"Windows Security Alert" continues after XPAntivirus removed

mimartin · 08-10-2008, 08:27 PM

Hi,

Thanks in advance for your help with this problem.

My OS is WinXP sp3. On Friday, my computer became infected with XPAntivirus, Joke.Blusod (where it replaced my desktop with a yellow box saying I've been infected with a virus), and "Windows Security Alert" bugs.

I ran Norton Antivirus, Ad-Aware, and Spybot multiple times over the weekend with XP in Safe mode and normal mode. Finally, this morning I used Malwarebytes which removed XPAntivirus and Joke.Blusod (I hope - at least they haven't shown back up all day).

However, the "Windows Security Alert" bug is still popping up every once in a while. It says in the top portion of it's window: "To help protect your computer, Windows Firewall has detected activity of harmful software." In the middle section it says: "Do you want to block this software from sending data over the Internet?". It then names a virus, which changes from one appearance to the next: Trojan-Spy.Win32.GreenScreen, Trojan-Spy.Win32.Keylogger.aa, etc.

In step1 of the 5 in preparation or this post, I only found Viewpoint Media Player which I then uninstalled.

Below is the DSS Main.txt copied. And attached is the DSS Extra.txt and the Panda ActiveScan.txt.

Thanks for your help!
Michael.

Deckard's System Scanner v20071014.68
Run by Michael on 2008-08-10 21:30:06
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

System Restore is disabled; attempting to re-enable...success.

-- Last 1 Restore Point(s) --
1: 2008-08-11 02:30:09 UTC - RP1 - System Checkpoint

Backed up registry hives.
Performed disk cleanup.

-- HijackThis Clone ------------------------------------------------------------

Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-08-10 21:34:34
Platform: Windows XP Service Pack 3 (5.01.2600)
MSIE: Internet Explorer (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCSETMGR.EXE
C:\Program Files\Common Files\Symantec Shared\CCEVTMGR.EXE
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Canon\IJPLM\ijplmsvc.exe
C:\Program Files\Norton AntiVirus\NAVAPSVC.EXE
C:\Program Files\Norton AntiVirus\IWP\NPFMNTOR.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\ScsiAccess.EXE
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\All Users\Application Data\fapcjszy\vuxszkfw.exe
C:\WINDOWS\ltmsg.exe
C:\WINDOWS\system\hpsysdrv.exe
C:\Program Files\HP\Digital Imaging\Unload\HpqCmon.exe
C:\WINDOWS\system32\hphmon05.exe
C:\WINDOWS\system32\ps2.EXE
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_monitor.exe
C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Common Files\Symantec Shared\CCAPP.EXE
C:\Program Files\PhatNoise Media Manager\PNAgent.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\acrotray.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\zcbcvuvw.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray\sgtray.exe
C:\Documents and Settings\Michael\Desktop\dss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.com/spbasic.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
R3 - URLSearchHook: (no name) - _{20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - (no file)
R3 - URLSearchHook: (no name) - {ECA67A70-18C9-BE83-72CC-D451B98B63B7} - (no file)
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NAVSHEXT.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: ScriptInocUI Class - - (no file)
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - (no file)
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NAVSHEXT.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [pRcu5m] C:\WINDOWS\iysfas.exe
O4 - HKLM\..\Run: [-
] C:\WINDOWS\iysfas.exe
O4 - HKLM\..\Run: [pRcu5mú*ÀaîžaaøY§C:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\iysfas.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [jbkyw.exe] C:\WINDOWS\system32\jbkyw.exe
O4 - HKLM\..\Run: [dmvoq.exe] C:\WINDOWS\system32\dmvoq.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [PNAgent] "C:\Program Files\PhatNoise Media Manager\PNAgent.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [WrtMon.exe] C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [msag] porka_.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [HlpWebUi] C:\WINDOWS\system32\zcbcvuvw.exe
O4 - HKCU\..\Run: [cmdsmart] C:\WINDOWS\system32\qvubkbwz.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [actdbapl] C:\WINDOWS\system32\zohivwrc.exe
O4 - HKLM\..\Policies\Explorer\Run: [YLbqW51HDy] C:\Documents and Settings\All Users\Application Data\fapcjszy\vuxszkfw.exe
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'Default user')
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: LimeShop Preferences - file://C:\Program Files\Lime_Shop\Sy700\Tp700\scri700a.htm
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing)
O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - C:\Program Files\Free Download Manager\FUM\fumiebtn.dll (file missing)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://fpdownload.macromedia.com/pub...irector/sw.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?Link...04&clcid=0x409
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} () - http://download.microsoft.com/downlo...22/wmv9VCM.CAB
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {99802379-7362-40E2-9D28-8A3B9AF880B7} () - http://hotsearchbar.com/toolbar2/winhot32.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9CF28A69-7659-4C51-BFD5-9ADE19E19EC3} (RegConfig Class) - http://download.yahoo.com/dl/install...od/yregcfg.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} () - http://v4.windowsupdate.microsoft.co...039.7208217593
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://download.yahoo.com/dl/installs/yab_af.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.15.38/ttinst.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{0689CEC2-8D77-4684-9520-B9193268E020}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{5B7D92DE-C59E-4A96-8384-87D106A9DE5B}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{F9852F02-FE8C-49A1-86BC-15688CF57C8D}: NameServer = 208.67.220.220,208.67.222.222
O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O21 - SSODL: UiHlp - {710EDF3B-3DF0-5723-471A-0AC80455DCAC} - C:\Program Files\rcecdxf\UiHlp.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCEVTMGR.EXE
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCSETMGR.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\ijplmsvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_0.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\NAVAPSVC.EXE
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMNTOR.EXE
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\system32\ScsiAccess.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\symwsc.exe

--
End of file - 19128 bytes

-- File Associations -----------------------------------------------------------

.cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*
.reg - regfile - shell\open\command - regedit.exe "%1" %*
.scr - scrfile - shell\open\command - "%1" %*

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 NEOFLTR_530_10641 (Juniper Networks TDI Filter Driver (NEOFLTR_530_10641)) - c:\windows\system32\drivers\neofltr_530_10641.sys <Not Verified; Neoteris; Secure Application Manager>
R1 PCLEPCI - c:\windows\system32\drivers\pclepci.sys <Not Verified; Pinnacle Systems GmbH; PCLEPCI>
R2 CDRPDACC (Arrowkey Device Access) - c:\program files\321studios\shared\cdrpdacc.sys <Not Verified; Arrowkey; CD Device Access>
R2 MCSTRM - c:\windows\system32\drivers\mcstrm.sys <Not Verified; RealNetworks, Inc.; RealNetworks Virtual Path Manager® (32-bit)>
R3 ASAPIW2k - c:\windows\system32\drivers\asapiw2k.sys <Not Verified; Pinnacle Systems GmbH; asapi>
R3 BENDER (Pinnacle AV/DV2 Capture) - c:\windows\system32\drivers\bender.sys <Not Verified; Pinnacle Systems GmbH; Pinnacle AV/DV2>
R3 Pcouffin (Low level access layer for CD devices) - c:\windows\system32\drivers\pcouffin.sys <Not Verified; VSO Software; Patin couffin engine>
R3 pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus(R) ASPI Shell>
R3 SunkFilt (Alcor Micro Corp - 9360) - c:\windows\system32\drivers\sunkfilt.sys <Not Verified; Alcor Micro Corp.; SunkFilt>

S3 Sunkfiltp (HP && Alcor Micro Corp for Phison) - c:\windows\system32\drivers\sunkfiltp.sys (file missing)

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service>
R2 IJPLMSVC (PIXMA Extended Survey Program) - c:\program files\canon\ijplm\ijplmsvc.exe <Not Verified; ; IJPLMSVC>
R2 ScsiAccess - c:\windows\system32\scsiaccess.exe
R3 ServiceLayer - "c:\program files\common files\pcsuite\services\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution>

-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {6BDD1FC6-810F-11D0-BEC7-08002BE2092F}
Description: Canon MX700 ser Network
Device ID: ROOT\CANON_IJ_NETWORK\0000
Manufacturer: Canon
Name: Canon MX700 ser Network
PNP Device ID: ROOT\CANON_IJ_NETWORK\0000
Service: StillCam

-- Scheduled Tasks -------------------------------------------------------------

2008-08-08 20:38:46 534 --a------ C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Michael.job
2008-08-06 18:44:05 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
2008-08-04 06:43:00 274 --a------ C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job
2008-02-16 07:43:52 396 --a------ C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job

-- Files created between 2008-07-10 and 2008-08-10 -----------------------------

2008-08-10 21:12:27 0 d-------- C:\WINDOWS\Prefetch
2008-08-10 21

04 0 d-------- C:\WINDOWS\LastGood.Tmp
2008-08-10 20:56:26 0 d-------- C:\WINDOWS\system32\scripting
2008-08-10 20:56:22 0 d-------- C:\WINDOWS\l2schemas
2008-08-10 20:56:21 0 d-------- C:\WINDOWS\system32\en
2008-08-10 20:45:10 0 d-------- C:\WINDOWS\network diagnostic
2008-08-10 19:38:10 0 d-------- C:\ie-spyad_zo
2008-08-10 19:27:41 0 d-------- C:\Program Files\SpywareBlaster
2008-08-10 16:37:07 0 d-------- C:\Program Files\Panda Security
2008-08-10 15:52:07 86016 --a------ C:\WINDOWS\system32\xwvobuhg.exe
2008-08-10 08:43:49 81920 --a------ C:\WINDOWS\system32\zohivwrc.exe
2008-08-09 22:57:27 98304 --a------ C:\WINDOWS\system32\qvubkbwz.exe
2008-08-09 22:32:39 0 d-------- C:\Documents and Settings\Michael\Application Data\Malwarebytes
2008-08-09 22:32:36 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-09 22:32:36 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-08 21:10:56 0 d-------- C:\Documents and Settings\Administrator\Application Data\Juniper Networks
2008-08-08 20:55:23 0 d-------- C:\Program Files\rcecdxf
2008-08-08 20:53:27 0 d-------- C:\Documents and Settings\All Users\Application Data\fapcjszy
2008-08-08 20:53:22 77824 --a------ C:\WINDOWS\system32\zcbcvuvw.exe
2008-08-07 06:18:25 0 d-------- C:\Documents and Settings\Michael\.Arachnophilia
2008-08-07 06:17:24 0 d-------- C:\Program Files\Arachnophilia
2008-07-15 22:03:07 40304 --ah----- C:\WINDOWS\system32\mlfcache.dat
2008-07-12 09

35 0 d-------- C:\Documents and Settings\Michael\Application Data\ICAClient
2008-07-12 09

25 0 d-------- C:\Documents and Settings\Michael\Application Data\Runaware

-- Find3M Report ---------------------------------------------------------------

2008-08-10 21:11:09 0 d-------- C:\Program Files\Messenger
2008-08-10 20:56:20 0 d-------- C:\Program Files\Movie Maker
2008-08-10 20:49:17 0 d-------- C:\Program Files\Windows NT
2008-08-09 23:01:31 0 d-------- C:\Program Files\Lavasoft
2008-08-09 23:00:46 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-08-08 20:53:25 0 d-------- C:\Documents and Settings\Michael\Application Data\Skype
2008-08-08 16:09:37 0 d-------- C:\Documents and Settings\Michael\Application Data\skypePM
2008-07-15 21:26:08 0 d-------- C:\Program Files\Picasa2
2008-07-15 08:14:39 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-07-09 16:58:42 0 d-------- C:\Program Files\LimeWire
2008-06-30 10:34:11 0 d-------- C:\Program Files\Motorola Phone Tools
2008-06-30 10:31:08 0 d-------- C:\Program Files\Common Files
2008-06-30 10:31:08 0 d-------- C:\Program Files\Common Files\Motorola Shared
2008-06-30 10:30:44 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-06-27 15:15:54 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat
2008-06-27 15:14:38 0 d-------- C:\Program Files\Common Files\Skype
2008-06-22 08:27:55 0 d-------- C:\Program Files\UltraEdit
2008-06-22 08:25:17 1564236 --a------ C:\Program Files\UltraEdit.zip

