDOWS\system32\yykmjepo.exe 2008-05-12 23:02 . 2008-05-12 23:02 <DIR> d-------- C:\Documents and Settings\Chad\Application Data\My Games 2008-05-12 23:01 . 2008-05-14 00:08 <DIR> d-------- C:\Program Files\Posh Boutique 2008-05-11 23:06 . 2008-05-11 23:06 2,112 --a------ C:\WINDOWS\system32\pxbqntcm.exe 2008-05-11 11:53 . 2008-05-11 11:53 <DIR> d-------- C:\Deckard 2008-05-11 09:43 . 2008-05-11 09:44 <DIR> d-------- C:\Program Files\Panda Security 2008-05-11 09:24 . 2008-05-11 09:25 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-05-11 09:24 . 2008-05-11 09:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-05-11 09:24 . 2005-08-25 18:18 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL 2008-05-11 09:24 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX 2008-05-10 23:05 . 2008-05-10 23:05 2,112 --a------ C:\WINDOWS\system32\jmfwarxy.exe 2008-05-10 22:08 . 2008-05-10 22:08 2,112 --a------ C:\WINDOWS\system32\luupsewc.exe 2008-05-09 22:07 . 2008-05-09 22:07 2,112 --a------ C:\WINDOWS\system32\cxxayorx.exe 2008-05-08 22:44 . 2008-05-08 22:44 <DIR> d-------- C:\Documents and Settings\Chad\Application Data\Sudden Games 2008-05-08 22:39 . 2008-05-08 23:15 <DIR> d-------- C:\Program Files\Yard Sale Junkie 2008-05-08 22:02 . 2008-05-08 22:02 2,112 --a------ C:\WINDOWS\system32\jyhidxfh.exe 2008-05-07 22:07 . 2008-05-07 22:07 2,112 --a------ C:\WINDOWS\system32\fttkawho.exe 2008-05-06 22:28 . 2008-05-06 22:28 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-05-06 22:28 . 2008-05-06 22:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-05-06 22:06 . 2008-05-06 22:06 2,112 --a------ C:\WINDOWS\system32\hdnxybim.exe 2008-05-05 18:25 . 2008-05-05 18:25 1,160 --a------ C:\WINDOWS\mozver.dat 2008-05-05 08:54 . 2008-05-05 08:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-05-05 08:48 . 2006-09-05 12:03 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2008-05-05 07:22 . 2008-05-14 18:48 109,778 --a------ C:\WINDOWS\BMb34de6fd.xml 2008-05-01 19:09 . 2008-05-01 19:09 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\HipSoft 2008-05-01 19:08 . 2008-05-02 09:11 <DIR> d-------- C:\Program Files\Buildalot 2 Town Of The Year 2008-04-30 22:30 . 2008-04-30 22:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Gogii 2008-04-30 22:29 . 2008-05-14 00:23 <DIR> d-------- C:\Program Files\The Hidden Object Show 2008-04-26 06:11 . 2008-04-26 06:11 0 --a------ C:\WINDOWS\nsreg.dat 2008-04-25 14:42 . 2008-04-25 14:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Fugazo 2008-04-25 14:36 . 2008-05-04 12:44 <DIR> d-------- C:\Program Files\Cooking Academy 2008-04-23 09:10 . 2008-05-12 00:11 <DIR> d-------- C:\Program Files\Tumblebugs 2 2008-04-23 09:10 . 2008-04-23 09:11 <DIR> d-------- C:\Documents and Settings\Chad\Application Data\Wildfire 2008-04-21 22:34 . 2008-04-21 22:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Astar Games 2008-04-21 22:31 . 2008-04-22 09:15 <DIR> d-------- C:\Program Files\Ice Cream Mania 2008-04-19 01:13 . 2008-04-19 01:13 <DIR> d-------- C:\Documents and Settings\Chad\Application Data\Ludia 2008-04-19 01:13 . 2008-04-19 01:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Ludia . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-14 18:48 --------- d-----w C:\Program Files\Fashion Boutique 2008-05-13 13:14 --------- d-----w C:\Program Files\mIRC 2008-05-13 13:14 --------- d-----w C:\Documents and Settings\Chad\Application Data\mIRC 2008-05-12 04:12 --------- d-----w C:\Program Files\Yahtzee Texas Hold Em 2008-05-05 22:41 --------- d-----w C:\Documents and Settings\Chad\Application Data\PlayFirst 2008-05-05 22:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\PlayFirst 2008-04-24 21:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\eGames 2008-04-21 00:23 --------- d-----w C:\Documents and Settings\Chad\Application Data\Azureus 2008-04-15 00:02 --------- d-----w C:\Program Files\Airport Mania 2008-04-13 04:22 52,736 ----a-w C:\WINDOWS\ipuninst.exe 2008-04-13 04:21 --------- d-----w C:\Program Files\BlackIsle 2008-04-12 05:49 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-04-12 05:49 --------- d-----w C:\Program Files\GSP 2008-04-11 01:32 --------- d-----w C:\Program Files\Burger Shop 2008-04-08 13:04 --------- d-----w C:\Program Files\Janes Hotel Family Hero 2008-04-08 13:04 --------- d-----w C:\Documents and Settings\Chad\Application Data\Jane s Hotel Family Hero 2008-04-08 00:13 --------- d-----w C:\Documents and Settings\Chad\Application Data\fltk.org 2008-04-04 13:07 --------- d-----w C:\Documents and Settings\Chad\Application Data\Meridian93 2008-03-26 18:59 --------- d-----w C:\Documents and Settings\Chad\Application Data\AdobeUM 2008-03-23 14:04 --------- d-----w C:\Documents and Settings\Chad\Application Data\Yahoo! 2008-03-23 14:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion 2008-03-23 01:03 --------- d-----w C:\Program Files\Azureus 2008-03-22 23:55 --------- d-----w C:\Documents and Settings\Chad\Application Data\funkitron 2008-03-21 14:33 --------- d-----w C:\Documents and Settings\Chad\Application Data\WinWay 2008-03-20 05:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Fashion Solitaire 1.2 2008-03-18 21:47 --------- d-----w C:\Documents and Settings\Chad\Application Data\MSN6 2008-03-18 21:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\MSN6 2008-03-18 03:32 --------- d-----w C:\Program Files\Chuzzle Deluxe 2008-03-17 04:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Zylom 2008-03-16 22:50 --------- d-----w C:\Program Files\Yahtzee 2008-03-16 13:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7 . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 15:49 153136] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-10-05 09:25 868352] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 02:41 81920] "NWEReboot"="" [] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2008-05-05 08:48 6731312] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2008-02-01 16:32 8699904] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.3IV2"= 3ivxVfWCodec.dll "SENTINEL"= snti386.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\mIRC\\mirc.exe"= "C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "57902:TCP"= 57902:TCP:azureus R0 Pnp680;SiI 680 ATA Controller;C:\WINDOWS\system32\DRIVERS\pnp680.sys [2007-06-28 18:01] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-14 20:51:05 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe . ************************************************************************** . Completion time: 2008-05-14 20:55:49 - machine was rebooted ComboFix-quarantined-files.txt 2008-05-15 00:55:47 Pre-Run: 4,725,153,792 bytes free Post-Run: 4,638,785,536 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons 198 Logfile of HijackThis v1.99.1 Scan saved at 8:59:36 PM, on 5/14/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\Chad\Desktop\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll O16 - DPF: KenoPop! by pogo - http://game3.pogo.com/v/8.1.8.21/app...keno-en_US.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - http://lads.myspace.com/upload/MySpaceUploader1006.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1203479944187 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe when i went in my hijack folder it had the hijack icon but said chad.exe and the normal hijack thing. whats that? |
|
|
|
|
05-15-2008, 04:16 AM
|
#5 (permalink) | |||
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: popups and running slow
Hello again Jenny
Quote:
The new version of AVG(AVG8)incorporates anti virus and anti spyware into one programe. We will install an antivirus programme later. ========== Open notepad and copy/paste the text in the quotebox below into it: Quote:
 Refering to the picture above, drag CFscript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ============= Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component.
========= Quote:
Next, download HijackThis to your desktop Alternate link Double-click on the file you just downloaded. Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis Upon install, HijackThis should open for you. Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe If it gives you an intro screen, just choose 'Do a system scan and save a logfile ========= Logs Required C:\Combofix.txt Kaspersky Scan Log Hijackthis Log Last edited by TheBruce1; 05-15-2008 at 04:18 AM. |
|||
|
|
|
|
05-15-2008, 06:24 AM
|
#6 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 6
OS: windows xp
|
Re: popups and running slow
ComboFix 08-05-12.1 - Chad 2008-05-15 6:33:16.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.245 [GMT -4:00] Running from: C:\Documents and Settings\Chad\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Chad\Desktop\CFscript.txt * Created a new restore point FILE :: C:\WINDOWS\BMb34de6fd.xml C:\WINDOWS\system32\cxxayorx.exe C:\WINDOWS\system32\fttkawho.exe C:\WINDOWS\system32\gvnysygp.exe C:\WINDOWS\system32\hdnxybim.exe C:\WINDOWS\system32\jmfwarxy.exe C:\WINDOWS\system32\jyhidxfh.exe C:\WINDOWS\system32\luupsewc.exe C:\WINDOWS\system32\pxbqntcm.exe C:\WINDOWS\system32\yykmjepo.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Chad\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML C:\WINDOWS\BMb34de6fd.xml C:\WINDOWS\system32\cxxayorx.exe C:\WINDOWS\system32\fttkawho.exe C:\WINDOWS\system32\gvnysygp.exe C:\WINDOWS\system32\hdnxybim.exe C:\WINDOWS\system32\jmfwarxy.exe C:\WINDOWS\system32\jyhidxfh.exe C:\WINDOWS\system32\luupsewc.exe C:\WINDOWS\system32\pxbqntcm.exe C:\WINDOWS\system32\yykmjepo.exe . ((((((((((((((((((((((((( Files Created from 2008-04-15 to 2008-05-15 ))))))))))))))))))))))))))))))) . 2008-05-14 20:44 . 2008-05-14 20:44 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG 2008-05-14 16:03 . 2008-05-14 16:03 <DIR> d-------- C:\WINDOWS\ERUNT 2008-05-14 16:02 . 2008-05-14 16:02 <DIR> d-------- C:\Documents and Settings\Administrator 2008-05-14 16:02 . 2008-05-14 20:44 1,024 --ah----- C:\Documents and Settings\Administrator\NtUser.dat.LOG 2008-05-14 15:04 . 2008-05-14 16:16 <DIR> d-------- C:\SDFix 2008-05-12 23:02 . 2008-05-12 23:02 <DIR> d-------- C:\Documents and Settings\Chad\Application Data\My Games 2008-05-12 23:01 . 2008-05-14 00:08 <DIR> d-------- C:\Program Files\Posh Boutique 2008-05-11 11:53 . 2008-05-11 11:53 <DIR> d-------- C:\Deckard 2008-05-11 09:43 . 2008-05-11 09:44 <DIR> d-------- C:\Program Files\Panda Security 2008-05-11 09:24 . 2008-05-11 09:25 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-05-11 09:24 . 2008-05-14 23:01 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-05-11 09:24 . 2005-08-25 18:18 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL 2008-05-11 09:24 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX 2008-05-08 22:44 . 2008-05-08 22:44 <DIR> d-------- C:\Documents and Settings\Chad\Application Data\Sudden Games 2008-05-08 22:39 . 2008-05-08 23:15 <DIR> d-------- C:\Program Files\Yard Sale Junkie 2008-05-06 22:28 . 2008-05-06 22:28 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-05-06 22:28 . 2008-05-06 22:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-05-05 18:25 . 2008-05-05 18:25 1,160 --a------ C:\WINDOWS\mozver.dat 2008-05-05 08:54 . 2008-05-05 08:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-05-05 08:48 . 2006-09-05 12:03 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2008-05-01 19:09 . 2008-05-01 19:09 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\HipSoft 2008-05-01 19:08 . 2008-05-02 09:11 <DIR> d-------- C:\Program Files\Buildalot 2 Town Of The Year 2008-04-30 22:30 . 2008-04-30 22:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Gogii 2008-04-30 22:29 . 2008-05-14 00:23 <DIR> d-------- C:\Program Files\The Hidden Object Show 2008-04-26 06:11 . 2008-04-26 06:11 0 --a------ C:\WINDOWS\nsreg.dat 2008-04-25 14:42 . 2008-04-25 14:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Fugazo 2008-04-25 14:36 . 2008-05-04 12:44 <DIR> d-------- C:\Program Files\Cooking Academy 2008-04-23 09:10 . 2008-05-12 00:11 <DIR> d-------- C:\Program Files\Tumblebugs 2 2008-04-23 09:10 . 2008-04-23 09:11 <DIR> d-------- C:\Documents and Settings\Chad\Application Data\Wildfire 2008-04-21 22:34 . 2008-04-21 22:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Astar Games 2008-04-21 22:31 . 2008-04-22 09:15 <DIR> d-------- C:\Program Files\Ice Cream Mania 2008-04-19 01:13 . 2008-04-19 01:13 <DIR> d-------- C:\Documents and Settings\Chad\Application Data\Ludia 2008-04-19 01:13 . 2008-04-19 01:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Ludia . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-14 18:48 --------- d-----w C:\Program Files\Fashion Boutique 2008-05-13 13:14 --------- d-----w C:\Program Files\mIRC 2008-05-13 13:14 --------- d-----w C:\Documents and Settings\Chad\Application Data\mIRC 2008-05-12 04:12 --------- d-----w C:\Program Files\Yahtzee Texas Hold Em 2008-05-05 22:41 --------- d-----w C:\Documents and Settings\Chad\Application Data\PlayFirst 2008-05-05 22:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\PlayFirst 2008-04-24 21:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\eGames 2008-04-21 00:23 --------- d-----w C:\Documents and Settings\Chad\Application Data\Azureus 2008-04-15 00:02 --------- d-----w C:\Program Files\Airport Mania 2008-04-13 04:22 52,736 ----a-w C:\WINDOWS\ipuninst.exe 2008-04-13 04:21 --------- d-----w C:\Program Files\BlackIsle 2008-04-12 05:49 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-04-12 05:49 --------- d-----w C:\Program Files\GSP 2008-04-11 01:32 --------- d-----w C:\Program Files\Burger Shop 2008-04-08 13:04 --------- d-----w C:\Program Files\Janes Hotel Family Hero 2008-04-08 13:04 --------- d-----w C:\Documents and Settings\Chad\Application Data\Jane s Hotel Family Hero 2008-04-08 00:13 --------- d-----w C:\Documents and Settings\Chad\Application Data\fltk.org 2008-04-04 13:07 --------- d-----w C:\Documents and Settings\Chad\Application Data\Meridian93 2008-03-26 18:59 --------- d-----w C:\Documents and Settings\Chad\Application Data\AdobeUM 2008-03-23 14:04 --------- d-----w C:\Documents and Settings\Chad\Application Data\Yahoo! 