Welcome to Tech Support Forum home to more then 136,000 problems solved. Issues have included: Spyware, Malware, Virus Issues, Windows, Microsoft, Linux, Networking, Security, Hardware, and Gaming Getting your problem solved is as easy as:
1. Registering for a free account
2. Asking your question
3. Receiving an answer

Registered members:
* Get free support
* Communicate privately with other members (PM).
* Removal of this message
* See fewer ads.
* And much more..

 


Want to know how to post a question? click here Having problems with spyware and pop-ups? First Steps
Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads
Reload this Page Trojan Attack - IE7 & Outlook Gone!!
User Name
Password
Site Map Register Donate Rules Blogs Mark Forums Read


Resolved HJT Threads Resolved spyware and popup issues.

 
Page 1 of 2 1 2
 
LinkBack Thread Tools
Old 06-27-2008, 10:14 PM   #1 (permalink)
Registered User
 
Join Date: Jun 2008
Posts: 14
OS: XPsp2


Trojan Attack - IE7 & Outlook Gone!!
Hi Guys,

it seems my PC has a Trojan, which disabled my IE7 from launching and removed a sub-accounts Outlook. I cannot install certain AV apps since I now get errors saying Access Denied, speak to Admin (I'm the Admin account on this PC).

I've gotten as far as the Microsoft Windows Updater step but cannot get IE to load, so I skipped that and went on to DSS. Logs follow...

Deckard's System Scanner v20071014.68
Run by Daddy on 2008-06-27 23:54:12
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Percentage of Memory in Use: 86% (more than 75%).
Total Physical Memory: 510 MiB (512 MiB recommended).
System Drive C: has 10.53 GiB (less than 15%) free.


-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-06-27 23:55:05
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\acsd.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\LOGI_MWX.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Documents and Settings\Daddy\Desktop\dss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: (no name) - {3CF5EE4E-819D-4999-B0B0-7E3EA1262E61} - C:\WINDOWS\system32\yayxwuRj.dll
O2 - BHO: {5aefcc73-0e7a-160b-9d64-af388235e6e4} - {4e6e5328-83fa-46d9-b061-a7e037ccfea5} - C:\WINDOWS\system32\gcxeksws.dll
O2 - BHO: (no name) - {57A52E74-004C-464B-96CC-4DFE5366EA02} - C:\WINDOWS\system32\rqRLebCT.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar2.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar2.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [4cf06acf] rundll32.exe "C:\WINDOWS\system32\ndqrwtcq.dll",b
O4 - HKLM\..\Run: [BM4fc35953] Rundll32.exe "C:\WINDOWS\system32\dqlhvmcg.dll",s
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKUS\S-1-5-18\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://fpdownload.macromedia.com/get...r/sw_promo.cab
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} (Shockwave ActiveX Control) - http://fpdownload.macromedia.com/get...irector/sw.cab
O16 - DPF: {3334504D-9980-0010-8000-00AA00389B71} () - http://download.microsoft.com/downlo...4D/mp43dmo.CAB
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} () - http://download.microsoft.com/downlo...22/wmv9VCM.CAB
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.shockwave.com/content/ric...GameLoader.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} () - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1161734388453
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get.../ultrashim.cab
O16 - DPF: {B0FB831D-17F6-4CBD-9B5D-3305881D362E} (LHGLauncherXForm Control) - http://www.shockwave.com/content/rea...LGLauncher.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub...sh/swflash.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://www.shockwave.com/content/fee...utLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.shockwave.com/content/zum...loader_v10.cab
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/optimize2/pcpitstop2.dll
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{15DDA148-4767-49AE-B6CC-EBAB3F0FF04F}: NameServer = 192.168.1.1,192.168.1.3
O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL kcjckdhn.dll
O20 - Winlogon Notify: rqRLebCT - C:\WINDOWS\system32\rqRLebCT.dll
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\acsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\ijplmsvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe


--
End of file - 14237 bytes

-- Files created between 2008-05-27 and 2008-06-27 -----------------------------

2008-06-27 19:35:53 0 d-------- C:\Program Files\ZonedOut
2008-06-27 19:33:00 0 d-------- C:\ie-spyad_zo
2008-06-27 19:23:28 0 d-------- C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-27 19:22:06 0 d-------- C:\Program Files\SpywareBlaster
2008-06-26 23:45:33 0 d-------- C:\Program Files\Panda Security
2008-06-26 23:25:06 0 d-------- C:\Documents and Settings\Daddy\Application Data\AVGTOOLBAR
2008-06-26 21:33:33 80896 --a------ C:\WINDOWS\system32\ndqrwtcq.dll
2008-06-26 21:33:27 106496 --a------ C:\WINDOWS\system32\gcxeksws.dll
2008-06-26 21:31:09 91648 --a------ C:\WINDOWS\system32\dqlhvmcg.dll
2008-06-26 15:48:41 3872 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-06-26 15:47:08 0 d-------- C:\kav
2008-06-26 15:26:45 22804 --ah----- C:\WINDOWS\system32\mlfcache.dat
2008-06-25 19:29:25 0 d-------- C:\Documents and Settings\Daddy\Application Data\Mozilla
2008-06-25 19:20:57 106496 --a------ C:\WINDOWS\system32\wsjbtmiv.dll
2008-06-25 19:19:22 91136 --a------ C:\WINDOWS\system32\bsjhqmpv.dll
2008-06-25 10:59:16 0 d-------- C:\Documents and Settings\Mom\Application Data\Verizon
2008-06-25 09:19:51 0 d-------- C:\Documents and Settings\Stephanie\Application Data\Verizon
2008-06-24 20:57:28 0 d--h----- C:\WINDOWS\PIF
2008-06-24 18:03:48 0 dr------- C:\Documents and Settings\NetworkService\My Documents <MYDOCU~1>
2008-06-24 17:50:51 0 d-------- C:\Documents and Settings\Daddy\Application Data\Verizon
2008-06-24 17:50:25 0 d-------- C:\Documents and Settings\All Users\Application Data\Verizon
2008-06-24 12:42:59 99840 --a------ C:\WINDOWS\system32\hoxllhaf.dll
2008-06-24 12:36:59 91136 --a------ C:\WINDOWS\system32\ulxjseaf.dll
2008-06-23 12:43:01 105984 --a------ C:\WINDOWS\system32\kcjckdhn.dll
2008-06-23 12:37:00 91136 --a------ C:\WINDOWS\system32\mjjpqlfd.dll
2008-06-23 00:45:29 25088 --a------ C:\WINDOWS\system32\awtqrPJC.dll
2008-06-23 00:33:58 652764 --ahs---- C:\WINDOWS\system32\jRuwxyay.ini2
2008-06-23 00:33:55 323072 --a------ C:\WINDOWS\system32\yayxwuRj.dll
2008-06-23 00:30:46 25088 --a------ C:\WINDOWS\system32\ljJASjJb.dll
2008-06-23 00:30:25 25088 --a------ C:\WINDOWS\system32\efcYQGVp.dll
2008-06-23 00:29:05 25088 --a------ C:\WINDOWS\system32\pmnLddcy.dll
2008-06-23 00:28:51 25088 --a------ C:\WINDOWS\system32\rqRLebCT.dll
2008-06-03 22:32:14 0 d-------- C:\Documents and Settings\Alex\Application Data\vlc
2008-06-03 21:22:23 0 d-------- C:\Program Files\PeerGuardian2
2008-06-01 12:16:42 0 d-------- C:\Documents and Settings\Stephanie\Application Data\CyberLink
2008-05-28 18:23:06 0 d-------- C:\Documents and Settings\All Users\Application Data\PCPitstop


-- Find3M Report ---------------------------------------------------------------

2008-06-26 22:57:40 0 d-------- C:\Program Files\Common Files\Symantec Shared
2008-06-26 15:43:09 0 d-------- C:\Program Files\Verizon
2008-06-26 15:42:34 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-06-26 15:42:29 0 d-------- C:\Program Files\Common Files
2008-06-24 17:34:07 0 d-------- C:\Documents and Settings\Daddy\Application Data\Apple Computer
2008-06-24 00:51:52 0 d-------- C:\Program Files\Soulseek
2008-06-22 15:45:12 0 d-------- C:\Documents and Settings\Daddy\Application Data\Azureus
2008-06-22 14:39:16 0 d-------- C:\Documents and Settings\Daddy\Application Data\Adobe
2008-06-18 19:39:53 0 d-------- C:\Documents and Settings\Daddy\Application Data\ZoomBrowser EX
2008-06-18 19:26:49 0 d-------- C:\Documents and Settings\Daddy\Application Data\Canon
2008-06-11 00:48:53 0 d-------- C:\Program Files\Solid AVI DIVX to DVD Burner
2008-06-01 00:51:58 0 d-------- C:\Documents and Settings\Daddy\Application Data\dvdcss
2008-05-25 10:52:38 0 d-------- C:\Documents and Settings\Daddy\Application Data\vlc
2008-05-25 10:46:36 0 d-------- C:\Program Files\VideoLAN
2008-05-25 10:33:02 0 d-------- C:\Documents and Settings\Daddy\Application Data\DVD Flick


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3CF5EE4E-819D-4999-B0B0-7E3EA1262E61}]
06/23/2008 12:33 AM 323072 --a------ C:\WINDOWS\system32\yayxwuRj.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4e6e5328-83fa-46d9-b061-a7e037ccfea5}]
06/26/2008 09:33 PM 106496 --a------ C:\WINDOWS\system32\gcxeksws.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{57A52E74-004C-464B-96CC-4DFE5366EA02}]
06/23/2008 12:28 AM 25088 --a------ C:\WINDOWS\system32\rqRLebCT.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}]
C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BCMSMMSG"="BCMSMMSG.exe" [08/29/2003 05:59 AM C:\WINDOWS\BCMSMMSG.exe]
"Logitech Utility"="LOGI_MWX.EXE" [11/26/2003 09:50 AM C:\WINDOWS\LOGI_MWX.EXE]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25 AM]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [10/26/2006 01:22 PM]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [10/26/2006 02:00 PM]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [09/24/2003 07:32 PM]
"nwiz"="nwiz.exe" [09/24/2003 07:32 PM C:\WINDOWS\system32\nwiz.exe]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [03/09/2007 11:09 AM]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [01/11/2008 08:54 PM]
"@"="" []
"Adobe_ID0EYTHM"="C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [03/20/2007 05:40 PM]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 11:16 PM]
"Verizon_McciTrayApp"="C:\Program Files\Verizon\McciTrayApp.exe" [09/28/2007 02:30 PM]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [03/28/2008 11:37 PM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [03/30/2008 10:36 AM]
"CanonSolutionMenu"="C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" [05/14/2007 09:01 PM]
"CanonMyPrinter"="C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" [04/03/2007 09:50 PM]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [10/25/2006 09:03 AM]
"OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [02/04/2007 12:02 PM]
"4cf06acf"="C:\WINDOWS\system32\ndqrwtcq.dll" [06/26/2008 09:33 PM]
"BM4fc35953"="C:\WINDOWS\system32\dqlhvmcg.dll" [06/26/2008 09:31 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 12:24 PM]
"NvMediaCenter"="C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit" []
"Aim6"="" []
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [11/12/2006 06:48 AM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 03:56 AM]
"PeerGuardian"="C:\Program Files\PeerGuardian2\pg2.exe" [09/18/2005 06:44 PM]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Symantec NetDriver Warning"=C:\PROGRA~1\SYMNET~1\SNDWarn.exe
"ALUAlert"=C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2/13/2001 2:01:04 AM]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57A52E74-004C-464B-96CC-4DFE5366EA02}"= C:\WINDOWS\system32\rqRLebCT.dll [06/23/2008 12:28 AM 25088]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqRLebCT]
rqRLebCT.dll 06/23/2008 12:28 AM 25088 C:\WINDOWS\system32\rqRLebCT.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL kcjckdhn.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\yayxwuRj

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{df50faf4-614e-11db-b3bb-806d6172696f}]
PlayWithPowerCinema\Command- "C:\Program Files\Dell\Media Experience\PCM2.exe" MOVIE "%L"




-- End of Deckard's System Scanner: finished at 2008-06-27 23:56:53 ------------

Any feedback would help since I'm over my head at this point.

Thanks!
Attached Files
File Type: txt extra.txt (23.6 KB, 3 views)
File Type: txt ActiveScan.txt (8.3 KB, 1 views)
bunker10 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Important Information
Join the #1 Tech Support Forum Today - It's Totally Free!

TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free.

Join TechSupportforum.com Today - Click Here

Old 07-01-2008, 04:57 AM   #2 (permalink)
Moderator, Analyst, Security Team
 
TheBruce1's Avatar
 
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP


Re: Trojan Attack - IE7 & Outlook Gone!!
Hello and welcome to TSF

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

========

Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear, a lack of symptoms does not mean that it is no longer present.

Please Do Not Attach logs to your posts unless you are advised to do so.

========

Please print out or copy this page to Notepad in order to assist you when carrying out the following instructions.

=========

P2P

P2P - I see you have P2P software Azureus and LimeWire 4.16.6 installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares and their infections.

References for the risk of these programs are Here,
Here and Here.

=========

Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs (if they exist):

J2SE Runtime Environment 5.0 Update 7
J2SE Runtime Environment 5.0 Update 9
J2SE Runtime Environment 5.0 Update 10
Java(TM) SE Runtime Environment 6 Update 1
Java(TM) 6 Update 2
Java(TM) 6 Update 3
Leave Java(TM) 6 Update 5 installed
Viewpoint Media Player<---Viewpoint is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 read this article: http://www.clickz.com/news/article.php/3561546

Additional Information Here
and Here

========

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:SDFix)

Please then reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, the Advanced Options Menu should appear;
  • Select the first option, to run Windows in Safe Mode, then press Enter.
  • Choose your usual account.
  • Open the extracted SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
    (Report.txt will also be copied to Clipboard ready for posting back on the forum).
  • Finally paste the contents of the Report.txt back on the forum with all the required logs

=========

Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/comb...o-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery mode. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once the Recovery Console is installed using ComboFix, you should see a message that says:

The Recovery Console was successfully installed.



Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Click Yes to allow ComboFix to continue scanning for malware.

When the tool is finished, it will produce a report for you.

==========

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

=========
Logs Required
Report.txt
C;\Combofix.txt
Hijackthis Log
__________________
Member of ASAP since 2007
Member of UNITE since 2008

**Notice to BT customers**
BT to dump Phorm, see Here for more information. No DPI

If we have helped you in anyway, please consider Donating
TheBruce1 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-01-2008, 10:09 AM   #3 (permalink)
Registered User
 
Join Date: Jun 2008
Posts: 14
OS: XPsp2


Re: Trojan Attack - IE7 & Outlook Gone!!
Thanks for the reply TheBruce1. I'll update tonite.
bunker10 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-02-2008, 09:56 PM   #4 (permalink)
Registered User
 
Join Date: Jun 2008
Posts: 14
OS: XPsp2


Re: Trojan Attack - IE7 & Outlook Gone!!
First I'd like to point out my IE browser is back. I'll check wife's Outlook later but want to post the log results.

SDFIX Report
SDFix: Version 1.199
Run by Daddy on Wed 07/02/2008 at 01:30 AM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\WINDOWS\system32\rqRLebCT.dll - Deleted
C:\Program Files\Setup.exe - Deleted





Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-02 09:29:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:c4a8f2d2
"s2"=dword:8d67dc45
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:d3,0a,44,d0,0d,e3,75,ed,88,46,68,a2,07,8b,2b,2c,c9,8b,6a,d2,51,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,31,f7,46,4c,7e,19,3f,4c,11,c6,fc,ba,6f,75,26,35,97,..
"khjeh"=hex:9c,b6,fb,18,e4,4b,94,47,e0,05,01,9e,9c,8b,58,db,bf,e1,40,44,09,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:2f,d1,d6,c9,d5,a8,c2,55,4e,e4,fd,a6,6c,76,9f,bc,b2,d2,e5,a0,51,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:d3,0a,44,d0,0d,e3,75,ed,88,46,68,a2,07,8b,2b,2c,c9,8b,6a,d2,51,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,31,f7,46,4c,7e,19,3f,4c,11,c6,fc,ba,6f,75,26,35,97,..
"khjeh"=hex:9c,b6,fb,18,e4,4b,94,47,e0,05,01,9e,9c,8b,58,db,bf,e1,40,44,09,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:2f,d1,d6,c9,d5,a8,c2,55,4e,e4,fd,a6,6c,76,9f,bc,b2,d2,e5,a0,51,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"="C:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe:*:Enabled:Adobe Version Cue CS3 Server"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files :


File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Sat 9 Aug 2003 49,237 A..H. --- "C:\Program Files\America Online 9.0\aolphx.exe"
Sat 9 Aug 2003 36,953 A..H. --- "C:\Program Files\America Online 9.0\aoltray.exe"
Sat 9 Aug 2003 40,960 A..H. --- "C:\Program Files\America Online 9.0\RBM.exe"
Sat 9 Aug 2003 233,553 A..H. --- "C:\Program Files\America Online 9.0\waol.exe"
Wed 20 Dec 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Mon 18 Dec 2006 24,576 A..H. --- "C:\Documents and Settings\Daddy\My Documents\~WRL0002.tmp"
Mon 18 Dec 2006 24,576 A..H. --- "C:\Documents and Settings\Daddy\My Documents\~WRL1266.tmp"
Tue 19 Dec 2006 29,696 A..H. --- "C:\Documents and Settings\Daddy\My Documents\~WRL1779.tmp"
Sat 7 Jun 2008 24,576 A..H. --- "C:\Documents and Settings\Stephanie\My Documents\~WRL1399.tmp"
Thu 15 Feb 2007 308,832 A..H. --- "C:\Program Files\Canon\MP Navigator EX 1.0\Maint.exe"
Mon 19 Dec 2005 61,440 A..H. --- "C:\Program Files\Canon\MP Navigator EX 1.0\uinstrsc.dll"
Fri 9 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\BIT4.tmp"
Sun 3 Dec 2006 19,456 A..H. --- "C:\Documents and Settings\Brian\Application Data\Microsoft\Word\~WRL0964.tmp"
Sun 3 Dec 2006 19,968 A..H. --- "C:\Documents and Settings\Brian\Application Data\Microsoft\Word\~WRL2560.tmp"
Wed 10 Jan 2007 22,016 A..H. --- "C:\Documents and Settings\Brian\Application Data\Microsoft\Word\~WRL3269.tmp"
Sun 3 Dec 2006 19,456 A..H. --- "C:\Documents and Settings\Brian\Application Data\Microsoft\Word\~WRL3515.tmp"
Sun 3 Dec 2006 19,968 A..H. --- "C:\Documents and Settings\Brian\Application Data\Microsoft\Word\~WRL3611.tmp"
Tue 19 Dec 2006 25,088 A..H. --- "C:\Documents and Settings\Daddy\Application Data\Microsoft\Word\~WRL0100.tmp"
Tue 19 Dec 2006 26,624 A..H. --- "C:\Documents and Settings\Daddy\Application Data\Microsoft\Word\~WRL0157.tmp"
Tue 19 Dec 2006 29,184 A..H. --- "C:\Documents and Settings\Daddy\Application Data\Microsoft\Word\~WRL2471.tmp"
Sun 14 Jan 2007 32,256 ...H. --- "C:\Documents and Settings\Stephanie\Application Data\Microsoft\Word\~WRL0946.tmp"
Sun 14 Jan 2007 19,456 ...H. --- "C:\Documents and Settings\Stephanie\Application Data\Microsoft\Word\~WRL1773.tmp"
Sun 14 Jan 2007 142,336 ...H. --- "C:\Documents and Settings\Stephanie\Application Data\Microsoft\Word\~WRL2020.tmp"
Sun 14 Jan 2007 58,880 ...H. --- "C:\Documents and Settings\Stephanie\Application Data\Microsoft\Word\~WRL2225.tmp"
Sat 9 Aug 2003 111,824 A..H. --- "C:\Program Files\Common Files\aolshare\shell\us\shellext.dll"

Finished!

COMBOFIX REPORT (Missed the part about Recovery Console First)
ComboFix 08-07-01.5 - Daddy 2008-07-02 13:41:00.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.195 [GMT -4:00]
Running from: C:\Documents and Settings\Daddy\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\BM4fc35953.txt
C:\WINDOWS\cookies.ini
C:\WINDOWS\Downloaded Program Files\setup.inf
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\abkwwgma.dll
C:\WINDOWS\system32\apjrbqdr.dll
C:\WINDOWS\system32\awtqrPJC.dll
C:\WINDOWS\system32\bsjhqmpv.dll
C:\WINDOWS\system32\cfhhsmuq.dll
C:\WINDOWS\system32\cylowr.dll
C:\WINDOWS\system32\cytysuuu.ini
C:\WINDOWS\system32\dllmbrdr.ini
C:\WINDOWS\system32\dnyuamer.ini
C:\WINDOWS\system32\dqlhvmcg.dll
C:\WINDOWS\system32\drivers\fad.sys
C:\WINDOWS\system32\dvqwaeix.dll
C:\WINDOWS\system32\dwqehwpq.dll
C:\WINDOWS\system32\efcYQGVp.dll
C:\WINDOWS\system32\fyesen.dll
C:\WINDOWS\system32\gcxeksws.dll
C:\WINDOWS\system32\hoxllhaf.dll
C:\WINDOWS\system32\jcwrcrra.dll
C:\WINDOWS\system32\jRuwxyay.ini
C:\WINDOWS\system32\jRuwxyay.ini2
C:\WINDOWS\system32\kcjckdhn.dll
C:\WINDOWS\system32\kduwdkec.dll
C:\WINDOWS\system32\ljJASjJb.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mdupvlbk.ini
C:\WINDOWS\system32\mjjpqlfd.dll
C:\WINDOWS\system32\pfqyiyrh.ini
C:\WINDOWS\system32\pmnLddcy.dll
C:\WINDOWS\system32\qctwrqdn.ini
C:\WINDOWS\system32\qkidwk.dll
C:\WINDOWS\system32\rdrbmlld.dll
C:\WINDOWS\system32\tgyemslf.dll
C:\WINDOWS\system32\txxddldu.ini
C:\WINDOWS\system32\ulxjseaf.dll
C:\WINDOWS\system32\vfwttxvs.ini
C:\WINDOWS\system32\wsjbtmiv.dll
C:\WINDOWS\system32\xifafqca.ini
C:\WINDOWS\system32\xmuboc.dll
C:\WINDOWS\system32\yayxwuRj.dll
C:\WINDOWS\system32\ycygwlhy.dll
C:\WINDOWS\system32\ydvroq.dll
C:\WINDOWS\system32\yieskrxf.dll
C:\WINDOWS\system32\yjhjiemt.ini

.
((((((((((((((((((((((((( Files Created from 2008-06-02 to 2008-07-02 )))))))))))))))))))))))))))))))
.