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [08/19/2003 04:56 AM]
"nwiz"="nwiz.exe" [08/19/2003 04:56 AM C:\WINDOWS\system32\nwiz.exe]
"LTMSG"="LTMSG.exe" [07/14/2003 07:52 PM C:\WINDOWS\ltmsg.exe]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [05/07/1998 06:04 PM]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [04/07/2003 09:07 AM]
"CamMonitor"="c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe" [10/07/2002 09:23 AM]
"HPHUPD05"="c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" []
"HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [05/23/2003 04:55 AM]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [11/04/2003 01:36 AM]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [09/13/2002 11:42 PM]
"VTTimer"="VTTimer.exe" []
"PS2"="C:\WINDOWS\system32\ps2.exe" [10/16/2002 06:57 PM]
"Sunkist2k"="C:\Program Files\Multimedia Card Reader\shwicon2k.exe" [08/14/2003 09:11 PM]
"CXMon"="C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe" [09/19/2001 11:18 AM]
"Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe" [07/03/2001 10:11 AM]
"@"="" []
"AlcxMonitor"="ALCXMNTR.EXE" [09/07/2004 02:47 PM C:\WINDOWS\ALCXMNTR.EXE]
"PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [03/10/2004 05:26 PM]
"pRcu5m"="C:\WINDOWS\iysfas.exe" []
"-
"="C:\WINDOWS\iysfas.exe" []
"pRcu5mú*ÀaîžaaøY§C:\Program Files\ISTsvc\istsvc.exe"="C:\WINDOWS\iysfas.exe" []
"BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [09/10/2002 09:26 PM]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [01/08/2008 06:33 PM]
"jbkyw.exe"="C:\WINDOWS\system32\jbkyw.exe" []
"dmvoq.exe"="C:\WINDOWS\system32\dmvoq.exe" []
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [03/12/2007 06:30 PM]
"PNAgent"="C:\Program Files\PhatNoise Media Manager\PNAgent.exe" [07/05/2006 04:51 PM]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [04/26/2006 08:29 AM]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [04/23/2008 02:08 AM]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [03/28/2008 11:37 PM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [03/30/2008 10:36 AM]
"CanonSolutionMenu"="C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" [05/14/2007 08:01 PM]
"CanonMyPrinter"="C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" [04/03/2007 08:50 PM]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [10/25/2006 09:03 AM]
"OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [02/04/2007 12:02 PM]
"WrtMon.exe"="C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe" [09/20/2006 08:35 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RecordNow!"="" []
"NVIEW"="nview.dll,nViewLoadHook" []
"BackupNotify"="c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe" [06/22/2003 11:25 PM]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [04/11/2006 05:52 PM]
"msag"="porka_.exe" []
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [04/13/2008 07:12 PM]
"HlpWebUi"="C:\WINDOWS\system32\zcbcvuvw.exe" [08/08/2008 08:53 PM]
"cmdsmart"="C:\WINDOWS\system32\qvubkbwz.exe" [08/09/2008 10:57 PM]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [07/30/2008 02:45 PM]
"actdbapl"="C:\WINDOWS\system32\zohivwrc.exe" [08/10/2008 08:43 AM]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"POSTRBT"=C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Picasa Media Detector"=C:\Program Files\Picasa2\PicasaMediaDetector.exe

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe [1/13/2008 8:45:57 AM]
SBC Self Support Tool.lnk - C:\Program Files\SBC Self Support Tool\bin\matcli.exe [8/26/2005 3:51:14 PM]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=0 (0x0)
"NoDispBackgroundPage"=0 (0x0)
"NoDispScrSavPage"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"AllowLegacyWebView"=1 (0x1)
"AllowUnhashedWebView"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]
"YLbqW51HDy"=C:\Documents and Settings\All Users\Application Data\fapcjszy\vuxszkfw.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"SpecifyDefaultButtons"=0 (0x0)
"Btn_Search"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"UiHlp"= {710EDF3B-3DF0-5723-471A-0AC80455DCAC} - C:\Program Files\rcecdxf\UiHlp.dll [08/08/2008 08:55 PM 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"System"="csqlr.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
C:\WINDOWS\System32\dimsntfy.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\KODAK Software Updater.lnk
backup=C:\WINDOWS\pss\KODAK Software Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MindManager PDF Writer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MindManager PDF Writer.lnk
backup=C:\WINDOWS\pss\MindManager PDF Writer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\control64]
TRPT.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\driver64]
Preliminary.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Uploader Oe Integration]
C:\Program Files\Free Download Manager\FUM\fumoei.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
C:\HP\KBD\KBD.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pamela.exe]
"C:\Program Files\Pamela\Pamela.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\QTTask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetupExeDll]
br0ken.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
"C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ssweeper]
vxdman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tapisys]
C:\WINDOWS\System32\tss.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tsa2]
C:\PROGRA~1\COMMON~1\tsa\tsm2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YBrowser]
C:\Program Files\Yahoo!\browser\ybrwicon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
eapsvcs eaphost
dot3svc dot3svc

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
napagent
hkmsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c1e2986f-2c64-11dd-a400-000ea6631781}]
AutoRun\command- K:\Launch.exe /run

*Newly Created Service* - PAVBOOT

-- Hosts -----------------------------------------------------------------------

localhost 127.0.0.1

-- End of Deckard's System Scanner: finished at 2008-08-10 21:36:41 ------------

**TheBruce1** · 08-13-2008, 06:22 AM

Hello and welcome to TSF

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

========

Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear, a lack of symptoms does not mean that it is no longer present.

Please DO NOT Attach logs to your posts unless you are advised to do so.

=========

P2P

P2P - I see you have P2P software LimeWire 4.18.3 installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares and their infections.

References for the risk of these programs are Here,
Here and Here.

=========

Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/comb...o-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery mode. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once the Recovery Console is installed using ComboFix, you should see a message that says:

The Recovery Console was successfully installed.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Click Yes to allow ComboFix to continue scanning for malware.

When the tool is finished, it will produce a report for you.

==========

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

==========
Logs Required
C:\Combofix.txt
Hijackthis Log

mimartin · 08-13-2008, 09:39 AM

Hi TheBruce1,

Thanks for your quick response and help with this!

Here are the things I did and the results.

1. Removed Limewire.
2. Ran Combofix
- It told me recovery console was already installed, and I did see it after a reboot.
- After Combofix provided the log, a System settings protector msgbox was displayed. It stated, "System settings protector has encountered a problem and needs to close."
- The desktop did not return (ie all blue, no icons)
3. Rebooted
- Desktop returned
- Joke.Blusod and XPAntiviru also returned.
4. Ran HJT

Attached are the Combofix.txt and HJT log.

ComboFix 08-08-12.01 - Michael 2008-08-13 10:15:38.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.165 [GMT -5:00]
Running from: C:\Documents and Settings\Michael\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Michael\Application Data\macromedia\Flash Player\#SharedObjects\HEDZD6A7\interclick.com
C:\Documents and Settings\Michael\Application Data\macromedia\Flash Player\#SharedObjects\HEDZD6A7\interclick.com\ud.sol
C:\Documents and Settings\Michael\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Michael\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Documents and Settings\Michael\Local Settings\Temporary Internet Files\Tvm.log
C:\Documents and Settings\Owner\Application Data\macromedia\Flash Player\#SharedObjects\G33BP8JM\interclick.com
C:\Documents and Settings\Owner\Application Data\macromedia\Flash Player\#SharedObjects\G33BP8JM\interclick.com\ud.sol
C:\Documents and Settings\Owner\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Owner\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Tvm.log
C:\Documents and Settings\User\Application Data\macromedia\Flash Player\#SharedObjects\KT9DWQ45\interclick.com
C:\Documents and Settings\User\Application Data\macromedia\Flash Player\#SharedObjects\KT9DWQ45\interclick.com\ud.sol
C:\Documents and Settings\User\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\User\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Program Files\akl
C:\Program Files\akl\akl.dll
C:\Program Files\akl\akl.exe
C:\Program Files\akl\uninstall.exe
C:\Program Files\akl\unsetup.exe
C:\Program Files\Inet Delivery
C:\Program Files\Inet Delivery\inetdl.exe
C:\Program Files\Inet Delivery\intdel.exe
C:\WINDOWS\a.bat
C:\WINDOWS\base64.tmp
C:\WINDOWS\bdn.com
C:\WINDOWS\Downloaded Program Files\setup.inf
C:\WINDOWS\FVProtect.exe
C:\WINDOWS\iTunesMusic.exe
C:\WINDOWS\mslagent
C:\WINDOWS\mslagent\2_mslagent.dll
C:\WINDOWS\mslagent\mslagent.exe
C:\WINDOWS\mslagent\uninstall.exe
C:\WINDOWS\mssecu.exe
C:\WINDOWS\system32\actskn43.ocx
C:\WINDOWS\system32\akttzn.exe
C:\WINDOWS\system32\anticipator.dll
C:\WINDOWS\system32\awtoolb.dll
C:\WINDOWS\system32\bdn.com
C:\WINDOWS\system32\bsva-egihsg52.exe
C:\WINDOWS\system32\dpcproxy.exe
C:\WINDOWS\system32\emesx.dll
C:\WINDOWS\system32\h@tkeysh@@k.dll
C:\WINDOWS\system32\hoproxy.dll
C:\WINDOWS\system32\hxiwlgpm.dat
C:\WINDOWS\system32\hxiwlgpm.exe
C:\WINDOWS\system32\medup012.dll
C:\WINDOWS\system32\medup020.dll
C:\WINDOWS\system32\msgp.exe
C:\WINDOWS\system32\msnbho.dll
C:\WINDOWS\system32\mssecu.exe
C:\WINDOWS\system32\msvchost.exe
C:\WINDOWS\system32\mtr2.exe
C:\WINDOWS\system32\mwin32.exe
C:\WINDOWS\system32\netode.exe
C:\WINDOWS\system32\newsd32.exe
C:\WINDOWS\system32\ps1.exe
C:\WINDOWS\system32\psof1.exe
C:\WINDOWS\system32\psoft1.exe
C:\WINDOWS\system32\regc64.dll
C:\WINDOWS\system32\regm64.dll
C:\WINDOWS\system32\Rundl1.exe
C:\WINDOWS\system32\smp
C:\WINDOWS\system32\smp\msrc.exe
C:\WINDOWS\system32\sncntr.exe
C:\WINDOWS\system32\ssurf022.dll
C:\WINDOWS\system32\ssvchost.com
C:\WINDOWS\system32\ssvchost.exe
C:\WINDOWS\system32\sysreq.exe
C:\WINDOWS\system32\taack.dat
C:\WINDOWS\system32\taack.exe
C:\WINDOWS\system32\temp#01.exe
C:\WINDOWS\system32\thun.dll
C:\WINDOWS\system32\thun32.dll
C:\WINDOWS\system32\VBIEWER.OCX
C:\WINDOWS\system32\vbsys2.dll
C:\WINDOWS\system32\vcatchpi.dll
C:\WINDOWS\system32\winlogonpc.exe
C:\WINDOWS\system32\winsystem.exe
C:\WINDOWS\system32\WINWGPX.EXE
C:\WINDOWS\userconfig9x.dll
C:\WINDOWS\winsystem.exe
C:\WINDOWS\zip1.tmp
C:\WINDOWS\zip2.tmp
C:\WINDOWS\zip3.tmp
C:\WINDOWS\zipped.tmp
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-07-13 to 2008-08-13 )))))))))))))))))))))))))))))))
.