2008-03-23 14:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion 2008-03-23 01:03 --------- d-----w C:\Program Files\Azureus 2008-03-22 23:55 --------- d-----w C:\Documents and Settings\Chad\Application Data\funkitron 2008-03-21 14:33 --------- d-----w C:\Documents and Settings\Chad\Application Data\WinWay 2008-03-20 05:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Fashion Solitaire 1.2 2008-03-18 21:47 --------- d-----w C:\Documents and Settings\Chad\Application Data\MSN6 2008-03-18 21:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\MSN6 2008-03-18 03:32 --------- d-----w C:\Program Files\Chuzzle Deluxe 2008-03-17 04:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Zylom 2008-03-16 22:50 --------- d-----w C:\Program Files\Yahtzee 2008-03-16 13:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7 2008-02-21 21:58 2,416,141 ----a-w C:\WINDOWS\java\Packages\M2XVXNZN.ZIP 2008-02-20 03:57 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll 2008-02-19 05:44 558,142 ----a-w C:\WINDOWS\java\Packages\R3PBBVL7.ZIP 2008-02-19 05:44 155,995 ----a-w C:\WINDOWS\java\Packages\FVVX3X73.ZIP . ((((((((((((((((((((((((((((( snapshot@2008-05-14_20.55.38.45 ))))))))))))))))))))))))))))))))))))))))) . - 2008-05-15 00:50:37 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-05-15 10:18:59 2,048 --s-a-w C:\WINDOWS\bootstat.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 15:49 153136] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-10-05 09:25 868352] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 02:41 81920] "NWEReboot"="" [] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2008-05-05 08:48 6731312] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2008-02-01 16:32 8699904] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.3IV2"= 3ivxVfWCodec.dll "SENTINEL"= snti386.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\mIRC\\mirc.exe"= "C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "57902:TCP"= 57902:TCP:azureus R0 Pnp680;SiI 680 ATA Controller;C:\WINDOWS\system32\DRIVERS\pnp680.sys [2007-06-28 18:01] *Newly Created Service* - CATCHME . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-15 06:34:48 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-05-15 6:36:12 ComboFix-quarantined-files.txt 2008-05-15 10:36:07 ComboFix2.txt 2008-05-15 00:55:50 Pre-Run: 4,619,579,392 bytes free Post-Run: 4,607,029,248 bytes free 161 ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Thursday, May 15, 2008 8:22:02 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 15/05/2008 Kaspersky Anti-Virus database records: 774978 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ H:\ Scan Statistics: Total number of scanned objects: 108254 Number of viruses found: 16 Number of infected objects: 87 Number of suspicious objects: 0 Duration of the scan process: 00:54:38 Infected Object Name / Virus Name / Last Action C:\Deckard\System Scanner\backup\DOCUME~1\Chad\LOCALS~1\Temp\mirc631.exe/stream/data0014 Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped C:\Deckard\System Scanner\backup\DOCUME~1\Chad\LOCALS~1\Temp\mirc631.exe/stream Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped C:\Deckard\System Scanner\backup\DOCUME~1\Chad\LOCALS~1\Temp\mirc631.exe NSIS: infected - 2 skipped C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\key3.db Object is locked skipped C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\parent.lock Object is locked skipped C:\Documents and Settings\Chad\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Chad\Desktop\raunli\raunli\Rapidshare Unlimited V2.0\Setup Rapidshare.exe Infected: Trojan-Dropper.Win32.Agent.qwy skipped C:\Documents and Settings\Chad\Desktop\raunli.rar/raunli/Rapidshare Unlimited V2.0/Setup Rapidshare.exe Infected: Trojan-Dropper.Win32.Agent.qwy skipped C:\Documents and Settings\Chad\Desktop\raunli.rar RAR: infected - 1 skipped C:\Documents and Settings\Chad\Local Settings\Application Data\Ahead\Nero Home\bl.db Object is locked skipped C:\Documents and Settings\Chad\Local Settings\Application Data\Ahead\Nero Home\is2.db Object is locked skipped C:\Documents and Settings\Chad\Local Settings\Application Data\Identities\{06B1FE61-C580-4819-9437-B56E60C3C328}\Microsoft\Outlook Express\Folders.dbx Object is locked skipped C:\Documents and Settings\Chad\Local Settings\Application Data\Identities\{06B1FE61-C580-4819-9437-B56E60C3C328}\Microsoft\Outlook Express\Offline.dbx Object is locked skipped C:\Documents and Settings\Chad\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Documents and Settings\Chad\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Chad\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Chad\Local Settings\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\Chad\Local Settings\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\Chad\Local Settings\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\Chad\Local Settings\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\Chad\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Chad\Local Settings\History\History.IE5\MSHist012008051520080516\index.dat Object is locked skipped C:\Documents and Settings\Chad\Local Settings\Temp\~DF3545.tmp Object is locked skipped C:\Documents and Settings\Chad\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Chad\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Chad\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\mIRC\backups\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped C:\QooBox\Quarantine\C\WINDOWS\system32\atudfvtp.dll.vir Infected: Trojan.Win32.Monder.gen skipped C:\QooBox\Quarantine\C\WINDOWS\system32\avylcfjn.dll.vir Infected: Trojan.Win32.Monder.gen skipped C:\QooBox\Quarantine\C\WINDOWS\system32\bqrlmamx.dll.vir Infected: Trojan.Win32.Monder.dk skipped C:\QooBox\Quarantine\C\WINDOWS\system32\icdnaajt.dll.vir Infected: Trojan.Win32.Monder.di skipped C:\QooBox\Quarantine\C\WINDOWS\system32\jtowsuaf.dll.vir Infected: Trojan.Win32.Monder.gen skipped C:\QooBox\Quarantine\C\WINDOWS\system32\msknpedv.dll.vir Infected: Trojan.Win32.Monder.gen skipped C:\QooBox\Quarantine\C\WINDOWS\system32\qtwyshic.dll.vir Infected: Trojan.Win32.Monder.de skipped C:\QooBox\Quarantine\C\WINDOWS\system32\qxruupyp.dll.vir Infected: Trojan.Win32.Monder.gen skipped C:\QooBox\Quarantine\C\WINDOWS\system32\rnhurjsy.dll.vir Infected: Trojan.Win32.Monder.gen skipped C:\QooBox\Quarantine\C\WINDOWS\system32\sxmhblpd.dll.vir Infected: Trojan.Win32.Monder.gen skipped C:\QooBox\Quarantine\C\WINDOWS\system32\ujpcacqy.dll.vir Infected: Trojan.Win32.Monder.gen skipped C:\QooBox\Quarantine\C\WINDOWS\system32\vjxpfocn.dll.vir Infected: Trojan.Win32.Monder.do skipped C:\QooBox\Quarantine\C\WINDOWS\system32\vskwqmkk.dll.vir Infected: Trojan.Win32.Monder.dl skipped C:\QooBox\Quarantine\C\WINDOWS\system32\wvUnOGwX.dll.vir Infected: Trojan.Win32.Monder.gen skipped C:\QooBox\Quarantine\catchme2008-05-14_204809.71.zip/geBRjHwW.dll Infected: Trojan.Win32.Monder.gen skipped C:\QooBox\Quarantine\catchme2008-05-14_204809.71.zip ZIP: infected - 1 skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP102\A0021995.dll Infected: Trojan.Win32.Monder.db skipped C:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP103\A0022087.dll Infected: Trojan.Win32.Monder.db skipped C:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP103\A0022106.dll Infected: Trojan.Win32.Monder.gen skipped C:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP104\A0022137.dll Infected: Trojan.Win32.Monder.gen skipped C:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP106\A0024161.dll Infected: Trojan.Win32.Monder.df skipped C:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP106\A0024162.dll Infected: Trojan.Win32.Monder.dm skipped C:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP107\A0025221.dll Infected: Trojan.Win32.Monder.dm skipped C:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP109\A0025304.dll Infected: Trojan.Win32.Monder.dj skipped C:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP111\A0025421.dll Infected: Trojan.Win32.Monder.gen skipped C:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP111\A0025422.dll Infected: Trojan.Win32.Monder.gen skipped C:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP111\A0025423.dll Infected: Trojan.Win32.Monder.dk skipped C:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP111\A0025428.dll Infected: Trojan.Win32.Monder.di skipped C:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP111\A0025430.dll Infected: Trojan.Win32.Monder.gen skipped C:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP111\A0025431.dll Infected: Trojan.Win32.Monder.gen skipped C:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP111\A0025434.dll Infected: Trojan.Win32.Monder.de skipped C:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP111\A0025435.dll Infected: Trojan.Win32.Monder.gen skipped C:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP111\A0025436.dll Infected: Trojan.Win32.Monder.gen skipped C:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP111\A0025437.dll Infected: Trojan.Win32.Monder.gen skipped C:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP111\A0025438.dll Infected: Trojan.Win32.Monder.gen skipped C:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP111\A0025439.dll Infected: Trojan.Win32.Monder.do skipped C:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP111\A0025440.dll Infected: Trojan.Win32.Monder.dl skipped C:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP111\A0025441.dll Infected: Trojan.Win32.Monder.gen skipped C:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP112\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\nmp.log Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped D:\Music\Done\9th_Wonder_And_Buckshot-The_Formula-2008-C4\9th_Wonder_And_Buckshot-The_Formula-2008-C4\00-9th_Wonder_And_Buckshot-The_Formula-2008-C4.m3u.exe/is202020.exe Infected: Trojan.Win32.Monder.gen skipped D:\Music\Done\9th_Wonder_And_Buckshot-The_Formula-2008-C4\9th_Wonder_And_Buckshot-The_Formula-2008-C4\00-9th_Wonder_And_Buckshot-The_Formula-2008-C4.m3u.exe CAB: infected - 1 skipped D:\Music\Done\9th_Wonder_And_Buckshot-The_Formula-2008-C4\9th_Wonder_And_Buckshot-The_Formula-2008-C4\00-9th_Wonder_And_Buckshot-The_Formula-2008-C4.nfo.exe/is202020.exe Infected: Trojan.Win32.Monder.gen skipped D:\Music\Done\9th_Wonder_And_Buckshot-The_Formula-2008-C4\9th_Wonder_And_Buckshot-The_Formula-2008-C4\00-9th_Wonder_And_Buckshot-The_Formula-2008-C4.nfo.exe CAB: infected - 1 skipped D:\Music\Done\9th_Wonder_And_Buckshot-The_Formula-2008-C4\9th_Wonder_And_Buckshot-The_Formula-2008-C4\00-9th_Wonder_And_Buckshot-The_Formula-2008-C4.sfv.exe/is202020.exe Infected: Trojan.Win32.Monder.gen skipped D:\Music\Done\9th_Wonder_And_Buckshot-The_Formula-2008-C4\9th_Wonder_And_Buckshot-The_Formula-2008-C4\00-9th_Wonder_And_Buckshot-The_Formula-2008-C4.sfv.exe CAB: infected - 1 skipped D:\Music\Done\9th_Wonder_And_Buckshot-The_Formula-2008-C4\9th_Wonder_And_Buckshot-The_Formula-2008-C4\Ninth Wonder Instrumental Bonus Tracks.exe/is202020.exe Infected: Trojan.Win32.Monder.gen skipped D:\Music\Done\9th_Wonder_And_Buckshot-The_Formula-2008-C4\9th_Wonder_And_Buckshot-The_Formula-2008-C4\Ninth Wonder Instrumental Bonus Tracks.exe CAB: infected - 1 skipped D:\Music\Done\MJG-****_Tight-2008-WHOA\MJG-****_Tight-2008-WHOA\00-mjg-****_tight-2008-whoa.m3u.EXE/is202193.exe Infected: Trojan.Win32.Monder.gen skipped D:\Music\Done\MJG-****_Tight-2008-WHOA\MJG-****_Tight-2008-WHOA\00-mjg-****_tight-2008-whoa.m3u.EXE CAB: infected - 1 skipped D:\Music\Done\MJG-****_Tight-2008-WHOA\MJG-****_Tight-2008-WHOA\00-mjg-****_tight-2008-whoa.nfo.EXE/is202193.exe Infected: Trojan.Win32.Monder.gen skipped D:\Music\Done\MJG-****_Tight-2008-WHOA\MJG-****_Tight-2008-WHOA\00-mjg-****_tight-2008-whoa.nfo.EXE CAB: infected - 1 skipped D:\Music\Done\MJG-****_Tight-2008-WHOA\MJG-****_Tight-2008-WHOA\00-mjg-****_tight-2008-whoa.sfv.EXE/is202193.exe Infected: Trojan.Win32.Monder.gen skipped D:\Music\Done\MJG-****_Tight-2008-WHOA\MJG-****_Tight-2008-WHOA\00-mjg-****_tight-2008-whoa.sfv.EXE CAB: infected - 1 skipped D:\Music\Done\MJG-****_Tight-2008-WHOA\MJG-****_Tight-2008-WHOA\Down South Mixes.EXE/is202193.exe Infected: Trojan.Win32.Monder.gen skipped D:\Music\Done\MJG-****_Tight-2008-WHOA\MJG-****_Tight-2008-WHOA\Down South Mixes.EXE CAB: infected - 1 skipped D:\Music\Done\Ransom-Street_Cinema-2008-C4\Ransom-Street_Cinema-2008-C4\00-ransom-street_cinema_retail_2008.m3u.exe/is202020.exe Infected: Trojan.Win32.Monder.gen skipped D:\Music\Done\Ransom-Street_Cinema-2008-C4\Ransom-Street_Cinema-2008-C4\00-ransom-street_cinema_retail_2008.m3u.exe CAB: infected - 1 skipped D:\Music\Done\Ransom-Street_Cinema-2008-C4\Ransom-Street_Cinema-2008-C4\00-ransom-street_cinema_retail_2008.nfo.exe/is202020.exe Infected: Trojan.Win32.Monder.gen skipped D:\Music\Done\Ransom-Street_Cinema-2008-C4\Ransom-Street_Cinema-2008-C4\00-ransom-street_cinema_retail_2008.nfo.exe CAB: infected - 1 skipped D:\Music\Done\Ransom-Street_Cinema-2008-C4\Ransom-Street_Cinema-2008-C4\00-ransom-street_cinema_retail_2008.sfv.exe/is202020.exe Infected: Trojan.Win32.Monder.gen skipped D:\Music\Done\Ransom-Street_Cinema-2008-C4\Ransom-Street_Cinema-2008-C4\00-ransom-street_cinema_retail_2008.sfv.exe CAB: infected - 1 skipped D:\Music\Done\Ransom-Street_Cinema-2008-C4\Ransom-Street_Cinema-2008-C4\Joe Budden Diss Tracks Bonus.exe/is202020.exe Infected: Trojan.Win32.Monder.gen skipped D:\Music\Done\Ransom-Street_Cinema-2008-C4\Ransom-Street_Cinema-2008-C4\Joe Budden Diss Tracks Bonus.exe CAB: infected - 1 skipped D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\00-sheek_louch-silverback_gorilla_2008-whoa.sfv.exe/is202020.exe Infected: Trojan.Win32.Monder.gen skipped D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\00-sheek_louch-silverback_gorilla_2008-whoa.sfv.exe CAB: infected - 1 skipped D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\00-sheek_louch-silverback_gorilla_2008.m3u.exe/is202020.exe Infected: Trojan.Win32.Monder.gen skipped D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\00-sheek_louch-silverback_gorilla_2008.m3u.exe CAB: infected - 1 skipped D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\00-sheek_louch-silverback_gorilla_2008.nfo.exe/is202020.exe Infected: Trojan.Win32.Monder.gen skipped D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\00-sheek_louch-silverback_gorilla_2008.nfo.exe CAB: infected - 1 skipped D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\50 Cent Diss Track and other Bonuses.exe/is202020.exe Infected: Trojan.Win32.Monder.gen skipped D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\50 Cent Diss Track and other Bonuses.exe CAB: infected - 1 skipped D:\Programs\mIRC6.12Invision2.0.rar/mIRC6.12Invision2.0/mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.612 skipped D:\Programs\mIRC6.12Invision2.0.rar RAR: infected - 1 skipped D:\raunli.rar/raunli/Rapidshare Unlimited V2.0/Setup Rapidshare.exe Infected: Trojan-Dropper.Win32.Agent.qwy skipped D:\raunli.rar RAR: infected - 1 skipped D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped D:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP112\change.log Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Accessories\mswrd6.wpc Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Accessories\mswrd8.wpc Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Accessories\wordpad.exe Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Accessories\write.wpc Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\dialer.exe Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\htrn_jis.dll Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\hypertrm.exe Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\FONT.DAT Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\PINBALL.DAT Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\PINBALL.EXE Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\PINBALL.MID Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\PINBALL2.MID Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND1.