2008-07-02 14:57 . 2008-07-02 14:57 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-07-02 14:57 . 2008-07-02 14:57 1,409 --a------ C:\WINDOWS\QTFont.for
2008-07-02 01:06 . 2008-07-02 01:06 <DIR> d-------- C:\WINDOWS\ERUNT
2008-07-02 00:53 . 2007-11-21 14:08 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Apple Computer
2008-07-02 00:53 . 2008-07-02 00:53 <DIR> d-------- C:\Documents and Settings\Administrator
2008-07-02 00:43 . 2008-07-02 09:40 <DIR> d-------- C:\SDFix
2008-06-27 20:16 . 2008-06-27 20:16 <DIR> d-------- C:\Deckard
2008-06-27 19:35 . 2008-06-27 19:35 <DIR> d-------- C:\Program Files\ZonedOut
2008-06-27 19:33 . 2008-06-27 19:33 <DIR> d-------- C:\ie-spyad_zo
2008-06-27 19:23 . 2008-06-27 19:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-27 19:22 . 2008-06-27 19:27 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-06-26 23:45 . 2008-06-26 23:54 <DIR> d-------- C:\Program Files\Panda Security
2008-06-26 23:25 . 2008-06-26 23:25 <DIR> d-------- C:\Documents and Settings\Daddy\Application Data\AVGTOOLBAR
2008-06-26 15:48 . 2008-06-26 17:42 3,872 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-06-26 15:48 . 2008-06-26 17:42 1,436 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-06-26 15:47 . 2008-06-26 15:47 <DIR> d-------- C:\kav
2008-06-26 15:26 . 2008-06-26 15:26 22,804 --ah----- C:\WINDOWS\system32\mlfcache.dat
2008-06-25 10:59 . 2008-06-25 10:59 <DIR> d-------- C:\Documents and Settings\Mom\Application Data\Verizon
2008-06-25 09:19 . 2008-06-25 09:19 <DIR> d-------- C:\Documents and Settings\Stephanie\Application Data\Verizon
2008-06-24 20:57 . 2008-06-24 20:57 <DIR> d--h----- C:\WINDOWS\PIF
2008-06-24 17:50 . 2008-06-24 17:50 <DIR> d-------- C:\Documents and Settings\Daddy\Application Data\Verizon
2008-06-24 17:50 . 2008-06-24 17:51 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Verizon
2008-06-23 12:37 . 2008-06-29 00:04 110,415 --a------ C:\WINDOWS\BM4fc35953.xml
2008-06-10 20:43 . 2008-06-13 09:10 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-03 22:32 . 2008-06-03 22:32 <DIR> d-------- C:\Documents and Settings\Alex\Application Data\vlc
2008-06-03 21:22 . 2008-07-01 23:10 <DIR> d-------- C:\Program Files\PeerGuardian2

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-01 07:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-06-27 02:57 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-06-27 02:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-06-27 01:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\SecTaskMan
2008-06-26 19:43 --------- d-----w C:\Program Files\Verizon
2008-06-26 19:42 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-24 21:34 --------- d-----w C:\Documents and Settings\Daddy\Application Data\Apple Computer
2008-06-24 16:28 --------- d-----w C:\Documents and Settings\Alex\Application Data\LimeWire
2008-06-24 04:51 --------- d-----w C:\Program Files\Soulseek
2008-06-22 19:45 --------- d-----w C:\Documents and Settings\Daddy\Application Data\Azureus
2008-06-18 23:39 --------- d-----w C:\Documents and Settings\Daddy\Application Data\ZoomBrowser EX
2008-06-18 23:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\ZoomBrowser
2008-06-18 23:26 --------- d-----w C:\Documents and Settings\Daddy\Application Data\Canon
2008-06-13 13:10 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 04:48 --------- d-----w C:\Program Files\Solid AVI DIVX to DVD Burner
2008-06-05 23:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\CanonIJPLM
2008-06-01 16:16 --------- d-----w C:\Documents and Settings\Stephanie\Application Data\CyberLink
2008-06-01 04:51 --------- d-----w C:\Documents and Settings\Daddy\Application Data\dvdcss
2008-05-28 22:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\PCPitstop
2008-05-25 14:52 --------- d-----w C:\Documents and Settings\Daddy\Application Data\vlc
2008-05-25 14:46 --------- d-----w C:\Program Files\VideoLAN
2008-05-25 14:33 --------- d-----w C:\Documents and Settings\Daddy\Application Data\DVD Flick
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-02-26 23:05 21,800 ----a-w C:\Documents and Settings\Stephanie\Application Data\GDIPFONTCACHEV1.DAT
2008-02-22 17:37 479 ----a-w C:\Program Files\setup.reg
2008-02-08 15:07 33,296,384 ----a-w C:\Program Files\kis.en.msi
2008-01-31 00:51 1,570,920 ----a-w C:\Program Files\taskmanager17.exe
2008-01-10 22:58 21,800 ----a-w C:\Documents and Settings\Daddy\Application Data\GDIPFONTCACHEV1.DAT
2007-11-17 02:31 8,212,216 ----a-w C:\Program Files\CheetahDVDBurner.exe
2007-05-12 14:40 630,784 ----a-w C:\Documents and Settings\Daddy\GoToAssist_chat2way__317_en.exe
2007-05-08 23:53 21,408 ----a-w C:\Documents and Settings\Brian\Application Data\GDIPFONTCACHEV1.DAT
2007-05-06 03:23 3,550,409 ----a-w C:\Program Files\ffdshow_rev529_20061113_clsid.exe
2007-04-04 13:52 507,904 ----a-w C:\Program Files\moveonb.msi
2007-03-21 23:37 528,312,337 ----a-w C:\Program Files\MSSetup.exe
2007-03-13 04:43 965 ----a-w C:\Program Files\Avery-MyProject8163.avery
2007-03-12 01:59 1,948,945 ----a-w C:\Program Files\burnquickeval.exe
2007-03-11 16:50 266,664 ----a-w C:\Program Files\burnsetup.exe
2007-03-11 15:26 830,422 ----a-w C:\Program Files\dBpowerAMP-codec-shorten.exe
2007-03-11 02:33 4,103,032 ----a-w C:\Program Files\dMC-r12.exe
2007-02-21 03:35 6,482,128 ----a-w C:\Program Files\FreeFXMPEG.EXE
2007-02-21 02:16 404,890 ----a-w C:\Program Files\switch.zip
2007-02-19 17:17 1,527,192 ----a-w C:\Program Files\daemon408-139-x86.exe
2007-02-19 16:58 1,035,271 ----a-w C:\Program Files\wrar362.exe
2007-02-11 23:16 10,007,784 ----a-w C:\Program Files\Azureus_2.5.0.4a_Win32.setup.exe
2007-01-11 04:36 51,973,232 ----a-w C:\Program Files\Quicken_Home_Business_2007.exe
2007-01-10 16:19 11,817,800 ----a-w C:\Program Files\GoogleEarth.exe
2006-11-06 23:33 557,056 ----a-w C:\Documents and Settings\Daddy\chatlnk.exe
2006-10-27 23:17 842,672 ----a-w C:\Program Files\slsk156c.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="C:\WINDOWS\System32\NVMCTRAY.DLL" [2003-09-24 19:32 49152]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 06:48 157592]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]
"PeerGuardian"="C:\Program Files\PeerGuardian2\pg2.exe" [2005-09-18 18:44 1382400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-10-26 13:22 180269]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-10-26 14:00 190464]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-09-24 19:32 5033984]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 20:54 623992]
"Adobe_ID0EYTHM"="C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 17:40 1884160]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"Verizon_McciTrayApp"="C:\Program Files\Verizon\McciTrayApp.exe" [2007-09-28 14:30 936960]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"CanonSolutionMenu"="C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 21:01 644696]
"CanonMyPrinter"="C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 21:50 1603152]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 09:03 210472]
"OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 12:02 79400]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 05:59 122880 C:\WINDOWS\BCMSMMSG.exe]
"Logitech Utility"="LOGI_MWX.EXE" [2003-11-26 09:50 19968 C:\WINDOWS\LOGI_MWX.EXE]
"nwiz"="nwiz.exe" [2003-09-24 19:32 741376 C:\WINDOWS\system32\nwiz.exe]

C:\Documents and Settings\Alex\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2008-02-08 17:32:57 147456]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL kcjckdhn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server

R2 ONSIO;ONSIO;C:\WINDOWS\SYSTEM32\DRIVERS\ONSIO.SYS [1998-04-17 14:23]
S0 SMPLSCSI;SMPLSCSI;C:\WINDOWS\system32\drivers\SMPLSCSI.SYS [1998-08-01 13:00]
S2 IJPLMSVC;PIXMA Extended Survey Program;C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2007-04-13 12:20]
S2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38]
S3 scsiscan;SCSI Scanner Driver;C:\WINDOWS\system32\DRIVERS\scsiscan.sys [2001-08-17 14:53]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{df50faf4-614e-11db-b3bb-806d6172696f}]
\shell\PlayWithPowerCinema\Command - "C:\Program Files\Dell\Media Experience\PCM2.exe" MOVIE "%L"

.
Contents of the 'Scheduled Tasks' folder
"2008-06-27 13:16:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Aim6 - (no file)
HKLM-Run-4cf06acf - C:\WINDOWS\system32\rdrbmlld.dll
HKU-Default-Run-Symantec NetDriver Warning - C:\PROGRA~1\SYMNET~1\SNDWarn.exe
HKU-Default-Run-ALUAlert - C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-02 14:57:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2008-07-02 15:05:11 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-02 19:04:37

Pre-Run: 10,963,951,616 bytes free
Post-Run: 15,812,448,256 bytes free

234 --- E O F --- 2008-06-20 07:01:22

HIJACKTHIS Log File
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:48:34 PM, on 7/2/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\LOGI_MWX.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\PROGRA~1\MICROS~2\Office10\OUTLOOK.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.shockwave.com/content/ric...GameLoader.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1161734388453
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {B0FB831D-17F6-4CBD-9B5D-3305881D362E} (LHGLauncherXForm Control) - http://www.shockwave.com/content/rea...LGLauncher.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://www.shockwave.com/content/fee...utLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.shockwave.com/content/zum...loader_v10.cab
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/optimize2/pcpitstop2.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{15DDA148-4767-49AE-B6CC-EBAB3F0FF04F}: NameServer = 192.168.1.1,192.168.1.3
O17 - HKLM\System\CS1\Services\Tcpip\..\{15DDA148-4767-49AE-B6CC-EBAB3F0FF04F}: NameServer = 192.168.1.1,192.168.1.3
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL kcjckdhn.dll
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 11494 bytes

Thanks Bruce for getting me to this point. Please let me know what if anything should be done next.

Bests
bunker10 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-03-2008, 06:13 AM   #5 (permalink)
Moderator, Analyst, Security Team
 
TheBruce1's Avatar
 
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP


Re: Trojan Attack - IE7 & Outlook Gone!!
Hello again

Any reason why you have no virus protection installed?

=========

Download ATF-Cleaner by Atribune to your desktop. Do not run just yet, we will shortly

=========

Open notepad and copy/paste the text in the quotebox below into it:

Quote:
Folder::
C:\Documents and Settings\Daddy\Application Data\AVGTOOLBAR
C:\kav
C:\Program Files\Common Files\Symantec Shared
C:\Documents and Settings\All Users\Application Data\Symantec
C:\Program Files\Viewpoint
File::
C:\WINDOWS\system32\drivers\fidbox2.dat
C:\WINDOWS\system32\drivers\fidbox2.idx
C:\WINDOWS\system32\mlfcache.dat
C:\WINDOWS\BM4fc35953.xml
Driver::
ViewpointService
Save this as CFscript







Refering to the picture above, drag CFscript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall


===========

JAVA OUTDATED


Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 6 Update 6 and save it to your desktop.
  • Scroll down to where it says "Java Runtime Environment (JRE) 6 Update 6. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
  • Click the "Download" button to the right.
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: "Accept License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u6-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH Checked
      • Applications and Applets
        Trace and Log Files
    • Click OK on Delete Temporary Files Window
      Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
    • Click OK to leave the Temporary Files Window
    • Click OK to leave the Java Control Panel.

=========

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you have Firefox installed:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you have Opera installed:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

==========

No AntiVirus Onboard

I see no evidence of an AntiVirus program on your system. This must be resolved. Here are a few very good free Antivirus products which are available:Select one of these, or another of your choice. Download, install, update definitions, and run a full system scan.

=========

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

=========
Logs Required
C:\Combofix.txt
Scan results from AV
Hijackthis Log
__________________
Member of ASAP since 2007
Member of UNITE since 2008

**Notice to BT customers**
BT to dump Phorm, see Here for more information. No DPI

If we have helped you in anyway, please consider Donating
TheBruce1 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-06-2008, 03:36 PM   #6 (permalink)
Registered User
 
Join Date: Jun 2008
Posts: 14
OS: XPsp2


Re: Trojan Attack - IE7 & Outlook Gone!!
TheBruce1,

I'm unable to remove the older versions of J2SE. I get the following error for
J2SE 5.0 Update 7
J2SE 5.0 Update 9
J2SE 5.0 Update 10

Error 1326. Error getting File Security:C:\Program Files\Java\jre1.5.0_10\lib\javaws\GetLastError:5
Fatal error during installation

I get the following error when I try to remove
Java SE RunTime Environment 6 update 1
Java 6 Update 2
Java 6 Update 3
Java 6 Update 5

Fatal Error during Installation

How should I proceed?

thanks!
bunker10 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-07-2008, 04:52 AM   #7 (permalink)
Moderator, Analyst, Security Team
 
TheBruce1's Avatar
 
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP


Re: Trojan Attack - IE7 & Outlook Gone!!
Hello again

Download/unzip JavaRa to your desktop.

*Double-Click on JavaRa.exe on your desktop to open it.
*Select Remove Older Versions button
*Answer Yes when asked to proceed.

========

Then carry on with the rest of instructions, remember to post the C:\JavaRa.Log in your reply.
__________________
Member of ASAP since 2007
Member of UNITE since 2008

**Notice to BT customers**
BT to dump Phorm, see Here for more information. No DPI

If we have helped you in anyway, please consider Donating
TheBruce1 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-07-2008, 05:30 PM   #8 (permalink)
Registered User
 
Join Date: Jun 2008
Posts: 14
OS: XPsp2


Re: Trojan Attack - IE7 & Outlook Gone!!
I'm back. Downloaded and ran JavaRa. It failed at first. Then I ran it again and removed most Java instances.

It failed to remove Java 6 upd 5.

I seem unable to download and launch upd 6. It fails to connect to server using Sun's Download Manager.

I copied the JavaRa log here.

JavaRa 1.08 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Mon Jul 07 18:49:29 2008

Found and removed: C:\Program Files\Java\jre1.5.0_07

Found and removed: C:\Program Files\Java\jre1.5.0_09

Found and removed: C:\Program Files\Java\jre1.5.0_10

Found and removed: C:\Program Files\Java\jre1.6.0_01

Found and removed: C:\Program Files\Java\jre1.6.0_02

Found and removed: C:\Program Files\Java\jre1.6.0_03

Found and removed: C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64

Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled.1.5.0.0

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\core1.zip

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\core2.zip

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\core3.zip

Found and removed: Software\JavaSoft\Java2D\1.5.0_07

Found and removed: Software\JavaSoft\Java2D\1.5.0_09

Found and removed: Software\JavaSoft\Java2D\1.5.0_10

Found and removed: Software\JavaSoft\Java2D\1.6.0_01

Found and removed: Software\JavaSoft\Java2D\1.6.0_02

Found and removed: Software\JavaSoft\Java2D\1.6.0_03

Found and removed: Software\JavaSoft\Java2D\1.6.0_05

Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_01

Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_02

Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_03

Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_05

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\JavaPlugin.150_07

Found and removed: SOFTWARE\Classes\JavaPlugin.150_09

Found and removed: SOFTWARE\Classes\JavaPlugin.150_10

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0150070}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0150090}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0150100}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\JavaPlugin.160_01

Found and removed: SOFTWARE\Classes\JavaPlugin.160_02

Found and removed: SOFTWARE\Classes\JavaPlugin.160_03

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_01

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_02

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_03

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_01

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_02

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_03

Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160010}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160020}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160030}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D510007

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D510009

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D511000

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610001

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610002

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610003

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D510007

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D510009

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D511000

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610001

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610002

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610003

JavaRa 1.08 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Mon Jul 07 18:52:02 2008

------------------------------------

Finished reporting.

Should I keep upd 5 and continue on?
bunker10 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-08-2008, 04:25 AM   #9 (permalink)
Moderator, Analyst, Security Team
 
TheBruce1's Avatar
 
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP


Re: Trojan Attack - IE7 & Outlook Gone!!
Quote:
Originally Posted by bunker10
Should I keep upd 5 and continue on?
Yes, please do, do not install update 6 at this time.
__________________
Member of ASAP since 2007
Member of UNITE since 2008

**Notice to BT customers**
BT to dump Phorm, see Here for more information. No DPI

If we have helped you in anyway, please consider Donating
TheBruce1 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-08-2008, 07:57 PM   #10 (permalink)
Registered User
 