2008-08-12 16:44 . 2008-08-13 10:12 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-08-12 16:44 . 2008-08-12 16:44 1,409 --a------ C:\WINDOWS\QTFont.for
2008-08-12 13:35 . 2008-08-12 13:35 81,920 --a------ C:\WINDOWS\system32\krihghct.exe
2008-08-11 17:15 . 2008-08-11 17:15 94,208 --a------ C:\WINDOWS\system32\qbcjyhqd.exe
2008-08-10 21:29 . 2008-08-10 21:29 <DIR> d-------- C:\Deckard
2008-08-10 20:56 . 2008-08-10 20:56 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-08-10 20:56 . 2008-08-10 20:56 <DIR> d-------- C:\WINDOWS\system32\en
2008-08-10 20:56 . 2008-08-10 20:56 <DIR> d-------- C:\WINDOWS\l2schemas
2008-08-10 20:24 . 2008-04-13 19:12 1,306,624 -----c--- C:\WINDOWS\system32\dllcache\msxml6.dll
2008-08-10 20:23 . 2008-04-13 19:11 650,752 --------- C:\WINDOWS\system32\dot3ui.dll
2008-08-10 19:38 . 2008-08-10 19:38 <DIR> d-------- C:\ie-spyad_zo
2008-08-10 19:27 . 2008-08-10 19:30 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-08-10 16:38 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys
2008-08-10 16:37 . 2008-08-10 16:37 <DIR> d-------- C:\Program Files\Panda Security
2008-08-10 15:52 . 2008-08-10 15:52 86,016 --a------ C:\WINDOWS\system32\xwvobuhg.exe
2008-08-10 08:43 . 2008-08-10 08:43 81,920 --a------ C:\WINDOWS\system32\zohivwrc.exe
2008-08-09 22:57 . 2008-08-09 22:57 98,304 --a------ C:\WINDOWS\system32\qvubkbwz.exe
2008-08-09 22:32 . 2008-08-09 22:32 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-09 22:32 . 2008-08-09 22:32 <DIR> d-------- C:\Documents and Settings\Michael\Application Data\Malwarebytes
2008-08-09 22:32 . 2008-08-09 22:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-09 22:32 . 2008-07-30 20:14 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-09 22:32 . 2008-07-30 20:14 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-09 16:07 . 2008-08-09 16:07 0 --a------ C:\WINDOWS\system32\FCF.tmp
2008-08-08 21:10 . 2008-08-08 21:10 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Juniper Networks
2008-08-08 20:55 . 2008-08-08 20:55 <DIR> d-------- C:\Program Files\rcecdxf
2008-08-08 20:53 . 2008-08-08 20:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\fapcjszy
2008-08-08 20:53 . 2008-08-08 20:53 77,824 --a------ C:\WINDOWS\system32\zcbcvuvw.exe
2008-08-07 06:18 . 2008-08-07 06:18 <DIR> d-------- C:\Documents and Settings\Michael\.Arachnophilia
2008-08-07 06:17 . 2008-08-07 06:17 <DIR> d-------- C:\Program Files\Arachnophilia
2008-07-15 22:03 . 2008-07-15 22:03 40,304 --ah----- C:\WINDOWS\system32\mlfcache.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-13 14:40 --------- d-----w C:\Program Files\LimeWire
2008-08-12 10:47 --------- d-----w C:\Program Files\Paint.NET
2008-08-10 21:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-08-10 13:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-10 12:39 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-08-10 04:01 --------- d-----w C:\Program Files\Lavasoft
2008-08-10 04:00 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-08-09 15:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-09 01:53 --------- d-----w C:\Documents and Settings\Michael\Application Data\Skype
2008-08-08 21:09 --------- d-----w C:\Documents and Settings\Michael\Application Data\skypePM
2008-08-03 04:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\CanonIJPLM
2008-07-16 02:26 --------- d-----w C:\Program Files\Picasa2
2008-07-12 14:07 --------- d-----w C:\Documents and Settings\Michael\Application Data\ICAClient
2008-07-12 14:06 --------- d-----w C:\Documents and Settings\Michael\Application Data\Runaware
2008-06-30 15:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\BVRP Software
2008-06-30 15:34 --------- d-----w C:\Program Files\Motorola Phone Tools
2008-06-30 15:31 --------- d-----w C:\Program Files\Common Files\Motorola Shared
2008-06-30 15:30 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-30 15:30 --------- d-----w C:\Documents and Settings\User\Application Data\InstallShield
2008-06-27 20:14 --------- d-----w C:\Program Files\Common Files\Skype
2008-06-22 13:27 --------- d-----w C:\Program Files\UltraEdit
2008-06-22 13:25 1,564,236 ----a-w C:\Program Files\UltraEdit.zip
2008-06-20 17:46 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 11:51 361,600 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 11:40 138,496 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 11:08 225,856 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-13 11:05 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-30 22:46 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL
2008-05-16 16:58 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2008-04-25 16:56 56,912 ----a-w C:\Documents and Settings\Michael\g2mdlhlpx.exe
2008-01-15 03:59 744 ----a-w C:\Documents and Settings\Michael\pass.dat
2007-12-22 12:35 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2005-01-01 06:53 37 ----a-w C:\Documents and Settings\Owner\Application Data\tvmcwrd.dll
2005-01-01 06:52 127 ----a-w C:\Documents and Settings\Owner\Application Data\tvmdmns.dll
2004-12-31 20:46 163 ----a-w C:\Documents and Settings\Michael\Application Data\tvmdmns.dll
2004-12-31 20:03 28 ----a-w C:\Documents and Settings\Michael\Application Data\tvmcwrd.dll
2002-08-29 12:00 94,784 --sh--w C:\WINDOWS\twain.dll
2008-04-14 00:12 50,688 --sh--w C:\WINDOWS\twain_32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BackupNotify"="c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe" [2003-06-22 23:25 24576]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-04-11 17:52 1409024]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-13 19:12 1695232]
"HlpWebUi"="C:\WINDOWS\system32\zcbcvuvw.exe" [2008-08-08 20:53 77824]
"cmdsmart"="C:\WINDOWS\system32\qvubkbwz.exe" [2008-08-09 22:57 98304]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-30 14:45 1829712]
"actdbapl"="C:\WINDOWS\system32\zohivwrc.exe" [2008-08-10 08:43 81920]
"NVIEW"="nview.dll" [2003-08-19 04:56 852038 C:\WINDOWS\system32\nview.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-08-19 04:56 4841472]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 18:04 52736]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 09:07 114688]
"CamMonitor"="c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 09:23 90112]
"HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2003-05-23 04:55 483328]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-11-04 01:36 45056]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 23:42 212992]
"PS2"="C:\WINDOWS\system32\ps2.exe" [2002-10-16 18:57 81920]
"Sunkist2k"="C:\Program Files\Multimedia Card Reader\shwicon2k.exe" [2003-08-14 21:11 139264]
"CXMon"="C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe" [2001-09-19 11:18 45056]
"Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 10:11 57344]
"PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-10 17:26 406016]
"BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 21:26 368706]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-08 18:33 53096]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 18:30 517768]
"PNAgent"="C:\Program Files\PhatNoise Media Manager\PNAgent.exe" [2006-07-05 16:51 40960]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [2006-04-26 08:29 237568]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 02:08 483328]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"CanonSolutionMenu"="C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 20:01 644696]
"CanonMyPrinter"="C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 20:50 1603152]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 09:03 210472]
"OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 12:02 79400]
"WrtMon.exe"="C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 08:35 20480]
"nwiz"="nwiz.exe" [2003-08-19 04:56 323584 C:\WINDOWS\system32\nwiz.exe]
"LTMSG"="LTMSG.exe" [2003-07-14 19:52 40960 C:\WINDOWS\ltmsg.exe]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 14:47 57344 C:\WINDOWS\ALCXMNTR.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-25 20:23 443968]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"POSTRBT"="C:\Program Files\Norton AntiVirus\Navw32.exe" [2007-05-23 12:13 173680]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"YLbqW51HDy"="C:\Documents and Settings\All Users\Application Data\fapcjszy\vuxszkfw.exe" [2008-08-08 20:53 57344]

C:\Documents and Settings\Owner\Start Menu\Programs\Startup\
spamsubtract.lnk - C:\Program Files\interMute\SpamSubtract\SpamSub.exe [2003-10-14 00:24:52 557056]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe [2008-01-13 08:45:57 25214]
SBC Self Support Tool.lnk - C:\Program Files\SBC Self Support Tool\bin\matcli.exe [2005-08-26 15:51:14 217088]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"AllowLegacyWebView"= 1 (0x1)
"AllowUnhashedWebView"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"SpecifyDefaultButtons"= 0 (0x0)
"Btn_Search"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"UiHlp"= {710EDF3B-3DF0-5723-471A-0AC80455DCAC} - C:\Program Files\rcecdxf\UiHlp.dll [2008-08-08 20:55 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= Pvmjpg21.dll
"VIDC.PIM1"= pclepim1.dll
"vidc.VP31"= vp31vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\KODAK Software Updater.lnk
backup=C:\WINDOWS\pss\KODAK Software Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MindManager PDF Writer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MindManager PDF Writer.lnk
backup=C:\WINDOWS\pss\MindManager PDF Writer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Uploader Oe Integration]
--a------ 2007-06-10 19:02 40960 C:\Program Files\Free Download Manager\FUM\fumoei.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-03-30 10:36 267048 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
--a------ 2003-02-11 22:02 61440 C:\hp\KBD\kbd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
--a------ 2004-09-22 19:20 53248 C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]
--a------ 2003-12-10 04:52 380928 C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-04-13 19:12 1695232 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pamela.exe]
--a------ 2007-12-22 07:57 6742016 C:\Program Files\Pamela\Pamela.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-03-28 23:37 413696 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2008-05-30 15:54 21718312 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 02:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YBrowser]
--a------ 2003-07-11 13:51 57344 C:\Program Files\Yahoo!\browser\ybrwicon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Java\\j2re1.4.2\\bin\\javaw.exe"=
"C:\\StubInstaller.exe"=
"C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\backWeb-7288971.exe"=
"C:\\Program Files\\Neoteris\\Secure Application Manager\\dsSamProxy.exe"=
"C:\\Program Files\\Best Buy Digital Music Store Powered by Rhapsody\\rhapsody.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 17:24]
R1 NEOFLTR_530_10641;Juniper Networks TDI Filter Driver (NEOFLTR_530_10641);C:\WINDOWS\system32\Drivers\NEOFLTR_530_10641.SYS [2006-04-27 00:40]
R2 IJPLMSVC;PIXMA Extended Survey Program;C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2007-04-13 10:49]
R3 BENDER;Pinnacle AV/DV2 Capture;C:\WINDOWS\system32\drivers\bender.sys [2003-07-09 15:35]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c1e2986f-2c64-11dd-a400-000ea6631781}]
\Shell\AutoRun\command - K:\Launch.exe /run

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder

2008-08-06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]

2008-08-09 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Michael.job
- C:\PROGRA~1\NORTON~1\Navw32.exe [2007-05-23 12:13]

2008-08-04 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []

2008-02-16 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-_{20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - (no file)
URLSearchHooks-{ECA67A70-18C9-BE83-72CC-D451B98B63B7} - (no file)
HKCU-Run-RecordNow! - (no file)
HKCU-Run-msag - porka_.exe
HKLM-Run-HPHUPD05 - c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
HKLM-Run-pRcu5m - C:\WINDOWS\iysfas.exe
HKLM-Run-pRcu5mú*ÀaîžaaøY§C:\Program Files\ISTsvc\istsvc.exe - C:\WINDOWS\iysfas.exe
HKLM-Run-jbkyw.exe - C:\WINDOWS\system32\jbkyw.exe
HKLM-Run-dmvoq.exe - C:\WINDOWS\system32\dmvoq.exe
HKLM-Run-VTTimer - VTTimer.exe
MSConfigStartUp-tapisys - C:\WINDOWS\System32\tss.exe
MSConfigStartUp-Tsa2 - C:\PROGRA~1\COMMON~1\tsa\tsm2.exe
MSConfigStartUp-Yahoo! Pager - C:\Program Files\Yahoo!\Messenger\ypager.exe
MSConfigStartUp-control64 - TRPT.exe
MSConfigStartUp-driver64 - Preliminary.exe
MSConfigStartUp-SetupExeDll - br0ken.exe
MSConfigStartUp-ssweeper - vxdman.exe

.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Michael\Application Data\Mozilla\Firefox\Profiles\84sg8ccx.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com/ig?hl=en

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-13 10:26:18
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pRcu5mú*ÀaîžaaøY§C:\\Program Files\\ISTsvc\\istsvc.exe"="C:\\WINDOWS\\iysfas.exe"
.
Completion time: 2008-08-13 10:38:16
ComboFix-quarantined-files.txt 2008-08-13 15:37:59

Pre-Run: 29,790,646,272 bytes free
Post-Run: 30,897,971,200 bytes free

349 --- E O F --- 2008-08-11 14:13:03

=======

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:19:45 AM, on 8/13/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\All Users\Application Data\fapcjszy\vuxszkfw.exe
C:\WINDOWS\LTMSG.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
C:\WINDOWS\System32\hphmon05.exe
C:\WINDOWS\system32\ps2.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe
C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\HEWLET~1\PHOTOS~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\PhatNoise Media Manager\PNAgent.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\zcbcvuvw.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\WINDOWS\system32\jkdqnghy.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Common Files\Sonic\Update Manager\sgtray\sgtray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - (no file)
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [PNAgent] "C:\Program Files\PhatNoise Media Manager\PNAgent.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [WrtMon.exe] C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
O4 - HKLM\..\Run: [pRcu5m] C:\WINDOWS\iysfas.exe
O4 - HKLM\..\Run: [pRcu5mú*ÀaîžaaøY§C:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\iysfas.exe
O4 - HKLM\..\Run: [jbkyw.exe] C:\WINDOWS\system32\jbkyw.exe
O4 - HKLM\..\Run: [dmvoq.exe] C:\WINDOWS\system32\dmvoq.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [HlpWebUi] C:\WINDOWS\system32\zcbcvuvw.exe
O4 - HKCU\..\Run: [cmdsmart] C:\WINDOWS\system32\qvubkbwz.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [actdbapl] C:\WINDOWS\system32\zohivwrc.exe
O4 - HKCU\..\Run: [ApiSh] C:\WINDOWS\system32\tyjwpglm.exe
O4 - HKCU\..\Run: [msag] porka_.exe
O4 - HKLM\..\Policies\Explorer\Run: [YLbqW51HDy] C:\Documents and Settings\All Users\Application Data\fapcjszy\vuxszkfw.exe
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: LimeShop Preferences - file://C:\Program Files\Lime_Shop\Sy700\Tp700\scri700a.htm
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing)
O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - C:\Program Files\Free Download Manager\FUM\fumiebtn.dll (file missing)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?Link...04&clcid=0x409
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {99802379-7362-40E2-9D28-8A3B9AF880B7} -
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.15.38/ttinst.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0689CEC2-8D77-4684-9520-B9193268E020}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{5B7D92DE-C59E-4A96-8384-87D106A9DE5B}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{F9852F02-FE8C-49A1-86BC-15688CF57C8D}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\..\{0689CEC2-8D77-4684-9520-B9193268E020}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS2\Services\Tcpip\..\{0689CEC2-8D77-4684-9520-B9193268E020}: NameServer = 208.67.220.220,208.67.222.222
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: UiHlp - {710EDF3B-3DF0-5723-471A-0AC80455DCAC} - C:\Program Files\rcecdxf\UiHlp.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

--
End of file - 17551 bytes

Thanks,
Michael.

**TheBruce1** · 08-13-2008, 11:02 AM

Hello again

Quote:

Please DO NOT Attach logs to your posts unless you are advised to do so.

Please follow instructions, DO NOT attach your logs, just copy/paste them into your replies.

============

Download ATF-Cleaner by Atribune to your desktop. Do not run just yet, we will shortly

===========

S& D Spybot's Tea Timer

While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.

Open Spybot Search & Destroy.
In the Mode menu click "Advanced mode" if not already selected.
Choose "Yes" at the Warning prompt.
Expand the "Tools" menu.
Click "Resident".
Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
In the File menu click "Exit" to exit Spybot Search & Destroy.