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND104.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND105.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND108.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND111.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND112.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND12.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND13.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND131.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND136.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND14.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND16.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND17.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND18.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND181.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND19.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND20.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND21.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND22.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND24.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND240.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND243.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND25.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND26.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND27.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND28.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND29.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND3.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND30.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND34.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND35.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND36.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND38.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND39.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND4.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND42.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND43.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND45.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND49.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND49D.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND5.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND50.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND528.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND53.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND54.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND55.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND560.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND563.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND57.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND58.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND6.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND65.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND68.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND7.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND713.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND735.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND8.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND827.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND9.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\SOUND999.WAV Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\table.bmp Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Windows NT\Pinball\wavemix.inf Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\Default.SFX Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\Descript.ion Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\Dos.SFX Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\File_Id.diz Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\Formats\ace.fmt Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\Formats\arj.fmt Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\Formats\bz2.fmt Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\Formats\cab.fmt Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\Formats\gz.fmt Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\Formats\iso.fmt Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\Formats\lzh.fmt Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\Formats\tar.fmt Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\Formats\UNACEV2.DLL Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\Formats\uue.fmt Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\License.txt Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\Order.txt Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\Rar.exe Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\Rar.txt Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\RarExt.dll Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\RarFiles.lst Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\rarnew.dat Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\rarreg.key Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\Rar_Site.txt Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\ReadMe.txt Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\Register.txt Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\TechNote.txt Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\Uninstall.exe Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\Uninstall.lst Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\UnRAR.exe Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\UnrarSrc.txt Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\WhatsNew.txt Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\WinCon.SFX Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\WinRAR.cnt Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\WinRAR.exe Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\WinRAR.hlp Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\Zip.SFX Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\WinRAR\zipnew.dat Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\XviD\AviC.exe Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\XviD\doom9forum.url Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\XviD\gpl.txt Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\XviD\koepishomepage.url Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\XviD\MiniCalc.exe Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\XviD\MiniCalc.txt Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\XviD\OGMCalc.exe Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\XviD\ReadMe.txt Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\XviD\releasenotes.txt Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\XviD\StatsReader.exe Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\XviD\statsreader.txt Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\XviD\unins000.dat Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\XviD\unins000.exe Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\XviD\UninstXviD.exe Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\XviD\vidccleaner.exe Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\XviD\XviD.ico Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\XviD\xvidhomepage.url Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\XviD\XviD_Quant_Matrices.zip Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Common\unyt.exe Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_atb.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_catb.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_cnf.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_cotb.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_ctb.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_fantip.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_fantipg.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_fintip.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_fintipg.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_grptip.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_grptipg.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_logtip.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_mailatip.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_mailtip.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_map.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_mlbtip.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_mlbtipg.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_msgratip.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_msgrtip.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_nbatip.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_nbatipg.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_newstip.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_newstipg.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_nfltip.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_nfltipg.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_opt.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_pub.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_srchtip.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_upg.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Data\dlg_wp.html Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Installs\cpn\inyt.exe Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Installs\cpn\inyt.exe.manifest Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Installs\cpn\pubmod.dll Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Installs\cpn\YMERemote.dll Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Installs\cpn\YPUBC.dll Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Installs\cpn\YTabBar.dll Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Installs\cpn\YTAntiSpy.dll Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Installs\cpn\YTBM.dll Object is locked skipped F:\70544a3d940595c96f\Documents and Settings\Program Files\Yahoo!\Companion\Installs\cpn\YTMsgr.dll Object is locked skipped F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped F:\System Volume Information\_restore{1BCD3441-2466-4383-840E-D92E22F5ECDA}\RP103\A0096109.exe/data0001 Infected: not-a-virus:AdWare.Win32.PurityScan.gp skipped F:\System Volume Information\_restore{1BCD3441-2466-4383-840E-D92E22F5ECDA}\RP103\A0096109.exe NSIS: infected - 1 skipped F:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP112\change.log Object is locked skipped F:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP65\A0011873.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.63 skipped F:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP65\A0013731.exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.a skipped F:\System Volume Information\_restore{F87A8F22-B149-49AA-BC94-D7F5F42ABA05}\RP65\A0013731.exe NSIS: infected - 1 skipped Scan process completed. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 8:23:49 AM, on 5/15/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user') O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: KenoPop! by pogo - http://game3.pogo.com/v/8.1.8.21/app...keno-en_US.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - http://lads.myspace.com/upload/MySpaceUploader1006.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1203479944187 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 5089 bytes |
|
|
|
|
05-15-2008, 12:52 PM
|
#7 (permalink) | |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: popups and running slow
Hello again
P2P P2P - I see you have P2P software Azureus Vuze installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares and their infections. References for the risk of these programs are Here, Here and Here. ========= This is the main reason your computer is infected. Visiting cracksites/warezsites - and other questionable/illegal sites is always a risk. Even a single click on the site can drop multiple forms of very serious malware, many of which disable your onboard protection, and System Restore. If you install the cracked software, you are running executable files from these dubious, unknown sources. You are in effect giving these sources access to information on your hard disk, and potential control over the operation of your computer. Additionally, cracked programs are illegal. Referring to the Forum Rules which you should have read at the time of Registering at this forum, TSF does not support illegal activity. As such, be advised that any request for assistance in removing malware may go unanswered, or may be discontinued, if the cracked (illegal) software is still present on the machine. ============ Open notepad and copy/paste the text in the quotebox below into it: Quote:
Refering to the picture above, drag CFscript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ========= No AntiVirus Onboard I see no evidence of an AntiVirus program on your system. This must be resolved. Here are a few very good free Antivirus products which are available:Select one of these, or another of your choice. Download, install, update definitions, and run a full system scan. Note: If installing AVG8, you will have to uninstall AVG Antispyware first, as AVG8 incorporates the anti-spyware module. ========= Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ========== Logs Required C:\Combofix.txt Results from Antivirus Scan Hijackthis Log Last edited by TheBruce1; 05-15-2008 at 12:53 PM. |