Join Date: Jun 2008
Posts: 14
OS: XPsp2


Re: Trojan Attack - IE7 & Outlook Gone!!
--------------------
ComboFix Logfile

ComboFix 08-07-01.5 - Daddy 2008-07-03 17:20:59.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.180 [GMT -4:00]
Running from: C:\Documents and Settings\Daddy\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Daddy\Desktop\CFscript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\BM4fc35953.xml
C:\WINDOWS\system32\drivers\fidbox2.dat
C:\WINDOWS\system32\drivers\fidbox2.idx
C:\WINDOWS\system32\mlfcache.dat
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Symantec
C:\Documents and Settings\All Users\Application Data\Symantec\DSA\B\fe0001.symantec.com\fe\{A92EE31F-F2BD-49f7-BAFF-36C773228854}\html_layout\RETexpired.htm
C:\Documents and Settings\All Users\Application Data\Symantec\DSA\B\fe0001.symantec.com\fe\{A92EE31F-F2BD-49f7-BAFF-36C773228854}\html_layout\RETexpired.htm.httpheader
C:\Documents and Settings\All Users\Application Data\Symantec\DSA\B\fe0001.symantec.com\fe\{A92EE31F-F2BD-49f7-BAFF-36C773228854}\html_layout\RETwarning.htm
C:\Documents and Settings\All Users\Application Data\Symantec\DSA\B\fe0001.symantec.com\fe\{A92EE31F-F2BD-49f7-BAFF-36C773228854}\html_layout\RETwarning.htm.httpheader
C:\Documents and Settings\All Users\Application Data\Symantec\DSA\B\fe0001.symantec.com\fe\{A92EE31F-F2BD-49f7-BAFF-36C773228854}\html_layout\RETwarning6days.htm
C:\Documents and Settings\All Users\Application Data\Symantec\DSA\B\fe0001.symantec.com\fe\{A92EE31F-F2BD-49f7-BAFF-36C773228854}\html_layout\RETwarning6days.htm.httpheader
C:\Documents and Settings\All Users\Application Data\Symantec\DSA\B\fe0001.symantec.com\fe\css\alert_radio.css
C:\Documents and Settings\All Users\Application Data\Symantec\DSA\B\fe0001.symantec.com\fe\css\alert_radio.css.httpheader
C:\Documents and Settings\All Users\Application Data\Symantec\DSA\B\fe0001.symantec.com\fe\images\buttonbg-active.png
C:\Documents and Settings\All Users\Application Data\Symantec\DSA\B\fe0001.symantec.com\fe\images\buttonbg-active.png.httpheader
C:\Documents and Settings\All Users\Application Data\Symantec\DSA\B\fe0001.symantec.com\fe\images\buttonbg-default.png
C:\Documents and Settings\All Users\Application Data\Symantec\DSA\B\fe0001.symantec.com\fe\images\buttonbg-default.png.httpheader
C:\Documents and Settings\All Users\Application Data\Symantec\DSA\B\fe0001.symantec.com\fe\images\buttonbg-disabled.png
C:\Documents and Settings\All Users\Application Data\Symantec\DSA\B\fe0001.symantec.com\fe\images\buttonbg-disabled.png.httpheader
C:\Documents and Settings\All Users\Application Data\Symantec\DSA\B\fe0001.symantec.com\fe\images\buttonbg-hover.png
C:\Documents and Settings\All Users\Application Data\Symantec\DSA\B\fe0001.symantec.com\fe\images\buttonbg-hover.png.httpheader
C:\Documents and Settings\All Users\Application Data\Symantec\DSA\B\fe0001.symantec.com\fe\images\FE_expired_icon.png
C:\Documents and Settings\All Users\Application Data\Symantec\DSA\B\fe0001.symantec.com\fe\images\FE_expired_icon.png.httpheader
C:\Documents and Settings\All Users\Application Data\Symantec\DSA\B\fe0001.symantec.com\fe\images\FE_warning_icon.png
C:\Documents and Settings\All Users\Application Data\Symantec\DSA\B\fe0001.symantec.com\fe\images\FE_warning_icon.png.httpheader
C:\Documents and Settings\All Users\Application Data\Symantec\DSA\V_G\DSASL.xml
C:\Documents and Settings\All Users\Application Data\Symantec\ErrLogs\{3CCAD2EF-CFF2-4637-82AA-AABF370282D3}ab1f723a.zip
C:\Documents and Settings\All Users\Application Data\Symantec\LiveSubscribe\Catalog.LiveSubscribe
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Settings.LiveUpdate
C:\Documents and Settings\All Users\Application Data\Symantec\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PEPCollectors\HBPep2_{BC8D3EAF-F864-4D4B-AB4D-B3D0C32E2840}.dat
C:\Documents and Settings\All Users\Application Data\Symantec\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PEPCollectors\HBPep2_{BC8D3EAF-F864-4D4B-AB4D-B3D0C32E2840}.tmp
C:\Documents and Settings\All Users\Application Data\Symantec\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PEPCollectors\Pep2_{BC8D3EAF-F864-4D4B-AB4D-B3D0C32E2840}.dat
C:\Documents and Settings\All Users\Application Data\Symantec\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PEPCollectors\System_.dat
C:\Documents and Settings\All Users\Application Data\Symantec\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PEPCollectors\System_.tmp
C:\Documents and Settings\All Users\Application Data\Symantec\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PollManager\PollManager_Current.dat
C:\Documents and Settings\All Users\Application Data\Symantec\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PollManager\PollManager_Job.dat
C:\Documents and Settings\All Users\Application Data\Symantec\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\SVAR\SVAR_{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}.dat
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{0A2C05EF-406A-4481-A0B4-94C8C3729121}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{0A2C05EF-406A-4481-A0B4-94C8C3729121}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{10F1C174-D168-425C-A30E-94B1DA8A0C88}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{10F1C174-D168-425C-A30E-94B1DA8A0C88}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{2708E05E-D2FE-45C7-B87B-C762CC0940BE}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{2708E05E-D2FE-45C7-B87B-C762CC0940BE}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{3682670F-1A34-4CBF-A642-E8405D6BB3D3}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{3682670F-1A34-4CBF-A642-E8405D6BB3D3}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{44098244-98D2-42B9-8BE8-460B012CF950}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{44098244-98D2-42B9-8BE8-460B012CF950}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{56EDDBCB-5042-4009-B58F-DB5AAA30D9CE}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{56EDDBCB-5042-4009-B58F-DB5AAA30D9CE}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{733D0CF9-3D32-47C3-8B90-6B5971EA0C8C}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{733D0CF9-3D32-47C3-8B90-6B5971EA0C8C}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{8A01EBD5-BB36-437E-8A1E-3ABFE051B28E}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{8A01EBD5-BB36-437E-8A1E-3ABFE051B28E}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{8BBB4A09-411E-4BCE-98B2-6BFE3C45FFE6}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{8BBB4A09-411E-4BCE-98B2-6BFE3C45FFE6}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{8EB3B96D-7536-4958-BCB1-4A902661558B}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{8EB3B96D-7536-4958-BCB1-4A902661558B}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{977DACC5-C7C3-409D-A96A-8C0EBABB0327}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{977DACC5-C7C3-409D-A96A-8C0EBABB0327}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{9FAF606E-3C63-4DA9-8EBB-D4798559F801}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{9FAF606E-3C63-4DA9-8EBB-D4798559F801}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{A45C10AD-278A-4FCF-A222-9EC4EFC31DB4}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{A45C10AD-278A-4FCF-A222-9EC4EFC31DB4}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{BD394BEC-6F44-46AD-BABA-07FC2474BE9A}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{BD394BEC-6F44-46AD-BABA-07FC2474BE9A}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{CAA904E6-5242-4A57-8204-A96BBE6BB43B}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{CAA904E6-5242-4A57-8204-A96BBE6BB43B}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{CB03CFAD-40F4-49AC-8AF2-9842C831B5E8}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{CB03CFAD-40F4-49AC-8AF2-9842C831B5E8}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{DF1AE0C5-93A3-401A-84D6-BC92152808F8}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{DF1AE0C5-93A3-401A-84D6-BC92152808F8}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{F679FB70-39D4-446F-8B80-B29AE0939509}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{165201DC-2147-44CE-8E28-537DBE0E3A1E}\{F679FB70-39D4-446F-8B80-B29AE0939509}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{16B84557-FA80-4D25-904D-D0D363F19887}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{16B84557-FA80-4D25-904D-D0D363F19887}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{16F4DDDD-BD97-4F96-A434-517EA42E38F1}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{16F4DDDD-BD97-4F96-A434-517EA42E38F1}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{22298544-CAE2-4569-8D3E-7160A731AAA9}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{22298544-CAE2-4569-8D3E-7160A731AAA9}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{2322BD2E-AFB4-4EC0-968A-E525D5BB6541}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{2322BD2E-AFB4-4EC0-968A-E525D5BB6541}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{37094475-D9A7-4E06-924B-0BFD38D4E212}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{37094475-D9A7-4E06-924B-0BFD38D4E212}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{488CA78D-AB5F-4361-8468-5C90ACB5EDFF}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{488CA78D-AB5F-4361-8468-5C90ACB5EDFF}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{4CF59215-F2D4-4796-9C3B-9A7DE63CF3AB}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{4CF59215-F2D4-4796-9C3B-9A7DE63CF3AB}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{52276AE0-6C4E-4AAD-BB4B-D1808D51B59D}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{52276AE0-6C4E-4AAD-BB4B-D1808D51B59D}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{5E1864EE-53CA-4723-BFC0-4099A63729BE}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{5E1864EE-53CA-4723-BFC0-4099A63729BE}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{63592495-DD26-4694-A72C-8F7B2F7194DB}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{63592495-DD26-4694-A72C-8F7B2F7194DB}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{6B302F39-E27D-42DA-8A09-419557A970E0}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{6B302F39-E27D-42DA-8A09-419557A970E0}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{6E5534C6-0D46-4E7C-9CE6-FC0FCFB35192}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{6E5534C6-0D46-4E7C-9CE6-FC0FCFB35192}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{6F018B86-9590-44D3-83DF-540D35C99EC1}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{6F018B86-9590-44D3-83DF-540D35C99EC1}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{70D1D223-A650-43A5-92C8-4CF778BA3301}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{70D1D223-A650-43A5-92C8-4CF778BA3301}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{7A2B5F27-3456-49B7-A44F-D24FACE802AB}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{7A2B5F27-3456-49B7-A44F-D24FACE802AB}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{8B988711-20B2-4463-9F5C-B039B6309B9B}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{8B988711-20B2-4463-9F5C-B039B6309B9B}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{8F2D59E8-392A-4130-BD96-B0F4B5EDD3F0}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{8F2D59E8-392A-4130-BD96-B0F4B5EDD3F0}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{8FFD35F0-44BF-4BF3-AF56-597726A7A52E}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{8FFD35F0-44BF-4BF3-AF56-597726A7A52E}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{C9E0225B-CE3C-4705-959A-B50995CFC5BF}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{C9E0225B-CE3C-4705-959A-B50995CFC5BF}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{D6F6D699-6E78-4B83-96FD-4FCF7BDDA3DF}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{D6F6D699-6E78-4B83-96FD-4FCF7BDDA3DF}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{DAC2D119-05B9-4E13-A435-064B569451D9}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{DAC2D119-05B9-4E13-A435-064B569451D9}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{E577A5E4-B092-4ADA-9539-034E4063C6A1}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{E577A5E4-B092-4ADA-9539-034E4063C6A1}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{F1977C6A-3BC7-4126-A4F1-09256076CAE7}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{F1977C6A-3BC7-4126-A4F1-09256076CAE7}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{F9FC3811-3CC9-486D-9DA5-05BA5D34D2E9}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{1C10BBD4-34EB-4569-962E-CCAF6C7BD0AC}\{F9FC3811-3CC9-486D-9DA5-05BA5D34D2E9}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{3B5CE6CD-7C3C-48DB-8FA7-3A8F37B09E43}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{3B5CE6CD-7C3C-48DB-8FA7-3A8F37B09E43}\{25CA016D-C28E-49C9-B240-9E82AAB0ECF6}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{3B5CE6CD-7C3C-48DB-8FA7-3A8F37B09E43}\{25CA016D-C28E-49C9-B240-9E82AAB0ECF6}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{3B5CE6CD-7C3C-48DB-8FA7-3A8F37B09E43}\{5640FA50-641B-4811-86C5-1C9531E4DE6A}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{3B5CE6CD-7C3C-48DB-8FA7-3A8F37B09E43}\{5640FA50-641B-4811-86C5-1C9531E4DE6A}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{3B5CE6CD-7C3C-48DB-8FA7-3A8F37B09E43}\{89190EE1-F29A-4A29-BAB1-4A99F806D7B1}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{3B5CE6CD-7C3C-48DB-8FA7-3A8F37B09E43}\{89190EE1-F29A-4A29-BAB1-4A99F806D7B1}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{3B5CE6CD-7C3C-48DB-8FA7-3A8F37B09E43}\{A484E4BE-3483-4A17-822B-F5E614F5E78B}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{3B5CE6CD-7C3C-48DB-8FA7-3A8F37B09E43}\{A484E4BE-3483-4A17-822B-F5E614F5E78B}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{3B5CE6CD-7C3C-48DB-8FA7-3A8F37B09E43}\{BB642E92-95A1-452A-A1BC-2F8BEE297D55}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{3B5CE6CD-7C3C-48DB-8FA7-3A8F37B09E43}\{BB642E92-95A1-452A-A1BC-2F8BEE297D55}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{3B5CE6CD-7C3C-48DB-8FA7-3A8F37B09E43}\{DC1E1D20-FF4A-4431-A101-4E6BA7CE7896}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{3B5CE6CD-7C3C-48DB-8FA7-3A8F37B09E43}\{DC1E1D20-FF4A-4431-A101-4E6BA7CE7896}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{54179003-0DF5-4364-883D-0D6F6FA72623}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{54179003-0DF5-4364-883D-0D6F6FA72623}\{6B642E68-0E3B-4BE8-BF77-649EAA9E5048}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{54179003-0DF5-4364-883D-0D6F6FA72623}\{6B642E68-0E3B-4BE8-BF77-649EAA9E5048}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{54179003-0DF5-4364-883D-0D6F6FA72623}\{6D634F1C-8B3A-49F0-9FCE-B40C14CE8F79}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{54179003-0DF5-4364-883D-0D6F6FA72623}\{6D634F1C-8B3A-49F0-9FCE-B40C14CE8F79}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{54179003-0DF5-4364-883D-0D6F6FA72623}\{A766CFF7-C158-4BA4-9C80-01BBF778C40F}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{54179003-0DF5-4364-883D-0D6F6FA72623}\{A766CFF7-C158-4BA4-9C80-01BBF778C40F}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{54179003-0DF5-4364-883D-0D6F6FA72623}\{AC54CF54-8A52-4BCD-AE25-E49990250C81}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{54179003-0DF5-4364-883D-0D6F6FA72623}\{AC54CF54-8A52-4BCD-AE25-E49990250C81}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{54179003-0DF5-4364-883D-0D6F6FA72623}\{D5413105-F53D-4662-BD45-60EEF626CCA7}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{54179003-0DF5-4364-883D-0D6F6FA72623}\{D5413105-F53D-4662-BD45-60EEF626CCA7}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{54179003-0DF5-4364-883D-0D6F6FA72623}\{FA741A66-CECA-4F8A-98AA-E8CD5C117D66}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{54179003-0DF5-4364-883D-0D6F6FA72623}\{FA741A66-CECA-4F8A-98AA-E8CD5C117D66}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{1BD51599-5A80-46BF-B7D5-DC380835F7F7}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{1BD51599-5A80-46BF-B7D5-DC380835F7F7}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{32CFB679-0FEA-4376-8054-5039C418AB38}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{32CFB679-0FEA-4376-8054-5039C418AB38}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{3CE78121-6674-4A46-9EC2-76C7A18B4166}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{3CE78121-6674-4A46-9EC2-76C7A18B4166}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{3D0B4305-BEEB-4006-A6F0-BC0BDD84F184}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{3D0B4305-BEEB-4006-A6F0-BC0BDD84F184}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{599EA2B3-800D-4DD7-AD0C-5B3F7636214F}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{599EA2B3-800D-4DD7-AD0C-5B3F7636214F}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{5B889AE6-BAAA-4B81-8D58-B162CC70EC91}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{5B889AE6-BAAA-4B81-8D58-B162CC70EC91}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{7D04E7B2-0C68-4940-9AEB-3A7A0498E7D6}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{7D04E7B2-0C68-4940-9AEB-3A7A0498E7D6}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{83F031DA-965A-4289-ABAF-EB6A84902944}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{83F031DA-965A-4289-ABAF-EB6A84902944}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{845E96A7-3EEC-42D6-9CF5-CC9838587F5D}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{845E96A7-3EEC-42D6-9CF5-CC9838587F5D}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{88162CFC-A8A0-44F7-B76A-820FCF98DA9D}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{88162CFC-A8A0-44F7-B76A-820FCF98DA9D}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{A5BA0F47-D10C-41C2-AC06-6DFBCE4BFF95}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{A5BA0F47-D10C-41C2-AC06-6DFBCE4BFF95}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{ABEDEE8C-3313-4EE7-A392-B5C871E00165}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{ABEDEE8C-3313-4EE7-A392-B5C871E00165}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{B051FB70-72E2-4E9A-B77B-FB5E0244F0C2}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{B051FB70-72E2-4E9A-B77B-FB5E0244F0C2}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{BB2C2C83-59CE-4964-B4EF-A7C23C20E966}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{BB2C2C83-59CE-4964-B4EF-A7C23C20E966}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{C05BDA2B-380F-4141-94AD-D8AD61476E43}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{C05BDA2B-380F-4141-94AD-D8AD61476E43}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{D0270D39-5931-4A1B-9D0B-56A95CD15C38}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{D0270D39-5931-4A1B-9D0B-56A95CD15C38}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{F9C1198E-7573-4C77-9D24-C461C937E6FC}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{F9C1198E-7573-4C77-9D24-C461C937E6FC}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{FD50FD69-EA10-4E1B-9FEF-DBBA29F598C4}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{93E17C0D-51DC-4AD8-AC14-A6A10CAB24FD}\{FD50FD69-EA10-4E1B-9FEF-DBBA29F598C4}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{97B33B23-E258-4DC2-AC12-42B9CCA6602B}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{97B33B23-E258-4DC2-AC12-42B9CCA6602B}\{0F750172-0481-4C61-B1A2-7EDEB53F7D49}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{97B33B23-E258-4DC2-AC12-42B9CCA6602B}\{0F750172-0481-4C61-B1A2-7EDEB53F7D49}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{97B33B23-E258-4DC2-AC12-42B9CCA6602B}\{6392A6E2-BFCC-4E8C-BF02-A1A002B9658F}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{97B33B23-E258-4DC2-AC12-42B9CCA6602B}\{6392A6E2-BFCC-4E8C-BF02-A1A002B9658F}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{97B33B23-E258-4DC2-AC12-42B9CCA6602B}\{82BE64DC-0055-479E-95EA-72BD302ADF2B}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{97B33B23-E258-4DC2-AC12-42B9CCA6602B}\{82BE64DC-0055-479E-95EA-72BD302ADF2B}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{97B33B23-E258-4DC2-AC12-42B9CCA6602B}\{9957C6EF-2346-4BE1-BB76-7B15748A4779}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{97B33B23-E258-4DC2-AC12-42B9CCA6602B}\{9957C6EF-2346-4BE1-BB76-7B15748A4779}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{97B33B23-E258-4DC2-AC12-42B9CCA6602B}\{B959E5C8-6DDE-413B-ABB9-19C606DC7D8B}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{97B33B23-E258-4DC2-AC12-42B9CCA6602B}\{B959E5C8-6DDE-413B-ABB9-19C606DC7D8B}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{97B33B23-E258-4DC2-AC12-42B9CCA6602B}\{BC4B4E81-11A0-438D-901C-D0355F8E56EB}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{97B33B23-E258-4DC2-AC12-42B9CCA6602B}\{BC4B4E81-11A0-438D-901C-D0355F8E56EB}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{075C27F3-E4E4-4174-8BF5-FF4195D1E08B}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{075C27F3-E4E4-4174-8BF5-FF4195D1E08B}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{09E57805-53EF-4C0B-BF14-18B325887963}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{09E57805-53EF-4C0B-BF14-18B325887963}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{2FE8D17F-A797-4FAB-960C-4CAE556C3792}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{2FE8D17F-A797-4FAB-960C-4CAE556C3792}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{336F5317-BAD3-4BE1-8896-25B78335F4B9}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{336F5317-BAD3-4BE1-8896-25B78335F4B9}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{3DB55EA8-8B30-41E9-BE6F-0ABE4678F427}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{3DB55EA8-8B30-41E9-BE6F-0ABE4678F427}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{43E09157-2604-46AC-8543-0E37EC3BF3BA}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{43E09157-2604-46AC-8543-0E37EC3BF3BA}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{5989B2EF-D116-45B9-9FA0-9E4150EA3221}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{5989B2EF-D116-45B9-9FA0-9E4150EA3221}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{645150AF-43F1-45C2-8E2C-67593F2D7624}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{645150AF-43F1-45C2-8E2C-67593F2D7624}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{715A12C2-2765-47FB-A7ED-DA7762A32987}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{715A12C2-2765-47FB-A7ED-DA7762A32987}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{78FF1AF3-475F-4CF9-A3F9-C2C933EDFB5F}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{78FF1AF3-475F-4CF9-A3F9-C2C933EDFB5F}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{80BCCE43-B83E-4D63-BC98-AB0B6C6A7B45}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{80BCCE43-B83E-4D63-BC98-AB0B6C6A7B45}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{91D4B9CA-DFCB-4950-9767-4C64438AB712}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{91D4B9CA-DFCB-4950-9767-4C64438AB712}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{B01BFB7C-E1AE-431E-960A-EE4217F606CB}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{B01BFB7C-E1AE-431E-960A-EE4217F606CB}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{B2CEA393-E9E0-4372-A950-8F77E8B7FF8A}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{B2CEA393-E9E0-4372-A950-8F77E8B7FF8A}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{B8BEA1BA-4809-4AEB-9533-327F166DF9B4}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{B8BEA1BA-4809-4AEB-9533-327F166DF9B4}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{C9519BBF-3763-4DAC-997A-82E1D9388D6F}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{C9519BBF-3763-4DAC-997A-82E1D9388D6F}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{D094F74B-4DB6-42F3-9D0A-C6D9F5182FBE}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{D094F74B-4DB6-42F3-9D0A-C6D9F5182FBE}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{D1B84885-22D8-4BA5-A425-ABF4E6C96DA9}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{D1B84885-22D8-4BA5-A425-ABF4E6C96DA9}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{EFD01F5A-7D8C-48C6-B714-57062FE9FF1A}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{EFD01F5A-7D8C-48C6-B714-57062FE9FF1A}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{F16E4E11-A273-4E14-96FB-E1E062E765D4}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C918990A-51B3-4C0F-92AC-3565E03A6CEC}\{F16E4E11-A273-4E14-96FB-E1E062E765D4}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CC93473A-C256-4B36-B1DE-0B87FE6049EC}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CC93473A-C256-4B36-B1DE-0B87FE6049EC}\{59B0AD1E-A83A-479F-BD41-935C227DBB65}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CC93473A-C256-4B36-B1DE-0B87FE6049EC}\{59B0AD1E-A83A-479F-BD41-935C227DBB65}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CC93473A-C256-4B36-B1DE-0B87FE6049EC}\{7469E1E4-80D5-47ED-A409-BA912CF87963}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CC93473A-C256-4B36-B1DE-0B87FE6049EC}\{7469E1E4-80D5-47ED-A409-BA912CF87963}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CC93473A-C256-4B36-B1DE-0B87FE6049EC}\{8578983E-53A5-434B-9FF4-C1E2AD54A3AE}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CC93473A-C256-4B36-B1DE-0B87FE6049EC}\{8578983E-53A5-434B-9FF4-C1E2AD54A3AE}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CC93473A-C256-4B36-B1DE-0B87FE6049EC}\{876210D9-95EE-4150-AA88-025ED0590028}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CC93473A-C256-4B36-B1DE-0B87FE6049EC}\{876210D9-95EE-4150-AA88-025ED0590028}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CC93473A-C256-4B36-B1DE-0B87FE6049EC}\{A48E6D76-B8E0-4158-9960-D8C1D65F8EB6}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CC93473A-C256-4B36-B1DE-0B87FE6049EC}\{A48E6D76-B8E0-4158-9960-D8C1D65F8EB6}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CC93473A-C256-4B36-B1DE-0B87FE6049EC}\{C1DFC5E1-2656-420F-8972-EAD5D4125FEF}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CC93473A-C256-4B36-B1DE-0B87FE6049EC}\{C1DFC5E1-2656-420F-8972-EAD5D4125FEF}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{0CA26B12-8BBD-4211-8048-80881BB05AD3}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{0CA26B12-8BBD-4211-8048-80881BB05AD3}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{17A72657-E585-4E82-89EB-3456A2FCF931}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{17A72657-E585-4E82-89EB-3456A2FCF931}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{29ADB143-E641-4761-BA66-B3895D80C286}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{29ADB143-E641-4761-BA66-B3895D80C286}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{38A372C0-A830-43E5-918D-203DB31C8D38}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{38A372C0-A830-43E5-918D-203DB31C8D38}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{39C35DBE-4EEC-42D8-954D-9BAD7BC20AB8}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{39C35DBE-4EEC-42D8-954D-9BAD7BC20AB8}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{3EDF7360-4726-43B8-9BF8-02CBBA106D34}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{3EDF7360-4726-43B8-9BF8-02CBBA106D34}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{42CFF615-0A23-4473-B2E8-16B752DEF796}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{42CFF615-0A23-4473-B2E8-16B752DEF796}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{51CDF437-BA1A-421D-9CD9-596AB7AB9663}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{51CDF437-BA1A-421D-9CD9-596AB7AB9663}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{530DF78F-B6B6-4AA1-887B-5A5E259F9A91}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{530DF78F-B6B6-4AA1-887B-5A5E259F9A91}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{535D4341-492B-4343-A692-34F06C68B2D0}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{535D4341-492B-4343-A692-34F06C68B2D0}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{56EB0E99-7D26-4FCE-A61B-D7770DF494E0}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{56EB0E99-7D26-4FCE-A61B-D7770DF494E0}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{5FF3A359-7682-468B-88D8-A005F2593C8A}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{5FF3A359-7682-468B-88D8-A005F2593C8A}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{72D579DC-48BF-4B22-9BB5-576C2204D541}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{72D579DC-48BF-4B22-9BB5-576C2204D541}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{82F23D54-317D-4CE8-89CD-2A5FEB54A37C}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{82F23D54-317D-4CE8-89CD-2A5FEB54A37C}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{89673F34-8B4E-4B48-ADA6-4AD1C26776B0}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{89673F34-8B4E-4B48-ADA6-4AD1C26776B0}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{9FAB8C66-9966-4B2D-B092-D366A275F61B}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{9FAB8C66-9966-4B2D-B092-D366A275F61B}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{BB595AF9-9DC0-4155-9D4E-29C71DEF32C9}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{BB595AF9-9DC0-4155-9D4E-29C71DEF32C9}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{BDD04D8A-90B7-4073-B595-AA125D762997}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{CF0E139C-DBE5-4B52-B95C-6898ED52B578}\{BDD04D8A-90B7-4073-B595-AA125D762997}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{01464278-C859-425F-A27D-92478554F724}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{01464278-C859-425F-A27D-92478554F724}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{21FD17FD-DE18-49CE-AF5A-CF96A464F243}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{21FD17FD-DE18-49CE-AF5A-CF96A464F243}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{24BDD4CC-A08E-4173-AC29-E2B741D7E855}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{24BDD4CC-A08E-4173-AC29-E2B741D7E855}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{2BB4ED7A-82C7-425D-B560-F07DBA67F4D9}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{2BB4ED7A-82C7-425D-B560-F07DBA67F4D9}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{2CF5789A-048E-40E3-AFE7-60F03259073B}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{2CF5789A-048E-40E3-AFE7-60F03259073B}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{39BF7D3A-64AC-4831-B5F1-A1A3CF20A957}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{39BF7D3A-64AC-4831-B5F1-A1A3CF20A957}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{3D027114-1DC3-409D-B7DF-20D487EBEFDC}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{3D027114-1DC3-409D-B7DF-20D487EBEFDC}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{3E27CC21-0844-4FAE-8407-9F17BDA4F0D8}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{3E27CC21-0844-4FAE-8407-9F17BDA4F0D8}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{44B73C2B-6465-4B28-8A72-5E4F296D4F34}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{44B73C2B-6465-4B28-8A72-5E4F296D4F34}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{4CB5BD85-1C66-41AC-8FEC-591AB6619187}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{4CB5BD85-1C66-41AC-8FEC-591AB6619187}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{528E6164-3DE2-48F3-8A41-6F44768480B0}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{528E6164-3DE2-48F3-8A41-6F44768480B0}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{5518FA3D-CB28-4522-B598-D45B8E777DE3}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{5518FA3D-CB28-4522-B598-D45B8E777DE3}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{82926F80-0B6E-4332-80D6-8EA3971DC27C}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{82926F80-0B6E-4332-80D6-8EA3971DC27C}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{B378C332-D552-4A5D-BAB4-5D3409B60C8A}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{B378C332-D552-4A5D-BAB4-5D3409B60C8A}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{BAB4D910-558C-4F6E-B8D4-5042ABB7F049}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{BAB4D910-558C-4F6E-B8D4-5042ABB7F049}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{BF568E39-F7DA-4A8E-963C-E1B5C9564D2A}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{BF568E39-F7DA-4A8E-963C-E1B5C9564D2A}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{F3D9ECFD-6BE5-4F36-952F-0A706A881C2A}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{F3D9ECFD-6BE5-4F36-952F-0A706A881C2A}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{F61853C4-4E16-49E2-80F3-8A5DB491FB35}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{E2077052-387B-4766-956F-03845DED3B35}\{F61853C4-4E16-49E2-80F3-8A5DB491FB35}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{020AF22F-55A3-4C03-9011-0377A2756AA4}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{020AF22F-55A3-4C03-9011-0377A2756AA4}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{076690D4-9EE4-477C-9BBE-30D2E81B0AC4}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{076690D4-9EE4-477C-9BBE-30D2E81B0AC4}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{2327593A-3E83-4757-B1ED-82C9A9AC7F82}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{2327593A-3E83-4757-B1ED-82C9A9AC7F82}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{280C22FF-A445-4599-81EF-474E31414306}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{280C22FF-A445-4599-81EF-474E31414306}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{30684EF4-E1C9-415E-BC85-AB846FE91B46}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{30684EF4-E1C9-415E-BC85-AB846FE91B46}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{334A1B8B-7E1A-416B-8E8B-73C82901B461}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{334A1B8B-7E1A-416B-8E8B-73C82901B461}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{3F1BB5E4-3AC2-4FCD-AD72-002F75866E27}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{3F1BB5E4-3AC2-4FCD-AD72-002F75866E27}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{4F079F2A-8959-4584-974D-08869BDC9CA3}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{4F079F2A-8959-4584-974D-08869BDC9CA3}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{566030A9-0508-4594-81F1-412B67B933BE}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{566030A9-0508-4594-81F1-412B67B933BE}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{629E643A-84CD-4D50-8623-DDFADFFE4DE4}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{629E643A-84CD-4D50-8623-DDFADFFE4DE4}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{63424C44-9F74-4F4B-B15C-B40C291FC227}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{63424C44-9F74-4F4B-B15C-B40C291FC227}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{6EB85B92-8CD4-47FD-A456-25E0FBEE1C04}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{6EB85B92-8CD4-47FD-A456-25E0FBEE1C04}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{7127C84A-34F8-4719-9721-F5D43E2F63C0}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{7127C84A-34F8-4719-9721-F5D43E2F63C0}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{896DFB54-1B5A-4274-B1DF-1966E9083C69}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{896DFB54-1B5A-4274-B1DF-1966E9083C69}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{B5556A99-4953-4310-973D-AE5E857A91B9}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{B5556A99-4953-4310-973D-AE5E857A91B9}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{B6C3EA30-BE2A-4516-9626-B09934A1EE52}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{B6C3EA30-BE2A-4516-9626-B09934A1EE52}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{BFBD6FA2-8569-4D8D-B2AB-3FF8071F3FAB}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{BFBD6FA2-8569-4D8D-B2AB-3FF8071F3FAB}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{CA71C062-5665-4282-B168-4A8583780D89}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{CA71C062-5665-4282-B168-4A8583780D89}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{CB1D4BCE-B113-4295-9703-CE0B3B03E047}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{CB1D4BCE-B113-4295-9703-CE0B3B03E047}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{D7120F0D-398D-4D16-B82B-632D9E7CAB83}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{D7120F0D-398D-4D16-B82B-632D9E7CAB83}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{E20DA707-5E4F-4209-A5D1-F8F065A57965}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{E20DA707-5E4F-4209-A5D1-F8F065A57965}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{E9B012A2-B1A6-4A29-BCD9-2F568025AEAC}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{E9B012A2-B1A6-4A29-BCD9-2F568025AEAC}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{EC92C7AC-0763-4821-A1A1-1AE9CAA1CB26}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{EC92C7AC-0763-4821-A1A1-1AE9CAA1CB26}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{F6A8D04C-20E6-4EAE-B63C-401A8031D9BC}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{F6A8D04C-20E6-4EAE-B63C-401A8031D9BC}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{FFE300B3-6A17-4E51-8038-856765DBF7B2}.qbd
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{FE0DCCC6-76D2-4EAA-9A34-D3BD669DF8FD}\{FFE300B3-6A17-4E51-8038-856765DBF7B2}.qbi
C:\Documents and Settings\All Users\Application Data\Symantec\wcid0.log
C:\Documents and Settings\Daddy\Application Data\AVGTOOLBAR
C:\kav
C:\kav\kis\kis.en.msi
C:\kav\kis\setup.exe
C:\kav\kis\setup.reg
C:\Program Files\Common Files\Symantec Shared
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll
C:\Program Files\Common Files\Symantec Shared\DefUtDCD.dll
C:\Program Files\Common Files\Symantec Shared\ecmldr32.DLL
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\Languages\09\01\AlertEng.loc
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\Languages\fallback.dat
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\lun.ico
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\mhDSA.dll
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\pifCrawl.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\SymHTML.dll
C:\Program Files\Viewpoint
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Viewpoint\Common\VistaBoot.sdll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\AxMetaStream.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\ClassIDs.ini
C:\Program Files\Viewpoint\Viewpoint Experience Technology\ComponentMgr.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\ComponentMgr_03000F11.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\AOLArt.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\AOLShell.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\AOLUserShell.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\Cursors.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\DataTracking.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\SceneComponent.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\SreeDMMX.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\SWFView.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPExtras.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\MetaStreamID.ini
C:\Program Files\Viewpoint\Viewpoint Experience Technology\MtsAxInstaller.exe
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents\AOLUserShell.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents\BlueStreak.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents\GifReader.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents\JpegReader.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents\LensFlares.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents\Mts2Reader.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents\Mts3Reader.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents\ObjectMovie.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents\SceneComponent.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents\ServiceComponent.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents\SreeDMMX.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents\SWFView.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents\VectorView.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents\VETScriptInterpreter.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents\VMPSpeech.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents\VMPVideo.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents\VMPVideo2.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents\WaveletReader.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewComponents\ZoomView.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.xpt
C:\WINDOWS\BM4fc35953.xml
C:\WINDOWS\system32\drivers\fidbox2.dat
C:\WINDOWS\system32\drivers\fidbox2.idx
C:\WINDOWS\system32\mlfcache.dat