============

Open notepad and copy/paste the text in the quotebox below into it:

Quote:

http://www.techsupportforum.com/security-center/hijackthis-log-help/279088-windows-security-alert-continues-after-xpantivirus-removed.html
Collect::
C:\WINDOWS\system32\krihghct.exe
C:\WINDOWS\system32\qbcjyhqd.exe
C:\WINDOWS\system32\xwvobuhg.exe
C:\WINDOWS\system32\zohivwrc.exe
C:\WINDOWS\system32\qvubkbwz.exe
C:\WINDOWS\system32\zcbcvuvw.exe
C:\WINDOWS\iysfas.exe
C:\WINDOWS\system32\jbkyw.exe
C:\WINDOWS\system32\dmvoq.exe
C:\WINDOWS\system32\tyjwpglm.exe
C:\Documents and Settings\All Users\Application Data\fapcjszy\vuxszkfw.exe
Folder::
C:\Program Files\LimeWire
C:\Documents and Settings\All Users\Application Data\Viewpoint
C:\Documents and Settings\All Users\Application Data\fapcjszy
DirLook::
C:\Program Files\rcecdxf
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HlpWebUi"=-
"cmdsmart"=-
"actdbapl"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"YLbqW51HDy"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msag"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pRcu5mú"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pRcu5mú*ÀaîžaaøY§C:\Program Files\ISTsvc\istsvc.exe"=-

Save this as CFscript

Refering to the picture above, drag CFscript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis.

Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file(s).

============

JAVA OUTDATED

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment (JRE) 6 Update 7 and save it to your desktop.
Scroll down to where it says "Java Runtime Environment (JRE) 6 Update 7. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
Click the "Download" button to the right.
Select the Windows platform from the dropdown menu.
Read the License Agreement and then check the box that says: "Accept License Agreement". Click on Continue.The page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u7-windows-i586-p.exe to install the newest version.

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH Checked
  - Applications and Applets
    Trace and Log Files
- Click OK on Delete Temporary Files Window
  Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
- Click OK to leave the Temporary Files Window
- Click OK to leave the Java Control Panel.

============

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you have Firefox installed:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you have Opera installed:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

=============

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Click Accept, when prompted to download and install the program files and database of malware definitions.

Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.
Click the Save Report As... button.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

**Note**

This animation will guide you through the process:

To optimize scanning time and produce a more sensible report for review:

Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

============

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

============
Logs Required
C:\Combofix.txt
Kaspersky Scan Report
Hijackthis Log

mimartin · 08-14-2008, 05:06 AM

Hi,

Here are the requested logs.

ComboFix 08-08-12.01 - Michael 2008-08-13 21:01:44.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.118 [GMT -5:00]
Running from: C:\Documents and Settings\Michael\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Michael\Desktop\CFscript
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\fapcjszy
C:\Documents and Settings\All Users\Application Data\fapcjszy\vuxszkfw.exe
C:\Documents and Settings\All Users\Application Data\Viewpoint
C:\Program Files\LimeWire
C:\Program Files\LimeWire\hs_err_pid5912.log
C:\WINDOWS\system32\1.tmp
C:\WINDOWS\system32\krihghct.exe
C:\WINDOWS\system32\qbcjyhqd.exe
C:\WINDOWS\system32\qvubkbwz.exe
C:\WINDOWS\system32\tyjwpglm.exe
C:\WINDOWS\system32\xwvobuhg.exe
C:\WINDOWS\system32\zcbcvuvw.exe
C:\WINDOWS\system32\zohivwrc.exe

.
((((((((((((((((((((((((( Files Created from 2008-07-14 to 2008-08-14 )))))))))))))))))))))))))))))))
.

2008-08-13 14:35 . 2008-08-13 14:35 81,920 --a------ C:\WINDOWS\system32\wdgzyfmf.exe
2008-08-13 11:17 . 2008-08-13 11:17 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-12 16:44 . 2008-08-13 20:06 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-08-12 16:44 . 2008-08-12 16:44 1,409 --a------ C:\WINDOWS\QTFont.for
2008-08-10 21:29 . 2008-08-10 21:29 <DIR> d-------- C:\Deckard
2008-08-10 20:56 . 2008-08-10 20:56 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-08-10 20:56 . 2008-08-10 20:56 <DIR> d-------- C:\WINDOWS\system32\en
2008-08-10 20:56 . 2008-08-10 20:56 <DIR> d-------- C:\WINDOWS\l2schemas
2008-08-10 20:24 . 2008-04-13 19:12 1,306,624 -----c--- C:\WINDOWS\system32\dllcache\msxml6.dll
2008-08-10 20:23 . 2008-04-13 19:11 650,752 --------- C:\WINDOWS\system32\dot3ui.dll
2008-08-10 19:38 . 2008-08-10 19:38 <DIR> d-------- C:\ie-spyad_zo
2008-08-10 19:27 . 2008-08-10 19:30 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-08-10 16:38 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys
2008-08-10 16:37 . 2008-08-10 16:37 <DIR> d-------- C:\Program Files\Panda Security
2008-08-09 22:32 . 2008-08-09 22:32 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-09 22:32 . 2008-08-09 22:32 <DIR> d-------- C:\Documents and Settings\Michael\Application Data\Malwarebytes
2008-08-09 22:32 . 2008-08-09 22:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-09 22:32 . 2008-07-30 20:14 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-09 22:32 . 2008-07-30 20:14 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-09 16:07 . 2008-08-09 16:07 0 --a------ C:\WINDOWS\system32\FCF.tmp
2008-08-08 21:10 . 2008-08-08 21:10 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Juniper Networks
2008-08-08 20:55 . 2008-08-08 20:55 <DIR> d-------- C:\Program Files\rcecdxf
2008-08-07 06:18 . 2008-08-07 06:18 <DIR> d-------- C:\Documents and Settings\Michael\.Arachnophilia
2008-08-07 06:17 . 2008-08-07 06:17 <DIR> d-------- C:\Program Files\Arachnophilia
2008-07-15 22:03 . 2008-07-15 22:03 40,304 --ah----- C:\WINDOWS\system32\mlfcache.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-13 23:57 --------- d-----w C:\Documents and Settings\Michael\Application Data\Skype
2008-08-13 21:29 --------- d-----w C:\Documents and Settings\Michael\Application Data\skypePM
2008-08-12 10:47 --------- d-----w C:\Program Files\Paint.NET
2008-08-10 13:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-10 12:39 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-08-10 04:01 --------- d-----w C:\Program Files\Lavasoft
2008-08-10 04:00 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-08-09 15:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-03 04:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\CanonIJPLM
2008-07-16 02:26 --------- d-----w C:\Program Files\Picasa2
2008-07-12 14:07 --------- d-----w C:\Documents and Settings\Michael\Application Data\ICAClient
2008-07-12 14:06 --------- d-----w C:\Documents and Settings\Michael\Application Data\Runaware
2008-06-30 15:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\BVRP Software
2008-06-30 15:34 --------- d-----w C:\Program Files\Motorola Phone Tools
2008-06-30 15:31 --------- d-----w C:\Program Files\Common Files\Motorola Shared
2008-06-30 15:30 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-30 15:30 --------- d-----w C:\Documents and Settings\User\Application Data\InstallShield
2008-06-27 20:14 --------- d-----w C:\Program Files\Common Files\Skype
2008-06-22 13:27 --------- d-----w C:\Program Files\UltraEdit
2008-06-22 13:25 1,564,236 ----a-w C:\Program Files\UltraEdit.zip
2008-06-20 11:51 361,600 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 11:40 138,496 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 11:08 225,856 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-04-25 16:56 56,912 ----a-w C:\Documents and Settings\Michael\g2mdlhlpx.exe
2008-01-15 03:59 744 ----a-w C:\Documents and Settings\Michael\pass.dat
2007-12-22 12:35 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2005-01-01 06:53 37 ----a-w C:\Documents and Settings\Owner\Application Data\tvmcwrd.dll
2005-01-01 06:52 127 ----a-w C:\Documents and Settings\Owner\Application Data\tvmdmns.dll
2004-12-31 20:46 163 ----a-w C:\Documents and Settings\Michael\Application Data\tvmdmns.dll
2004-12-31 20:03 28 ----a-w C:\Documents and Settings\Michael\Application Data\tvmcwrd.dll
2002-08-29 12:00 94,784 --sh--w C:\WINDOWS\twain.dll
2008-04-14 00:12 50,688 --sh--w C:\WINDOWS\twain_32.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

---- Directory of C:\Program Files\rcecdxf ----

2008-08-08 20:55 118784 --a------ C:\Program Files\rcecdxf\UiHlp.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BackupNotify"="c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe" [2003-06-22 23:25 24576]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-04-11 17:52 1409024]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-13 19:12 1695232]
"NVIEW"="nview.dll" [2003-08-19 04:56 852038 C:\WINDOWS\system32\nview.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-08-19 04:56 4841472]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 18:04 52736]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 09:07 114688]
"CamMonitor"="c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 09:23 90112]
"HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2003-05-23 04:55 483328]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-11-04 01:36 45056]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 23:42 212992]
"PS2"="C:\WINDOWS\system32\ps2.exe" [2002-10-16 18:57 81920]
"Sunkist2k"="C:\Program Files\Multimedia Card Reader\shwicon2k.exe" [2003-08-14 21:11 139264]
"CXMon"="C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe" [2001-09-19 11:18 45056]
"Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 10:11 57344]
"PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-10 17:26 406016]
"BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 21:26 368706]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-08 18:33 53096]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 18:30 517768]
"PNAgent"="C:\Program Files\PhatNoise Media Manager\PNAgent.exe" [2006-07-05 16:51 40960]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [2006-04-26 08:29 237568]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 02:08 483328]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"CanonSolutionMenu"="C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 20:01 644696]
"CanonMyPrinter"="C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 20:50 1603152]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 09:03 210472]
"OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 12:02 79400]
"WrtMon.exe"="C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 08:35 20480]
"pRcu5m"="C:\WINDOWS\iysfas.exe" [BU]
"jbkyw.exe"="C:\WINDOWS\system32\jbkyw.exe" [BU]
"dmvoq.exe"="C:\WINDOWS\system32\dmvoq.exe" [BU]
"nwiz"="nwiz.exe" [2003-08-19 04:56 323584 C:\WINDOWS\system32\nwiz.exe]
"LTMSG"="LTMSG.exe" [2003-07-14 19:52 40960 C:\WINDOWS\ltmsg.exe]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 14:47 57344 C:\WINDOWS\ALCXMNTR.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-25 20:23 443968]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"POSTRBT"="C:\Program Files\Norton AntiVirus\Navw32.exe" [2007-05-23 12:13 173680]

C:\Documents and Settings\Owner\Start Menu\Programs\Startup\
spamsubtract.lnk - C:\Program Files\interMute\SpamSubtract\SpamSub.exe [2003-10-14 00:24:52 557056]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe [2008-01-13 08:45:57 25214]
SBC Self Support Tool.lnk - C:\Program Files\SBC Self Support Tool\bin\matcli.exe [2005-08-26 15:51:14 217088]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"AllowLegacyWebView"= 1 (0x1)
"AllowUnhashedWebView"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"SpecifyDefaultButtons"= 0 (0x0)
"Btn_Search"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"UiHlp"= {710EDF3B-3DF0-5723-471A-0AC80455DCAC} - C:\Program Files\rcecdxf\UiHlp.dll [2008-08-08 20:55 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= Pvmjpg21.dll
"VIDC.PIM1"= pclepim1.dll
"vidc.VP31"= vp31vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\KODAK Software Updater.lnk
backup=C:\WINDOWS\pss\KODAK Software Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MindManager PDF Writer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MindManager PDF Writer.lnk
backup=C:\WINDOWS\pss\MindManager PDF Writer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Uploader Oe Integration]
--a------ 2007-06-10 19:02 40960 C:\Program Files\Free Download Manager\FUM\fumoei.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-03-30 10:36 267048 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
--a------ 2003-02-11 22:02 61440 C:\hp\KBD\kbd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
--a------ 2004-09-22 19:20 53248 C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]
--a------ 2003-12-10 04:52 380928 C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-04-13 19:12 1695232 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pamela.exe]
--a------ 2007-12-22 07:57 6742016 C:\Program Files\Pamela\Pamela.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-03-28 23:37 413696 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2008-05-30 15:54 21718312 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 02:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YBrowser]
--a------ 2003-07-11 13:51 57344 C:\Program Files\Yahoo!\browser\ybrwicon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Java\\j2re1.4.2\\bin\\javaw.exe"=
"C:\\StubInstaller.exe"=
"C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\backWeb-7288971.exe"=
"C:\\Program Files\\Neoteris\\Secure Application Manager\\dsSamProxy.exe"=
"C:\\Program Files\\Best Buy Digital Music Store Powered by Rhapsody\\rhapsody.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 17:24]
R1 NEOFLTR_530_10641;Juniper Networks TDI Filter Driver (NEOFLTR_530_10641);C:\WINDOWS\system32\Drivers\NEOFLTR_530_10641.SYS [2006-04-27 00:40]
R2 IJPLMSVC;PIXMA Extended Survey Program;C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2007-04-13 10:49]
R3 BENDER;Pinnacle AV/DV2 Capture;C:\WINDOWS\system32\drivers\bender.sys [2003-07-09 15:35]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c1e2986f-2c64-11dd-a400-000ea6631781}]
\Shell\AutoRun\command - K:\Launch.exe /run
.
Contents of the 'Scheduled Tasks' folder

2008-08-13 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]

2008-08-09 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Michael.job
- C:\PROGRA~1\NORTON~1\Navw32.exe [2007-05-23 12:13]