|
|
|
|
|
05-16-2008, 12:47 AM
|
#8 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 6
OS: windows xp
|
Re: popups and running slow
yea my bf plays around with all that im not to sure about lol but heres those scans
ComboFix 08-05-12.1 - Chad 2008-05-15 20:54:32.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.249 [GMT -4:00] Running from: C:\Documents and Settings\Chad\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Chad\Desktop\CFscript.txt * Created a new restore point FILE :: D:\raunli.rar . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Chad\Desktop\raunli C:\Documents and Settings\Chad\Desktop\raunli\Law__amp__Order_CI___SEASON_01__COMPLETE_.torrent C:\Documents and Settings\Chad\Desktop\raunli\Law__amp__Order_CI___SEASON_04__COMPLETE_.torrent C:\Documents and Settings\Chad\Desktop\raunli\Law__amp__Order_CI___SEASON_05__COMPLETE_.torrent C:\Documents and Settings\Chad\Desktop\raunli\Law__Order_CI___SEASON_02__COMPLETE_.torrent C:\Documents and Settings\Chad\Desktop\raunli\Law__Order_CI___SEASON_03__COMPLETE_.torrent C:\Documents and Settings\Chad\Desktop\raunli\LAW_AND_ORDER_TBJ__COMPLETE_.torrent C:\Documents and Settings\Chad\Desktop\raunli\raunli\Rapidshare Unlimited V2.0\RapidGet russian.exe C:\Documents and Settings\Chad\Desktop\raunli\raunli\Rapidshare Unlimited V2.0\Setup Rapidshare.exe C:\Documents and Settings\Chad\Desktop\raunli\The_Twilight_Zone__2002_03__Episode_1___44.torrent D:\Music\Done\9th_Wonder_And_Buckshot-The_Formula-2008-C4 D:\Music\Done\9th_Wonder_And_Buckshot-The_Formula-2008-C4\9th_Wonder_And_Buckshot-The_Formula-2008-C4\00-9th_Wonder_And_Buckshot-The_Formula-2008-C4.m3u.exe D:\Music\Done\9th_Wonder_And_Buckshot-The_Formula-2008-C4\9th_Wonder_And_Buckshot-The_Formula-2008-C4\00-9th_Wonder_And_Buckshot-The_Formula-2008-C4.nfo.exe D:\Music\Done\9th_Wonder_And_Buckshot-The_Formula-2008-C4\9th_Wonder_And_Buckshot-The_Formula-2008-C4\00-9th_Wonder_And_Buckshot-The_Formula-2008-C4.sfv.exe D:\Music\Done\9th_Wonder_And_Buckshot-The_Formula-2008-C4\9th_Wonder_And_Buckshot-The_Formula-2008-C4\01-9th_wonder_and_buckshot-intro_(the_formula)_(feat._the_formula_crew).mp3 D:\Music\Done\9th_Wonder_And_Buckshot-The_Formula-2008-C4\9th_Wonder_And_Buckshot-The_Formula-2008-C4\02-9th_wonder_and_buckshot-ready_(brand_new_day).mp3 D:\Music\Done\9th_Wonder_And_Buckshot-The_Formula-2008-C4\9th_Wonder_And_Buckshot-The_Formula-2008-C4\03-9th_wonder_and_buckshot-be_cool_(feat._swan).mp3 D:\Music\Done\9th_Wonder_And_Buckshot-The_Formula-2008-C4\9th_Wonder_And_Buckshot-The_Formula-2008-C4\04-9th_wonder_and_buckshot-go_all_out_(no_doubt)_(feat._carlitta_durand).mp3 D:\Music\Done\9th_Wonder_And_Buckshot-The_Formula-2008-C4\9th_Wonder_And_Buckshot-The_Formula-2008-C4\05-9th_wonder_and_buckshot-no_future.mp3 D:\Music\Done\9th_Wonder_And_Buckshot-The_Formula-2008-C4\9th_Wonder_And_Buckshot-The_Formula-2008-C4\06-9th_wonder_and_buckshot-hold_it_down_(feat._talib_kweli_and_tyler_woods).mp3 D:\Music\Done\9th_Wonder_And_Buckshot-The_Formula-2008-C4\9th_Wonder_And_Buckshot-The_Formula-2008-C4\07-9th_wonder_and_buckshot-whassup_with_u_(feat._keisha_shontelle).mp3 D:\Music\Done\9th_Wonder_And_Buckshot-The_Formula-2008-C4\9th_Wonder_And_Buckshot-The_Formula-2008-C4\08-9th_wonder_and_buckshot-one_for_you_(big_lou).mp3 D:\Music\Done\9th_Wonder_And_Buckshot-The_Formula-2008-C4\9th_Wonder_And_Buckshot-The_Formula-2008-C4\09-9th_wonder_and_buckshot-just_display.mp3 D:\Music\Done\9th_Wonder_And_Buckshot-The_Formula-2008-C4\9th_Wonder_And_Buckshot-The_Formula-2008-C4\10-9th_wonder_and_buckshot-here_we_go.mp3 D:\Music\Done\9th_Wonder_And_Buckshot-The_Formula-2008-C4\9th_Wonder_And_Buckshot-The_Formula-2008-C4\11-9th_wonder_and_buckshot-throwin_shade.mp3 D:\Music\Done\9th_Wonder_And_Buckshot-The_Formula-2008-C4\9th_Wonder_And_Buckshot-The_Formula-2008-C4\12-9th_wonder_and_buckshot-shinin_yall_(feat._arafat_yates_and_big_chops).mp3 D:\Music\Done\9th_Wonder_And_Buckshot-The_Formula-2008-C4\9th_Wonder_And_Buckshot-The_Formula-2008-C4\13-9th_wonder_and_buckshot-man_listen_(cause_ummm)_(feat._carlitta_durand).mp3 D:\Music\Done\9th_Wonder_And_Buckshot-The_Formula-2008-C4\9th_Wonder_And_Buckshot-The_Formula-2008-C4\Ninth Wonder Instrumental Bonus Tracks.exe D:\Music\Done\Ransom-Street_Cinema-2008-C4 D:\Music\Done\Ransom-Street_Cinema-2008-C4\Ransom-Street_Cinema-2008-C4\00-ransom-street_cinema_retail_2008.m3u.exe D:\Music\Done\Ransom-Street_Cinema-2008-C4\Ransom-Street_Cinema-2008-C4\00-ransom-street_cinema_retail_2008.nfo.exe D:\Music\Done\Ransom-Street_Cinema-2008-C4\Ransom-Street_Cinema-2008-C4\00-ransom-street_cinema_retail_2008.sfv.exe D:\Music\Done\Ransom-Street_Cinema-2008-C4\Ransom-Street_Cinema-2008-C4\01-ransom-no_introduction.mp3 D:\Music\Done\Ransom-Street_Cinema-2008-C4\Ransom-Street_Cinema-2008-C4\02-ransom-grind_and_hustle.mp3 D:\Music\Done\Ransom-Street_Cinema-2008-C4\Ransom-Street_Cinema-2008-C4\03-ransom-jersey.mp3 D:\Music\Done\Ransom-Street_Cinema-2008-C4\Ransom-Street_Cinema-2008-C4\04-ransom-aint_nobody.mp3 D:\Music\Done\Ransom-Street_Cinema-2008-C4\Ransom-Street_Cinema-2008-C4\05-ransom-love_iz_life.mp3 D:\Music\Done\Ransom-Street_Cinema-2008-C4\Ransom-Street_Cinema-2008-C4\06-ransom-walk_talk.mp3 D:\Music\Done\Ransom-Street_Cinema-2008-C4\Ransom-Street_Cinema-2008-C4\07-ransom-you_know_what_we_about.mp3 D:\Music\Done\Ransom-Street_Cinema-2008-C4\Ransom-Street_Cinema-2008-C4\08-ransom-young_ransom.mp3 D:\Music\Done\Ransom-Street_Cinema-2008-C4\Ransom-Street_Cinema-2008-C4\09-ransom-big_wheelz.mp3 D:\Music\Done\Ransom-Street_Cinema-2008-C4\Ransom-Street_Cinema-2008-C4\10-ransom-love.mp3 D:\Music\Done\Ransom-Street_Cinema-2008-C4\Ransom-Street_Cinema-2008-C4\11-ransom-lookin_back.mp3 D:\Music\Done\Ransom-Street_Cinema-2008-C4\Ransom-Street_Cinema-2008-C4\12-ransom-cash_in_da_duffle_(feat._stack_bundles).mp3 D:\Music\Done\Ransom-Street_Cinema-2008-C4\Ransom-Street_Cinema-2008-C4\13-ransom-ransom.mp3 D:\Music\Done\Ransom-Street_Cinema-2008-C4\Ransom-Street_Cinema-2008-C4\14-ransom-dinna_time.mp3 D:\Music\Done\Ransom-Street_Cinema-2008-C4\Ransom-Street_Cinema-2008-C4\15-ransom-shine.mp3 D:\Music\Done\Ransom-Street_Cinema-2008-C4\Ransom-Street_Cinema-2008-C4\16-ransom-soul_2_keep.mp3 D:\Music\Done\Ransom-Street_Cinema-2008-C4\Ransom-Street_Cinema-2008-C4\Joe Budden Diss Tracks Bonus.exe D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\00-sheek_louch-silverback_gorilla_2008-whoa.sfv.exe D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\00-sheek_louch-silverback_gorilla_2008.m3u.exe D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\00-sheek_louch-silverback_gorilla_2008.nfo.exe D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\01-sheek_louch-lottery_(skit)-whoa.mp3 D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\02-sheek_louch-think_we_got_a_problem_(featuring_bun_b._and_the_game)-whoa.mp3 D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\03-sheek_louch-keep_pushin_(featuring_mike_smith)-whoa.mp3 D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\04-sheek_louch-good_love-whoa.mp3 D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\05-sheek_louch-d-block-dipset_(featuring_jim_jones_styles_p._hell_rell_and_jadakiss)-whoa.mp3 D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\06-sheek_louch-we_at_war-whoa.mp3 D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\07-sheek_louch-scrap_to_this-whoa.mp3 D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\08-sheek_louch-dont_be_them-whoa.mp3 D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\09-sheek_louch-gettin_stronger_(featuring_styles_p._and_jadakiss)-whoa.mp3 D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\10-sheek_louch-thats_a_soldier-whoa.mp3 D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\11-sheek_louch-what_what_(featuring_bully)-whoa.mp3 D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\12-sheek_louch-we_comin_(featuring_unk)-whoa.mp3 D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\13-sheek_louch-crowd_(skit)-whoa.mp3 D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\14-sheek_louch-we_spray_crowds-whoa.mp3 D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\15-sheek_louch-rubber_grip_(featuring_fat_joe_and_styles_p.)-whoa.mp3 D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\16-sheek_louch-2_turntables_and_a_mic-whoa.mp3 D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\17-sheek_louch-mic_check-whoa.mp3 D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\18-sheek_louch-go_hoodlums-whoa.mp3 D:\Music\Done\Sheek_Louch-Silverback_Gorilla-2008-WHOA\Sheek_Louch-Silverback_Gorilla-2008-WHOA\50 Cent Diss Track and other Bonuses.exe D:\raunli.rar . ((((((((((((((((((((((((( Files Created from 2008-04-16 to 2008-05-16 ))))))))))))))))))))))))))))))) . 2008-05-15 20:51 . 2008-05-15 20:52 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg 2008-05-15 20:51 . 2008-05-15 20:51 <DIR> d-------- C:\Program Files\AVG 2008-05-15 20:51 . 2008-05-15 20:51 <DIR> d-------- C:\Documents and Settings\Chad\Application Data\AVGTOOLBAR 2008-05-15 20:51 . 2008-05-15 20:51 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8 2008-05-15 20:51 . 2008-05-15 20:51 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys 2008-05-15 20:51 . 2008-05-15 20:51 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys 2008-05-15 20:51 . 2008-05-15 20:51 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll 2008-05-15 08:38 . 2008-05-15 08:38 <DIR> d-------- C:\Documents and Settings\Chad\Application Data\iWin 2008-05-15 08:37 . 2008-05-15 09:09 <DIR> d-------- C:\Program Files\Family Feud Dream Home 2008-05-15 06:40 . 2008-05-15 06:40 <DIR> d-------- C:\Program Files\Trend Micro 2008-05-14 20:44 . 2008-05-14 20:44 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG 2008-05-14 16:03 . 2008-05-14 16:03 <DIR> d-------- C:\WINDOWS\ERUNT 2008-05-14 16:02 . 2008-05-15 20:51 <DIR> d-------- C:\Documents and Settings\Administrator 2008-05-14 16:02 . 2008-05-15 20:51 1,024 --ah----- C:\Documents and Settings\Administrator\NtUser.dat.LOG 2008-05-14 15:04 . 2008-05-14 16:16 <DIR> d-------- C:\SDFix 2008-05-12 23:02 . 2008-05-12 23:02 <DIR> d-------- C:\Documents and Settings\Chad\Application Data\My Games 2008-05-12 23:01 . 2008-05-14 00:08 <DIR> d-------- C:\Program Files\Posh Boutique 2008-05-11 11:53 . 2008-05-11 11:53 <DIR> d-------- C:\Deckard 2008-05-11 09:43 . 2008-05-11 09:44 <DIR> d-------- C:\Program Files\Panda Security 2008-05-11 09:24 . 2008-05-11 09:25 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-05-11 09:24 . 2008-05-14 23:01 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-05-11 09:24 . 2005-08-25 18:18 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL 2008-05-11 09:24 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX 2008-05-08 22:44 . 2008-05-08 22:44 <DIR> d-------- C:\Documents and Settings\Chad\Application Data\Sudden Games 2008-05-08 22:39 . 2008-05-08 23:15 <DIR> d-------- C:\Program Files\Yard Sale Junkie 2008-05-06 22:28 . 2008-05-06 22:28 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-05-06 22:28 . 2008-05-06 22:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-05-05 18:25 . 2008-05-05 18:25 1,160 --a------ C:\WINDOWS\mozver.dat 2008-05-05 08:54 . 2008-05-05 08:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-05-01 19:09 . 2008-05-01 19:09 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\HipSoft 2008-05-01 19:08 . 2008-05-02 09:11 <DIR> d-------- C:\Program Files\Buildalot 2 Town Of The Year 2008-04-30 22:30 . 2008-04-30 22:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Gogii 2008-04-30 22:29 . 2008-05-15 09:38 <DIR> d-------- C:\Program Files\The Hidden Object Show 2008-04-26 06:11 . 2008-04-26 06:11 0 --a------ C:\WINDOWS\nsreg.dat 2008-04-25 14:42 . 2008-04-25 14:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Fugazo 2008-04-25 14:36 . 2008-05-04 12:44 <DIR> d-------- C:\Program Files\Cooking Academy 2008-04-23 09:10 . 2008-04-23 09:11 <DIR> d-------- C:\Documents and Settings\Chad\Application Data\Wildfire 2008-04-21 22:34 . 2008-04-21 22:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Astar Games 2008-04-21 22:31 . 2008-04-22 09:15 <DIR> d-------- C:\Program Files\Ice Cream Mania 2008-04-19 01:13 . 2008-04-19 01:13 <DIR> d-------- C:\Documents and Settings\Chad\Application Data\Ludia 2008-04-19 01:13 . 2008-04-19 01:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Ludia . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-14 18:48 --------- d-----w C:\Program Files\Fashion Boutique 2008-05-13 13:14 --------- d-----w C:\Program Files\mIRC 2008-05-13 13:14 --------- d-----w C:\Documents and Settings\Chad\Application Data\mIRC 2008-05-12 04:12 --------- d-----w C:\Program Files\Yahtzee Texas Hold Em 2008-05-05 22:41 --------- d-----w C:\Documents and Settings\Chad\Application Data\PlayFirst 2008-05-05 22:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\PlayFirst 2008-04-24 21:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\eGames 2008-04-21 00:23 --------- d-----w C:\Documents and Settings\Chad\Application Data\Azureus 2008-04-13 04:22 52,736 ----a-w C:\WINDOWS\ipuninst.exe 2008-04-13 04:21 --------- d-----w C:\Program Files\BlackIsle 2008-04-12 05:49 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-04-12 05:49 --------- d-----w C:\Program Files\GSP 2008-04-08 13:04 --------- d-----w C:\Program Files\Janes Hotel Family Hero 2008-04-08 13:04 --------- d-----w C:\Documents and Settings\Chad\Application Data\Jane s Hotel Family Hero 2008-04-08 00:13 --------- d-----w C:\Documents and Settings\Chad\Application Data\fltk.org 2008-04-04 13:07 --------- d-----w C:\Documents and Settings\Chad\Application Data\Meridian93 2008-03-26 18:59 --------- d-----w C:\Documents and Settings\Chad\Application Data\AdobeUM 2008-03-23 14:04 --------- d-----w C:\Documents and Settings\Chad\Application Data\Yahoo! 