.
((((((((((((((((((((((((( Files Created from 2008-06-03 to 2008-07-03 )))))))))))))))))))))))))))))))
.

2008-07-03 17:08 . 2008-07-03 17:08 <DIR> d-------- C:\WINDOWS\LastGood
2008-07-03 00:39 . 2008-07-03 00:39 <DIR> d-------- C:\Program Files\Kaspersky Lab
2008-07-03 00:39 . 2008-07-03 00:44 51,232 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-07-03 00:39 . 2008-07-03 00:44 1,676 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-07-02 23:46 . 2008-07-02 23:46 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-02 01:06 . 2008-07-02 01:06 <DIR> d-------- C:\WINDOWS\ERUNT
2008-07-02 00:53 . 2007-11-21 14:08 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Apple Computer
2008-07-02 00:53 . 2008-07-02 00:53 <DIR> d-------- C:\Documents and Settings\Administrator
2008-07-02 00:43 . 2008-07-02 09:40 <DIR> d-------- C:\SDFix
2008-06-27 20:16 . 2008-06-27 20:16 <DIR> d-------- C:\Deckard
2008-06-27 19:35 . 2008-06-27 19:35 <DIR> d-------- C:\Program Files\ZonedOut
2008-06-27 19:33 . 2008-06-27 19:33 <DIR> d-------- C:\ie-spyad_zo
2008-06-27 19:23 . 2008-06-27 19:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-27 19:22 . 2008-06-27 19:27 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-06-26 23:45 . 2008-06-26 23:54 <DIR> d-------- C:\Program Files\Panda Security
2008-06-25 10:59 . 2008-06-25 10:59 <DIR> d-------- C:\Documents and Settings\Mom\Application Data\Verizon
2008-06-25 09:19 . 2008-06-25 09:19 <DIR> d-------- C:\Documents and Settings\Stephanie\Application Data\Verizon
2008-06-24 20:57 . 2008-06-24 20:57 <DIR> d--h----- C:\WINDOWS\PIF
2008-06-24 17:50 . 2008-06-24 17:50 <DIR> d-------- C:\Documents and Settings\Daddy\Application Data\Verizon
2008-06-24 17:50 . 2008-06-24 17:51 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Verizon
2008-06-10 20:43 . 2008-06-13 09:10 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-03 22:32 . 2008-06-03 22:32 <DIR> d-------- C:\Documents and Settings\Alex\Application Data\vlc
2008-06-03 21:22 . 2008-07-03 17:18 <DIR> d-------- C:\Program Files\PeerGuardian2

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-01 07:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-06-27 01:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\SecTaskMan
2008-06-26 19:43 --------- d-----w C:\Program Files\Verizon
2008-06-26 19:42 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-24 21:34 --------- d-----w C:\Documents and Settings\Daddy\Application Data\Apple Computer
2008-06-24 16:28 --------- d-----w C:\Documents and Settings\Alex\Application Data\LimeWire
2008-06-24 04:51 --------- d-----w C:\Program Files\Soulseek
2008-06-22 19:45 --------- d-----w C:\Documents and Settings\Daddy\Application Data\Azureus
2008-06-18 23:39 --------- d-----w C:\Documents and Settings\Daddy\Application Data\ZoomBrowser EX
2008-06-18 23:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\ZoomBrowser
2008-06-18 23:26 --------- d-----w C:\Documents and Settings\Daddy\Application Data\Canon
2008-06-13 13:10 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 04:48 --------- d-----w C:\Program Files\Solid AVI DIVX to DVD Burner
2008-06-05 23:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\CanonIJPLM
2008-06-01 16:16 --------- d-----w C:\Documents and Settings\Stephanie\Application Data\CyberLink
2008-06-01 04:51 --------- d-----w C:\Documents and Settings\Daddy\Application Data\dvdcss
2008-05-28 22:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\PCPitstop
2008-05-25 14:52 --------- d-----w C:\Documents and Settings\Daddy\Application Data\vlc
2008-05-25 14:46 --------- d-----w C:\Program Files\VideoLAN
2008-05-25 14:33 --------- d-----w C:\Documents and Settings\Daddy\Application Data\DVD Flick
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-26 23:05 21,800 ----a-w C:\Documents and Settings\Stephanie\Application Data\GDIPFONTCACHEV1.DAT
2008-02-22 17:37 479 ----a-w C:\Program Files\setup.reg
2008-02-08 15:07 33,296,384 ----a-w C:\Program Files\kis.en.msi
2008-01-31 00:51 1,570,920 ----a-w C:\Program Files\taskmanager17.exe
2008-01-10 22:58 21,800 ----a-w C:\Documents and Settings\Daddy\Application Data\GDIPFONTCACHEV1.DAT
2007-11-17 02:31 8,212,216 ----a-w C:\Program Files\CheetahDVDBurner.exe
2007-05-12 14:40 630,784 ----a-w C:\Documents and Settings\Daddy\GoToAssist_chat2way__317_en.exe
2007-05-08 23:53 21,408 ----a-w C:\Documents and Settings\Brian\Application Data\GDIPFONTCACHEV1.DAT
2007-05-06 03:23 3,550,409 ----a-w C:\Program Files\ffdshow_rev529_20061113_clsid.exe
2007-04-04 13:52 507,904 ----a-w C:\Program Files\moveonb.msi
2007-03-21 23:37 528,312,337 ----a-w C:\Program Files\MSSetup.exe
2007-03-13 04:43 965 ----a-w C:\Program Files\Avery-MyProject8163.avery
2007-03-12 01:59 1,948,945 ----a-w C:\Program Files\burnquickeval.exe
2007-03-11 16:50 266,664 ----a-w C:\Program Files\burnsetup.exe
2007-03-11 15:26 830,422 ----a-w C:\Program Files\dBpowerAMP-codec-shorten.exe
2007-03-11 02:33 4,103,032 ----a-w C:\Program Files\dMC-r12.exe
2007-02-21 03:35 6,482,128 ----a-w C:\Program Files\FreeFXMPEG.EXE
2007-02-21 02:16 404,890 ----a-w C:\Program Files\switch.zip
2007-02-19 17:17 1,527,192 ----a-w C:\Program Files\daemon408-139-x86.exe
2007-02-19 16:58 1,035,271 ----a-w C:\Program Files\wrar362.exe
2007-02-11 23:16 10,007,784 ----a-w C:\Program Files\Azureus_2.5.0.4a_Win32.setup.exe
2007-01-11 04:36 51,973,232 ----a-w C:\Program Files\Quicken_Home_Business_2007.exe
2007-01-10 16:19 11,817,800 ----a-w C:\Program Files\GoogleEarth.exe
2006-11-06 23:33 557,056 ----a-w C:\Documents and Settings\Daddy\chatlnk.exe
2006-10-27 23:17 842,672 ----a-w C:\Program Files\slsk156c.exe
.

((((((((((((((((((((((((((((( snapshot@2008-07-02_15.04.22.70 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-07-02 18:57:02 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-07-03 2118 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2007-08-13 22:39:10 13,312 ----a-w C:\WINDOWS\system32\ieudinit.exe
+ 2008-04-22 07:39:58 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
- 2006-09-06 21:43:16 22,752 ----a-w C:\WINDOWS\system32\spupdsvc.exe
+ 2005-06-28 13:21:34 22,752 ----a-w C:\WINDOWS\system32\spupdsvc.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="C:\WINDOWS\System32\NVMCTRAY.DLL" [2003-09-24 19:32 49152]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 06:48 157592]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]
"PeerGuardian"="C:\Program Files\PeerGuardian2\pg2.exe" [2005-09-18 18:44 1382400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-10-26 13:22 180269]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-10-26 14:00 190464]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-09-24 19:32 5033984]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 20:54 623992]
"Adobe_ID0EYTHM"="C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 17:40 1884160]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"Verizon_McciTrayApp"="C:\Program Files\Verizon\McciTrayApp.exe" [2007-09-28 14:30 936960]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"CanonSolutionMenu"="C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 21:01 644696]
"CanonMyPrinter"="C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 21:50 1603152]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 09:03 210472]
"OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 12:02 79400]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 05:59 122880 C:\WINDOWS\BCMSMMSG.exe]
"Logitech Utility"="LOGI_MWX.EXE" [2003-11-26 09:50 19968 C:\WINDOWS\LOGI_MWX.EXE]
"nwiz"="nwiz.exe" [2003-09-24 19:32 741376 C:\WINDOWS\system32\nwiz.exe]

C:\Documents and Settings\Alex\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2008-02-08 17:32:57 147456]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL kcjckdhn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server

R2 ONSIO;ONSIO;C:\WINDOWS\SYSTEM32\DRIVERS\ONSIO.SYS [1998-04-17 14:23]
S0 SMPLSCSI;SMPLSCSI;C:\WINDOWS\system32\drivers\SMPLSCSI.SYS [1998-08-01 13:00]
S2 IJPLMSVC;PIXMA Extended Survey Program;C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2007-04-13 12:20]
S2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" []
S3 scsiscan;SCSI Scanner Driver;C:\WINDOWS\system32\DRIVERS\scsiscan.sys [2001-08-17 14:53]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{df50faf4-614e-11db-b3bb-806d6172696f}]
\shell\PlayWithPowerCinema\Command - "C:\Program Files\Dell\Media Experience\PCM2.exe" MOVIE "%L"

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2008-06-27 13:16:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-03 17:25:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-07-03 17:30:32
ComboFix-quarantined-files.txt 2008-07-03 21:29:50
ComboFix2.txt 2008-07-02 19:05:12

Pre-Run: 17,463,054,336 bytes free
Post-Run: 17,413,857,280 bytes free

618 --- E O F --- 2008-07-03 04:43:36


------------------




----------------------------

HJT Logfile

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:14:18 PM, on 7/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\LOGI_MWX.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
c:\program files\avira\antivir personaledition classic\avcenter.exe
C:\PROGRA~1\MICROS~2\Office10\OUTLOOK.EXE
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.shockwave.com/content/ric...GameLoader.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1161734388453
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1215552413000
O16 - DPF: {B0FB831D-17F6-4CBD-9B5D-3305881D362E} (LHGLauncherXForm Control) - http://www.shockwave.com/content/rea...LGLauncher.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://www.shockwave.com/content/fee...utLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.shockwave.com/content/zum...loader_v10.cab
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/optimize2/pcpitstop2.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{15DDA148-4767-49AE-B6CC-EBAB3F0FF04F}: NameServer = 192.168.1.1,192.168.1.3
O17 - HKLM\System\CS1\Services\Tcpip\..\{15DDA148-4767-49AE-B6CC-EBAB3F0FF04F}: NameServer = 192.168.1.1,192.168.1.3
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL kcjckdhn.dll
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Viewpoint Manager Service - Unknown owner - C:\Program Files\Viewpoint\Common\ViewpointService.exe (file missing)
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 12310 bytes

---------------------
Avira AntiVir Personal
Report file date: Tuesday, July 08, 2008 17:58

Scanning for 1165085 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Normally booted
Username: Daddy
Computer name: DELLPC

Version information:
BUILD.DAT : 8.1.00.295 16479 Bytes 4/9/2008 16:24:00
AVSCAN.EXE : 8.1.2.12 311553 Bytes 3/18/2008 15:02:56
AVSCAN.DLL : 8.1.1.0 53505 Bytes 2/7/2008 14:43:37
LUKE.DLL : 8.1.2.9 151809 Bytes 2/28/2008 14:41:23
LUKERES.DLL : 8.1.2.1 12033 Bytes 2/21/2008 14:28:40
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 7/18/2007 16:33:34
ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 3/7/2008 19:08:58
ANTIVIR2.VDF : 7.0.3.62 337408 Bytes 3/21/2008 01:12:34
ANTIVIR3.VDF : 7.0.3.68 57856 Bytes 3/25/2008 14:27:50
Engineversion : 8.1.0.28
AEVDF.DLL : 8.1.0.5 102772 Bytes 2/25/2008 15:58:21
AESCRIPT.DLL : 8.1.0.19 229754 Bytes 4/7/2008 21:34:44
AESCN.DLL : 8.1.0.12 115060 Bytes 4/7/2008 21:34:44
AERDL.DLL : 8.1.0.19 418164 Bytes 4/7/2008 21:34:44
AEPACK.DLL : 8.1.1.0 364918 Bytes 3/18/2008 17:20:42
AEOFFICE.DLL : 8.1.0.15 192889 Bytes 4/7/2008 21:34:44
AEHEUR.DLL : 8.1.0.15 1147253 Bytes 4/7/2008 21:34:44
AEHELP.DLL : 8.1.0.11 115061 Bytes 4/7/2008 21:34:43
AEGEN.DLL : 8.1.0.15 299379 Bytes 4/7/2008 21:34:43
AEEMU.DLL : 8.1.0.5 430450 Bytes 4/7/2008 21:34:43
AECORE.DLL : 8.1.0.25 168309 Bytes 4/8/2008 15:58:32
AVWINLL.DLL : 1.0.0.7 14593 Bytes 1/23/2008 23:07:53
AVPREF.DLL : 8.0.0.1 25857 Bytes 2/18/2008 16:37:50
AVREP.DLL : 7.0.0.1 155688 Bytes 4/16/2007 19:26:47
AVREG.DLL : 8.0.0.0 30977 Bytes 1/23/2008 23:07:49
AVARKT.DLL : 1.0.0.23 307457 Bytes 2/12/2008 14:29:23
AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 2/28/2008 14:31:31
SQLITE3.DLL : 3.3.17.1 339968 Bytes 1/22/2008 23:28:02
SMTPLIB.DLL : 1.2.0.19 28929 Bytes 1/23/2008 23:08:39
NETNT.DLL : 8.0.0.1 7937 Bytes 1/25/2008 18:05:10
RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 3/10/2008 20:37:25
RCTEXT.DLL : 8.0.32.0 86273 Bytes 3/6/2008 18:02:11

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: Tuesday, July 08, 2008 17:58

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'msmsgs.exe' - '1' Module(s) have been scanned
Scan process 'pg2.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'daemon.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'OpWareSE4.exe' - '1' Module(s) have been scanned
Scan process 'BJMYPRT.EXE' - '1' Module(s) have been scanned
Scan process 'McciTrayApp.exe' - '1' Module(s) have been scanned
Scan process 'Acrotray.exe' - '1' Module(s) have been scanned
Scan process 'apdproxy.exe' - '1' Module(s) have been scanned
Scan process 'realsched.exe' - '1' Module(s) have been scanned
Scan process 'LOGI_MWX.EXE' - '1' Module(s) have been scanned
Scan process 'BCMSMMSG.exe' - '1' Module(s) have been scanned
Scan process 'wscntfy.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'wanmpsvc.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'acsd.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
38 processes with 38 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
[WARNING] The device is not ready.

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '36' files ).


Starting the file scan:

Begin scan in 'C:\' <DSK1_VOL1>
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\inst.exe
[DETECTION] Contains detection pattern of a probably damaged sample CC/Agent.CZ
[NOTE] The file was moved to '48e6f25a.qua'!
C:\Documents and Settings\Daddy\Application Data\Verizon\VSP\downloads\SA_Rec-Det_07052008.41.zip.dir\SA_RecSc.js
[DETECTION] Contains detection pattern of the HTML script virus HTML/Rce.Gen
[NOTE] The file was moved to '48d2f45e.qua'!
C:\Documents and Settings\Daddy\Application Data\Verizon\VSP\SoftwareDetectionScripts\SA_RecSc.js
[DETECTION] Contains detection pattern of the HTML script virus HTML/Rce.Gen
[NOTE] The file was moved to '48d2f46a.qua'!
C:\Documents and Settings\Mom\Application Data\Verizon\VSP\downloads\SA_Rec-Det_07052008.41.zip.dir\SA_RecSc.js
[DETECTION] Contains detection pattern of the HTML script virus HTML/Rce.Gen
[NOTE] The file was moved to '48d2f5e4.qua'!
C:\Documents and Settings\Mom\Application Data\Verizon\VSP\SoftwareDetectionScripts\SA_RecSc.js
[DETECTION] Contains detection pattern of the HTML script virus HTML/Rce.Gen
[NOTE] The file was moved to '48d2f5ea.qua'!
C:\Documents and Settings\Stephanie\Application Data\Verizon\VSP\downloads\SA_Rec-Det_07052008.41.zip.dir\SA_RecSc.js
[DETECTION] Contains detection pattern of the HTML script virus HTML/Rce.Gen
[NOTE] The file was moved to '48d2f648.qua'!
C:\Documents and Settings\Stephanie\Application Data\Verizon\VSP\SoftwareDetectionScripts\SA_RecSc.js
[DETECTION] Contains detection pattern of the HTML script virus HTML/Rce.Gen
[NOTE] The file was moved to '48d2f64b.qua'!
C:\Program Files\Panda Security\ActiveScan 2.0\pskavs.dll
[DETECTION] Contains detection pattern of the Windows virus W95/Blumblebee.1738
[NOTE] The file was moved to '48defd96.qua'!
C:\Program Files\Panda Security\NanoScan\Engine\psnflg.dll
[DETECTION] Is the Trojan horse TR/Agent.bux.1
[NOTE] The file was moved to '48e1fd98.qua'!
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!


End of the scan: Tuesday, July 08, 2008 20:01
Used time: 2:03:36 min

The scan has been done completely.

20509 Scanning directories
481483 Files were scanned
9 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
9 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
481474 Files not concerned
3343 Archives were scanned
3 Warnings
9 Notes


Please note I was unable to install and run both AVG and Avast due to errors I could not correct.

Also, even though my (Admin) IE7 is working properly, all sub account are now missing Office in it's entirety and will not let me install IE7 or Firefox at all.