2008-08-04 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []

2008-02-16 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-ApiSh - C:\WINDOWS\system32\tyjwpglm.exe
HKLM-Run-pRcu5mú*ÀaîžaaøY§C:\Program Files\ISTsvc\istsvc.exe - C:\WINDOWS\iysfas.exe

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-13 21

59
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pRcu5mú*ÀaîžaaøY§C:\\Program Files\\ISTsvc\\istsvc.exe"="C:\\WINDOWS\\iysfas.exe"
.
Completion time: 2008-08-13 21:17:36
ComboFix-quarantined-files.txt 2008-08-14 02:17:29
ComboFix2.txt 2008-08-13 15:38:22

Pre-Run: 31,282,102,272 bytes free
Post-Run: 31,265,587,200 bytes free

246 --- E O F --- 2008-08-11 14:13:03

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Thursday, August 14, 2008
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Thursday, August 14, 2008 03:28:31
Records in database: 1091795
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\
H:\
I:\
J:\
L:\

Scan statistics:
Files scanned: 139182
Threat name: 90
Infected objects: 160
Suspicious objects: 0
Duration of the scan: 02:37:59

File name / Threat name / Threats count
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\01945F3A Infected: Trojan-Downloader.Win32.OneClickNetSearch.h 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\03753CEF.def Infected: Trojan-Dropper.Win32.Agent.qsm 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\04C87AE4.exe Infected: Trojan-Downloader.Win32.Agent.uj 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\057C5097 Infected: Trojan-Downloader.Win32.Petrolin.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\057F7A94 Infected: Trojan-Downloader.Win32.Petrolin.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\061D5AF6 Infected: Trojan-Downloader.Win32.Small.os 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\085E7F20 Infected: Trojan-Downloader.Win32.Dyfuca.dp 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0861291C Infected: Trojan-Downloader.Win32.IstBar.gen 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\08655318 Infected: Trojan-Downloader.Win32.IstBar.gm 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\086B2711 Infected: not-a-virus:AdWare.Win32.SideFind 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\086E510E Infected: Trojan-Downloader.Win32.TSUpdate.f 2
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\08862E17 Infected: Trojan-Downloader.Win32.IstBar.go 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\09670D15.exe Infected: Trojan.Win32.Favadd.ar 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0ACC6445.exe Infected: Trojan.Win32.DNSChanger.de 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0ACE0208 Infected: Trojan-Downloader.Win32.IstBar.gn 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0AD55601 Infected: Trojan-Downloader.Win32.IstBar.gn 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0AF923D9 Infected: Trojan-Downloader.Win32.IstBar.gn 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0B5E6CBE.tmp Infected: Trojan.Java.ClassLoader.ak 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0CC22A21 Infected: Trojan-Downloader.Win32.Dluca.ao 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0F912B88 Infected: Trojan.Win32.Starter.a 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\137C3E7A.dll Infected: not-a-virus:AdWare.Win32.SBSoft.h 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\13BD4CD5 Infected: Trojan-Downloader.Win32.Agent.ab 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\13D747F6 Infected: Trojan.Win32.Starter.a 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1995218A Infected: Trojan-Downloader.Win32.Small.os 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1A9D7AC1 Infected: not-a-virus:AdWare.Win32.DealHelper.aa 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1AC9592E Infected: Trojan.Win32.StartPage.ih 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1B611B4B.tmp Infected: Trojan-Dropper.Java.Beyond.d 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1BF51B1F.tmp Infected: Trojan-Downloader.Java.OpenConnection.v 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1C0C5A33 Infected: Trojan-Downloader.Win32.Dyfuca.cj 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1E130EC2.tmp Infected: Trojan-Downloader.Java.OpenConnection.ao 2
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1E130EC2.tmp Infected: Trojan.Java.ClassLoader.au 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1E474C33 Infected: Trojan-Dropper.Java.Beyond.d 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2082497C Infected: Trojan-Downloader.Win32.TSUpdate.f 2
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\21C7456C.tmp Infected: Trojan.Java.ClassLoader.c 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\236A4912 Infected: Trojan-Downloader.Win32.IstBar.go 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\236D730F Infected: Trojan-Downloader.Win32.IstBar.gm 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\23701D0B Infected: Trojan-Downloader.Win32.IstBar.go 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\23744708 Infected: not-a-virus:AdWare.Win32.BetterInternet 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\241D605D Infected: Trojan-Downloader.Win32.OneClickNetSearch.h 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\24C01173 Infected: Trojan-Downloader.Win32.Small.wk 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\25D40BFD Infected: Trojan-Dropper.Win32.Agent.ad 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\28692C20 Infected: Trojan-Downloader.Win32.Agent.az 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\28D93E03 Infected: Trojan-Dropper.Win32.Delf.z 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\290360CA Infected: Trojan.Win32.Delf.gh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2A4951DB Infected: Trojan-Downloader.Win32.Dyfuca.gen 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2AE42ED6 Infected: Trojan-Downloader.Win32.TSUpdate.f 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2CEC7D05 Infected: not-a-virus:AdWare.Win32.BiSpy.t 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2D514D9F.tmp Infected: Exploit.Java.Gimsh.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2E613EDA Infected: not-a-virus:AdWare.Win32.BetterInternet 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\30F707CD.exe Infected: Trojan-Dropper.Win32.Agent.ch 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\33640CDB Infected: Trojan.Java.ClassLoader.i 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\33EE45B8 Infected: Trojan-Downloader.Win32.IstBar.gen 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\347709BD.tmp Infected: Trojan.Java.ClassLoader.ak 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\35154608 Infected: not-a-virus:AdWare.Win32.DealHelper.v 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\358110D6 Infected: not-a-virus:AdWare.Win32.180Solutions 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\36112230.dll Infected: not-a-virus:AdWare.Win32.HotSearchBar.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\36D92355.exe Infected: Net-Worm.Win32.Dedler.u 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\36DF774E.exe Infected: Trojan-DDoS.Win32.Boxed.w 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\36E74259.exe Infected: not-a-virus:FraudTool.Win32.MalwareProtector.d 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\377E2E99.tmp Infected: Trojan.Java.ClassLoader.z 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\37A3417A Infected: Trojan-Downloader.Win32.TSUpdate.f 2
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\38265DE6.tmp Infected: Trojan.Java.ClassLoader.z 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\382907E3.tmp Infected: Trojan.Java.ClassLoader.z 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3839714D Infected: Trojan-Downloader.Win32.TSUpdate.h 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3B9042D2.tmp Infected: Trojan-Downloader.Win32.Small.wk 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3F8718C1 Infected: Trojan-Spy.Win32.Briss.h 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3FA55FDD Infected: not-a-virus:AdWare.Win32.DealHelper.u 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\40163A49 Infected: Trojan-Downloader.Win32.Dyfuca.gen 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\42FF7937 Infected: Trojan-Downloader.Win32.IstBar.go 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\43A62329.tmp Infected: Exploit.Java.ByteVerify 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\441E1CEB Infected: Trojan-Downloader.Win32.Dyfuca.bw 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\442146E8 Infected: Trojan.Win32.Revop.c 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\458E7825.wmf Infected: Trojan-Downloader.Win32.Agent.acd 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\45F712EC Infected: Trojan-Downloader.Win32.Small.vq 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\45FA3CE8 Infected: Trojan-Downloader.Win32.Small.vq 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\46E81FA8.exe Infected: Net-Worm.Win32.Dedler.u 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\46EB49A5.exe Infected: Trojan-DDoS.Win32.Boxed.w 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\46EE2D93 Infected: Exploit.Java.ByteVerify 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\483C497C Infected: not-a-virus:AdWare.Win32.DealHelper.t 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\48833BDD.exe Infected: not-a-virus:AdWare.Win32.Msnagent.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\488A0FD6.exe Infected: not-a-virus:AdWare.Win32.FindSpy.a 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\494F61E5.tmp Infected: not-a-virus:AdWare.Win32.Sidesearch.c 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\494F61E5.tmp Infected: Backdoor.Win32.Ruledor.e 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\494F61E5.tmp Infected: not-a-virus:AdWare.Win32.ClearSearch.f 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\499F4026 Infected: not-a-virus:AdWare.Win32.InstaFinder.a 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4A744DFB Infected: Trojan-Downloader.JS.Small.d 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4DFB58D9 Infected: Trojan-Downloader.Win32.Dyfuca.gen 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\504A7F31 Infected: Trojan-Downloader.Win32.IstBar.go 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\51264ABD.tmp Infected: Trojan-Downloader.Java.OpenConnection.v 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\53C40802.exe Infected: Trojan-Spy.Win32.AdvancedKeyLogger.c 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\53C40802.exe Infected: not-a-virus:Monitor.Win32.HandyKeylogger.a 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\53C40802.exe Infected: Trojan-Spy.Win32.AdvancedKeyLogger.a 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\53C40802.exe Infected: not-a-virus:Monitor.Win32.QuickKeyLogger.e 2
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\53C40802.exe Infected: not-a-virus:Monitor.Win32.QuickKeyLogger.a 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\53C40802.exe Infected: not-a-virus:Monitor.Win32.QuickKeyLogger.d 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5867236A Infected: Trojan-Downloader.Win32.IstBar.gen 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\58F05B52 Infected: Trojan-Downloader.Win32.Agent.az 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\59350B51 Infected: Trojan.Win32.Small.ae 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\598C14D8 Infected: Trojan-Downloader.Win32.Agent.ae 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5A214746.wmf Infected: Trojan-Downloader.Win32.Agent.acd 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5AA91F8C.tmp Infected: Trojan.Java.ClassLoader.ao 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5AB31D82.tmp Infected: Trojan.Java.ClassLoader.ao 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5AB9717A.tmp Infected: Trojan.Java.ClassLoader.ao 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5D3D2078.tmp Infected: Trojan.Java.ClassLoader.ap 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5D471E6D.tmp Infected: Trojan.Java.ClassLoader.ap 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5EBE2DAA Infected: not-a-virus:AdWare.Win32.Sahat.h 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\60406FCB Infected: Trojan-Proxy.Win32.Agent.cj 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\62214D7A.exe Infected: not-a-virus:AdWare.Win32.Beginto.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\62930F9E Infected: Trojan-Downloader.Win32.TSUpdate.g 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\648173DC Infected: Trojan-Spy.Win32.Briss.h 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\649017FB Infected: Trojan-Downloader.Win32.TSUpdate.i 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\649017FB Infected: Trojan-Downloader.Win32.TSUpdate.g 3
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\649017FB Infected: Trojan-Downloader.Win32.TSUpdate.h 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\651C50D6 Infected: not-a-virus:AdWare.Win32.BetterInternet 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\65E5380F Infected: Trojan-Dropper.Win32.Delf.z 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\664B277C Infected: not-a-virus:AdWare.Win32.BetterInternet 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\664D54DE.tmp Infected: not-a-virus:AdWare.Win32.NewWeb.ay 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\664D54DE.tmp Infected: not-a-virus:AdWare.Win32.BHO.aad 2
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\67241F06 Infected: not-a-virus:AdWare.Win32.MegaSearch.a 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\67D22818 Infected: Trojan-Dropper.Win32.Delf.z 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\69EA6116.tmp Infected: Trojan.Java.ClassLoader.ap 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6E5C203F Infected: Trojan-Downloader.Win32.Small.os 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6EA23BF6 Infected: Trojan.Java.ClassLoader.k 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6FB07D24 Infected: Trojan.Java.ClassLoader.aj 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\70AC0CD5 Infected: Trojan-Downloader.Win32.Dyfuca.dc 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\70E03579.tmp Infected: Trojan.Java.Binny.a 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\71DB637A Infected: Trojan-Downloader.Win32.IstBar.gen 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\72597048 Infected: not-a-virus:AdWare.Win32.HotSearchBar.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\725C1A45 Infected: Trojan-Downloader.NSIS.Agent.a 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\736744EB Infected: Trojan-Dropper.Java.Beyond.d 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\73843ECB Infected: Exploit.HTML.CodeBaseExec 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74F771B9.tmp Infected: Trojan-Downloader.Java.OpenConnection.v 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\75D600CF.exe Infected: not-a-virus:FraudTool.Win32.MalwareProtector.d 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\773E14D4 Infected: Trojan-Dropper.Win32.Agent.ad 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\779E734E.wmf Infected: Trojan-Downloader.Win32.Agent.acd 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\784504D7 Infected: not-a-virus:AdWare.Win32.Sahat.h 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\785C2ABE Infected: not-a-virus:AdWare.Win32.F1Organizer.h 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\785E1BDE.tmp Infected: Trojan.Java.Binny.a 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\785F54BA Infected: not-a-virus:AdWare.Win32.F1Organizer.c 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\78627EB6 Infected: Trojan-Downloader.Win32.IstBar.er 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\786628B3 Infected: Trojan-Downloader.Win32.Agent.ae 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\786952AF Infected: Trojan-Downloader.Win32.Agent.ae 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\786C7CAC Infected: Trojan-Downloader.Win32.Agent.ae 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\786F26A8 Infected: not-a-virus:AdWare.Win32.WinComm 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\787350A4 Infected: not-a-virus:AdWare.Win32.BetterInternet 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\78767AA1 Infected: not-a-virus:AdWare.Win32.WinComm 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\795F2B5A Infected: Trojan-Downloader.Win32.TSUpdate.g 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\797C3615.tmp Infected: Trojan-Downloader.Java.OpenConnection.v 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7EC9501C Infected: Trojan-Downloader.Win32.TSUpdate.g 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7FEC710A.tmp Infected: Exploit.Java.Gimsh.b 1
C:\Documents and Settings\Owner\My Documents\Michaels Files\Limewire\Shared\Microsoft_Windows_95_98_ME_2000_2k_XP_Plus_Office_Product_Keys_Cd_Key_License_Crack.txt.exe Infected: Trojan.Win32.DusBunn 1
C:\QooBox\Quarantine\C\WINDOWS\system32\1.tmp.vir Infected: not-a-virus:FraudTool.Win32.MalwareProtector.d 1