2008-03-23 14:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion 2008-03-23 01:03 --------- d-----w C:\Program Files\Azureus 2008-03-22 23:55 --------- d-----w C:\Documents and Settings\Chad\Application Data\funkitron 2008-03-21 14:33 --------- d-----w C:\Documents and Settings\Chad\Application Data\WinWay 2008-03-20 05:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Fashion Solitaire 1.2 2008-03-18 21:47 --------- d-----w C:\Documents and Settings\Chad\Application Data\MSN6 2008-03-18 21:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\MSN6 2008-03-18 03:32 --------- d-----w C:\Program Files\Chuzzle Deluxe 2008-03-17 04:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Zylom 2008-03-16 22:50 --------- d-----w C:\Program Files\Yahtzee 2008-02-21 21:58 2,416,141 ----a-w C:\WINDOWS\java\Packages\M2XVXNZN.ZIP 2008-02-20 03:57 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll 2008-02-19 05:44 558,142 ----a-w C:\WINDOWS\java\Packages\R3PBBVL7.ZIP 2008-02-19 05:44 155,995 ----a-w C:\WINDOWS\java\Packages\FVVX3X73.ZIP . ((((((((((((((((((((((((((((( snapshot@2008-05-14_20.55.38.45 ))))))))))))))))))))))))))))))))))))))))) . - 2008-05-15 00:50:37 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-05-15 10:18:59 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-05-16 00:51:32 26,184 ----a-w C:\WINDOWS\system32\drivers\avgmfx86.sys + 2006-12-02 02:56:00 96,256 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll + 2006-12-02 02:54:32 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll + 2006-12-02 02:54:34 548,864 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll + 2006-12-02 02:54:32 626,688 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll + 2006-12-02 04:25:52 1,101,824 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll + 2006-12-02 04:25:56 1,093,120 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll + 2006-12-02 04:25:58 69,632 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll + 2006-12-02 04:26:00 57,856 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll + 2006-12-02 04:08:00 40,960 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll + 2006-12-02 04:08:00 45,056 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll + 2006-12-02 04:08:00 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll + 2006-12-02 04:08:00 57,344 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll + 2006-12-02 04:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll + 2006-12-02 04:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll + 2006-12-02 04:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll + 2006-12-02 04:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll + 2006-12-02 04:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll + 2006-12-02 04:46:44 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}] 2008-05-15 20:51 2050816 --a------ C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{A057A204-BACC-4D26-9990-79A187E2698E}"= "C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL" [2008-05-15 20:51 2050816] [HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-9990-79a187e2698e}] [HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{A057A204-BACC-4D26-9990-79A187E2698E}"= C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [2008-05-15 20:51 2050816] [HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-9990-79a187e2698e}] [HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 15:49 153136] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-10-05 09:25 868352] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 02:41 81920] "NWEReboot"="" [] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-05-15 20:51 1177368] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2008-02-01 16:32 8699904] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.3IV2"= 3ivxVfWCodec.dll "SENTINEL"= snti386.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\mIRC\\mirc.exe"= "C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"= "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "C:\\Program Files\\AVG\\AVG8\\avgemc.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "57902:TCP"= 57902:TCP:azureus R0 Pnp680;SiI 680 ATA Controller;C:\WINDOWS\system32\DRIVERS\pnp680.sys [2007-06-28 18:01] R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-05-15 20:51] R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-05-15 20:51] R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-05-15 20:51] R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-05-15 20:51] *Newly Created Service* - AVG8EMC *Newly Created Service* - AVG8WD *Newly Created Service* - AVGLDX86 *Newly Created Service* - AVGMFX86 *Newly Created Service* - AVGTDIX *Newly Created Service* - CATCHME . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-15 20:56:11 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-05-15 20:57:46 ComboFix-quarantined-files.txt 2008-05-16 00:57:42 ComboFix2.txt 2008-05-15 10:36:13 ComboFix3.txt 2008-05-15 00:55:50 Pre-Run: 4,592,062,464 bytes free Post-Run: 4,580,433,920 bytes free 263 "Scan ""Scan whole computer"" was finished." "Infections found:";"37" "Infected objects removed or healed";"37" "Not removed or healed.";"0" "Spyware found:";"0" "Spyware removed:";"0" "Not removed:";"0" "Warnings count:";"376" "Information count:";"0" "Scan started:";"Thursday, May 15, 2008, 8:58:23 PM" "Total object scanned:";"445497" "Time needed:";"34 minute(s) 16 second(s) " "Errors encountered:";"0" "Infections" "File";"Infection";"Result" "C:\Documents and Settings\Chad\Desktop\raunli.rar:\raunli\Rapidshare Unlimited V2.0\Setup Rapidshare.exe";"Trojan horse Delf.CNQ";"Moved to Virus Vault" "C:\Documents and Settings\Chad\Desktop\raunli.rar";"Trojan horse Delf.CNQ";"Moved to Virus Vault" "C:\Program Files\Purrfect Pet Shop\ps.exe";"Trojan horse Generic10.KPU";"Moved to Virus Vault" "C:\QooBox\Quarantine\catchme2008-05-14_204809.71.zip:\geBRjHwW.dll";"Trojan horse Generic10.XPG";"Moved to Virus Vault" "C:\QooBox\Quarantine\catchme2008-05-14_204809.71.zip";"Trojan horse Generic10.XPG";"Moved to Virus Vault" "D:\Music\Done\MJG-****_Tight-2008-WHOA\MJG-****_Tight-2008-WHOA\00-mjg-****_tight-2008-whoa.m3u.EXE:\is202193.exe";"Trojan horse Vundo.O";"Moved to Virus Vault" "D:\Music\Done\MJG-****_Tight-2008-WHOA\MJG-****_Tight-2008-WHOA\00-mjg-****_tight-2008-whoa.m3u.EXE";"Trojan horse Vundo.O";"Moved to Virus Vault" "D:\Music\Done\MJG-****_Tight-2008-WHOA\MJG-****_Tight-2008-WHOA\00-mjg-****_tight-2008-whoa.nfo.EXE:\is202193.exe";"Trojan horse Vundo.O";"Moved to Virus Vault" "D:\Music\Done\MJG-****_Tight-2008-WHOA\MJG-****_Tight-2008-WHOA\00-mjg-****_tight-2008-whoa.nfo.EXE";"Trojan horse Vundo.O";"Moved to Virus Vault" "D:\Music\Done\MJG-****_Tight-2008-WHOA\MJG-****_Tight-2008-WHOA\00-mjg-****_tight-2008-whoa.sfv.EXE:\is202193.exe";"Trojan horse Vundo.O";"Moved to Virus Vault" "D:\Music\Done\MJG-****_Tight-2008-WHOA\MJG-****_Tight-2008-WHOA\00-mjg-****_tight-2008-whoa.sfv.EXE";"Trojan horse Vundo.O";"Moved to Virus Vault" "D:\Music\Done\MJG-****_Tight-2008-WHOA\MJG-****_Tight-2008-WHOA\Down South Mixes.EXE:\is202193.exe";"Trojan horse Vundo.O";"Moved to Virus Vault" "D:\Music\Done\MJG-****_Tight-2008-WHOA\MJG-****_Tight-2008-WHOA\Down South Mixes.EXE";"Trojan horse Vundo.O";"Moved to Virus Vault" "D:\Programs\Alcohol.120.v1.9.5.3823.Retail.Cracked-BLiZZARD\Alcohol.120.v1.9.5.3823.Retail.Cracked-BLiZZARD\b-a19581\b-a1958\blz-a120_1953823-patch.exe";"Trojan horse PSW.OnlineGames.FIY";"Moved to Virus Vault" "D:\Programs\Alcohol.120.v1.9.5.3823.Retail.Cracked-BLiZZARD\Alcohol.120.v1.9.5.3823.Retail.Cracked-BLiZZARD\b-a19581\b-a1958.rar:\blz-a120_1953823-patch.exe";"Trojan horse PSW.OnlineGames.FIY";"Moved to Virus Vault" "D:\Programs\Alcohol.120.v1.9.5.3823.Retail.Cracked-BLiZZARD\Alcohol.120.v1.9.5.3823.Retail.Cracked-BLiZZARD\b-a19581\b-a1958.rar";"Trojan horse PSW.OnlineGames.FIY";"Moved to Virus Vault" "D:\Programs\Alcohol.120.v1.9.5.3823.Retail.Cracked-BLiZZARD\Alcohol.120.v1.9.5.3823.Retail.Cracked-BLiZZARD\b-a19581.zip:\b-a1958.rar:\blz-a120_1953823-patch.exe";"Trojan horse PSW.OnlineGames.FIY";"Moved to Virus Vault" "D:\Programs\Alcohol.120.v1.9.5.3823.Retail.Cracked-BLiZZARD\Alcohol.120.v1.9.5.3823.Retail.Cracked-BLiZZARD\b-a19581.zip:\b-a1958.rar";"Trojan horse PSW.OnlineGames.FIY";"Moved to Virus Vault" "D:\Programs\Alcohol.120.v1.9.5.3823.Retail.Cracked-BLiZZARD\Alcohol.120.v1.9.5.3823.Retail.Cracked-BLiZZARD\b-a19581.zip";"Trojan horse PSW.OnlineGames.FIY";"Moved to Virus Vault" "D:\Programs\DVD_X_Copy_Platinum_v3.21\DVD X Copy Platinum v3.21\DVD X Copy Platinum v3.21\DVDXCopy_Platinum_v3.2.1_full_install.exe:\ns_00006";"Virus found Win32/Heur";"Deleted" "D:\Programs\DVD_X_Copy_Platinum_v3.21\DVD X Copy Platinum v3.21\DVD X Copy Platinum v3.21\DVDXCopy_Platinum_v3.2.1_full_install.exe:\ns_00017";"Virus found Win32/Heur";"Deleted" "D:\Programs\DVD_X_Copy_Platinum_v3.21\DVD X Copy Platinum v3.21\DVD X Copy Platinum v3.21\DVDXCopy_Platinum_v3.2.1_full_install.exe:\ns_00024";"Virus found Win32/Heur";"Deleted" "D:\Programs\DVD_X_Copy_Platinum_v3.21\DVD X Copy Platinum v3.21\DVD X Copy Platinum v3.21\DVDXCopy_Platinum_v3.2.1_full_install.exe";"Virus found Win32/Heur";"Deleted" "D:\Programs\DVD_X_Copy_Platinum_v3.21\DVD X Copy Platinum v3.21\DVDXCopy_Platinum_v3.2.1_full_install.exe:\ns_00006";"Virus found Win32/Heur";"Deleted" "D:\Programs\DVD_X_Copy_Platinum_v3.21\DVD X Copy Platinum v3.21\DVDXCopy_Platinum_v3.2.1_full_install.exe:\ns_00017";"Virus found Win32/Heur";"Deleted" "D:\Programs\DVD_X_Copy_Platinum_v3.21\DVD X Copy Platinum v3.21\DVDXCopy_Platinum_v3.2.1_full_install.exe:\ns_00024";"Virus found Win32/Heur";"Deleted" "D:\Programs\DVD_X_Copy_Platinum_v3.21\DVD X Copy Platinum v3.21\DVDXCopy_Platinum_v3.2.1_full_install.exe";"Virus found Win32/Heur";"Deleted" "D:\Programs\DVD_X_Copy_Platinum_v3.21.rar:\DVD X Copy Platinum v3.21\DVDXCopy_Platinum_v3.2.1_full_install.exe:\ns_00006";"Virus found Win32/Heur";"Deleted" "D:\Programs\DVD_X_Copy_Platinum_v3.21.rar:\DVD X Copy Platinum v3.21\DVDXCopy_Platinum_v3.2.1_full_install.exe:\ns_00017";"Virus found Win32/Heur";"Deleted" "D:\Programs\DVD_X_Copy_Platinum_v3.21.rar:\DVD X Copy Platinum v3.21\DVDXCopy_Platinum_v3.2.1_full_install.exe:\ns_00024";"Virus found Win32/Heur";"Deleted" "D:\Programs\DVD_X_Copy_Platinum_v3.21.rar:\DVD X Copy Platinum v3.21\DVDXCopy_Platinum_v3.2.1_full_install.exe";"Virus found Win32/Heur";"Deleted" "D:\Programs\DVD_X_Copy_Platinum_v3.21.rar:\DVD X Copy Platinum v3.21\DVD X Copy Platinum v3.21\DVDXCopy_Platinum_v3.2.1_full_install.exe:\ns_00006";"Virus found Win32/Heur";"Deleted" "D:\Programs\DVD_X_Copy_Platinum_v3.21.rar:\DVD X Copy Platinum v3.21\DVD X Copy Platinum v3.21\DVDXCopy_Platinum_v3.2.1_full_install.exe:\ns_00017";"Virus found Win32/Heur";"Deleted" "D:\Programs\DVD_X_Copy_Platinum_v3.21.rar:\DVD X Copy Platinum v3.21\DVD X Copy Platinum v3.21\DVDXCopy_Platinum_v3.2.1_full_install.exe:\ns_00024";"Virus found Win32/Heur";"Deleted" "D:\Programs\DVD_X_Copy_Platinum_v3.21.rar:\DVD X Copy Platinum v3.21\DVD X Copy Platinum v3.21\DVDXCopy_Platinum_v3.2.1_full_install.exe";"Virus found Win32/Heur";"Deleted" "D:\Programs\DVD_X_Copy_Platinum_v3.21.rar";"Virus found Win32/Heur";"Deleted" "D:\Programs\WinRAR.3.20.(final).+Keygen\KeyGen.exe";"Trojan horse Generic10.HJF";"Moved to Virus Vault" "Warnings" "File";"Infection";"Result" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{00000001-C003-4A2F-9142-7CB1D78DE6C1}";"Found Adware.InternetOptimizer";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{00000049-8F91-4D9C-9573-F016E7626484}";"Found Adware.Isearch";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{00110011-4B0B-44D5-9718-90C88817369B}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{002AF282-E42D-4B51-9F70-F1570C02FAAD}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{00C9C6A4-1889-46BC-B73A-F4DDCC042735}";"Found Adware.Vundo";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{00DBDAC8-4691-4797-8E6A-7C6AB89BC441}";"Found Downloader.ConHook.l";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{01E69986-A054-4C52-ABE8-EF63DF1C5211}";"Found Adware.CramToolbar";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{01EB5130-FC0C-4d75-B9CE-4801B1B854F5}";"Found Adware.Begin2Search";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{037CE595-57CB-4EB5-9775-97BC112F3BB3}";"Found Trojan.Bomka";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{06EECACB-F7C6-4ab9-B6AE-2DC4ED4588BB}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{086AE192-23A6-48D6-96EC-715F53797E85}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{08A312BB-5409-49FC-9347-54BB7D069AC6}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0A51FD8D-6835-4212-B796-AFC24F4D108A}";"Found Adware.CreatrixMedia";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0B9B7B2E-30E3-4C5D-AD2C-C38724979B4B}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0D045BAA-4BD3-4C94-BE8B-21536BD6BD9F}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0D4C7057-EAD2-44C6-AD18-9092905F28F1}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0EDC6C20-A31C-11DB-8AB9-0800200C9A66}";"Found Adware.RogueSuspect";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{11111111-2222-3333-4444-555555555555}";"Found Adware.Casino";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{11904CE8-632A-4856-A7CC-00B33FE71BD8}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{11A4CA8C-A8B9-49c2-A6D3-3F64C9EEBAE6}";"Found Adware.Shorty";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{13146842-6251-5625-3072-548536364311}";"Found Logger.Goldun.an";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{13589181-4F0D-4553-B9F8-B4B72172C139}";"Found Adware.Vundo";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{150FA160-130D-451F-B863-B655061432BA}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{16DF666F-BA95-4F41-B396-1381C2BA66F4}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{17DA0C9E-4A27-4ac5-BB75-5D24B8CDB972}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{18F57D30-EF36-4C0E-9343-7BFA6DF79B4A}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{192C5B4A-3EFD-40C7-9F99-C472DEB8EFC0}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{1C78AB3F-A857-482E-80C0-3A1E5238A565}";"Found Adware.Isearch";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{1CA480CD-C0E5-4548-874E-B85B17905B3A}";"Found Trojan.Zlob.f";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{1E6CE4CD-161B-4847-B8BF-E2EF72299D69}";"Found Logger.Sters";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{1F48AA48-C53A-4E21-85E7-AC7CC6B5FFB2}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{22DFEAE8-9AD2-4FC6-9CBA-A6566CA3B6EB}";"Found Adware.Begin2search";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{2305D8B7-B649-4C65-BA03-4C8B05213E1A}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{2353FCBC-012D-487B-8BF3-865C0929FBEB}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{2513A321-CB50-4C5F-91C5-80342AFACFB1}";"Found Adware.TitanShieldAntispyware";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{25E1A054-1262-459F-9F14-BF06148F4253}";"Found Trojan.Bomka";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{27A7FB75-FB40-4f94-BCF6-4945BCC8BAAF}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{28DFFB3C-A6C2-481B-B8D7-AD205DECBA6E}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{2A7372BA-656A-409A-B76D-F2B2B2DC6B1F}";"Found Adware.Vundo";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{2D38A51A-23C9-48a1-A33C-48675AA2B494}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{2E246FAE-8420-11D9-870D-000C2917DE7F}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{2E9CAFF6-30C7-4208-8807-E79D4EC6F806}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{3050F4D8-6D62-11CE-AF61-013309406392}";"Found Trojan.BindFil.g";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{3050F4D8-6D62-11CE-AF61-E13309406392}";"Found Trojan.ZMark.a";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{31615D5C-5126-448A-818A-A7CDFEE85A9B}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{325338F0-AED0-45f6-A0DA-B5B09E6A07ED}";"Found Adware.SavingsHound";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{366B2151-E1C7-44a3-86A3-E5686C2A3D2F}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{39C78B50-7E98-4aa0-B007-D83114EA6E0F}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{39D3264A-0031-49DB-860D-37647ACCB78A}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{39F25B12-74FF-4079-A51F-1D70F5B08B84}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{3AAC4C68-AFC8-11DB-80EF-8AF955D89593}";"Found Adware.RogueSuspect";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{3BF1F86F-B1A8-489B-8D8B-43781D51411F}";"Found Hijacker.