Thanks!
bunker10 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-08-2008, 07:58 PM   #11 (permalink)
Registered User
 
Join Date: Jun 2008
Posts: 14
OS: XPsp2


Re: Trojan Attack - IE7 & Outlook Gone!!
JavaRa 1.08 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Mon Jul 07 18:49:29 2008

Found and removed: C:\Program Files\Java\jre1.5.0_07

Found and removed: C:\Program Files\Java\jre1.5.0_09

Found and removed: C:\Program Files\Java\jre1.5.0_10

Found and removed: C:\Program Files\Java\jre1.6.0_01

Found and removed: C:\Program Files\Java\jre1.6.0_02

Found and removed: C:\Program Files\Java\jre1.6.0_03

Found and removed: C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64

Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled.1.5.0.0

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\core1.zip

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\core2.zip

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\core3.zip

Found and removed: Software\JavaSoft\Java2D\1.5.0_07

Found and removed: Software\JavaSoft\Java2D\1.5.0_09

Found and removed: Software\JavaSoft\Java2D\1.5.0_10

Found and removed: Software\JavaSoft\Java2D\1.6.0_01

Found and removed: Software\JavaSoft\Java2D\1.6.0_02

Found and removed: Software\JavaSoft\Java2D\1.6.0_03

Found and removed: Software\JavaSoft\Java2D\1.6.0_05

Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_01

Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_02

Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_03

Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_05

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\JavaPlugin.150_07

Found and removed: SOFTWARE\Classes\JavaPlugin.150_09

Found and removed: SOFTWARE\Classes\JavaPlugin.150_10

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0150070}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0150090}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0150100}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\JavaPlugin.160_01

Found and removed: SOFTWARE\Classes\JavaPlugin.160_02

Found and removed: SOFTWARE\Classes\JavaPlugin.160_03

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_01

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_02

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_03

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_01

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_02

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_03

Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160010}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160020}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160030}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D510007

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D510009

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D511000

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610001

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610002

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610003

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D510007

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D510009

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D511000

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610001

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610002

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610003

JavaRa 1.08 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Mon Jul 07 18:52:02 2008

------------------------------------

Finished reporting.
bunker10 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-09-2008, 08:17 AM   #12 (permalink)
Moderator, Analyst, Security Team
 
TheBruce1's Avatar
 
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP


Re: Trojan Attack - IE7 & Outlook Gone!!
Hello again

Its important you follow the instructions accordingly, otherwise things can become confusing, so which antivirus product do you have installed at this time, have you been able to remove previous version of Java.

=========

Delete your current version of Combofix on your desktop, then download the updated version from one of the links below.

Link 1
Link 2
Link 3

**Note: It is important that it is saved directly to your desktop**

=========

Open notepad and copy/paste the text in the quotebox below into it:

Quote:
File::
C:\WINDOWS\SYSTEM32\DQLHVMCG.DLL
C:\WINDOWS\SYSTEM32\KCJCKDHN.DLL
C:\WINDOWS\SYSTEM32\NDQRWTCQ.DLL
C:\WINDOWS\SYSTEM32\RQRLEBCT.DLL
Registry::
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{37B85A21-692B-4205-9CAD-2626E4993404}]
[-HKEY_CLASSES_ROOT\vbrad.trayicon]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\switch]
Save this as CFscript







Refering to the picture above, drag CFscript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

=========

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

==========
Logs Required
C:\Combofix.txt
Hijackthis Log
__________________
Member of ASAP since 2007
Member of UNITE since 2008

**Notice to BT customers**
BT to dump Phorm, see Here for more information. No DPI

If we have helped you in anyway, please consider Donating
TheBruce1 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-09-2008, 12:24 PM   #13 (permalink)
Registered User
 
Join Date: Jun 2008
Posts: 14
OS: XPsp2


Re: Trojan Attack - IE7 & Outlook Gone!!
TheBruce1,

I've installed Avira Antivir Personal. Haven;t been able to update the Virus log due to some scheduler error, but I ran a scan and posted it last evening.

I'm running Java v6 upd 5, and all other versions are removed.


ComboFix 08-07-08.9 - Daddy 2008-07-09 14:02:21.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.215 [GMT -4:00]
Running from: C:\Documents and Settings\Daddy\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Daddy\Desktop\CFscript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\SYSTEM32\DQLHVMCG.DLL
C:\WINDOWS\SYSTEM32\KCJCKDHN.DLL
C:\WINDOWS\SYSTEM32\NDQRWTCQ.DLL
C:\WINDOWS\SYSTEM32\RQRLEBCT.DLL
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\twunk_16.exe

.
((((((((((((((((((((((((( Files Created from 2008-06-09 to 2008-07-09 )))))))))))))))))))))))))))))))
.

2008-07-09 10:06 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-07-09 10:06 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-07-08 17:54 . 2008-07-08 17:54 <DIR> d-------- C:\Program Files\Avira
2008-07-08 17:54 . 2008-07-08 17:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-07-08 17:53 . 2008-07-08 17:53 22,311,160 --a------ C:\Program Files\antivir_workstation_winu_en_h.exe
2008-07-08 16:47 . 2008-07-08 16:47 <DIR> d-------- C:\Program Files\Alwil Software
2008-07-08 16:47 . 2008-07-08 16:47 24,234,968 --a------ C:\Program Files\setupeng.exe
2008-07-08 16:36 . 2008-07-08 16:36 <DIR> d-------- C:\Documents and Settings\Daddy\Application Data\AVGTOOLBAR
2008-07-07 19:05 . 2008-07-07 19:23 <DIR> d-------- C:\Documents and Settings\Daddy\.SunDownloadManager
2008-07-04 11:09 . 2008-07-04 11:09 21,336 --a------ C:\WINDOWS\system32\GDIPFONTCACHEV1.DAT
2008-07-03 00:39 . 2008-07-03 00:39 <DIR> d-------- C:\Program Files\Kaspersky Lab
2008-07-03 00:39 . 2008-07-03 00:44 51,232 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-07-03 00:39 . 2008-07-03 00:44 1,676 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-07-02 23:46 . 2008-07-02 23:46 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-02 01:06 . 2008-07-02 01:06 <DIR> d-------- C:\WINDOWS\ERUNT
2008-07-02 00:53 . 2007-11-21 14:08 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Apple Computer
2008-07-02 00:53 . 2008-07-02 00:53 <DIR> d-------- C:\Documents and Settings\Administrator
2008-07-02 00:43 . 2008-07-02 09:40 <DIR> d-------- C:\SDFix
2008-06-27 20:16 . 2008-06-27 20:16 <DIR> d-------- C:\Deckard
2008-06-27 19:35 . 2008-06-27 19:35 <DIR> d-------- C:\Program Files\ZonedOut
2008-06-27 19:33 . 2008-06-27 19:33 <DIR> d-------- C:\ie-spyad_zo
2008-06-27 19:23 . 2008-06-27 19:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-27 19:22 . 2008-06-27 19:27 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-06-26 23:45 . 2008-06-26 23:54 <DIR> d-------- C:\Program Files\Panda Security
2008-06-25 10:59 . 2008-06-25 10:59 <DIR> d-------- C:\Documents and Settings\Mom\Application Data\Verizon
2008-06-25 09:19 . 2008-06-25 09:19 <DIR> d-------- C:\Documents and Settings\Stephanie\Application Data\Verizon
2008-06-24 20:57 . 2008-06-24 20:57 <DIR> d--h----- C:\WINDOWS\PIF
2008-06-24 17:50 . 2008-06-24 17:50 <DIR> d-------- C:\Documents and Settings\Daddy\Application Data\Verizon
2008-06-24 17:50 . 2008-06-24 17:51 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Verizon
2008-06-20 13:41 . 2008-06-20 13:41 245,248 -----c--- C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 06:44 . 2008-06-20 06:44 138,368 -----c--- C:\WINDOWS\system32\dllcache\afd.sys
2008-06-10 20:43 . 2008-06-13 09:10 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-09 17:59 --------- d-----w C:\Program Files\PeerGuardian2
2008-07-09 13:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-07-07 22:49 --------- d-----w C:\Program Files\Java
2008-06-27 01:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\SecTaskMan
2008-06-26 19:43 --------- d-----w C:\Program Files\Verizon
2008-06-26 19:42 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-24 21:34 --------- d-----w C:\Documents and Settings\Daddy\Application Data\Apple Computer
2008-06-24 16:28 --------- d-----w C:\Documents and Settings\Alex\Application Data\LimeWire
2008-06-24 04:51 --------- d-----w C:\Program Files\Soulseek
2008-06-22 19:45 --------- d-----w C:\Documents and Settings\Daddy\Application Data\Azureus
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-18 23:39 --------- d-----w C:\Documents and Settings\Daddy\Application Data\ZoomBrowser EX
2008-06-18 23:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\ZoomBrowser
2008-06-18 23:26 --------- d-----w C:\Documents and Settings\Daddy\Application Data\Canon
2008-06-13 13:10 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 04:48 --------- d-----w C:\Program Files\Solid AVI DIVX to DVD Burner
2008-06-05 23:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\CanonIJPLM
2008-06-04 02:32 --------- d-----w C:\Documents and Settings\Alex\Application Data\vlc
2008-06-01 16:16 --------- d-----w C:\Documents and Settings\Stephanie\Application Data\CyberLink
2008-06-01 04:51 --------- d-----w C:\Documents and Settings\Daddy\Application Data\dvdcss
2008-05-28 22:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\PCPitstop
2008-05-25 14:52 --------- d-----w C:\Documents and Settings\Daddy\Application Data\vlc
2008-05-25 14:46 --------- d-----w C:\Program Files\VideoLAN
2008-05-25 14:33 --------- d-----w C:\Documents and Settings\Daddy\Application Data\DVD Flick
2008-02-26 23:05 21,800 ----a-w C:\Documents and Settings\Stephanie\Application Data\GDIPFONTCACHEV1.DAT
2008-02-22 17:37 479 ----a-w C:\Program Files\setup.reg
2008-02-08 15:07 33,296,384 ----a-w C:\Program Files\kis.en.msi
2008-01-31 00:51 1,570,920 ----a-w C:\Program Files\taskmanager17.exe
2008-01-10 22:58 21,800 ----a-w C:\Documents and Settings\Daddy\Application Data\GDIPFONTCACHEV1.DAT
2007-11-17 02:31 8,212,216 ----a-w C:\Program Files\CheetahDVDBurner.exe
2007-05-12 14:40 630,784 ----a-w C:\Documents and Settings\Daddy\GoToAssist_chat2way__317_en.exe
2007-05-08 23:53 21,408 ----a-w C:\Documents and Settings\Brian\Application Data\GDIPFONTCACHEV1.DAT
2007-05-06 03:23 3,550,409 ----a-w C:\Program Files\ffdshow_rev529_20061113_clsid.exe
2007-04-04 13:52 507,904 ----a-w C:\Program Files\moveonb.msi
2007-03-21 23:37 528,312,337 ----a-w C:\Program Files\MSSetup.exe
2007-03-13 04:43 965 ----a-w C:\Program Files\Avery-MyProject8163.avery
2007-03-12 01:59 1,948,945 ----a-w C:\Program Files\burnquickeval.exe
2007-03-11 16:50 266,664 ----a-w C:\Program Files\burnsetup.exe
2007-03-11 15:26 830,422 ----a-w C:\Program Files\dBpowerAMP-codec-shorten.exe
2007-03-11 02:33 4,103,032 ----a-w C:\Program Files\dMC-r12.exe
2007-02-21 03:35 6,482,128 ----a-w C:\Program Files\FreeFXMPEG.EXE
2007-02-21 02:16 404,890 ----a-w C:\Program Files\switch.zip
2007-02-19 17:17 1,527,192 ----a-w C:\Program Files\daemon408-139-x86.exe
2007-02-19 16:58 1,035,271 ----a-w C:\Program Files\wrar362.exe
2007-02-11 23:16 10,007,784 ----a-w C:\Program Files\Azureus_2.5.0.4a_Win32.setup.exe
2007-01-11 04:36 51,973,232 ----a-w C:\Program Files\Quicken_Home_Business_2007.exe
2007-01-10 16:19 11,817,800 ----a-w C:\Program Files\GoogleEarth.exe
2006-11-06 23:33 557,056 ----a-w C:\Documents and Settings\Daddy\chatlnk.exe
2006-10-27 23:17 842,672 ----a-w C:\Program Files\slsk156c.exe
.

((((((((((((((((((((((((((((( snapshot@2008-07-02_15.04.22.70 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-07-02 18:57:02 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-07-09 18:08:32 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2008-02-20 05:32:43 148,992 -c----w C:\WINDOWS\system32\dllcache\dnsapi.dll
+ 2008-06-20 17:41:10 148,992 -c--a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
- 2007-10-30 17:20:55 360,064 -c----w C:\WINDOWS\system32\dllcache\tcpip.sys
+ 2008-06-20 10:45:13 360,320 -c--a-w C:\WINDOWS\system32\dllcache\tcpip.sys
- 2006-08-16 09:37:30 225,664 -c----w C:\WINDOWS\system32\dllcache\tcpip6.sys
+ 2008-06-20 09:52:06 225,920 -c--a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
- 2008-02-20 05:32:43 148,992 ----a-w C:\WINDOWS\system32\dnsapi.dll
+ 2008-06-20 17:41:10 148,992 ----a-w C:\WINDOWS\system32\dnsapi.dll
+ 2008-01-21 22:12:56 41,792 ----a-w C:\WINDOWS\system32\drivers\avgntdd.sys
+ 2008-01-21 22:11:28 22,336 ----a-w C:\WINDOWS\system32\drivers\avgntmgr.sys
+ 2008-03-04 17:28:53 79,424 ----a-w C:\WINDOWS\system32\drivers\avipbb.sys
+ 2007-03-01 14:34:22 28,352 ----a-w C:\WINDOWS\system32\drivers\ssmdrv.sys
- 2007-08-13 22:39:10 13,312 ----a-w C:\WINDOWS\system32\ieudinit.exe
+ 2008-04-22 07:39:58 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
- 2007-03-15 22:19:28 1,476,992 ----a-w C:\WINDOWS\system32\LegitCheckControl.dll
+ 2008-03-20 2236 1,480,232 ----a-w C:\WINDOWS\system32\LegitCheckControl.dll
- 2008-05-29 20:35:12 17,486,968 ----a-w C:\WINDOWS\system32\MRT.exe
+ 2008-06-25 16:15:46 17,972,344 ----a-w C:\WINDOWS\system32\MRT.exe
- 2004-08-04 07:56:44 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
+ 2008-06-20 17:41:10 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
+ 2007-07-30 23:18:34 207,736 ----a-w C:\WINDOWS\system32\muweb.dll
- 2007-11-30 11:18:51 17,272 ----a-w C:\WINDOWS\system32\spmsg.dll
+ 2007-11-30 12:39:22 17,272 ------w C:\WINDOWS\system32\spmsg.dll
- 2006-09-06 21:43:16 22,752 ----a-w C:\WINDOWS\system32\spupdsvc.exe
+ 2005-06-28 13:21:34 22,752 ----a-w C:\WINDOWS\system32\spupdsvc.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="C:\WINDOWS\System32\NVMCTRAY.DLL" [2003-09-24 19:32 49152]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 06:48 157592]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]
"PeerGuardian"="C:\Program Files\PeerGuardian2\pg2.exe" [2005-09-18 18:44 1382400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-10-26 13:22 180269]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-10-26 14:00 190464]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-09-24 19:32 5033984]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 20:54 623992]
"Adobe_ID0EYTHM"="C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 17:40 1884160]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"Verizon_McciTrayApp"="C:\Program Files\Verizon\McciTrayApp.exe" [2007-09-28 14:30 936960]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"CanonSolutionMenu"="C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 21:01 644696]
"CanonMyPrinter"="C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 21:50 1603152]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 09:03 210472]
"OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 12:02 79400]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 05:59 122880 C:\WINDOWS\BCMSMMSG.exe]
"Logitech Utility"="LOGI_MWX.EXE" [2003-11-26 09:50 19968 C:\WINDOWS\LOGI_MWX.EXE]
"nwiz"="nwiz.exe" [2003-09-24 19:32 741376 C:\WINDOWS\system32\nwiz.exe]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server

R2 ONSIO;ONSIO;C:\WINDOWS\SYSTEM32\DRIVERS\ONSIO.SYS [1998-04-17 14:23]
S0 SMPLSCSI;SMPLSCSI;C:\WINDOWS\system32\drivers\SMPLSCSI.SYS [1998-08-01 13:00]
S2 IJPLMSVC;PIXMA Extended Survey Program;C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2007-04-13 12:20]
S2 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files\Viewpoint\Common\ViewpointService.exe []
S3 scsiscan;SCSI Scanner Driver;C:\WINDOWS\system32\DRIVERS\scsiscan.sys [2001-08-17 14:53]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{df50faf4-614e-11db-b3bb-806d6172696f}]
\shell\PlayWithPowerCinema\Command - "C:\Program Files\Dell\Media Experience\PCM2.exe" MOVIE "%L"

*Newly Created Service* - SSMDRV
.
Contents of the 'Scheduled Tasks' folder
"2008-07-04 13:16:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-09 14:09:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2008-07-09 14:15:35 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-09 18:15:01
ComboFix2.txt 2008-07-09 17:40:48
ComboFix3.txt 2008-07-03 21:30:33
ComboFix4.txt 2008-07-02 19:05:12

Pre-Run: 17,254,588,416 bytes free
Post-Run: 17,244,651,520 bytes free

229 --- E O F --- 2008-07-09 07:02:03


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:23:18 PM, on 7/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\LOGI_MWX.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.shockwave.com/content/ric...GameLoader.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1161734388453
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1215552413000
O16 - DPF: {B0FB831D-17F6-4CBD-9B5D-3305881D362E} (LHGLauncherXForm Control) - http://www.shockwave.com/content/rea...LGLauncher.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://www.shockwave.com/content/fee...utLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.shockwave.com/content/zum...loader_v10.cab
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/optimize2/pcpitstop2.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{15DDA148-4767-49AE-B6CC-EBAB3F0FF04F}: NameServer = 192.168.1.1,192.168.1.3
O17 - HKLM\System\CS1\Services\Tcpip\..\{15DDA148-4767-49AE-B6CC-EBAB3F0FF04F}: NameServer = 192.168.1.1,192.168.1.3
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Viewpoint Manager Service - Unknown owner - C:\Program Files\Viewpoint\Common\ViewpointService.exe (file missing)
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 11949 bytes
bunker10 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-09-2008, 03:26 PM   #14 (permalink)
Moderator, Analyst, Security Team
 
TheBruce1's Avatar
 
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP


Re: Trojan Attack - IE7 & Outlook Gone!!
Hello again

Quote:
Originally Posted by bunker10
I've installed Avira Antivir Personal. Haven;t been able to update the Virus log due to some scheduler error, but I ran a scan and posted it last evening.

I'm running Java v6 upd 5, and all other versions are removed.
At least you have some protection installed, we `ll need to remove Avast/AVG and Kaspersky files\folders, we`ll also try to update Java
again.

==========

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any)

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O23 - Service: Viewpoint Manager Service - Unknown owner - C:\Program Files\Viewpoint\Common\ViewpointService.exe (file missing)

Please remember to close all other windows, including browsers then click Fix checked.


===========

Open notepad and copy/paste the text in the quotebox below into it:

Quote:
Folder::
C:\Program Files\Alwil Software
C:\Documents and Settings\Daddy\Application Data\AVGTOOLBAR
C:\Program Files\AVG
C:\Program Files\Viewpoint
File::
C:\Program Files\kis.en.msi
Save this as CFscript







Refering to the picture above, drag CFscript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

==========

JAVA OUTDATED


Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 6 Update 7 and save it to your desktop.
  • Scroll down to where it says "Java Runtime Environment (JRE) 6 Update 7. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
  • Click the "Download" button to the right.
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: "Accept License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u7-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH Checked
      • Applications and Applets
        Trace and Log Files
    • Click OK on Delete Temporary Files Window
      Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
    • Click OK to leave the Temporary Files Window
    • Click OK to leave the Java Control Panel.

==========

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Click Accept, when prompted to download and install the program files and database of malware definitions.
  • Click Run at the Security prompt.
  • The program will then begin downloading and installing and will also update the database.
  • Please be patient as this can take several minutes.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.
  • Click the Save Report As... button.
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.
**Note**

Animated Tutorial Here


To optimize scanning time and produce a more sensible report for review:
  • Close any open programs.
  • Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

==========

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

===========
Logs Required
C:\Combofix.txt
Kaspersky Scan Report
Hijackthis Log

If Java update 5 will not uninstall, then miss that part out and carry on with the rest of the fix and let me know in your reply.
__________________
Member of ASAP since 2007
Member of UNITE since 2008

**Notice to BT customers**
BT to dump Phorm, see Here for more information. No DPI

If we have helped you in anyway, please consider Donating
TheBruce1 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-11-2008, 07:01 AM   #15 (permalink)
Registered User
 
Join Date: Jun 2008
Posts: 14
OS: XPsp2


Re: Trojan Attack - IE7 & Outlook Gone!!
Mornin.

Looks like I'm stuck in Java limbo. I cannot uninstall 6 upd5. I get a Fatal Error when using Control Panel to remove the program.

I tried JavaRA again, but 6 upd 5 remained. I decided to install 6 upd 7 thinking RA would then consider upd 5 "old" and remove it. I got this error when installing upd 7...

Error 1321. The Installer has insufficient privileges to
modify the file C:\Program Files\Common Files\Java\Update\
Base Images\jre1.6.0.b105\core1.zip.

So, onto the logs...

ComboFix...

ComboFix 08-07-08.9 - Daddy 2008-07-10 21:50:47.5 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.214 [GMT -4:00]
Running from: C:\Documents and Settings\Daddy\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Daddy\Desktop\CFscript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\Program Files\kis.en.msi
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Daddy\Application Data\AVGTOOLBAR
C:\Program Files\Alwil Software
C:\Program Files\kis.en.msi

.
((((((((((((((((((((((((( Files Created from 2008-06-11 to 2008-07-11 )))))))))))))))))))))))))))))))
.