The selected area was scanned.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:33:07 AM, on 8/14/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\LTMSG.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
C:\WINDOWS\System32\hphmon05.exe
C:\WINDOWS\system32\ps2.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe
C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\HEWLET~1\PHOTOS~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\PhatNoise Media Manager\PNAgent.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Common Files\Sonic\Update Manager\sgtray\sgtray.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - (no file)
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [PNAgent] "C:\Program Files\PhatNoise Media Manager\PNAgent.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [WrtMon.exe] C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
O4 - HKLM\..\Run: [pRcu5m] C:\WINDOWS\iysfas.exe
O4 - HKLM\..\Run: [jbkyw.exe] C:\WINDOWS\system32\jbkyw.exe
O4 - HKLM\..\Run: [dmvoq.exe] C:\WINDOWS\system32\dmvoq.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: LimeShop Preferences - file://C:\Program Files\Lime_Shop\Sy700\Tp700\scri700a.htm
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing)
O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - C:\Program Files\Free Download Manager\FUM\fumiebtn.dll (file missing)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?Link...04&clcid=0x409
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.15.38/ttinst.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0689CEC2-8D77-4684-9520-B9193268E020}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{5B7D92DE-C59E-4A96-8384-87D106A9DE5B}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{F9852F02-FE8C-49A1-86BC-15688CF57C8D}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\..\{0689CEC2-8D77-4684-9520-B9193268E020}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS2\Services\Tcpip\..\{0689CEC2-8D77-4684-9520-B9193268E020}: NameServer = 208.67.220.220,208.67.222.222
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: UiHlp - {710EDF3B-3DF0-5723-471A-0AC80455DCAC} - C:\Program Files\rcecdxf\UiHlp.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

--
End of file - 16872 bytes

I really appreciate your help with this!

Thanks,
Michael.

**TheBruce1** · 08-14-2008, 06:30 AM

Please download MGADiag.exe to your desktop.

Double-click MGADiag.exe and click Continue in the bottom right of the window to run the tool.

When it's done, capture a screenshot of the finished scan, and post that.

In Windows a screenshot of the entire monitor, complete with taskbar, can be copied to the system clipboard by pressing the Print screen key (normally located in the top row on the right-hand side of the keyboard)..

You can then paste the clipboard into a program like MS Paint to save it as an image file or paste it directly into a document.

Press the Print screen key
Click the "Start" button (normally located in the bottom left of your screen).
Click "Run" & type "mspaint" (without quotes) & click the "OK" button.
Wait while the application "Paint" opens. Once it is open, proceed to the next step.
Click the "Edit" menu and select "Paste".
Click the "File" menu and select "Save As...". A dialog box will appear.
In the "File name" field, enter a name of your choice.
Click the "Save as type" drop-down and select "JPEG (*.JPG;*.JPEG;*.JPE*;.JFIF)".
Click the "Save" button.

Attach it in your next reply, please.

To attach a file to a new post, simply

Click the[Manage Attachments] button under Additional Options > Attach Files on the post composition page, browse to where you saved the file, and
Click Upload.

mimartin · 08-14-2008, 05:13 PM

Hi,

Attached is the MGADiag scan result.

Thanks,
Michael.

mimartin · 08-14-2008, 05:20 PM

Hi,

Sorry, my previous screen capture didn't include the entire monitor. Here it is with the entire monitor.

Thanks,
Michael.

**TheBruce1** · 08-15-2008, 05:23 AM

Hello again Michael

Cracked (Illegal) Software & Keygens

This is the main reason your computer is infected. Visiting cracksites/warezsites - and other questionable/illegal sites is always a risk.

Even a single click on the site can drop multiple forms of very serious malware, many of which disable your onboard protection, and System Restore.

If you install the cracked software, you are running executable files from these dubious, unknown sources. You are in effect giving these sources access to information on your hard disk, and potential control over the operation of your computer.

Additionally, cracked programs are illegal. Before posting for help, uninstall any such applications.

Referring to the Forum Rules which you should have read at the time of Registering at this forum, TSF does not support illegal activity. As such, be advised that any request for assistance in removing malware may go unanswered, or may be discontinued, if the cracked (illegal) software is still present on the machine

In accordance with the rules I have every right to stop help from this point, but I do believe that education about the effects that P2P/cracks/keygens have in supporting the role of malware, these outlets are the main cause of malware that we see everyday in logs. Any other illegal software that you have, even though they do not appear as trojans themselves, will come from sites that support and promote malware which unknowingly to you, can provide backdoors to your machine and install other malicious items.

========

There are files in Norton Quarantine folder, you can delete/remove these by following instructions Here.

=========

Open notepad and copy/paste the text in the quotebox below into it:

Quote:

http://www.techsupportforum.com/security-center/hijackthis-log-help/279088-windows-security-alert-continues-after-xpantivirus-removed.html
Collect::
C:\WINDOWS\system32\wdgzyfmf.exe
C:\Program Files\rcecdxf\UiHlp.dll
Folder::
C:\Documents and Settings\Owner\My Documents\Michaels Files\Limewire
C:\Program Files\rcecdxf
C:\Program Files\Java\jre1.6.0_03
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pRcu5m"=-
"jbkyw.exe"=-
"dmvoq.exe"=
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"UiHlp"=-

Save this as CFscript

Refering to the picture above, drag CFscript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis.

=========

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

==========
Logs Required
C:\Combofix.txt
Hijackthis Log

mimartin · 08-15-2008, 09:07 AM

Hi,

Thanks for your continued support with this issue. I haven't seen the "Windows Security Alert" in a couple of days now. Also the XPAntivirus and Joke.Blusod are not showing up as well.

I'm not aware of any illegal programs (cracked or otherwise) on this computer. It is a family computer so it is possible that someone else installed something. I looked at the combofix log and saw the files in limewire directory. I went there and didn't see those files or any others like that after the scan. But if you can see something else that isn't legit, please let me know and I will remove.

I cleared the Norton quarantine folder.

I ran combofix using the CFScript text you provided. Combofix said a newer version was available when it started so I accepted to update it. It then ran. It did reboot before ending.

I then ran HJT

Here are the logs.