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{3E9B951E-6F72-431B-82CF-4A9FBF2F53BC}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{3EBDDEDC-85D1-462F-B875-F013A8EA7B8D}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{3FE36807-69ED-45D1-B9BE-85C0E3F75B6A}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{4136C3F6-7636-49bf-A122-D4DA53B1ADDF}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{4145B998-6511-46de-A873-FD1DBD053164}";"Found Adware.SurfComp";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{41ED67C9-2734-4094-AD92-32F9EFEB5CC7}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{426F81A5-0B8C-4948-8115-11606FD3F389}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{429E4B60-3CEC-43C3-A53B-501C25F7F5FD}";"Found Adware.Vundo";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{44240BB5-BD7D-4D49-A1AA-8AB0F3D3CB44}";"Found Trojan.Small.anm";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{4734044C-7427-43D8-ADBE-DF942E52BEF2}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{4A85F02A-CCD3-4E96-9BB1-7ACE7D0B9C23}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{4AA870AC-8427-42a4-B92E-ECD956197489}";"Found Adware.BetterInternet";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{4DA4616D-7E6E-4FD9-A2D5-B6C535733E22}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{4E7BD74F-2B8D-469E-C1F2-F063A09BB32A}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{5054F860-748D-4840-B7B4-DDDB428421AF}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{5240864B-FDFE-4563-3514-463926792311}";"Found Logger.Goldun.ac";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{52B1DFC7-AAFC-4362-B103-868B0683C697}";"Found Adware.Vundo";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{56262124-6251-5625-3072-548536364311}";"Found Logger.Goldun.aa";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{5753791B-F607-48CA-814E-91C14D081F9E}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{5EB7CB50-E375-4718-B4C0-9AD12EFA2F84}";"Found Downloader.Agent.rs";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{5FCA4D4F-CBDD-4263-3814-463926792311}";"Found Logger.Goldun.ae";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{61468245-A343-CF27-3452-44DF4679BDF1}";"Found Trojan.Goldun.v";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{62457936-6381-6170-3572-468926792311}";"Found Logger.Goldun.ed";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{65194BCE-CBDD-4263-3814-463926792311}";"Found Logger.Goldun.h";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{659E147E-BD03-4605-988C-AA6D7EA497CA}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{65E9801C-0472-47F9-85A0-8442D47A82B0}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{67982BB7-0F95-44C5-92DC-E3AF3DC19D6D}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{6DA975EA-CBB4-411B-97C0-DB0A892BF2C1}";"Found Trojan.Agent.dq";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{6DD0BC06-4719-4BA3-BEBC-FBAE6A448152}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{6E28339B-7A2A-47B6-AEB2-46BA53782373}";"Found Trojan.Wayphisher";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{6E28339B-7A2A-47B6-AEB2-46BA53782375}";"Found Trojan.Wayphisher";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{6E28339B-7A2A-47B6-AEB2-46BA53782378}";"Found Trojan.Wayphisher";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{6E2CE423-B3F7-4DCC-ACF3-8671CC20BFCF}";"Found Adware.Vundo";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{6EEB621D-02F7-4EE6-B889-C6218BFCFEA8}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{6F3F8C08-2506-4CD0-B1A9-E4A83383CBBB}";"Found Adware.Vundo";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{6F71C05E-6C91-4A3A-9146-9C19DA2E4CCE}";"Found Adware.Vundo";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{724510C3-F3C8-4FB7-879A-D99F29008A2F}";"Found Hijacker.SpyAxe";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{7507739F-BC2E-4DC3-B233-816783C25DC9}";"Found Downloader.Delf";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{7697DB96-5DA3-44F2-BC97-AD35E5F4CEDC}";"Found Adware.Vundo";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{780916B6-00F4-484C-8AF7-A69CEAE0736B}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{78653A3E-A63F-42A9-A6FE-7524F4058767}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{79A002FB-C126-462D-B4A7-81D6B42D1666}";"Found Adware.DirectIP";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{79A576C4-B7A9-47EC-B57C-2CE5CA6ECC6A}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{7A1693A1-AFAF-4F1E-9B05-EEC38A85FBF3}";"Found Trojan.Kolweb.b";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{7A1A109F-58B3-414B-9829-5F4D9BE5FEDE}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{7BF451AC-2010-4804-B256-DB2F0A8D9EB6}";"Found Adware.Vundo";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{7E093FD0-5372-4FD5-9C7B-875668B4CDB2}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{7FC91C90-8256-4868-B4B1-DACDDC9A4546}";"Found Adware.Vundo";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{80D484FE-0AA1-4D80-9FF2-5B196084E051}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{811ABD55-9D94-4892-AB46-11D7DA29B8AE}";"Found Downloader.Small.ain";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{826B2228-BC09-49F2-B5F8-42CE26B1B712}";"Found Downloader.Delf";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{827DC836-DD9F-4A68-A602-5812EB50A834}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{8333C319-0669-4893-A418-F56D9249FCA6}";"Found Adware.TitanShieldAntispyware";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{83A5F7B7-DC75-44CE-9195-264F41709FA9}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{84695FD5-A8A8-11D8-978E-005022E14DE2}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{85597C9D-3994-4B7F-8CE3-515E632297A1}";"Found Adware.Vundo";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{86059629-45EE-4AA6-A994-672B68AC8B44}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{87185E78-A61B-4DB3-965A-3235BBD7A622}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{873EB32D-AE1A-4183-89BD-45A77F761BE4}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{88C9975E-3995-4C53-BB17-B893F278049A}";"Found Adware.Vundo";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{88CC91DE-5930-45AD-9E04-6B1233609FEA}";"Found Adware.Appoli";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{88D758A3-D33B-45FD-91E3-67749B4057FA}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{88DE3E1B-3D01-4032-9BAE-FD1994A3D7B8}";"Found Adware.RogueSuspect";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{8B309141-83A9-4C92-BCBE-2ADA24058DF0}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{8DBF02DA-4360-4A7E-BEA1-347B87816327}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{8E13DDE1-E013-47ec-9C4C-27C2F78BDD26}";"Found Trojan.Conhook.c";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9068A414-3AF9-4F79-AF1C-E6EA415BAF52}";"Found Adware.Vundo";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9148C6A5-5F1A-41EC-B3C2-883FA9F2CBAC}";"Found Adware.Vundo";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{93C6313C-9DB4-4694-8BD0-E378C573A9AD}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9ADE0443-2AB2-4B23-A3F8-AC520773DE12}";"Found Adware.Begin2Search";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9C691A33-7DDA-4C2F-BE4C-C176083F35CF}";"Found Adware.TitanShieldAntispyware";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9E69A5DE-24D3-4D3B-8117-5B60439EBFC2}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{A19EF336-01D4-48E6-926A-FE7E1C747AED}";"Found Adware.MWSearch";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{A5845A98-EBDA-4670-9DE6-5201C506E741}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{A6F42CAD-2559-48DF-AF30-89E480AF5DFA}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{A708A39C-8DA7-4e36-B3B0-0A1FFAFD4B6D}";"Found Trojan.KillAV.e";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{A708A39C-8DA7-4e36-B3B0-0A1FFAFD4BCD}";"Found Trojan.KillAV.e";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{A717DBE3-D78D-4aa7-BDCF-2CC06B36371B}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{AC9382D7-F0ED-4350-B7A7-4A383A1A93B0}";"Found Adware.Vundo";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{AD42064F-2C53-CB42-1263-6A7F24C2B819}";"Found Adware.RogueSuspect";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{AE21A223-C4CA-43D7-9764-4FC6DF529F4D}";"Found Adware.7000n";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{AF43C96A-216D-7D7A-AF61-0018C6061DD0}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{AF7FCAFB-9FDB-4F5E-BAC6-68BDEE61D6C6}";"Found Adware.Vundo";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{B313D637-F405-4052-AC37-E2119AB3C8F8}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{B49DA3DF-E569-423d-BDEA-8F89128E8107}";"Found Trojan.Foron";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{B53455DB-5527-4041-AC41-F86E6947AA47}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{B72549CE-5644-4116-B8A4-A2B042321EC4}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{B8B55274-0F9A-41E5-9067-A3539BD9E860}";"Found Trojan.Agent.dj";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{BBBE1C1A-89F7-4AF6-ABD1-F8FBCFA47408}";"Found Adware.Able2know";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{BEF178EB-79D6-4BFA-8213-6FB8EA4769C8}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{BF1CED2C-4B3F-4079-A330-864EDA5A4CFF}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C1FE7C8F-043A-4FAC-AB62-2CC56F7482B1}";"Found Adware.Vundo";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C370527A-24A7-4583-BE01-72E59000EB17}";"Found Adware.AFAEnhance";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C3A64E2B-748B-4CA4-B20C-8C2817E12A6F}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C75A33FE-50C7-4F0F-81B0-6EB2272022CB}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C95FE080-8F5D-11D2-A20B-00AA003C157A}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CBE0D59D-F985-4AC6-8826-FEE957065D42}";"Found Adware.Vundo";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CE70731D-F28D-4D81-9D61-C8EE60378401}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CE7C3CF0-4B15-11D1-0BED-709549C10020}";"Found Hijacker.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CF021F40-3E14-23A5-CBA2-717765721306}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D1AC752E-883F-4ED8-8828-B618C3A72152}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D4D5C535-BA95-4327-870D-A33826FDD17A}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D5EFDB0E-4F51-414F-B740-54A5C87A8957}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D9E5F993-FAEC-45B1-84F4-78A5BF27ED89}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{DA7FF3F8-08BE-4CAC-BC00-94D91C6AE7F4}";"Found Adware.MWSearch";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{DDDC947A-43F1-446A-A257-632F3ABDC212}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{DE23A040-D6AA-43ca-9B86-D9BE3DAA6FE7}";"Found Trojan.KillAV.F";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E14DCE67-8FB7-4721-8149-179BAA4D792C}";"Found Trojan.Ciadoor.m";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E2B2B5A1-B48C-4886-A318-723916A01024}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E2DDF680-9905-4DEE-8C64-0A5DE7FE133C}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E694E3DC-723F-40C7-87FE-6FFC222AD122}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E6D5237D-A6C7-4C83-A67F-F9F15586FA62}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E730189A-9973-4121-B046-AD1C161EC3AF}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E7AFFF2A-1B57-49C7-BF6B-E5123394C970}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E8EDB60C-951E-4130-93DC-FAF1AD25F8E7}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E99D4D0C-EB54-46AF-B62A-3AA1F31D53E5}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E9CCF15D-4C68-4B5A-9E9A-8E12E4BD39BD}";"Found Hijacker.