2008-07-10 21:57 . 54,156 C:\WINDOWS\QTFont.qfn
2008-07-10 21:57 . 1,409 C:\WINDOWS\QTFont.for
2008-07-09 10:06 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-07-09 10:06 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-07-08 17:54 . 2008-07-08 17:54 <DIR> d-------- C:\Program Files\Avira
2008-07-08 17:54 . 2008-07-08 17:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-07-08 17:53 . 2008-07-08 17:53 22,311,160 --a------ C:\Program Files\antivir_workstation_winu_en_h.exe
2008-07-08 16:47 . 2008-07-08 16:47 24,234,968 --a------ C:\Program Files\setupeng.exe
2008-07-07 19:05 . 2008-07-07 19:23 <DIR> d-------- C:\Documents and Settings\Daddy\.SunDownloadManager
2008-07-04 11:09 . 2008-07-04 11:09 21,336 --a------ C:\WINDOWS\system32\GDIPFONTCACHEV1.DAT
2008-07-03 00:39 . 2008-07-03 00:39 <DIR> d-------- C:\Program Files\Kaspersky Lab
2008-07-03 00:39 . 2008-07-03 00:44 51,232 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-07-03 00:39 . 2008-07-03 00:44 1,676 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-07-02 23:46 . 2008-07-02 23:46 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-02 01:06 . 2008-07-02 01:06 <DIR> d-------- C:\WINDOWS\ERUNT
2008-07-02 00:53 . 2007-11-21 14:08 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Apple Computer
2008-07-02 00:53 . 2008-07-02 00:53 <DIR> d-------- C:\Documents and Settings\Administrator
2008-07-02 00:43 . 2008-07-02 09:40 <DIR> d-------- C:\SDFix
2008-06-27 20:16 . 2008-06-27 20:16 <DIR> d-------- C:\Deckard
2008-06-27 19:35 . 2008-06-27 19:35 <DIR> d-------- C:\Program Files\ZonedOut
2008-06-27 19:33 . 2008-06-27 19:33 <DIR> d-------- C:\ie-spyad_zo
2008-06-27 19:23 . 2008-06-27 19:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-27 19:22 . 2008-06-27 19:27 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-06-26 23:45 . 2008-06-26 23:54 <DIR> d-------- C:\Program Files\Panda Security
2008-06-25 10:59 . 2008-06-25 10:59 <DIR> d-------- C:\Documents and Settings\Mom\Application Data\Verizon
2008-06-25 09:19 . 2008-06-25 09:19 <DIR> d-------- C:\Documents and Settings\Stephanie\Application Data\Verizon
2008-06-24 20:57 . 2008-06-24 20:57 <DIR> d--h----- C:\WINDOWS\PIF
2008-06-24 17:50 . 2008-06-24 17:50 <DIR> d-------- C:\Documents and Settings\Daddy\Application Data\Verizon
2008-06-24 17:50 . 2008-06-24 17:51 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Verizon
2008-06-20 13:41 . 2008-06-20 13:41 245,248 -----c--- C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 06:44 . 2008-06-20 06:44 138,368 -----c--- C:\WINDOWS\system32\dllcache\afd.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-11 01:49 --------- d-----w C:\Program Files\PeerGuardian2
2008-07-10 12:12 --------- d-----w C:\Documents and Settings\Daddy\Application Data\Azureus
2008-07-09 13:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-07-07 22:49 --------- d-----w C:\Program Files\Java
2008-06-27 01:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\SecTaskMan
2008-06-26 19:43 --------- d-----w C:\Program Files\Verizon
2008-06-26 19:42 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-24 21:34 --------- d-----w C:\Documents and Settings\Daddy\Application Data\Apple Computer
2008-06-24 16:28 --------- d-----w C:\Documents and Settings\Alex\Application Data\LimeWire
2008-06-24 04:51 --------- d-----w C:\Program Files\Soulseek
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-18 23:39 --------- d-----w C:\Documents and Settings\Daddy\Application Data\ZoomBrowser EX
2008-06-18 23:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\ZoomBrowser
2008-06-18 23:26 --------- d-----w C:\Documents and Settings\Daddy\Application Data\Canon
2008-06-13 13:10 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 04:48 --------- d-----w C:\Program Files\Solid AVI DIVX to DVD Burner
2008-06-05 23:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\CanonIJPLM
2008-06-04 02:32 --------- d-----w C:\Documents and Settings\Alex\Application Data\vlc
2008-06-01 16:16 --------- d-----w C:\Documents and Settings\Stephanie\Application Data\CyberLink
2008-06-01 04:51 --------- d-----w C:\Documents and Settings\Daddy\Application Data\dvdcss
2008-05-28 22:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\PCPitstop
2008-05-25 14:52 --------- d-----w C:\Documents and Settings\Daddy\Application Data\vlc
2008-05-25 14:46 --------- d-----w C:\Program Files\VideoLAN
2008-05-25 14:33 --------- d-----w C:\Documents and Settings\Daddy\Application Data\DVD Flick
2008-02-26 23:05 21,800 ----a-w C:\Documents and Settings\Stephanie\Application Data\GDIPFONTCACHEV1.DAT
2008-02-22 17:37 479 ----a-w C:\Program Files\setup.reg
2008-01-31 00:51 1,570,920 ----a-w C:\Program Files\taskmanager17.exe
2008-01-10 22:58 21,800 ----a-w C:\Documents and Settings\Daddy\Application Data\GDIPFONTCACHEV1.DAT
2007-11-17 02:31 8,212,216 ----a-w C:\Program Files\CheetahDVDBurner.exe
2007-05-12 14:40 630,784 ----a-w C:\Documents and Settings\Daddy\GoToAssist_chat2way__317_en.exe
2007-05-08 23:53 21,408 ----a-w C:\Documents and Settings\Brian\Application Data\GDIPFONTCACHEV1.DAT
2007-05-06 03:23 3,550,409 ----a-w C:\Program Files\ffdshow_rev529_20061113_clsid.exe
2007-04-04 13:52 507,904 ----a-w C:\Program Files\moveonb.msi
2007-03-21 23:37 528,312,337 ----a-w C:\Program Files\MSSetup.exe
2007-03-13 04:43 965 ----a-w C:\Program Files\Avery-MyProject8163.avery
2007-03-12 01:59 1,948,945 ----a-w C:\Program Files\burnquickeval.exe
2007-03-11 16:50 266,664 ----a-w C:\Program Files\burnsetup.exe
2007-03-11 15:26 830,422 ----a-w C:\Program Files\dBpowerAMP-codec-shorten.exe
2007-03-11 02:33 4,103,032 ----a-w C:\Program Files\dMC-r12.exe
2007-02-21 03:35 6,482,128 ----a-w C:\Program Files\FreeFXMPEG.EXE
2007-02-21 02:16 404,890 ----a-w C:\Program Files\switch.zip
2007-02-19 17:17 1,527,192 ----a-w C:\Program Files\daemon408-139-x86.exe
2007-02-19 16:58 1,035,271 ----a-w C:\Program Files\wrar362.exe
2007-02-11 23:16 10,007,784 ----a-w C:\Program Files\Azureus_2.5.0.4a_Win32.setup.exe
2007-01-11 04:36 51,973,232 ----a-w C:\Program Files\Quicken_Home_Business_2007.exe
2007-01-10 16:19 11,817,800 ----a-w C:\Program Files\GoogleEarth.exe
2006-11-06 23:33 557,056 ----a-w C:\Documents and Settings\Daddy\chatlnk.exe
2006-10-27 23:17 842,672 ----a-w C:\Program Files\slsk156c.exe
.

((((((((((((((((((((((((((((( snapshot@2008-07-02_15.04.22.70 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-07-02 18:57:02 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-07-11 01:56:28 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2008-02-20 05:32:43 148,992 -c----w C:\WINDOWS\system32\dllcache\dnsapi.dll
+ 2008-06-20 17:41:10 148,992 -c--a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
- 2007-10-30 17:20:55 360,064 -c----w C:\WINDOWS\system32\dllcache\tcpip.sys
+ 2008-06-20 10:45:13 360,320 -c--a-w C:\WINDOWS\system32\dllcache\tcpip.sys
- 2006-08-16 09:37:30 225,664 -c----w C:\WINDOWS\system32\dllcache\tcpip6.sys
+ 2008-06-20 09:52:06 225,920 -c--a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
- 2008-02-20 05:32:43 148,992 ----a-w C:\WINDOWS\system32\dnsapi.dll
+ 2008-06-20 17:41:10 148,992 ----a-w C:\WINDOWS\system32\dnsapi.dll
+ 2008-01-21 22:12:56 41,792 ----a-w C:\WINDOWS\system32\drivers\avgntdd.sys
+ 2008-01-21 22:11:28 22,336 ----a-w C:\WINDOWS\system32\drivers\avgntmgr.sys
+ 2008-03-04 17:28:53 79,424 ----a-w C:\WINDOWS\system32\drivers\avipbb.sys
+ 2007-03-01 14:34:22 28,352 ----a-w C:\WINDOWS\system32\drivers\ssmdrv.sys
- 2007-08-13 22:39:10 13,312 ----a-w C:\WINDOWS\system32\ieudinit.exe
+ 2008-04-22 07:39:58 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
- 2007-03-15 22:19:28 1,476,992 ----a-w C:\WINDOWS\system32\LegitCheckControl.dll
+ 2008-03-20 2236 1,480,232 ----a-w C:\WINDOWS\system32\LegitCheckControl.dll
- 2008-05-29 20:35:12 17,486,968 ----a-w C:\WINDOWS\system32\MRT.exe
+ 2008-06-25 16:15:46 17,972,344 ----a-w C:\WINDOWS\system32\MRT.exe
- 2004-08-04 07:56:44 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
+ 2008-06-20 17:41:10 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
+ 2007-07-30 23:18:34 207,736 ----a-w C:\WINDOWS\system32\muweb.dll
- 2007-11-30 11:18:51 17,272 ----a-w C:\WINDOWS\system32\spmsg.dll
+ 2007-11-30 12:39:22 17,272 ------w C:\WINDOWS\system32\spmsg.dll
- 2006-09-06 21:43:16 22,752 ----a-w C:\WINDOWS\system32\spupdsvc.exe
+ 2005-06-28 13:21:34 22,752 ----a-w C:\WINDOWS\system32\spupdsvc.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="C:\WINDOWS\System32\NVMCTRAY.DLL" [2003-09-24 19:32 49152]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 06:48 157592]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]
"PeerGuardian"="C:\Program Files\PeerGuardian2\pg2.exe" [2005-09-18 18:44 1382400]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-10-26 13:22 180269]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-10-26 14:00 190464]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-09-24 19:32 5033984]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 20:54 623992]
"Adobe_ID0EYTHM"="C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 17:40 1884160]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"Verizon_McciTrayApp"="C:\Program Files\Verizon\McciTrayApp.exe" [2007-09-28 14:30 936960]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"CanonSolutionMenu"="C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 21:01 644696]
"CanonMyPrinter"="C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 21:50 1603152]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 09:03 210472]
"OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 12:02 79400]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 05:59 122880 C:\WINDOWS\BCMSMMSG.exe]
"Logitech Utility"="LOGI_MWX.EXE" [2003-11-26 09:50 19968 C:\WINDOWS\LOGI_MWX.EXE]
"nwiz"="nwiz.exe" [2003-09-24 19:32 741376 C:\WINDOWS\system32\nwiz.exe]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Documents and Settings\\Daddy\\My Documents\\New Folder\\Azureus\\Azureus.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server

R2 ONSIO;ONSIO;C:\WINDOWS\SYSTEM32\DRIVERS\ONSIO.SYS [1998-04-17 14:23]
S0 SMPLSCSI;SMPLSCSI;C:\WINDOWS\system32\drivers\SMPLSCSI.SYS [1998-08-01 13:00]
S2 IJPLMSVC;PIXMA Extended Survey Program;C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2007-04-13 12:20]
S3 scsiscan;SCSI Scanner Driver;C:\WINDOWS\system32\DRIVERS\scsiscan.sys [2001-08-17 14:53]
S4 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files\Viewpoint\Common\ViewpointService.exe []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{df50faf4-614e-11db-b3bb-806d6172696f}]
\shell\PlayWithPowerCinema\Command - "C:\Program Files\Dell\Media Experience\PCM2.exe" MOVIE "%L"

.
Contents of the 'Scheduled Tasks' folder
"2008-07-04 13:16:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-10 21:57:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


C:\WINDOWS\QTFont.for 1409 bytes
C:\WINDOWS\QTFont.qfn 54156 bytes

scan completed successfully
hidden files: 2

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2008-07-10 22:04:37 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-11 02:04:03
ComboFix2.txt 2008-07-09 18:15:37
ComboFix3.txt 2008-07-09 17:40:48
ComboFix4.txt 2008-07-03 21:30:33
ComboFix5.txt 2008-07-02 19:05:12

Pre-Run: 14,457,241,600 bytes free
Post-Run: 14,395,969,536 bytes free

229 --- E O F --- 2008-07-10 07:02:38
---------------

------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Friday, July 11, 2008
Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Friday, July 11, 2008 00:27:25
Records in database: 937938
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\
H:\

Scan statistics:
Files scanned: 170421
Threat name: 19
Infected objects: 36
Suspicious objects: 1
Duration of the scan: 03:04:23


File name / Threat name / Threats count
C:\Documents and Settings\Alex\My Documents\LimeWire\Incomplete\Preview-T-3545425-dady im breathin.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1
C:\Documents and Settings\Alex\My Documents\LimeWire\Incomplete\Preview-T-3545425-los sables.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1
C:\Documents and Settings\Alex\My Documents\LimeWire\Incomplete\Preview-T-5745425-i like the way she move it.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1
C:\Documents and Settings\Daddy\Local Settings\Application Data\Identities\{30004582-3C40-4D36-A1FD-3A386BE04994}\Microsoft\Outlook Express\Inbox.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 1
C:\Program Files\Dell Computer\Cdvd.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.ak 1
C:\Program Files\Dell Computer\Cdvd.exe Infected: not-a-virus:AdTool.Win32.WhenU.a 1
C:\Program Files\SpywareBlaster\unins000.exe Infected: Trojan-Downloader.Win32.Agent.vur 1
C:\QooBox\Quarantine\C\WINDOWS\system32\abkwwgma.dll.vir Infected: Trojan.Win32.Monder.ajm 1
C:\QooBox\Quarantine\C\WINDOWS\system32\apjrbqdr.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\awtqrPJC.dll.vir Infected: Trojan.Win32.Agent.ryv 1
C:\QooBox\Quarantine\C\WINDOWS\system32\bsjhqmpv.dll.vir Infected: Trojan.Win32.Monder.acy 1
C:\QooBox\Quarantine\C\WINDOWS\system32\cfhhsmuq.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\cylowr.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\dqlhvmcg.dll.vir Infected: Trojan.Win32.Monder.aeo 1
C:\QooBox\Quarantine\C\WINDOWS\system32\dvqwaeix.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\dwqehwpq.dll.vir Infected: Trojan.Win32.Monder.wg 1
C:\QooBox\Quarantine\C\WINDOWS\system32\efcYQGVp.dll.vir Infected: Trojan.Win32.Agent.ryv 1
C:\QooBox\Quarantine\C\WINDOWS\system32\fyesen.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\gcxeksws.dll.vir Infected: Trojan.Win32.Monder.wf 1
C:\QooBox\Quarantine\C\WINDOWS\system32\hoxllhaf.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.zdg 1
C:\QooBox\Quarantine\C\WINDOWS\system32\jcwrcrra.dll.vir Infected: Trojan.Win32.Monder.wj 1
C:\QooBox\Quarantine\C\WINDOWS\system32\kcjckdhn.dll.vir Infected: Trojan.Win32.Monder.zm 1
C:\QooBox\Quarantine\C\WINDOWS\system32\kduwdkec.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.zjk 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ljJASjJb.dll.vir Infected: Trojan.Win32.Agent.ryv 1
C:\QooBox\Quarantine\C\WINDOWS\system32\mjjpqlfd.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\pmnLddcy.dll.vir Infected: Trojan.Win32.Agent.ryv 1
C:\QooBox\Quarantine\C\WINDOWS\system32\qkidwk.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\rdrbmlld.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\tgyemslf.dll.vir Infected: Trojan.Win32.Monderc.a 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ulxjseaf.dll.vir Infected: Trojan.Win32.Monder.zn 1
C:\QooBox\Quarantine\C\WINDOWS\system32\wsjbtmiv.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\xmuboc.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.zjk 1
C:\QooBox\Quarantine\C\WINDOWS\system32\yayxwuRj.dll.vir Infected: Trojan.Win32.Monder.wd 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ycygwlhy.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ydvroq.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\yieskrxf.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\SDFix\backups\backups.zip Infected: Trojan.Win32.Agent.ryv 1

The selected area was scanned.
----------------

HJT Log...
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:48:39 AM, on 7/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\LOGI_MWX.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.shockwave.com/content/ric...GameLoader.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1161734388453
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1215552413000
O16 - DPF: {B0FB831D-17F6-4CBD-9B5D-3305881D362E} (LHGLauncherXForm Control) - http://www.shockwave.com/content/rea...LGLauncher.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://www.shockwave.com/content/fee...utLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.shockwave.com/content/zum...loader_v10.cab
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/optimize2/pcpitstop2.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{15DDA148-4767-49AE-B6CC-EBAB3F0FF04F}: NameServer = 192.168.1.1,192.168.1.3
O17 - HKLM\System\CS1\Services\Tcpip\..\{15DDA148-4767-49AE-B6CC-EBAB3F0FF04F}: NameServer = 192.168.1.1,192.168.1.3
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 11432 bytes

Thanks again for the attention.

Bunker10
bunker10 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-11-2008, 08:22 AM   #16 (permalink)
Moderator, Analyst, Security Team
 
TheBruce1's Avatar
 
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP


Re: Trojan Attack - IE7 & Outlook Gone!!
Hello again Bunker

Quote:
Originally Posted by bunker10
Error 1321. The Installer has insufficient privileges to
modify the file C:\Program Files\Common Files\Java\Update\
Base Images\jre1.6.0.b105\core1.zip.
Looks like we`ll try this the manual way.

==========

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

Please remember to close all other windows, including browsers then click Fix checked.

==========

Open notepad and copy/paste the text in the quotebox below into it:

Quote:
Folder::
C:\Program Files\Java
C:\Program Files\Viewpoint
Driver::
ViewpointService
File::
C:\Documents and Settings\Alex\My Documents\LimeWire\Incomplete\Preview-T-3545425-dady im breathin.mp3
C:\Documents and Settings\Alex\My Documents\LimeWire\Incomplete\Preview-T-3545425-los sables.mp3
C:\Documents and Settings\Alex\My Documents\LimeWire\Incomplete\Preview-T-5745425-i like the way she move it.mp3
Save this as CFscript







Refering to the picture above, drag CFscript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

============

Please go to: VirusTotal
  • In the middle of the page you'll find a "Browse" button.



    Click the "Browse" button and browse to this file in RED:

    C:\Program Files\Dell Computer\Cdvd.exe

  • Click "Open".
  • Then click the "Send File" button at the bottom of the VirusTotal page.
  • This will scan the file. Please be patient.
  • Once scanned, copy and paste the results in your next reply.

Do the same with this file:

C:\Program Files\SpywareBlaster\unins000.exe

==========

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

==========
Logs Required
C:\Combofix.txt
Virustotal Results
Hijackthis Log

Search manually for Java 1.6.0_05 and/or jre1.6.0_05 file or folders and delete, until no more are found.

Click start>search
__________________
Member of ASAP since 2007
Member of UNITE since 2008

**Notice to BT customers**
BT to dump Phorm, see Here for more information. No DPI

If we have helped you in anyway, please consider Donating
TheBruce1 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-11-2008, 04:17 PM   #17 (permalink)
Registered User
 
Join Date: Jun 2008
Posts: 14
OS: XPsp2


Re: Trojan Attack - IE7 & Outlook Gone!!
Heres what I have...