***********************

ComboFix 08-08-14.03 - Michael 2008-08-15 10:00:38.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.224 [GMT -5:00]
Running from: C:\Documents and Settings\Michael\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Michael\Desktop\CFScript
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@2o7[1].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@a.hasbro[1].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@ad.yieldmanager[1].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@ads.pointroll[2].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@bellaonline[1].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@belointeractive[1].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@boxofficemojo[2].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@casalemedia[1].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@catalog.target[2].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@cuc.famousfootwear[1].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@ebaumsworld[1].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@ebay[1].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@edge.ru4[2].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@ejbdotcom[1].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@expedia[2].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@famousfootwear[2].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@insightexpressai[2].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@livescience[1].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@mapquest[2].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@metacafe[2].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@metrics.adobe[2].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@my.clearchannelradio[1].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@myspace[1].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@nextag[2].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@partner2profit[1].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@photobucket[2].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@questionmarket[1].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@revsci[2].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@rtm[4].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@sanangelostandardtimes[2].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@shopzilla[2].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@specificclick[2].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@statcounter[1].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@trafficmp[1].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@tribalfusion[2].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@turn[2].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@tvguide[1].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@walmart[1].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@weather[1].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@weather[2].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@weather[3].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@www.potpourrigift[1].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@yahoo[2].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@yellowpages[1].txt
C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@youtube[2].txt
C:\Documents and Settings\Owner\My Documents\Michaels Files\Limewire
C:\Documents and Settings\Owner\My Documents\Michaels Files\Limewire\Incomplete\downloads.bak
C:\Documents and Settings\Owner\My Documents\Michaels Files\Limewire\Incomplete\downloads.dat
C:\Documents and Settings\Owner\My Documents\Michaels Files\Limewire\Incomplete\T-218-Plus! Digital Media Edition (DME) Key.txt
C:\Documents and Settings\Owner\My Documents\Michaels Files\Limewire\Shared\DVD XCopy Xpress Platinum v3.20+Crack.exe
C:\Documents and Settings\Owner\My Documents\Michaels Files\Limewire\Shared\Microsoft_Windows_95_98_ME_2000_2k_XP_Plus_Office_Product_Keys_Cd_Key_License_Crack.txt.exe
C:\Documents and Settings\Owner\My Documents\Michaels Files\Limewire\Shared\Plus_DME_Crack_A0015556.exe
C:\Documents and Settings\User\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\user@my.clearchannelradio[2].txt
C:\Program Files\Java\jre1.6.0_03
C:\Program Files\Java\jre1.6.0_03\bin\awt.dll
C:\Program Files\Java\jre1.6.0_03\bin\axbridge.dll
C:\Program Files\Java\jre1.6.0_03\bin\client\classes.jsa
C:\Program Files\Java\jre1.6.0_03\bin\client\jvm.dll
C:\Program Files\Java\jre1.6.0_03\bin\client\Xusage.txt
C:\Program Files\Java\jre1.6.0_03\bin\cmm.dll
C:\Program Files\Java\jre1.6.0_03\bin\dcpr.dll
C:\Program Files\Java\jre1.6.0_03\bin\deploy.dll
C:\Program Files\Java\jre1.6.0_03\bin\dt_shmem.dll
C:\Program Files\Java\jre1.6.0_03\bin\dt_socket.dll
C:\Program Files\Java\jre1.6.0_03\bin\fontmanager.dll
C:\Program Files\Java\jre1.6.0_03\bin\hpi.dll
C:\Program Files\Java\jre1.6.0_03\bin\hprof.dll
C:\Program Files\Java\jre1.6.0_03\bin\instrument.dll
C:\Program Files\Java\jre1.6.0_03\bin\ioser12.dll
C:\Program Files\Java\jre1.6.0_03\bin\j2pcsc.dll
C:\Program Files\Java\jre1.6.0_03\bin\j2pkcs11.dll
C:\Program Files\Java\jre1.6.0_03\bin\jaas_nt.dll
C:\Program Files\Java\jre1.6.0_03\bin\java-rmi.exe
C:\Program Files\Java\jre1.6.0_03\bin\java.dll
C:\Program Files\Java\jre1.6.0_03\bin\java.exe
C:\Program Files\Java\jre1.6.0_03\bin\java_crw_demo.dll
C:\Program Files\Java\jre1.6.0_03\bin\javacpl.cpl
C:\Program Files\Java\jre1.6.0_03\bin\javacpl.exe
C:\Program Files\Java\jre1.6.0_03\bin\javaw.exe
C:\Program Files\Java\jre1.6.0_03\bin\javaws.exe
C:\Program Files\Java\jre1.6.0_03\bin\jawt.dll
C:\Program Files\Java\jre1.6.0_03\bin\JdbcOdbc.dll
C:\Program Files\Java\jre1.6.0_03\bin\jdwp.dll
C:\Program Files\Java\jre1.6.0_03\bin\jli.dll
C:\Program Files\Java\jre1.6.0_03\bin\jpeg.dll
C:\Program Files\Java\jre1.6.0_03\bin\jpicom.dll
C:\Program Files\Java\jre1.6.0_03\bin\jpiexp.dll
C:\Program Files\Java\jre1.6.0_03\bin\jpinscp.dll
C:\Program Files\Java\jre1.6.0_03\bin\jpioji.dll
C:\Program Files\Java\jre1.6.0_03\bin\jpishare.dll
C:\Program Files\Java\jre1.6.0_03\bin\jsound.dll
C:\Program Files\Java\jre1.6.0_03\bin\jsoundds.dll
C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
C:\Program Files\Java\jre1.6.0_03\bin\jureg.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Java\jre1.6.0_03\bin\keytool.exe
C:\Program Files\Java\jre1.6.0_03\bin\kinit.exe
C:\Program Files\Java\jre1.6.0_03\bin\klist.exe
C:\Program Files\Java\jre1.6.0_03\bin\ktab.exe
C:\Program Files\Java\jre1.6.0_03\bin\management.dll
C:\Program Files\Java\jre1.6.0_03\bin\msvcr71.dll
C:\Program Files\Java\jre1.6.0_03\bin\net.dll
C:\Program Files\Java\jre1.6.0_03\bin\nio.dll
C:\Program Files\Java\jre1.6.0_03\bin\npjava11.dll
C:\Program Files\Java\jre1.6.0_03\bin\npjava12.dll
C:\Program Files\Java\jre1.6.0_03\bin\npjava13.dll
C:\Program Files\Java\jre1.6.0_03\bin\npjava14.dll
C:\Program Files\Java\jre1.6.0_03\bin\npjava32.dll
C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll
C:\Program Files\Java\jre1.6.0_03\bin\npoji610.dll
C:\Program Files\Java\jre1.6.0_03\bin\npt.dll
C:\Program Files\Java\jre1.6.0_03\bin\orbd.exe
C:\Program Files\Java\jre1.6.0_03\bin\pack200.exe
C:\Program Files\Java\jre1.6.0_03\bin\policytool.exe
C:\Program Files\Java\jre1.6.0_03\bin\regutils.dll
C:\Program Files\Java\jre1.6.0_03\bin\rmi.dll
C:\Program Files\Java\jre1.6.0_03\bin\rmid.exe
C:\Program Files\Java\jre1.6.0_03\bin\rmiregistry.exe
C:\Program Files\Java\jre1.6.0_03\bin\servertool.exe
C:\Program Files\Java\jre1.6.0_03\bin\splashscreen.dll
C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
C:\Program Files\Java\jre1.6.0_03\bin\sunmscapi.dll
C:\Program Files\Java\jre1.6.0_03\bin\tnameserv.exe
C:\Program Files\Java\jre1.6.0_03\bin\unpack.dll
C:\Program Files\Java\jre1.6.0_03\bin\unpack200.exe
C:\Program Files\Java\jre1.6.0_03\bin\verify.dll
C:\Program Files\Java\jre1.6.0_03\bin\w2k_lsa_auth.dll
C:\Program Files\Java\jre1.6.0_03\bin\wsdetect.dll
C:\Program Files\Java\jre1.6.0_03\bin\zip.dll
C:\Program Files\Java\jre1.6.0_03\COPYRIGHT
C:\Program Files\Java\jre1.6.0_03\lib\applet\WMPNS.jar
C:\Program Files\Java\jre1.6.0_03\lib\calendars.properties
C:\Program Files\Java\jre1.6.0_03\lib\classlist
C:\Program Files\Java\jre1.6.0_03\lib\cmm\CIEXYZ.pf
C:\Program Files\Java\jre1.6.0_03\lib\cmm\GRAY.pf
C:\Program Files\Java\jre1.6.0_03\lib\cmm\LINEAR_RGB.pf
C:\Program Files\Java\jre1.6.0_03\lib\cmm\sRGB.pf
C:\Program Files\Java\jre1.6.0_03\lib\content-types.properties
C:\Program Files\Java\jre1.6.0_03\lib\deploy.jar
C:\Program Files\Java\jre1.6.0_03\lib\deploy\ffjcext.zip
C:\Program Files\Java\jre1.6.0_03\lib\deploy\messages.properties
C:\Program Files\Java\jre1.6.0_03\lib\deploy\messages_de.properties
C:\Program Files\Java\jre1.6.0_03\lib\deploy\messages_es.properties
C:\Program Files\Java\jre1.6.0_03\lib\deploy\messages_fr.properties
C:\Program Files\Java\jre1.6.0_03\lib\deploy\messages_it.properties
C:\Program Files\Java\jre1.6.0_03\lib\deploy\messages_ja.properties
C:\Program Files\Java\jre1.6.0_03\lib\deploy\messages_ko.properties
C:\Program Files\Java\jre1.6.0_03\lib\deploy\messages_sv.properties
C:\Program Files\Java\jre1.6.0_03\lib\deploy\messages_zh_CN.properties
C:\Program Files\Java\jre1.6.0_03\lib\deploy\messages_zh_HK.properties
C:\Program Files\Java\jre1.6.0_03\lib\deploy\messages_zh_TW.properties
C:\Program Files\Java\jre1.6.0_03\lib\deploy\splash.jpg
C:\Program Files\Java\jre1.6.0_03\lib\ext\dnsns.jar
C:\Program Files\Java\jre1.6.0_03\lib\ext\meta-index
C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip
C:\Program Files\Java\jre1.6.0_03\lib\ext\sunjce_provider.jar
C:\Program Files\Java\jre1.6.0_03\lib\ext\sunmscapi.jar
C:\Program Files\Java\jre1.6.0_03\lib\ext\sunpkcs11.jar
C:\Program Files\Java\jre1.6.0_03\lib\flavormap.properties
C:\Program Files\Java\jre1.6.0_03\lib\fontconfig.98.bfc
C:\Program Files\Java\jre1.6.0_03\lib\fontconfig.98.properties.src
C:\Program Files\Java\jre1.6.0_03\lib\fontconfig.bfc
C:\Program Files\Java\jre1.6.0_03\lib\fontconfig.properties.src
C:\Program Files\Java\jre1.6.0_03\lib\fonts\LucidaSansRegular.ttf
C:\Program Files\Java\jre1.6.0_03\lib\i386\jvm.cfg
C:\Program Files\Java\jre1.6.0_03\lib\im\indicim.jar
C:\Program Files\Java\jre1.6.0_03\lib\im\thaiim.jar
C:\Program Files\Java\jre1.6.0_03\lib\images\cursors\cursors.properties
C:\Program Files\Java\jre1.6.0_03\lib\images\cursors\invalid32x32.gif
C:\Program Files\Java\jre1.6.0_03\lib\images\cursors\win32_CopyDrop32x32.gif
C:\Program Files\Java\jre1.6.0_03\lib\images\cursors\win32_CopyNoDrop32x32.gif
C:\Program Files\Java\jre1.6.0_03\lib\images\cursors\win32_LinkDrop32x32.gif
C:\Program Files\Java\jre1.6.0_03\lib\images\cursors\win32_LinkNoDrop32x32.gif
C:\Program Files\Java\jre1.6.0_03\lib\images\cursors\win32_MoveDrop32x32.gif
C:\Program Files\Java\jre1.6.0_03\lib\images\cursors\win32_MoveNoDrop32x32.gif
C:\Program Files\Java\jre1.6.0_03\lib\javaws.jar
C:\Program Files\Java\jre1.6.0_03\lib\jce.jar
C:\Program Files\Java\jre1.6.0_03\lib\jsse.jar
C:\Program Files\Java\jre1.6.0_03\lib\jvm.hprof.txt
C:\Program Files\Java\jre1.6.0_03\lib\logging.properties
C:\Program Files\Java\jre1.6.0_03\lib\management-agent.jar
C:\Program Files\Java\jre1.6.0_03\lib\management\jmxremote.access
C:\Program Files\Java\jre1.6.0_03\lib\management\jmxremote.password.template
C:\Program Files\Java\jre1.6.0_03\lib\management\management.properties
C:\Program Files\Java\jre1.6.0_03\lib\management\snmp.acl.template
C:\Program Files\Java\jre1.6.0_03\lib\meta-index
C:\Program Files\Java\jre1.6.0_03\lib\net.properties
C:\Program Files\Java\jre1.6.0_03\lib\plugin.jar
C:\Program Files\Java\jre1.6.0_03\lib\psfont.properties.ja
C:\Program Files\Java\jre1.6.0_03\lib\psfontj2d.properties
C:\Program Files\Java\jre1.6.0_03\lib\resources.jar
C:\Program Files\Java\jre1.6.0_03\lib\rt.jar
C:\Program Files\Java\jre1.6.0_03\lib\security\cacerts
C:\Program Files\Java\jre1.6.0_03\lib\security\java.policy
C:\Program Files\Java\jre1.6.0_03\lib\security\java.security
C:\Program Files\Java\jre1.6.0_03\lib\security\javaws.policy
C:\Program Files\Java\jre1.6.0_03\lib\security\local_policy.jar
C:\Program Files\Java\jre1.6.0_03\lib\security\US_export_policy.jar
C:\Program Files\Java\jre1.6.0_03\lib\sound.properties
C:\Program Files\Java\jre1.6.0_03\lib\tzmappings
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Abidjan
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Accra
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Addis_Ababa
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Algiers
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Asmara
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Bamako
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Bangui
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Banjul
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Bissau
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Blantyre
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Brazzaville
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Bujumbura
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Cairo
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Casablanca
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Ceuta
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Conakry
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Dakar
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Dar_es_Salaam
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Djibouti
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Douala
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\El_Aaiun
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Freetown
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Gaborone
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Harare
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Johannesburg
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Kampala
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Khartoum
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Kigali
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Kinshasa
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Lagos
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Libreville
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Lome
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Luanda
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Lubumbashi
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Lusaka
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Malabo
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Maputo
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Maseru
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Mbabane
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Mogadishu
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Monrovia
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Nairobi
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Ndjamena
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Niamey
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Nouakchott
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Ouagadougou
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Porto-Novo
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Sao_Tome
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Tripoli
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Tunis
C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Windhoek
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Adak
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Anchorage
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Anguilla
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Antigua
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Araguaina
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Argentina\Buenos_Aires
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Argentina\Catamarca
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Argentina\Cordoba
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Argentina\Jujuy
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Argentina\La_Rioja
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Argentina\Mendoza
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Argentina\Rio_Gallegos
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Argentina\San_Juan
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Argentina\Tucuman
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Argentina\Ushuaia
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Aruba
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Asuncion
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Atikokan
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Bahia
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Barbados
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Belem
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Belize
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Blanc-Sablon
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Boa_Vista
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Bogota
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Boise
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Cambridge_Bay
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Campo_Grande
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Cancun
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Caracas
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Cayenne
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Cayman
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Chicago
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Chihuahua
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Costa_Rica
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Cuiaba
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Curacao
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Danmarkshavn
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Dawson
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Dawson_Creek
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Denver
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Detroit
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Dominica
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Edmonton
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Eirunepe
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\El_Salvador
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Fortaleza
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Glace_Bay
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Godthab
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Goose_Bay
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Grand_Turk
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Grenada
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Guadeloupe
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Guatemala
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Guayaquil
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Guyana
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Halifax
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Havana
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Hermosillo
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Indiana\Indianapolis
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Indiana\Knox
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Indiana\Marengo
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Indiana\Petersburg
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Indiana\Tell_City
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Indiana\Vevay
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Indiana\Vincennes
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Indiana\Winamac
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Inuvik
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Iqaluit
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Jamaica
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Juneau
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Kentucky\Louisville
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Kentucky\Monticello
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\La_Paz
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Lima
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Los_Angeles
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Maceio
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Managua
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Manaus
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Martinique
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Mazatlan
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Menominee
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Merida
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Mexico_City
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Miquelon
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Moncton
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Monterrey
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Montevideo
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Montreal
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Montserrat
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Nassau
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\New_York
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Nipigon
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Nome
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Noronha
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\North_Dakota\Center
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\North_Dakota\New_Salem
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Panama
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Pangnirtung
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Paramaribo
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Phoenix
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Port-au-Prince
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Port_of_Spain
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Porto_Velho
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Puerto_Rico
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Rainy_River
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Rankin_Inlet
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Recife
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Regina
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Resolute
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Rio_Branco
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Santiago
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Santo_Domingo
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Sao_Paulo
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Scoresbysund
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\St_Johns
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\St_Kitts
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\St_Lucia
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\St_Thomas
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\St_Vincent
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Swift_Current
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Tegucigalpa
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Thule
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Thunder_Bay
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Tijuana
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Toronto
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Tortola
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Vancouver
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Whitehorse
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Winnipeg
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Yakutat
C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Yellowknife
C:\Program Files\Java\jre1.6.0_03\lib\zi\Antarctica\Casey
C:\Program Files\Java\jre1.6.0_03\lib\zi\Antarctica\Davis
C:\Program Files\Java\jre1.6.0_03\lib\zi\Antarctica\DumontDUrville
C:\Program Files\Java\jre1.6.0_03\lib\zi\Antarctica\Mawson
C:\Program Files\Java\jre1.6.0_03\lib\zi\Antarctica\McMurdo
C:\Program Files\Java\jre1.6.0_03\lib\zi\Antarctica\Palmer
C:\Program Files\Java\jre1.6.0_03\lib\zi\Antarctica\Rothera
C:\Program Files\Java\jre1.6.0_03\lib\zi\Antarctica\Syowa
C:\Program Files\Java\jre1.6.0_03\lib\zi\Antarctica\Vostok
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Aden
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Almaty
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Amman
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Anadyr
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Aqtau
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Aqtobe
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Ashgabat
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Baghdad
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Bahrain
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Baku
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Bangkok
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Beirut
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Bishkek
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Brunei
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Calcutta
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Choibalsan
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Chongqing
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Colombo
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Damascus
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Dhaka
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Dili
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Dubai
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Dushanbe
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Gaza
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Harbin
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Hong_Kong
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Hovd
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Irkutsk
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Jakarta
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Jayapura
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Jerusalem
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Kabul
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Kamchatka
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Karachi
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Kashgar
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Katmandu
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Krasnoyarsk
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Kuala_Lumpur
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Kuching
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Kuwait
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Macau
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Magadan
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Makassar
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Manila
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Muscat
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Nicosia
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Novosibirsk
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Omsk
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Oral
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Phnom_Penh
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Pontianak
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Pyongyang
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Qatar
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Qyzylorda
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Rangoon
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Riyadh
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Riyadh87
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Riyadh88
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Riyadh89
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Saigon
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Sakhalin
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Samarkand
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Seoul
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Shanghai
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Singapore
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Taipei
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Tashkent
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Tbilisi
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Tehran
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Thimphu
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Tokyo
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Ulaanbaatar
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Urumqi
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Vientiane
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Vladivostok
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Yakutsk
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Yekaterinburg
C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Yerevan
C:\Program Files\Java\jre1.6.0_03\lib\zi\Atlantic\Azores
C:\Program Files\Java\jre1.6.0_03\lib\zi\Atlantic\Bermuda
C:\Program Files\Java\jre1.6.0_03\lib\zi\Atlantic\Canary
C:\Program Files\Java\jre1.6.0_03\lib\zi\Atlantic\Cape_Verde
C:\Program Files\Java\jre1.6.0_03\lib\zi\Atlantic\Faroe
C:\Program Files\Java\jre1.6.0_03\lib\zi\Atlantic\Madeira
C:\Program Files\Java\jre1.6.0_03\lib\zi\Atlantic\Reykjavik
C:\Program Files\Java\jre1.6.0_03\lib\zi\Atlantic\South_Georgia
C:\Program Files\Java\jre1.6.0_03\lib\zi\Atlantic\St_Helena
C:\Program Files\Java\jre1.6.0_03\lib\zi\Atlantic\Stanley
C:\Program Files\Java\jre1.6.0_03\lib\zi\Australia\Adelaide
C:\Program Files\Java\jre1.6.0_03\lib\zi\Australia\Brisbane
C:\Program Files\Java\jre1.6.0_03\lib\zi\Australia\Broken_Hill
C:\Program Files\Java\jre1.6.0_03\lib\zi\Australia\Currie
C:\Program Files\Java\jre1.6.0_03\lib\zi\Australia\Darwin
C:\Program Files\Java\jre1.6.0_03\lib\zi\Australia\Eucla
C:\Program Files\Java\jre1.6.0_03\lib\zi\Australia\Hobart
C:\Program Files\Java\jre1.6.0_03\lib\zi\Australia\Lindeman
C:\Program Files\Java\jre1.6.0_03\lib\zi\Australia\Lord_Howe
C:\Program Files\Java\jre1.6.0_03\lib\zi\Australia\Melbourne
C:\Program Files\Java\jre1.6.0_03\lib\zi\Australia\Perth
C:\Program Files\Java\jre1.6.0_03\lib\zi\Australia\Sydney
C:\Program Files\Java\jre1.6.0_03\lib\zi\CET
C:\Program Files\Java\jre1.6.0_03\lib\zi\CST6CDT
C:\Program Files\Java\jre1.6.0_03\lib\zi\EET
C:\Program Files\Java\jre1.6.0_03\lib\zi\EST
C:\Program Files\Java\jre1.6.0_03\lib\zi\EST5EDT
C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT-1
C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT-10
C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT-11
C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT-12
C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT-13
C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT-14
C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT-2
C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT-3
C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT-4
C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT-5
C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT-6
C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT-7
C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT-8
C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT-9
C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT
C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\UCT
C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\UTC
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Amsterdam
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Andorra
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Athens
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Belgrade
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Berlin
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Brussels
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Bucharest
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Budapest
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Chisinau
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Copenhagen
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Dublin
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Gibraltar
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Helsinki
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Istanbul
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Kaliningrad
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Kiev
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Lisbon
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\London
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Luxembourg
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Madrid
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Malta
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Minsk
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Monaco
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Moscow
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Oslo
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Paris
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Prague
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Riga
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Rome
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Samara
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Simferopol
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Sofia
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Stockholm
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Tallinn
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Tirane
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Uzhgorod
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Vaduz
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Vienna
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Vilnius
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Volgograd
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Warsaw
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Zaporozhye
C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Zurich
C:\Program Files\Java\jre1.6.0_03\lib\zi\GMT
C:\Program Files\Java\jre1.6.0_03\lib\zi\HST
C:\Program Files\Java\jre1.6.0_03\lib\zi\Indian\Antananarivo
C:\Program Files\Java\jre1.6.0_03\lib\zi\Indian\Chagos
C:\Program Files\Java\jre1.6.0_03\lib\zi\Indian\Christmas
C:\Program Files\Java\jre1.6.0_03\lib\zi\Indian\Cocos
C:\Program Files\Java\jre1.6.0_03\lib\zi\Indian\Comoro
C:\Program Files\Java\jre1.6.0_03\lib\zi\Indian\Kerguelen
C:\Program Files\Java\jre1.6.0_03\lib\zi\Indian\Mahe
C:\Program Files\Java\jre1.6.0_03\lib\zi\Indian\Maldives
C:\Program Files\Java\jre1.6.0_03\lib\zi\Indian\Mauritius
C:\Program Files\Java\jre1.6.0_03\lib\zi\Indian\Mayotte
C:\Program Files\Java\jre1.6.0_03\lib\zi\Indian\Reunion
C:\Program Files\Java\jre1.6.0_03\lib\zi\MET
C:\Program Files\Java\jre1.6.0_03\lib\zi\MST
C:\Program Files\Java\jre1.6.0_03\lib\zi\MST7MDT
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Apia
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Auckland
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Chatham
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Easter
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Efate
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Enderbury
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Fakaofo
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Fiji
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Funafuti
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Galapagos
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Gambier
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Guadalcanal
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Guam
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Honolulu
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Johnston
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Kiritimati
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Kosrae
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Kwajalein
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Majuro
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Marquesas
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Midway
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Nauru
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Niue
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Norfolk
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Noumea
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Pago_Pago
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Palau
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Pitcairn
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Ponape
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Port_Moresby
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Rarotonga
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Saipan
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Tahiti
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Tarawa
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Tongatapu
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Truk
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Wake
C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Wallis
C:\Program Files\Java\jre1.6.0_03\lib\zi\PST8PDT
C:\Program Files\Java\jre1.6.0_03\lib\zi\SystemV\AST4
C:\Program Files\Java\jre1.6.0_03\lib\zi\SystemV\AST4ADT
C:\Program Files\Java\jre1.6.0_03\lib\zi\SystemV\CST6
C:\Program Files\Java\jre1.6.0_03\lib\zi\SystemV\CST6CDT
C:\Program Files\Java\jre1.6.0_03\lib\zi\SystemV\EST5
C:\Program Files\Java\jre1.6.0_03\lib\zi\SystemV\EST5EDT
C:\Program Files\Java\jre1.6.0_03\lib\zi\SystemV\HST10
C:\Program Files\Java\jre1.6.0_03\lib\zi\SystemV\MST7
C:\Program Files\Java\jre1.6.0_03\lib\zi\SystemV\MST7MDT
C:\Program Files\Java\jre1.6.0_03\lib\zi\SystemV\PST8
C:\Program Files\Java\jre1.6.0_03\lib\zi\SystemV\PST8PDT
C:\Program Files\Java\jre1.6.0_03\lib\zi\SystemV\YST9
C:\Program Files\Java\jre1.6.0_03\lib\zi\SystemV\YST9YDT
C:\Program Files\Java\jre1.6.0_03\lib\zi\WET
C:\Program Files\Java\jre1.6.0_03\lib\zi\ZoneInfoMappings
C:\Program Files\Java\jre1.6.0_03\LICENSE
C:\Program Files\Java\jre1.6.0_03\PATCH.ERR
C:\Program Files\Java\jre1.6.0_03\README.txt
C:\Program Files\Java\jre1.6.0_03\THIRDPARTYLICENSEREADME.txt
C:\Program Files\Java\jre1.6.0_03\Welcome.html
C:\Program Files\rcecdxf
C:\Program Files\rcecdxf\UiHlp.dll
C:\WINDOWS\system32\wdgzyfmf.exe