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{EA32FB3B-21C9-42cc-B8EF-01A9B28EDB0D}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{EA806E03-A6B1-205A-117C-013309406392}";"Found Trojan.Singu.s";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{EB1CE8AA-7F27-45D3-BA59-37AFBFB4437F}";"Found Adware.Vundo";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{EC83B900-B33A-D316-EF7D-013309406392}";"Found Trojan.Stoped.b";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{EDBF1BC8-39AB-48EB-A0A9-C75078EB7C8E}";"Found Adware.SpyAxe";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{EE02B99B-1D55-48bc-B8DB-649A42CE45F6}";"Found Adware.CreatrixMedia";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{F007E221-018D-4baf-924A-B0E9092F3853}";"Found Adware.CreatrixMedia";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{F5BDC469-1EC5-4193-824B-2E209993D183}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{F74B358E-6979-40a9-96CD-636C80B87AFF}";"Found Trojan.BankAsh.g";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{F7D40011-29BB-43EB-9C97-875CE89E9E36}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{FA1A6CC3-BE63-4f7c-A455-417D35A67DA6}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{FBD49452-69E0-4837-91FA-9227A6DD1A83}";"Found Adware.Vundo";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{FC148228-87E1-4D00-AC06-58DCAA52A4D1}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{FD9BC004-8331-4457-B830-4759FF704C22}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{FDC47F1A-61E1-4AC5-89CA-6B95644953AE}";"Found Adware.Virtumonde";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{FE6A3E85-0F6C-49AD-8843-68FF44E7EEA9}";"Found Adware.SecureServicePack";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{FF1BF4C7-4E08-4A28-A43F-9D60A9F7A880}";"Found Adware.Generic";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{FFD2825E-0785-40C5-9A41-518F53A8261F}";"Found Adware.TitanShieldAntispyware";"Potentially dangerous object" "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF}";"Found Adware.Generic";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\revsci.net.55564293";"Found Tracking cookie.Revsci";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\revsci.net.e9dbeb91";"Found Tracking cookie.Revsci";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\revsci.net.44927ec";"Found Tracking cookie.Revsci";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\revsci.net.2df99d79";"Found Tracking cookie.Revsci";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\m.webtrends.com.b4ca7df0";"Found Tracking cookie.Webtrends";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\realmedia.com.68087763";"Found Tracking cookie.Realmedia";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\realmedia.com.c0c4936";"Found Tracking cookie.Realmedia";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\realmedia.com.ef906bac";"Found Tracking cookie.Realmedia";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\casalemedia.com.80ad4799";"Found Tracking cookie.Casalemedia";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\casalemedia.com.987e6b46";"Found Tracking cookie.Casalemedia";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\casalemedia.com.1773afc";"Found Tracking cookie.Casalemedia";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\casalemedia.com.1d158016";"Found Tracking cookie.Casalemedia";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\casalemedia.com.837115b5";"Found Tracking cookie.Casalemedia";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\serving-sys.com.4b416ef8";"Found Tracking cookie.Serving-sys";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\serving-sys.com.400f83f";"Found Tracking cookie.Serving-sys";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\serving-sys.com.6a1cf9e8";"Found Tracking cookie.Serving-sys";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\serving-sys.com.606c3d3b";"Found Tracking cookie.Serving-sys";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\serving-sys.com.c9034af6";"Found Tracking cookie.Serving-sys";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\bs.serving-sys.com.5bf1f00f";"Found Tracking cookie.Serving-sys";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\serving-sys.com.255d6f2f";"Found Tracking cookie.Serving-sys";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\adopt.euroclick.com.17044b51";"Found Tracking cookie.Euroclick";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\adopt.euroclick.com.891542da";"Found Tracking cookie.Euroclick";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\adopt.euroclick.com.6d7740f7";"Found Tracking cookie.Euroclick";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\adopt.euroclick.com.fb764ef7";"Found Tracking cookie.Euroclick";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\adopt.euroclick.com.ffe11db7";"Found Tracking cookie.Euroclick";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\adopt.euroclick.com.8b1bd7bc";"Found Tracking cookie.Euroclick";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\aavalue.com.1caaee8";"Found Tracking cookie.Aavalue";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\statcounter.com.cbeca241";"Found Tracking cookie.Statcounter";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\statcounter.com.b05e19c9";"Found Tracking cookie.Statcounter";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\statcounter.com.8aeeaeee";"Found Tracking cookie.Statcounter";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\statcounter.com.e8529e99";"Found Tracking cookie.Statcounter";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt:\adengage.com.2864435e";"Found Tracking cookie.Adengage";"Potentially dangerous object" "C:\Documents and Settings\Chad\Application Data\Mozilla\Firefox\Profiles\qb33fdmw.default\cookies.txt";"Found Tracking cookie.Revsci";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@2o7[2].txt:\2o7.net.686f76b4";"Found Tracking cookie.2o7";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@2o7[2].txt:\2o7.net.484dbb69";"Found Tracking cookie.2o7";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@2o7[2].txt:\2o7.net.37588d03";"Found Tracking cookie.2o7";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@2o7[2].txt:\2o7.net.9a95c5ee";"Found Tracking cookie.2o7";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@2o7[2].txt:\2o7.net.421018d1";"Found Tracking cookie.2o7";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@2o7[2].txt:\2o7.net.b1303688";"Found Tracking cookie.2o7";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@2o7[2].txt";"Found Tracking cookie.2o7";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[1].txt:\ad.yieldmanager.com.ff92306";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[1].txt:\ad.yieldmanager.com.539b0606";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[1].txt:\ad.yieldmanager.com.87a9ab5d";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[1].txt:\ad.yieldmanager.com.8a47878";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[1].txt:\ad.yieldmanager.com.b68f2b7b";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[1].txt:\ad.yieldmanager.com.557bf2b0";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[1].txt:\ad.yieldmanager.com.e762f029";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[1].txt";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[2].txt:\ad.yieldmanager.com.ff92306";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[2].txt:\ad.yieldmanager.com.b68f2b7b";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[2].txt:\ad.yieldmanager.com.557bf2b0";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[2].txt:\ad.yieldmanager.com.8a47878";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[2].txt:\ad.yieldmanager.com.830b6f08";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[2].txt:\ad.yieldmanager.com.539b0606";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[2].txt:\ad.yieldmanager.com.eec26c3e";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[2].txt:\ad.yieldmanager.com.e762f029";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[2].txt";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[3].txt:\ad.yieldmanager.com.ff92306";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[3].txt:\ad.yieldmanager.com.539b0606";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[3].txt:\ad.yieldmanager.com.87a9ab5d";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[3].txt:\ad.yieldmanager.com.8a47878";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[3].txt:\ad.yieldmanager.com.b68f2b7b";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[3].txt:\ad.yieldmanager.com.557bf2b0";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[3].txt:\ad.yieldmanager.com.830b6f08";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[3].txt:\ad.yieldmanager.com.e762f029";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[3].txt";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[5].txt:\ad.yieldmanager.com.ff92306";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[5].txt:\ad.yieldmanager.com.539b0606";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[5].txt:\ad.yieldmanager.com.87a9ab5d";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[5].txt:\ad.yieldmanager.com.8a47878";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[5].txt:\ad.yieldmanager.com.b68f2b7b";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[5].txt:\ad.yieldmanager.com.557bf2b0";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[5].txt:\ad.yieldmanager.com.830b6f08";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[5].txt:\ad.yieldmanager.com.e762f029";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@ad.yieldmanager[5].txt";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@adengage[1].txt:\adengage.com.2864435e";"Found Tracking cookie.Adengage";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@adengage[1].txt:\adengage.com.98337295";"Found Tracking cookie.Adengage";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@adengage[1].txt:\adengage.com.411a57fb";"Found Tracking cookie.Adengage";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@adengage[1].txt";"Found Tracking cookie.Adengage";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@adopt.euroclick[2].txt:\adopt.euroclick.com.6d7740f7";"Found Tracking cookie.Euroclick";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@adopt.euroclick[2].txt:\adopt.euroclick.com.17044b51";"Found Tracking cookie.Euroclick";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@adopt.euroclick[2].txt:\adopt.euroclick.com.8b1bd7bc";"Found Tracking cookie.Euroclick";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@adopt.euroclick[2].txt:\adopt.euroclick.com.fb764ef7";"Found Tracking cookie.Euroclick";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@adopt.euroclick[2].txt:\adopt.euroclick.com.891542da";"Found Tracking cookie.Euroclick";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@adopt.euroclick[2].txt:\adopt.euroclick.com.ffe11db7";"Found Tracking cookie.Euroclick";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@adopt.euroclick[2].txt";"Found Tracking cookie.Euroclick";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@adrevolver[2].txt:\adrevolver.com.f6cfcad4";"Found Tracking cookie.Adrevolver";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@adrevolver[2].txt:\adrevolver.com.9b9d670a";"Found Tracking cookie.Adrevolver";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@adrevolver[2].txt:\adrevolver.com.4a719aa9";"Found Tracking cookie.Adrevolver";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@adrevolver[2].txt:\adrevolver.com.b595d4db";"Found Tracking cookie.Adrevolver";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@adrevolver[2].txt";"Found Tracking cookie.Adrevolver";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@advertising[2].txt:\advertising.com.525a5fb9";"Found Tracking cookie.Advertising";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@advertising[2].txt:\advertising.com.203aa218";"Found Tracking cookie.Advertising";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@advertising[2].txt:\advertising.com.f62113d5";"Found Tracking cookie.Advertising";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@advertising[2].txt:\advertising.com.1820df7a";"Found Tracking cookie.Advertising";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@advertising[2].txt:\advertising.com.b624fa46";"Found Tracking cookie.Advertising";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@advertising[2].txt";"Found Tracking cookie.Advertising";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@atdmt[2].txt:\atdmt.com.b3e33b5f";"Found Tracking cookie.Atdmt";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@atdmt[2].txt";"Found Tracking cookie.Atdmt";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@bluestreak[1].txt:\bluestreak.com.bf396750";"Found Tracking cookie.Bluestreak";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@bluestreak[1].txt";"Found Tracking cookie.Bluestreak";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@burstnet[2].txt:\burstnet.com.a3218a37";"Found Tracking cookie.Burstnet";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@burstnet[2].txt:\burstnet.com.27341d57";"Found Tracking cookie.Burstnet";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@burstnet[2].txt:\burstnet.com.c4fe2ebb";"Found Tracking cookie.Burstnet";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@burstnet[2].txt";"Found Tracking cookie.Burstnet";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@casalemedia[2].txt:\casalemedia.com.80ad4799";"Found Tracking cookie.Casalemedia";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@casalemedia[2].txt:\casalemedia.com.987e6b46";"Found Tracking cookie.Casalemedia";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@casalemedia[2].txt:\casalemedia.com.1773afc";"Found Tracking cookie.Casalemedia";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@casalemedia[2].txt:\casalemedia.com.837115b5";"Found Tracking cookie.Casalemedia";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@casalemedia[2].txt:\casalemedia.com.5e43734d";"Found Tracking cookie.Casalemedia";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@casalemedia[2].txt";"Found Tracking cookie.Casalemedia";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@doubleclick[1].txt:\doubleclick.net.bf396750";"Found Tracking cookie.Doubleclick";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@doubleclick[1].txt";"Found Tracking cookie.Doubleclick";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@enhance[2].txt:\enhance.com.2ff9c31e";"Found Tracking cookie.Enhance";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@enhance[2].txt:\enhance.com.378d31e7";"Found Tracking cookie.Enhance";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@enhance[2].txt";"Found