ComboFix 08-07-08.9 - Daddy 2008-07-11 17:04:54.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.225 [GMT -4:00]
Running from: C:\Documents and Settings\Daddy\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Daddy\Desktop\CFscript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\Documents and Settings\Alex\My Documents\LimeWire\Incomplete\Preview-T-3545425-dady im breathin.mp3
C:\Documents and Settings\Alex\My Documents\LimeWire\Incomplete\Preview-T-3545425-los sables.mp3
C:\Documents and Settings\Alex\My Documents\LimeWire\Incomplete\Preview-T-5745425-i like the way she move it.mp3
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Alex\My Documents\LimeWire\Incomplete\Preview-T-3545425-dady im breathin.mp3
C:\Documents and Settings\Alex\My Documents\LimeWire\Incomplete\Preview-T-3545425-los sables.mp3
C:\Documents and Settings\Alex\My Documents\LimeWire\Incomplete\Preview-T-5745425-i like the way she move it.mp3
C:\Program Files\Java
C:\Program Files\Java\jre1.6.0_05\bin\awt.dll
C:\Program Files\Java\jre1.6.0_05\bin\axbridge.dll
C:\Program Files\Java\jre1.6.0_05\bin\client\classes.jsa
C:\Program Files\Java\jre1.6.0_05\bin\client\jvm.dll
C:\Program Files\Java\jre1.6.0_05\bin\client\Xusage.txt
C:\Program Files\Java\jre1.6.0_05\bin\cmm.dll
C:\Program Files\Java\jre1.6.0_05\bin\dcpr.dll
C:\Program Files\Java\jre1.6.0_05\bin\deploy.dll
C:\Program Files\Java\jre1.6.0_05\bin\dt_shmem.dll
C:\Program Files\Java\jre1.6.0_05\bin\dt_socket.dll
C:\Program Files\Java\jre1.6.0_05\bin\fontmanager.dll
C:\Program Files\Java\jre1.6.0_05\bin\hpi.dll
C:\Program Files\Java\jre1.6.0_05\bin\hprof.dll
C:\Program Files\Java\jre1.6.0_05\bin\instrument.dll
C:\Program Files\Java\jre1.6.0_05\bin\ioser12.dll
C:\Program Files\Java\jre1.6.0_05\bin\j2pcsc.dll
C:\Program Files\Java\jre1.6.0_05\bin\j2pkcs11.dll
C:\Program Files\Java\jre1.6.0_05\bin\jaas_nt.dll
C:\Program Files\Java\jre1.6.0_05\bin\java-rmi.exe
C:\Program Files\Java\jre1.6.0_05\bin\java.dll
C:\Program Files\Java\jre1.6.0_05\bin\java.exe
C:\Program Files\Java\jre1.6.0_05\bin\java_crw_demo.dll
C:\Program Files\Java\jre1.6.0_05\bin\javacpl.cpl
C:\Program Files\Java\jre1.6.0_05\bin\javacpl.exe
C:\Program Files\Java\jre1.6.0_05\bin\javaw.exe
C:\Program Files\Java\jre1.6.0_05\bin\javaws.exe
C:\Program Files\Java\jre1.6.0_05\bin\jawt.dll
C:\Program Files\Java\jre1.6.0_05\bin\JdbcOdbc.dll
C:\Program Files\Java\jre1.6.0_05\bin\jdwp.dll
C:\Program Files\Java\jre1.6.0_05\bin\jli.dll
C:\Program Files\Java\jre1.6.0_05\bin\jpeg.dll
C:\Program Files\Java\jre1.6.0_05\bin\jpicom.dll
C:\Program Files\Java\jre1.6.0_05\bin\jpiexp.dll
C:\Program Files\Java\jre1.6.0_05\bin\jpinscp.dll
C:\Program Files\Java\jre1.6.0_05\bin\jpioji.dll
C:\Program Files\Java\jre1.6.0_05\bin\jpishare.dll
C:\Program Files\Java\jre1.6.0_05\bin\jsound.dll
C:\Program Files\Java\jre1.6.0_05\bin\jsoundds.dll
C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
C:\Program Files\Java\jre1.6.0_05\bin\jureg.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Java\jre1.6.0_05\bin\keytool.exe
C:\Program Files\Java\jre1.6.0_05\bin\kinit.exe
C:\Program Files\Java\jre1.6.0_05\bin\klist.exe
C:\Program Files\Java\jre1.6.0_05\bin\ktab.exe
C:\Program Files\Java\jre1.6.0_05\bin\management.dll
C:\Program Files\Java\jre1.6.0_05\bin\mlib_image.dll
C:\Program Files\Java\jre1.6.0_05\bin\msvcr71.dll
C:\Program Files\Java\jre1.6.0_05\bin\net.dll
C:\Program Files\Java\jre1.6.0_05\bin\nio.dll
C:\Program Files\Java\jre1.6.0_05\bin\npjava11.dll
C:\Program Files\Java\jre1.6.0_05\bin\npjava12.dll
C:\Program Files\Java\jre1.6.0_05\bin\npjava13.dll
C:\Program Files\Java\jre1.6.0_05\bin\npjava14.dll
C:\Program Files\Java\jre1.6.0_05\bin\npjava32.dll
C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll
C:\Program Files\Java\jre1.6.0_05\bin\npoji610.dll
C:\Program Files\Java\jre1.6.0_05\bin\npt.dll
C:\Program Files\Java\jre1.6.0_05\bin\orbd.exe
C:\Program Files\Java\jre1.6.0_05\bin\pack200.exe
C:\Program Files\Java\jre1.6.0_05\bin\policytool.exe
C:\Program Files\Java\jre1.6.0_05\bin\regutils.dll
C:\Program Files\Java\jre1.6.0_05\bin\rmi.dll
C:\Program Files\Java\jre1.6.0_05\bin\rmid.exe
C:\Program Files\Java\jre1.6.0_05\bin\rmiregistry.exe
C:\Program Files\Java\jre1.6.0_05\bin\servertool.exe
C:\Program Files\Java\jre1.6.0_05\bin\splashscreen.dll
C:\Program Files\Java\jre1.6.0_05\bin\sunmscapi.dll
C:\Program Files\Java\jre1.6.0_05\bin\tnameserv.exe
C:\Program Files\Java\jre1.6.0_05\bin\unpack.dll
C:\Program Files\Java\jre1.6.0_05\bin\unpack200.exe
C:\Program Files\Java\jre1.6.0_05\bin\verify.dll
C:\Program Files\Java\jre1.6.0_05\bin\w2k_lsa_auth.dll
C:\Program Files\Java\jre1.6.0_05\bin\wsdetect.dll
C:\Program Files\Java\jre1.6.0_05\bin\zip.dll
C:\Program Files\Java\jre1.6.0_05\COPYRIGHT
C:\Program Files\Java\jre1.6.0_05\lib\calendars.properties
C:\Program Files\Java\jre1.6.0_05\lib\classlist
C:\Program Files\Java\jre1.6.0_05\lib\cmm\CIEXYZ.pf
C:\Program Files\Java\jre1.6.0_05\lib\cmm\GRAY.pf
C:\Program Files\Java\jre1.6.0_05\lib\cmm\LINEAR_RGB.pf
C:\Program Files\Java\jre1.6.0_05\lib\cmm\sRGB.pf
C:\Program Files\Java\jre1.6.0_05\lib\content-types.properties
C:\Program Files\Java\jre1.6.0_05\lib\deploy.jar
C:\Program Files\Java\jre1.6.0_05\lib\deploy\ffjcext.zip
C:\Program Files\Java\jre1.6.0_05\lib\deploy\messages.properties
C:\Program Files\Java\jre1.6.0_05\lib\deploy\messages_de.properties
C:\Program Files\Java\jre1.6.0_05\lib\deploy\messages_es.properties
C:\Program Files\Java\jre1.6.0_05\lib\deploy\messages_fr.properties
C:\Program Files\Java\jre1.6.0_05\lib\deploy\messages_it.properties
C:\Program Files\Java\jre1.6.0_05\lib\deploy\messages_ja.properties
C:\Program Files\Java\jre1.6.0_05\lib\deploy\messages_ko.properties
C:\Program Files\Java\jre1.6.0_05\lib\deploy\messages_sv.properties
C:\Program Files\Java\jre1.6.0_05\lib\deploy\messages_zh_CN.properties
C:\Program Files\Java\jre1.6.0_05\lib\deploy\messages_zh_HK.properties
C:\Program Files\Java\jre1.6.0_05\lib\deploy\messages_zh_TW.properties
C:\Program Files\Java\jre1.6.0_05\lib\deploy\splash.jpg
C:\Program Files\Java\jre1.6.0_05\lib\ext\dnsns.jar
C:\Program Files\Java\jre1.6.0_05\lib\ext\meta-index
C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip
C:\Program Files\Java\jre1.6.0_05\lib\ext\sunjce_provider.jar
C:\Program Files\Java\jre1.6.0_05\lib\ext\sunmscapi.jar
C:\Program Files\Java\jre1.6.0_05\lib\ext\sunpkcs11.jar
C:\Program Files\Java\jre1.6.0_05\lib\flavormap.properties
C:\Program Files\Java\jre1.6.0_05\lib\fontconfig.98.bfc
C:\Program Files\Java\jre1.6.0_05\lib\fontconfig.98.properties.src
C:\Program Files\Java\jre1.6.0_05\lib\fontconfig.bfc
C:\Program Files\Java\jre1.6.0_05\lib\fontconfig.properties.src
C:\Program Files\Java\jre1.6.0_05\lib\fonts\LucidaSansRegular.ttf
C:\Program Files\Java\jre1.6.0_05\lib\i386\jvm.cfg
C:\Program Files\Java\jre1.6.0_05\lib\im\indicim.jar
C:\Program Files\Java\jre1.6.0_05\lib\im\thaiim.jar
C:\Program Files\Java\jre1.6.0_05\lib\images\cursors\cursors.properties
C:\Program Files\Java\jre1.6.0_05\lib\images\cursors\invalid32x32.gif
C:\Program Files\Java\jre1.6.0_05\lib\images\cursors\win32_CopyDrop32x32.gif
C:\Program Files\Java\jre1.6.0_05\lib\images\cursors\win32_CopyNoDrop32x32.gif
C:\Program Files\Java\jre1.6.0_05\lib\images\cursors\win32_LinkDrop32x32.gif
C:\Program Files\Java\jre1.6.0_05\lib\images\cursors\win32_LinkNoDrop32x32.gif
C:\Program Files\Java\jre1.6.0_05\lib\images\cursors\win32_MoveDrop32x32.gif
C:\Program Files\Java\jre1.6.0_05\lib\images\cursors\win32_MoveNoDrop32x32.gif
C:\Program Files\Java\jre1.6.0_05\lib\javaws.jar
C:\Program Files\Java\jre1.6.0_05\lib\jce.jar
C:\Program Files\Java\jre1.6.0_05\lib\jsse.jar
C:\Program Files\Java\jre1.6.0_05\lib\jvm.hprof.txt
C:\Program Files\Java\jre1.6.0_05\lib\logging.properties
C:\Program Files\Java\jre1.6.0_05\lib\management-agent.jar
C:\Program Files\Java\jre1.6.0_05\lib\management\jmxremote.access
C:\Program Files\Java\jre1.6.0_05\lib\management\jmxremote.password.template
C:\Program Files\Java\jre1.6.0_05\lib\management\management.properties
C:\Program Files\Java\jre1.6.0_05\lib\management\snmp.acl.template
C:\Program Files\Java\jre1.6.0_05\lib\meta-index
C:\Program Files\Java\jre1.6.0_05\lib\net.properties
C:\Program Files\Java\jre1.6.0_05\lib\plugin.jar
C:\Program Files\Java\jre1.6.0_05\lib\psfont.properties.ja
C:\Program Files\Java\jre1.6.0_05\lib\psfontj2d.properties
C:\Program Files\Java\jre1.6.0_05\lib\resources.jar
C:\Program Files\Java\jre1.6.0_05\lib\rt.jar
C:\Program Files\Java\jre1.6.0_05\lib\security\cacerts
C:\Program Files\Java\jre1.6.0_05\lib\security\java.policy
C:\Program Files\Java\jre1.6.0_05\lib\security\java.security
C:\Program Files\Java\jre1.6.0_05\lib\security\javaws.policy
C:\Program Files\Java\jre1.6.0_05\lib\security\local_policy.jar
C:\Program Files\Java\jre1.6.0_05\lib\security\US_export_policy.jar
C:\Program Files\Java\jre1.6.0_05\lib\servicetag\jdk_header.png
C:\Program Files\Java\jre1.6.0_05\lib\sound.properties
C:\Program Files\Java\jre1.6.0_05\lib\tzmappings
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Abidjan
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Accra
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Addis_Ababa
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Algiers
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Asmara
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Bamako
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Bangui
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Banjul
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Bissau
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Blantyre
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Brazzaville
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Bujumbura
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Cairo
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Casablanca
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Ceuta
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Conakry
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Dakar
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Dar_es_Salaam
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Djibouti
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Douala
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\El_Aaiun
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Freetown
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Gaborone
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Harare
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Johannesburg
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Kampala
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Khartoum
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Kigali
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Kinshasa
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Lagos
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Libreville
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Lome
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Luanda
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Lubumbashi
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Lusaka
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Malabo
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Maputo
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Maseru
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Mbabane
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Mogadishu
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Monrovia
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Nairobi
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Ndjamena
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Niamey
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Nouakchott
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Ouagadougou
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Porto-Novo
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Sao_Tome
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Tripoli
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Tunis
C:\Program Files\Java\jre1.6.0_05\lib\zi\Africa\Windhoek
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Adak
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Anchorage
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Anguilla
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Antigua
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Araguaina
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Argentina\Buenos_Aires
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Argentina\Catamarca
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Argentina\Cordoba
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Argentina\Jujuy
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Argentina\La_Rioja
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Argentina\Mendoza
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Argentina\Rio_Gallegos
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Argentina\San_Juan
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Argentina\Tucuman
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Argentina\Ushuaia
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Aruba
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Asuncion
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Atikokan
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Bahia
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Barbados
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Belem
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Belize
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Blanc-Sablon
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Boa_Vista
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Bogota
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Boise
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Cambridge_Bay
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Campo_Grande
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Cancun
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Caracas
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Cayenne
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Cayman
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Chicago
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Chihuahua
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Costa_Rica
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Cuiaba
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Curacao
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Danmarkshavn
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Dawson
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Dawson_Creek
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Denver
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Detroit
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Dominica
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Edmonton
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Eirunepe
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\El_Salvador
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Fortaleza
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Glace_Bay
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Godthab
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Goose_Bay
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Grand_Turk
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Grenada
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Guadeloupe
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Guatemala
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Guayaquil
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Guyana
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Halifax
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Havana
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Hermosillo
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Indiana\Indianapolis
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Indiana\Knox
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Indiana\Marengo
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Indiana\Petersburg
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Indiana\Tell_City
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Indiana\Vevay
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Indiana\Vincennes
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Indiana\Winamac
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Inuvik
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Iqaluit
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Jamaica
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Juneau
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Kentucky\Louisville
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Kentucky\Monticello
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\La_Paz
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Lima
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Los_Angeles
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Maceio
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Managua
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Manaus
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Martinique
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Mazatlan
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Menominee
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Merida
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Mexico_City
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Miquelon
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Moncton
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Monterrey
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Montevideo
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Montreal
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Montserrat
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Nassau
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\New_York
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Nipigon
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Nome
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Noronha
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\North_Dakota\Center
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\North_Dakota\New_Salem
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Panama
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Pangnirtung
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Paramaribo
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Phoenix
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Port-au-Prince
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Port_of_Spain
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Porto_Velho
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Puerto_Rico
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Rainy_River
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Rankin_Inlet
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Recife
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Regina
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Resolute
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Rio_Branco
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Santiago
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Santo_Domingo
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Sao_Paulo
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Scoresbysund
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\St_Johns
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\St_Kitts
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\St_Lucia
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\St_Thomas
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\St_Vincent
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Swift_Current
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Tegucigalpa
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Thule
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Thunder_Bay
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Tijuana
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Toronto
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Tortola
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Vancouver
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Whitehorse
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Winnipeg
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Yakutat
C:\Program Files\Java\jre1.6.0_05\lib\zi\America\Yellowknife
C:\Program Files\Java\jre1.6.0_05\lib\zi\Antarctica\Casey
C:\Program Files\Java\jre1.6.0_05\lib\zi\Antarctica\Davis
C:\Program Files\Java\jre1.6.0_05\lib\zi\Antarctica\DumontDUrville
C:\Program Files\Java\jre1.6.0_05\lib\zi\Antarctica\Mawson
C:\Program Files\Java\jre1.6.0_05\lib\zi\Antarctica\McMurdo
C:\Program Files\Java\jre1.6.0_05\lib\zi\Antarctica\Palmer
C:\Program Files\Java\jre1.6.0_05\lib\zi\Antarctica\Rothera
C:\Program Files\Java\jre1.6.0_05\lib\zi\Antarctica\Syowa
C:\Program Files\Java\jre1.6.0_05\lib\zi\Antarctica\Vostok
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Aden
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Almaty
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Amman
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Anadyr
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Aqtau
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Aqtobe
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Ashgabat
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Baghdad
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Bahrain
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Baku
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Bangkok
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Beirut
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Bishkek
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Brunei
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Calcutta
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Choibalsan
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Chongqing
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Colombo
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Damascus
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Dhaka
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Dili
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Dubai
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Dushanbe
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Gaza
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Harbin
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Hong_Kong
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Hovd
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Irkutsk
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Jakarta
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Jayapura
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Jerusalem
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Kabul
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Kamchatka
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Karachi
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Kashgar
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Katmandu
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Krasnoyarsk
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Kuala_Lumpur
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Kuching
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Kuwait
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Macau
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Magadan
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Makassar
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Manila
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Muscat
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Nicosia
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Novosibirsk
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Omsk
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Oral
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Phnom_Penh
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Pontianak
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Pyongyang
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Qatar
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Qyzylorda
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Rangoon
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Riyadh
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Riyadh87
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Riyadh88
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Riyadh89
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Saigon
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Sakhalin
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Samarkand
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Seoul
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Shanghai
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Singapore
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Taipei
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Tashkent
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Tbilisi
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Tehran
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Thimphu
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Tokyo
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Ulaanbaatar
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Urumqi
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Vientiane
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Vladivostok
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Yakutsk
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Yekaterinburg
C:\Program Files\Java\jre1.6.0_05\lib\zi\Asia\Yerevan
C:\Program Files\Java\jre1.6.0_05\lib\zi\Atlantic\Azores
C:\Program Files\Java\jre1.6.0_05\lib\zi\Atlantic\Bermuda
C:\Program Files\Java\jre1.6.0_05\lib\zi\Atlantic\Canary
C:\Program Files\Java\jre1.6.0_05\lib\zi\Atlantic\Cape_Verde
C:\Program Files\Java\jre1.6.0_05\lib\zi\Atlantic\Faroe
C:\Program Files\Java\jre1.6.0_05\lib\zi\Atlantic\Madeira
C:\Program Files\Java\jre1.6.0_05\lib\zi\Atlantic\Reykjavik
C:\Program Files\Java\jre1.6.0_05\lib\zi\Atlantic\South_Georgia
C:\Program Files\Java\jre1.6.0_05\lib\zi\Atlantic\St_Helena
C:\Program Files\Java\jre1.6.0_05\lib\zi\Atlantic\Stanley
C:\Program Files\Java\jre1.6.0_05\lib\zi\Australia\Adelaide
C:\Program Files\Java\jre1.6.0_05\lib\zi\Australia\Brisbane
C:\Program Files\Java\jre1.6.0_05\lib\zi\Australia\Broken_Hill
C:\Program Files\Java\jre1.6.0_05\lib\zi\Australia\Currie
C:\Program Files\Java\jre1.6.0_05\lib\zi\Australia\Darwin
C:\Program Files\Java\jre1.6.0_05\lib\zi\Australia\Eucla
C:\Program Files\Java\jre1.6.0_05\lib\zi\Australia\Hobart
C:\Program Files\Java\jre1.6.0_05\lib\zi\Australia\Lindeman
C:\Program Files\Java\jre1.6.0_05\lib\zi\Australia\Lord_Howe
C:\Program Files\Java\jre1.6.0_05\lib\zi\Australia\Melbourne
C:\Program Files\Java\jre1.6.0_05\lib\zi\Australia\Perth
C:\Program Files\Java\jre1.6.0_05\lib\zi\Australia\Sydney
C:\Program Files\Java\jre1.6.0_05\lib\zi\CET
C:\Program Files\Java\jre1.6.0_05\lib\zi\CST6CDT
C:\Program Files\Java\jre1.6.0_05\lib\zi\EET
C:\Program Files\Java\jre1.6.0_05\lib\zi\EST
C:\Program Files\Java\jre1.6.0_05\lib\zi\EST5EDT
C:\Program Files\Java\jre1.6.0_05\lib\zi\Etc\GMT-1
C:\Program Files\Java\jre1.6.0_05\lib\zi\Etc\GMT-10
C:\Program Files\Java\jre1.6.0_05\lib\zi\Etc\GMT-11
C:\Program Files\Java\jre1.6.0_05\lib\zi\Etc\GMT-12
C:\Program Files\Java\jre1.6.0_05\lib\zi\Etc\GMT-13
C:\Program Files\Java\jre1.6.0_05\lib\zi\Etc\GMT-14
C:\Program Files\Java\jre1.6.0_05\lib\zi\Etc\GMT-2
C:\Program Files\Java\jre1.6.0_05\lib\zi\Etc\GMT-3
C:\Program Files\Java\jre1.6.0_05\lib\zi\Etc\GMT-4
C:\Program Files\Java\jre1.6.0_05\lib\zi\Etc\GMT-5
C:\Program Files\Java\jre1.6.0_05\lib\zi\Etc\GMT-6
C:\Program Files\Java\jre1.6.0_05\lib\zi\Etc\GMT-7
C:\Program Files\Java\jre1.6.0_05\lib\zi\Etc\GMT-8
C:\Program Files\Java\jre1.6.0_05\lib\zi\Etc\GMT-9
C:\Program Files\Java\jre1.6.0_05\lib\zi\Etc\GMT
C:\Program Files\Java\jre1.6.0_05\lib\zi\Etc\UCT
C:\Program Files\Java\jre1.6.0_05\lib\zi\Etc\UTC
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Amsterdam
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Andorra
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Athens
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Belgrade
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Berlin
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Brussels
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Bucharest
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Budapest
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Chisinau
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Copenhagen
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Dublin
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Gibraltar
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Helsinki
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Istanbul
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Kaliningrad
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Kiev
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Lisbon
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\London
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Luxembourg
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Madrid
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Malta
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Minsk
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Monaco
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Moscow
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Oslo
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Paris
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Prague
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Riga
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Rome
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Samara
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Simferopol
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Sofia
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Stockholm
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Tallinn
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Tirane
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Uzhgorod
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Vaduz
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Vienna
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Vilnius
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Volgograd
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Warsaw
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Zaporozhye
C:\Program Files\Java\jre1.6.0_05\lib\zi\Europe\Zurich
C:\Program Files\Java\jre1.6.0_05\lib\zi\GMT
C:\Program Files\Java\jre1.6.0_05\lib\zi\HST
C:\Program Files\Java\jre1.6.0_05\lib\zi\Indian\Antananarivo
C:\Program Files\Java\jre1.6.0_05\lib\zi\Indian\Chagos
C:\Program Files\Java\jre1.6.0_05\lib\zi\Indian\Christmas
C:\Program Files\Java\jre1.6.0_05\lib\zi\Indian\Cocos
C:\Program Files\Java\jre1.6.0_05\lib\zi\Indian\Comoro
C:\Program Files\Java\jre1.6.0_05\lib\zi\Indian\Kerguelen
C:\Program Files\Java\jre1.6.0_05\lib\zi\Indian\Mahe
C:\Program Files\Java\jre1.6.0_05\lib\zi\Indian\Maldives
C:\Program Files\Java\jre1.6.0_05\lib\zi\Indian\Mauritius
C:\Program Files\Java\jre1.6.0_05\lib\zi\Indian\Mayotte
C:\Program Files\Java\jre1.6.0_05\lib\zi\Indian\Reunion
C:\Program Files\Java\jre1.6.0_05\lib\zi\MET
C:\Program Files\Java\jre1.6.0_05\lib\zi\MST
C:\Program Files\Java\jre1.6.0_05\lib\zi\MST7MDT
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Apia
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Auckland
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Chatham
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Easter
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Efate
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Enderbury
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Fakaofo
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Fiji
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Funafuti
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Galapagos
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Gambier
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Guadalcanal
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Guam
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Honolulu
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Johnston
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Kiritimati
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Kosrae
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Kwajalein
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Majuro
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Marquesas
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Midway
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Nauru
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Niue
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Norfolk
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Noumea
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Pago_Pago
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Palau
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Pitcairn
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Ponape
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Port_Moresby
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Rarotonga
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Saipan
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Tahiti
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Tarawa
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Tongatapu
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Truk
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Wake
C:\Program Files\Java\jre1.6.0_05\lib\zi\Pacific\Wallis
C:\Program Files\Java\jre1.6.0_05\lib\zi\PST8PDT
C:\Program Files\Java\jre1.6.0_05\lib\zi\SystemV\AST4
C:\Program Files\Java\jre1.6.0_05\lib\zi\SystemV\AST4ADT
C:\Program Files\Java\jre1.6.0_05\lib\zi\SystemV\CST6
C:\Program Files\Java\jre1.6.0_05\lib\zi\SystemV\CST6CDT
C:\Program Files\Java\jre1.6.0_05\lib\zi\SystemV\EST5
C:\Program Files\Java\jre1.6.0_05\lib\zi\SystemV\EST5EDT
C:\Program Files\Java\jre1.6.0_05\lib\zi\SystemV\HST10
C:\Program Files\Java\jre1.6.0_05\lib\zi\SystemV\MST7
C:\Program Files\Java\jre1.6.0_05\lib\zi\SystemV\MST7MDT
C:\Program Files\Java\jre1.6.0_05\lib\zi\SystemV\PST8
C:\Program Files\Java\jre1.6.0_05\lib\zi\SystemV\PST8PDT
C:\Program Files\Java\jre1.6.0_05\lib\zi\SystemV\YST9
C:\Program Files\Java\jre1.6.0_05\lib\zi\SystemV\YST9YDT
C:\Program Files\Java\jre1.6.0_05\lib\zi\WET
C:\Program Files\Java\jre1.6.0_05\lib\zi\ZoneInfoMappings
C:\Program Files\Java\jre1.6.0_05\LICENSE
C:\Program Files\Java\jre1.6.0_05\PATCH.ERR
C:\Program Files\Java\jre1.6.0_05\README.txt
C:\Program Files\Java\jre1.6.0_05\THIRDPARTYLICENSEREADME.txt
C:\Program Files\Java\jre1.6.0_05\Welcome.html

.
((((((((((((((((((((((((( Files Created from 2008-06-11 to 2008-07-11 )))))))))))))))))))))))))))))))
.