Tracking cookie.Enhance";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@fastclick[2].txt:\fastclick.net.fac3d6f0";"Found Tracking cookie.Fastclick";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@fastclick[2].txt:\fastclick.net.8a6435e9";"Found Tracking cookie.Fastclick";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@fastclick[2].txt:\fastclick.net.57e8da10";"Found Tracking cookie.Fastclick";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@fastclick[2].txt:\fastclick.net.6fd479aa";"Found Tracking cookie.Fastclick";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@fastclick[2].txt";"Found Tracking cookie.Fastclick";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@findwhat[1].txt:\findwhat.com.539b0606";"Found Tracking cookie.Findwhat";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@findwhat[1].txt";"Found Tracking cookie.Findwhat";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@hitbox[2].txt:\hitbox.com.bbf2a6e8";"Found Tracking cookie.Hitbox";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@hitbox[2].txt:\hitbox.com.2b95f8a3";"Found Tracking cookie.Hitbox";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@hitbox[2].txt";"Found Tracking cookie.Hitbox";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@hypertracker[1].txt:\hypertracker.com.f9487006";"Found Tracking cookie.Hypertracker";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@hypertracker[1].txt";"Found Tracking cookie.Hypertracker";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@m.webtrends[1].txt:\m.webtrends.com.b4ca7df0";"Found Tracking cookie.Webtrends";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@m.webtrends[1].txt";"Found Tracking cookie.Webtrends";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@media.adrevolver[2].txt:\media.adrevolver.com.5fed601d";"Found Tracking cookie.Adrevolver";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@media.adrevolver[2].txt:\media.adrevolver.com.2be00b0";"Found Tracking cookie.Adrevolver";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@media.adrevolver[2].txt";"Found Tracking cookie.Adrevolver";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@mediaplex[2].txt:\mediaplex.com.f652b123";"Found Tracking cookie.Mediaplex";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@mediaplex[2].txt:\mediaplex.com.323e9a10";"Found Tracking cookie.Mediaplex";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@mediaplex[2].txt";"Found Tracking cookie.Mediaplex";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@overture[2].txt:\overture.com.d727de6f";"Found Tracking cookie.Overture";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@overture[2].txt:\overture.com.52ca467a";"Found Tracking cookie.Overture";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@overture[2].txt:\overture.com.8e32a996";"Found Tracking cookie.Overture";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@overture[2].txt";"Found Tracking cookie.Overture";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@perf.overture[1].txt:\perf.overture.com.610ef18d";"Found Tracking cookie.Overture";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@perf.overture[1].txt";"Found Tracking cookie.Overture";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@realmedia[1].txt:\realmedia.com.68087763";"Found Tracking cookie.Realmedia";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@realmedia[1].txt:\realmedia.com.ef906bac";"Found Tracking cookie.Realmedia";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@realmedia[1].txt:\realmedia.com.c0c4936";"Found Tracking cookie.Realmedia";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@realmedia[1].txt:\realmedia.com.6b2e2a72";"Found Tracking cookie.Realmedia";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@realmedia[1].txt";"Found Tracking cookie.Realmedia";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@revsci[1].txt:\revsci.net.44927ec";"Found Tracking cookie.Revsci";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@revsci[1].txt:\revsci.net.6132e6c9";"Found Tracking cookie.Revsci";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@revsci[1].txt:\revsci.net.676dd36f";"Found Tracking cookie.Revsci";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@revsci[1].txt:\revsci.net.f1b6b2e";"Found Tracking cookie.Revsci";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@revsci[1].txt:\revsci.net.e9dbeb91";"Found Tracking cookie.Revsci";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@revsci[1].txt:\revsci.net.2df99d79";"Found Tracking cookie.Revsci";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@revsci[1].txt";"Found Tracking cookie.Revsci";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@statcounter[2].txt:\statcounter.com.e8529e99";"Found Tracking cookie.Statcounter";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@statcounter[2].txt:\statcounter.com.b05e19c9";"Found Tracking cookie.Statcounter";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@statcounter[2].txt:\statcounter.com.51e1825d";"Found Tracking cookie.Statcounter";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@statcounter[2].txt:\statcounter.com.80be278e";"Found Tracking cookie.Statcounter";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@statcounter[2].txt:\statcounter.com.99cd0d15";"Found Tracking cookie.Statcounter";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@statcounter[2].txt";"Found Tracking cookie.Statcounter";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@tacoda[1].txt:\tacoda.net.c4fe2ebb";"Found Tracking cookie.Tacoda";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@tacoda[1].txt:\tacoda.net.d323296e";"Found Tracking cookie.Tacoda";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@tacoda[1].txt:\tacoda.net.5935e89";"Found Tracking cookie.Tacoda";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@tacoda[1].txt:\tacoda.net.27341d57";"Found Tracking cookie.Tacoda";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@tacoda[1].txt:\tacoda.net.e9f57f8";"Found Tracking cookie.Tacoda";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@tacoda[1].txt";"Found Tracking cookie.Tacoda";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@tradedoubler[1].txt:\tradedoubler.com.eab0972e";"Found Tracking cookie.Tradedoubler";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@tradedoubler[1].txt:\tradedoubler.com.ba12c0e9";"Found Tracking cookie.Tradedoubler";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@tradedoubler[1].txt";"Found Tracking cookie.Tradedoubler";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@trafficmp[2].txt:\trafficmp.com.e2e71e33";"Found Tracking cookie.Trafficmp";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@trafficmp[2].txt:\trafficmp.com.37644bdb";"Found Tracking cookie.Trafficmp";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@trafficmp[2].txt:\trafficmp.com.ae53b8b";"Found Tracking cookie.Trafficmp";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@trafficmp[2].txt:\trafficmp.com.a00e30b4";"Found Tracking cookie.Trafficmp";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@trafficmp[2].txt:\trafficmp.com.f3e5803e";"Found Tracking cookie.Trafficmp";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@trafficmp[2].txt";"Found Tracking cookie.Trafficmp";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@tribalfusion[2].txt:\tribalfusion.com.dcc03271";"Found Tracking cookie.Tribalfusion";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@tribalfusion[2].txt:\tribalfusion.com.7610f0e0";"Found Tracking cookie.Tribalfusion";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@tribalfusion[2].txt:\tribalfusion.com.9bc3e98f";"Found Tracking cookie.Tribalfusion";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@tribalfusion[2].txt:\tribalfusion.com.8b22ad8c";"Found Tracking cookie.Tribalfusion";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@tribalfusion[2].txt";"Found Tracking cookie.Tribalfusion";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@zedo[2].txt:\zedo.com.a5b6a132";"Found Tracking cookie.Zedo";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@zedo[2].txt:\zedo.com.c1dd09f2";"Found Tracking cookie.Zedo";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@zedo[2].txt:\zedo.com.775ee79c";"Found Tracking cookie.Zedo";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@zedo[2].txt:\zedo.com.f1d14556";"Found Tracking cookie.Zedo";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@zedo[2].txt:\zedo.com.f462b69f";"Found Tracking cookie.Zedo";"Potentially dangerous object" "C:\Documents and Settings\Chad\Cookies\chad@zedo[2].txt";"Found Tracking cookie.Zedo";"Potentially dangerous object" Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:47:30 AM, on 5/16/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user') O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: KenoPop! by pogo - http://game3.pogo.com/v/8.1.8.21/app...keno-en_US.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - http://lads.myspace.com/upload/MySpaceUploader1006.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1203479944187 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 5684 bytes |
|
|
|
|
05-16-2008, 12:17 PM
|
#9 (permalink) | |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: popups and running slow
Quote:
As for the 376 warnings that showed up in the AVG scan, AVG should have deleted them, you can run another scan to verify this. ========== Delete SDFix on your desktop, also delete the SDFix folder at C:\SDFix. ========== Well done,your logs are clean. Click start>run>type(or copy/paste command into run box): ComboFix /u Click ok. ====== Clear IE7 cookies *On the Internet Explorer 7 Tools menu, click Internet Options. The Internet Options box should open to the General tab. *On the General tab, in the Browsing History, click the Delete button. This will delete all the files that are currently stored in your cache [that includes cookies too]. *Click OK, and then click OK again. Clear Firefox cookies/cache • Select "Tools" • Select "Options". • Select "Privacy". • In "Settings" window put the check mark for Cookies,Cache,Browsing history and any others you want. • Click OK. • In Private area click "Clear Now". ------------------------------------------------------------------------------------------- MICROSOFT UPDATES 1.Click Start,Run, type sysdm.cpl, and then press OK. 2.Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended). Microsoft updates are released every second Tuesday of each month,what is called "Patch Tuesday". ------------------------------------------------------------------------------------------ Useful Information and Programs to keep you safe. TrendProtect is a FREE browser plug-in that helps you avoid Web pages with unwanted content and hidden threats. TrendProtect rates the current page and pages listed in Google, MSN, and Yahoo search results. You can use the rating to decide if you want to visit or avoid a given Web page. To rate Web pages, TrendProtect refers to an extensive database that covers the following information for billions of Web pages: * Content category * Phishing scam detection * Site reputation * Page reputation WOT Free helps you avoid disingenuous Internet content by allowing you to learn from others' experiences. WOT shows you website reputations on your browser, telling you how much other users trust a website. This helps you make better decisions while browsing and avoid phishing, malware, and other types of fraud. Reputations can also be added to web search results, Gmail, Wikipedia, and other selected sites. WOT reputations are computed mainly from user testimonies. Sharing your knowledge with others is just a click away, without ever having to leave the site. We also collect data from hundreds of other sources (including PhishTank) to quickly warn you of emerging threats. Currently, WOT knows over 12 million websites. Note:Only compatible with Firefox 1.5 and higher. Only install one of the above -------------------------------------------------------------------------------------- Alternate Browsers Try the following free alternate browsers rather than Internet Explorer Avant Firefox Opera K-Meleon ------------------------------------------------------------------------------------------ Free Antispyware Products SuperAntiSpyware Ad-Aware Spybot S&D Download SpywareBlaster 3.5.1 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items. Download Spyware Guard to catch and block spyware before it can execute. ------------------------------------------------------------------ IE-Spyad™ is a freeware utility that places more than 4000 dubious websites and domains in the Internet Explorer Restricted List. Download and installation instructions for IE-Spyad™ Here ----------------------------------------- The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file. If your having trouble downloading & extracting,see link below for guidance: http://www.mvps.org/winhelp2002/hosts2.htm Once you have extracted the host file,double click on it and a new window will open. Double-click on mvps.batand follow the prompts --------------------------------------------------------------- Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here: Using Winpatrol to protect your computer. ---------------------------------------- SnoopFree is a programme that informs you when another programme is wanting to log your keystrokes or read your screen.Only for XP users. Update all these programs regularly. Without regular updates you will not be protected when new malicious programs are released. ============================================== Also, please take a look at these well written articles: PC Safety and Security--What Do I Need? HOW DID I GET INFECTED IN THE FIRST PLACE? by Tony Klein THE ANTI-SPYWARE TUTORIAL MAKING INTERNET EXPLORER SAFER Understanding and Using Firewalls **Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them. Please reply to this thread once more, as we may mark this as resolved, thanks. |
|
|
|
|
|
05-17-2008, 09:11 PM
|
#10 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 6
OS: windows xp
|
Re: popups and running slow
thank you very much for your help. he said his uncle built the pc and installed a bunch of programs on it and didnt know some of them were like that.
but thank you very much for you time and help and things are running great! |
|
|
|
| Thread Tools | |
|
|