2008-07-11 17:12 . 54,156 C:\WINDOWS\QTFont.qfn
2008-07-11 17:12 . 1,409 C:\WINDOWS\QTFont.for
2008-07-09 10:06 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-07-09 10:06 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-07-08 17:54 . 2008-07-08 17:54 <DIR> d-------- C:\Program Files\Avira
2008-07-08 17:54 . 2008-07-08 17:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-07-08 17:53 . 2008-07-08 17:53 22,311,160 --a------ C:\Program Files\antivir_workstation_winu_en_h.exe
2008-07-08 16:47 . 2008-07-08 16:47 24,234,968 --a------ C:\Program Files\setupeng.exe
2008-07-07 19:05 . 2008-07-11 00:16 <DIR> d-------- C:\Documents and Settings\Daddy\.SunDownloadManager
2008-07-04 11:09 . 2008-07-04 11:09 21,336 --a------ C:\WINDOWS\system32\GDIPFONTCACHEV1.DAT
2008-07-03 00:39 . 2008-07-03 00:39 <DIR> d-------- C:\Program Files\Kaspersky Lab
2008-07-03 00:39 . 2008-07-03 00:44 51,232 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-07-03 00:39 . 2008-07-03 00:44 1,676 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-07-02 23:46 . 2008-07-02 23:46 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-02 01:06 . 2008-07-02 01:06 <DIR> d-------- C:\WINDOWS\ERUNT
2008-07-02 00:53 . 2007-11-21 14:08 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Apple Computer
2008-07-02 00:53 . 2008-07-02 00:53 <DIR> d-------- C:\Documents and Settings\Administrator
2008-07-02 00:43 . 2008-07-02 09:40 <DIR> d-------- C:\SDFix
2008-06-27 20:16 . 2008-06-27 20:16 <DIR> d-------- C:\Deckard
2008-06-27 19:35 . 2008-06-27 19:35 <DIR> d-------- C:\Program Files\ZonedOut
2008-06-27 19:33 . 2008-06-27 19:33 <DIR> d-------- C:\ie-spyad_zo
2008-06-27 19:23 . 2008-06-27 19:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-27 19:22 . 2008-06-27 19:27 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-06-26 23:45 . 2008-06-26 23:54 <DIR> d-------- C:\Program Files\Panda Security
2008-06-25 10:59 . 2008-06-25 10:59 <DIR> d-------- C:\Documents and Settings\Mom\Application Data\Verizon
2008-06-25 09:19 . 2008-06-25 09:19 <DIR> d-------- C:\Documents and Settings\Stephanie\Application Data\Verizon
2008-06-24 20:57 . 2008-06-24 20:57 <DIR> d--h----- C:\WINDOWS\PIF
2008-06-24 17:50 . 2008-06-24 17:50 <DIR> d-------- C:\Documents and Settings\Daddy\Application Data\Verizon
2008-06-24 17:50 . 2008-06-24 17:51 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Verizon
2008-06-20 13:41 . 2008-06-20 13:41 245,248 -----c--- C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 06:44 . 2008-06-20 06:44 138,368 -----c--- C:\WINDOWS\system32\dllcache\afd.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-11 21:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-07-11 21:02 --------- d-----w C:\Program Files\PeerGuardian2
2008-07-10 12:12 --------- d-----w C:\Documents and Settings\Daddy\Application Data\Azureus
2008-06-27 01:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\SecTaskMan
2008-06-26 19:43 --------- d-----w C:\Program Files\Verizon
2008-06-26 19:42 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-24 21:34 --------- d-----w C:\Documents and Settings\Daddy\Application Data\Apple Computer
2008-06-24 16:28 --------- d-----w C:\Documents and Settings\Alex\Application Data\LimeWire
2008-06-24 04:51 --------- d-----w C:\Program Files\Soulseek
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-18 23:39 --------- d-----w C:\Documents and Settings\Daddy\Application Data\ZoomBrowser EX
2008-06-18 23:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\ZoomBrowser
2008-06-18 23:26 --------- d-----w C:\Documents and Settings\Daddy\Application Data\Canon
2008-06-13 13:10 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 04:48 --------- d-----w C:\Program Files\Solid AVI DIVX to DVD Burner
2008-06-05 23:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\CanonIJPLM
2008-06-04 02:32 --------- d-----w C:\Documents and Settings\Alex\Application Data\vlc
2008-06-01 16:16 --------- d-----w C:\Documents and Settings\Stephanie\Application Data\CyberLink
2008-06-01 04:51 --------- d-----w C:\Documents and Settings\Daddy\Application Data\dvdcss
2008-05-28 22:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\PCPitstop
2008-05-25 14:52 --------- d-----w C:\Documents and Settings\Daddy\Application Data\vlc
2008-05-25 14:46 --------- d-----w C:\Program Files\VideoLAN
2008-05-25 14:33 --------- d-----w C:\Documents and Settings\Daddy\Application Data\DVD Flick
2008-02-26 23:05 21,800 ----a-w C:\Documents and Settings\Stephanie\Application Data\GDIPFONTCACHEV1.DAT
2008-02-22 17:37 479 ----a-w C:\Program Files\setup.reg
2008-01-31 00:51 1,570,920 ----a-w C:\Program Files\taskmanager17.exe
2008-01-10 22:58 21,800 ----a-w C:\Documents and Settings\Daddy\Application Data\GDIPFONTCACHEV1.DAT
2007-11-17 02:31 8,212,216 ----a-w C:\Program Files\CheetahDVDBurner.exe
2007-05-12 14:40 630,784 ----a-w C:\Documents and Settings\Daddy\GoToAssist_chat2way__317_en.exe
2007-05-08 23:53 21,408 ----a-w C:\Documents and Settings\Brian\Application Data\GDIPFONTCACHEV1.DAT
2007-05-06 03:23 3,550,409 ----a-w C:\Program Files\ffdshow_rev529_20061113_clsid.exe
2007-04-04 13:52 507,904 ----a-w C:\Program Files\moveonb.msi
2007-03-21 23:37 528,312,337 ----a-w C:\Program Files\MSSetup.exe
2007-03-13 04:43 965 ----a-w C:\Program Files\Avery-MyProject8163.avery
2007-03-12 01:59 1,948,945 ----a-w C:\Program Files\burnquickeval.exe
2007-03-11 16:50 266,664 ----a-w C:\Program Files\burnsetup.exe
2007-03-11 15:26 830,422 ----a-w C:\Program Files\dBpowerAMP-codec-shorten.exe
2007-03-11 02:33 4,103,032 ----a-w C:\Program Files\dMC-r12.exe
2007-02-21 03:35 6,482,128 ----a-w C:\Program Files\FreeFXMPEG.EXE
2007-02-21 02:16 404,890 ----a-w C:\Program Files\switch.zip
2007-02-19 17:17 1,527,192 ----a-w C:\Program Files\daemon408-139-x86.exe
2007-02-19 16:58 1,035,271 ----a-w C:\Program Files\wrar362.exe
2007-02-11 23:16 10,007,784 ----a-w C:\Program Files\Azureus_2.5.0.4a_Win32.setup.exe
2007-01-11 04:36 51,973,232 ----a-w C:\Program Files\Quicken_Home_Business_2007.exe
2007-01-10 16:19 11,817,800 ----a-w C:\Program Files\GoogleEarth.exe
2006-11-06 23:33 557,056 ----a-w C:\Documents and Settings\Daddy\chatlnk.exe
2006-10-27 23:17 842,672 ----a-w C:\Program Files\slsk156c.exe
.

((((((((((((((((((((((((((((( snapshot@2008-07-02_15.04.22.70 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-07-02 18:57:02 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-07-11 21:10:45 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2008-02-20 05:32:43 148,992 -c----w C:\WINDOWS\system32\dllcache\dnsapi.dll
+ 2008-06-20 17:41:10 148,992 -c--a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
- 2007-10-30 17:20:55 360,064 -c----w C:\WINDOWS\system32\dllcache\tcpip.sys
+ 2008-06-20 10:45:13 360,320 -c--a-w C:\WINDOWS\system32\dllcache\tcpip.sys
- 2006-08-16 09:37:30 225,664 -c----w C:\WINDOWS\system32\dllcache\tcpip6.sys
+ 2008-06-20 09:52:06 225,920 -c--a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
- 2008-02-20 05:32:43 148,992 ----a-w C:\WINDOWS\system32\dnsapi.dll
+ 2008-06-20 17:41:10 148,992 ----a-w C:\WINDOWS\system32\dnsapi.dll
+ 2008-01-21 22:12:56 41,792 ----a-w C:\WINDOWS\system32\drivers\avgntdd.sys
+ 2008-01-21 22:11:28 22,336 ----a-w C:\WINDOWS\system32\drivers\avgntmgr.sys
+ 2008-03-04 17:28:53 79,424 ----a-w C:\WINDOWS\system32\drivers\avipbb.sys
+ 2007-03-01 14:34:22 28,352 ----a-w C:\WINDOWS\system32\drivers\ssmdrv.sys
- 2007-08-13 22:39:10 13,312 ----a-w C:\WINDOWS\system32\ieudinit.exe
+ 2008-04-22 07:39:58 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
- 2007-03-15 22:19:28 1,476,992 ----a-w C:\WINDOWS\system32\LegitCheckControl.dll
+ 2008-03-20 2236 1,480,232 ----a-w C:\WINDOWS\system32\LegitCheckControl.dll
- 2008-05-29 20:35:12 17,486,968 ----a-w C:\WINDOWS\system32\MRT.exe
+ 2008-06-25 16:15:46 17,972,344 ----a-w C:\WINDOWS\system32\MRT.exe
- 2004-08-04 07:56:44 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
+ 2008-06-20 17:41:10 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
+ 2007-07-30 23:18:34 207,736 ----a-w C:\WINDOWS\system32\muweb.dll
- 2007-11-30 11:18:51 17,272 ----a-w C:\WINDOWS\system32\spmsg.dll
+ 2007-11-30 12:39:22 17,272 ------w C:\WINDOWS\system32\spmsg.dll
- 2006-09-06 21:43:16 22,752 ----a-w C:\WINDOWS\system32\spupdsvc.exe
+ 2005-06-28 13:21:34 22,752 ----a-w C:\WINDOWS\system32\spupdsvc.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="C:\WINDOWS\System32\NVMCTRAY.DLL" [2003-09-24 19:32 49152]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 06:48 157592]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]
"PeerGuardian"="C:\Program Files\PeerGuardian2\pg2.exe" [2005-09-18 18:44 1382400]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-10-26 13:22 180269]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-10-26 14:00 190464]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-09-24 19:32 5033984]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 20:54 623992]
"Adobe_ID0EYTHM"="C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 17:40 1884160]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"Verizon_McciTrayApp"="C:\Program Files\Verizon\McciTrayApp.exe" [2007-09-28 14:30 936960]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"CanonSolutionMenu"="C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 21:01 644696]
"CanonMyPrinter"="C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 21:50 1603152]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 09:03 210472]
"OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 12:02 79400]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 05:59 122880 C:\WINDOWS\BCMSMMSG.exe]
"Logitech Utility"="LOGI_MWX.EXE" [2003-11-26 09:50 19968 C:\WINDOWS\LOGI_MWX.EXE]
"nwiz"="nwiz.exe" [2003-09-24 19:32 741376 C:\WINDOWS\system32\nwiz.exe]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Documents and Settings\\Daddy\\My Documents\\New Folder\\Azureus\\Azureus.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server

R2 ONSIO;ONSIO;C:\WINDOWS\SYSTEM32\DRIVERS\ONSIO.SYS [1998-04-17 14:23]
S0 SMPLSCSI;SMPLSCSI;C:\WINDOWS\system32\drivers\SMPLSCSI.SYS [1998-08-01 13:00]
S2 IJPLMSVC;PIXMA Extended Survey Program;C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2007-04-13 12:20]
S3 scsiscan;SCSI Scanner Driver;C:\WINDOWS\system32\DRIVERS\scsiscan.sys [2001-08-17 14:53]
S4 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files\Viewpoint\Common\ViewpointService.exe []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{df50faf4-614e-11db-b3bb-806d6172696f}]
\shell\PlayWithPowerCinema\Command - "C:\Program Files\Dell\Media Experience\PCM2.exe" MOVIE "%L"

.
Contents of the 'Scheduled Tasks' folder
"2008-07-11 13:16:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-11 17:11:49
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


C:\WINDOWS\QTFont.for 1409 bytes
C:\WINDOWS\QTFont.qfn 54156 bytes

scan completed successfully
hidden files: 2

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2008-07-11 17:18:53 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-11 21:18:21
ComboFix2.txt 2008-07-11 02:04:39
ComboFix3.txt 2008-07-09 18:15:37
ComboFix4.txt 2008-07-09 17:40:48
ComboFix5.txt 2008-07-03 21:30:33

Pre-Run: 14,964,273,152 bytes free
Post-Run: 14,983,561,216 bytes free

809 --- E O F --- 2008-07-11 07:03:41

----------------------

VirusTotal Log #1

File Cdvd.exe received on 10.02.2007 12:40:43 (CET)
Current status: finished

Result: 8/32 (25.00%)
Compact Print results
Antivirus Version Last Update Result
AhnLab-V3 - - -
AntiVir - - -
Authentium - - -
Avast - - Win32:Spyware-gen.
AVG - - -
BitDefender - - Application.MWS
CAT-QuickHeal - - -
ClamAV - - Adware.WhenU-3
DrWeb - - -
eSafe - - -
eTrust-Vet - - -
Ewido - - -
F-Prot - - -
F-Secure - - -
FileAdvisor - - -
Fortinet - - Adware/SaveNow
Ikarus - - -
Kaspersky - - not-a-virus:AdTool.Win32.MyWebSearch.ak
McAfee - - -
Microsoft - - -
NOD32v2 - - Win32/AdInstaller
Norman - - -
Panda - - -
Prevx1 - - -
Rising - - -
Sophos - - MyWebSearch
Sunbelt - - -
Symantec - - -
TheHacker - - -
VBA32 - - AdWare.Win32.SaveNow.bo
VirusBuster - - -
Webwasher-Gateway - - -
Additional information
MD5: 2edd557779e53d554d9ad28af9bf7650
SHA1: 3174f93868e8d16fd7699454e393decd4d7867c7
SHA256: cbe4f421a5a795e13de3558c32d267b7ca67a7d0b60eea706207ae15145a0907
SHA512: 11dcc0e4a1c1c378c0a269f2cd9ac85ddeca63e9c727b4c7f896a79c8621bce9bfe2ee29ca3db6d7520aa7d066b02d97ab0348c04a25acd1c3bb7f23710fe5a0

VirusTotal Log #2

File unins000.exe received on 07.11.2008 19:15:26 (CET)
Current status: finished

Result: 1/33 (3.03%)
Compact Print results
Antivirus Version Last Update Result
AhnLab-V3 2008.7.11.0 2008.07.11 -
AntiVir 7.8.0.64 2008.07.11 -
Authentium 5.1.0.4 2008.07.10 -
Avast 4.8.1195.0 2008.07.11 -
AVG 7.5.0.516 2008.07.11 -
BitDefender 7.2 2008.07.11 -
CAT-QuickHeal 9.50 2008.07.11 -
ClamAV 0.93.1 2008.07.11 -
DrWeb 4.44.0.09170 2008.07.11 -
eSafe 7.0.17.0 2008.07.10 -
eTrust-Vet 31.6.5947 2008.07.11 -
Ewido 4.0 2008.07.11 -
F-Prot 4.4.4.56 2008.07.10 -
F-Secure 7.60.13501.0 2008.07.10 -
Fortinet 3.14.0.0 2008.07.11 -
GData 2.0.7306.1023 2008.07.11 -
Ikarus T3.1.1.26.0 2008.07.11 Trojan-Downloader.Win32.Agent.vur
Kaspersky 7.0.0.125 2008.07.11 -
McAfee 5337 2008.07.11 -
Microsoft 1.3704 2008.07.11 -
NOD32v2 3263 2008.07.11 -
Norman 5.80.02 2008.07.11 -
Panda 9.0.0.4 2008.07.11 -
Prevx1 V2 2008.07.11 -
Rising 20.52.41.00 2008.07.11 -
Sophos 4.31.0 2008.07.11 -
Sunbelt 3.1.1509.1 2008.07.04 -
Symantec 10 2008.07.11 -
TheHacker 6.2.96.376 2008.07.10 -
TrendMicro 8.700.0.1004 2008.07.11 -
VBA32 3.12.6.9 2008.07.11 -
VirusBuster 4.5.11.0 2008.07.11 -
Webwasher-Gateway 6.6.2 2008.07.11 -
Additional information
File size: 691481 bytes
MD5...: d76f302343dc64f98cf888a4c846c208
SHA1..: f37726de186ffbb0edfa1e403d2561a0a4b1408c
SHA256: b70dd14b3ace73d18bb8deba9c322912221d11e0d5e4080a54b6216bd1bef3f5
SHA512: 299b98f721a83a0c24843b4973206ebbb68c8e7ea47fc59fbf37fb9cc560b5df
7fa9879c8b9bce397396cc291ed93b033a1598563d11ea188769acdcb61b405c
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x48fb00
timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992)
machinetype.......: 0x14c (I386)

( 8 sections )
name viradd virsiz rawdsiz ntrpy md5
CODE 0x1000 0x8ed30 0x8ee00 6.59 65057a4ee67c422926d7ddc20ed1763e
DATA 0x90000 0xf6c 0x1000 4.30 d21fe5132dea99525a6cf1585a804736
BSS 0x91000 0x139c 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.idata 0x93000 0x2580 0x2600 4.93 e5e6e5ba169e985617b6ee51af033aa1
.tls 0x96000 0x8 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.rdata 0x97000 0x18 0x200 0.20 aa788c79120afbe36e18b7b180139dd9
.reloc 0x98000 0x8250 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.rsrc 0xa1000 0x13a00 0x13a00 4.92 922121138b9461e06c43de883787955b

( 17 imports )
> kernel32.dll: DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle
> user32.dll: MessageBoxA
> oleaut32.dll: SafeArrayPutElement, SafeArrayCreate, VariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen
> advapi32.dll: RegSetValueExA, RegQueryValueExA, RegQueryInfoKeyA, RegOpenKeyExA, RegEnumValueA, RegEnumKeyExA, RegDeleteValueA, RegDeleteKeyA, RegCreateKeyExA, RegCloseKey, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueA, GetUserNameA, GetTokenInformation, FreeSid, EqualSid, AllocateAndInitializeSid
> kernel32.dll: lstrcmpA, WriteProfileStringA, WritePrivateProfileStringA, WriteFile, WaitForSingleObject, VirtualFree, VirtualAlloc, UnmapViewOfFile, TransactNamedPipe, TerminateThread, TerminateProcess, Sleep, SizeofResource, SetNamedPipeHandleState, SetLastError, SetFileTime, SetFilePointer, SetFileAttributesA, SetErrorMode, SetEndOfFile, SetCurrentDirectoryA, RemoveDirectoryA, ReleaseMutex, ReadFile, QueryPerformanceCounter, OpenProcess, OpenMutexA, MultiByteToWideChar, MulDiv, MoveFileExA, MoveFileA, MapViewOfFile, LockResource, LocalFree, LocalFileTimeToFileTime, LoadResource, LoadLibraryExA, LoadLibraryA, IsDBCSLeadByte, IsBadWritePtr, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetWindowsDirectoryA, GetVersionExA, GetVersion, GetUserDefaultLangID, GetTickCount, GetSystemTimeAsFileTime, GetSystemInfo, GetSystemDirectoryA, GetSystemDefaultLCID, GetShortPathNameA, GetProfileStringA, GetProcAddress, GetPrivateProfileStringA, GetOverlappedResult, GetModuleHandleA, GetModuleFileNameA, GetLogicalDrives, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetDriveTypeA, GetDiskFreeSpaceA, GetCurrentThreadId, GetCurrentThread, GetCurrentProcessId, GetCurrentProcess, GetCurrentDirectoryA, GetComputerNameA, GetCommandLineA, GetACP, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FlushFileBuffers, FindResourceA, FindNextFileA, FindFirstFileA, FindClose, FileTimeToSystemTime, FileTimeToLocalFileTime, DeviceIoControl, DeleteFileA, CreateThread, CreateProcessA, CreateNamedPipeA, CreateMutexA, CreateFileMappingA, CreateFileA, CreateEventA, CreateDirectoryA, CopyFileA, CompareStringA, CompareFileTime, CloseHandle
> mpr.dll: WNetOpenEnumA, WNetGetUniversalNameA, WNetGetConnectionA, WNetEnumResourceA, WNetCloseEnum
> version.dll: VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
> gdi32.dll: UnrealizeObject, TextOutA, StretchDIBits, StretchBlt, SetWindowOrgEx, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RoundRect, RestoreDC, RemoveFontResourceA, Rectangle, RectVisible, RealizePalette, Polyline, Pie, PatBlt, MoveToEx, LineTo, LineDDA, IntersectClipRect, GetWindowOrgEx, GetTextMetricsA, GetTextExtentPointA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetPixel, GetPaletteEntries, GetObjectA, GetDeviceCaps, GetDIBits, GetCurrentPositionEx, GetClipBox, GetBitmapBits, ExtFloodFill, ExcludeClipRect, EnumFontsA, Ellipse, DeleteObject, DeleteDC, CreateSolidBrush, CreateRectRgn, CreatePenIndirect, CreatePalette, CreateFontIndirectA, CreateDIBitmap, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, Chord, BitBlt, Arc, AddFontResourceA
> user32.dll: WindowFromPoint, WinHelpA, WaitMessage, WaitForInputIdle, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowOwnedPopups, ShowCursor, SetWindowRgn, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetCapture, SetActiveWindow, SendNotifyMessageA, SendMessageTimeoutA, SendMessageW, SendMessageA, ScrollWindowEx, ScrollWindow, ScreenToClient, ReplyMessage, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClassA, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OffsetRect, OemToCharBuffA, OemToCharA, MsgWaitForMultipleObjects, MessageBoxA, MessageBeep, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRgn, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetSystemMetrics, GetSystemMenu, GetSysColor, GetSubMenu, GetScrollPos, GetPropA, GetParent, GetWindow, GetMessagePos, GetMessageA, GetMenuStringA, GetMenuState, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClientRect, GetClassInfoW, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, ExitWindowsEx, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EnableWindow, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreateWindowExA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcW, CallWindowProcA, CallNextHookEx, BringWindowToTop, BeginPaint, AppendMenuA, CharPrevA, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, CharToOemBuffA, AdjustWindowRectEx
> comctl32.dll: ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Create, InitCommonControls
> ole32.dll: CoTaskMemFree, CLSIDFromProgID, CoCreateInstance, CoFreeUnusedLibraries, CoUninitialize, CoInitialize, IsEqualGUID
> oleaut32.dll: GetActiveObject, RegisterTypeLib, LoadTypeLib, SysFreeString
> shell32.dll: ShellExecuteExA, ShellExecuteA, SHGetFileInfoA, ExtractIconA
> shell32.dll: SHChangeNotify, SHBrowseForFolder, SHGetPathFromIDList, SHGetMalloc
> comdlg32.dll: GetSaveFileNameA, GetOpenFileNameA
> ole32.dll: CoDisconnectObject
> advapi32.dll: AdjustTokenPrivileges

( 0 exports )
-----------------------

HJT Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:31:45 PM, on 7/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\LOGI_MWX.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.shockwave.com/content/ric...GameLoader.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1161734388453
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1215552413000
O16 - DPF: {B0FB831D-17F6-4CBD-9B5D-3305881D362E} (LHGLauncherXForm Control) - http://www.shockwave.com/content/rea...LGLauncher.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://www.shockwave.com/content/fee...utLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.shockwave.com/content/zum...loader_v10.cab
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/optimize2/pcpitstop2.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{15DDA148-4767-49AE-B6CC-EBAB3F0FF04F}: NameServer = 192.168.1.1,192.168.1.3
O17 - HKLM\System\CS1\Services\Tcpip\..\{15DDA148-4767-49AE-B6CC-EBAB3F0FF04F}: NameServer = 192.168.1.1,192.168.1.3
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 10858 bytes

I no longer see any JRE or Java 1.605 files during a search, but still get the previous error of insufficient rights when I install upd 7.

Bunker10
bunker10 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-12-2008, 11:45 AM   #18 (permalink)
Moderator, Analyst, Security Team
 
TheBruce1's Avatar
 
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP


Re: Trojan Attack - IE7 & Outlook Gone!!
Hello again

Delete this file in red.

C:\Program Files\Dell Computer\Cdvd.exe

==========

Run ATF-Cleaner again, then reboot.

==========

Try to install update 7, if you receive any error messages please copy the exact message and post that together with a new hijackthis log.
__________________
Member of ASAP since 2007
Member of UNITE since 2008

**Notice to BT customers**
BT to dump Phorm, see Here for more information. No DPI

If we have helped you in anyway, please consider Donating
TheBruce1 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-13-2008, 05:57 PM   #19 (permalink)
Registered User
 
Join Date: Jun 2008
Posts: 14
OS: XPsp2


Re: Trojan Attack - IE7 & Outlook Gone!!
TheBruce1,

I got this error when installing upd 7 again...

Error 1321. The Installer has insufficient privileges to
modify the file C:\Program Files\Common Files\Java\Update\
Base Images\jre1.6.0.b105\core1.zip.

It then rolls back the install and launches Sun's Java Help Page, which has no listing for Error 1321. I did a search and it looks like it might be a Windows Privileges thing for the folder. I changed each folder above it from read-only but this does not solve the error.

HJT Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:52:20 PM, on 7/13/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\LOGI_MWX.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/