.
((((((((((((((((((((((((( Files Created from 2008-07-15 to 2008-08-15 )))))))))))))))))))))))))))))))
.

2008-08-15 10:10 . 2008-08-15 10:10 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-08-15 10:10 . 2008-08-15 10:10 1,409 --a------ C:\WINDOWS\QTFont.for
2008-08-14 19:06 . 2008-08-14 19:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-08-14 17:20 . 2008-04-11 14:04 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-08-14 17:20 . 2008-05-01 09:33 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-13 11:17 . 2008-08-13 11:17 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-10 21:29 . 2008-08-10 21:29 <DIR> d-------- C:\Deckard
2008-08-10 20:56 . 2008-08-10 20:56 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-08-10 20:56 . 2008-08-10 20:56 <DIR> d-------- C:\WINDOWS\system32\en
2008-08-10 20:56 . 2008-08-10 20:56 <DIR> d-------- C:\WINDOWS\l2schemas
2008-08-10 20:24 . 2008-04-13 19:12 1,306,624 -----c--- C:\WINDOWS\system32\dllcache\msxml6.dll
2008-08-10 20:23 . 2008-04-13 19:11 650,752 --------- C:\WINDOWS\system32\dot3ui.dll
2008-08-10 19:38 . 2008-08-10 19:38 <DIR> d-------- C:\ie-spyad_zo
2008-08-10 19:27 . 2008-08-10 19:30 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-08-10 16:38 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys
2008-08-10 16:37 . 2008-08-10 16:37 <DIR> d-------- C:\Program Files\Panda Security
2008-08-09 22:32 . 2008-08-09 22:32 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-09 22:32 . 2008-08-09 22:32 <DIR> d-------- C:\Documents and Settings\Michael\Application Data\Malwarebytes
2008-08-09 22:32 . 2008-08-09 22:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-09 22:32 . 2008-07-30 20:14 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-09 22:32 . 2008-07-30 20:14 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-09 16:07 . 2008-08-09 16:07 0 --a------ C:\WINDOWS\system32\FCF.tmp
2008-08-08 21:10 . 2008-08-08 21:10 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Juniper Networks
2008-08-07 06:18 . 2008-08-07 06:18 <DIR> d-------- C:\Documents and Settings\Michael\.Arachnophilia
2008-08-07 06:17 . 2008-08-07 06:17 <DIR> d-------- C:\Program Files\Arachnophilia
2008-07-15 22:03 . 2008-07-15 22:03 40,304 --ah----- C:\WINDOWS\system32\mlfcache.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-15 15:03 --------- d-----w C:\Program Files\Java
2008-08-15 01:09 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-08-13 23:57 --------- d-----w C:\Documents and Settings\Michael\Application Data\Skype
2008-08-13 21:29 --------- d-----w C:\Documents and Settings\Michael\Application Data\skypePM
2008-08-12 10:47 --------- d-----w C:\Program Files\Paint.NET
2008-08-10 13:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-10 12:39 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-08-10 04:01 --------- d-----w C:\Program Files\Lavasoft
2008-08-09 15:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-03 04:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\CanonIJPLM
2008-07-16 02:26 --------- d-----w C:\Program Files\Picasa2
2008-07-12 14:07 --------- d-----w C:\Documents and Settings\Michael\Application Data\ICAClient
2008-07-12 14:06 --------- d-----w C:\Documents and Settings\Michael\Application Data\Runaware
2008-06-30 15:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\BVRP Software
2008-06-30 15:34 --------- d-----w C:\Program Files\Motorola Phone Tools
2008-06-30 15:31 --------- d-----w C:\Program Files\Common Files\Motorola Shared
2008-06-30 15:30 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-30 15:30 --------- d-----w C:\Documents and Settings\User\Application Data\InstallShield
2008-06-27 20:14 --------- d-----w C:\Program Files\Common Files\Skype
2008-06-22 13:27 --------- d-----w C:\Program Files\UltraEdit
2008-06-22 13:25 1,564,236 ----a-w C:\Program Files\UltraEdit.zip
2008-06-20 11:51 361,600 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 11:40 138,496 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 11:08 225,856 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-04-25 16:56 56,912 ----a-w C:\Documents and Settings\Michael\g2mdlhlpx.exe
2008-01-15 03:59 744 ----a-w C:\Documents and Settings\Michael\pass.dat
2007-12-22 12:35 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2005-01-01 06:53 37 ----a-w C:\Documents and Settings\Owner\Application Data\tvmcwrd.dll
2005-01-01 06:52 127 ----a-w C:\Documents and Settings\Owner\Application Data\tvmdmns.dll
2004-12-31 20:46 163 ----a-w C:\Documents and Settings\Michael\Application Data\tvmdmns.dll
2004-12-31 20:03 28 ----a-w C:\Documents and Settings\Michael\Application Data\tvmcwrd.dll
2002-08-29 12:00 94,784 --sh--w C:\WINDOWS\twain.dll
2008-04-14 00:12 50,688 --sh--w C:\WINDOWS\twain_32.dll
.

((((((((((((((((((((((((((((( snapshot@2008-08-13_10.37.03.40 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-15 01:09:33 59,904 ----a-r C:\WINDOWS\Installer\{7EC96FCD-0C12-46D3-988A-FB802F138BEB}\IconA3AFE979.exe
+ 2008-07-07 20:26:58 253,952 -c----w C:\WINDOWS\system32\dllcache\es.dll
+ 2008-06-24 16:43:16 74,240 -c----w C:\WINDOWS\system32\dllcache\mscms.dll
- 2008-04-21 06:44:29 3,066,880 -c----w C:\WINDOWS\system32\dllcache\mshtml.dll
+ 2008-06-23 15:09:27 3,067,392 -c----w C:\WINDOWS\system32\dllcache\mshtml.dll
+ 2008-06-26 08:15:29 1,499,136 -c----w C:\WINDOWS\system32\dllcache\shdocvw.dll
+ 2008-06-26 08:15:30 619,520 -c----w C:\WINDOWS\system32\dllcache\urlmon.dll
- 2008-04-21 06:44:29 666,112 -c----w C:\WINDOWS\system32\dllcache\wininet.dll
+ 2008-06-23 15:09:27 666,112 -c----w C:\WINDOWS\system32\dllcache\wininet.dll
- 2008-04-14 00:11:53 246,272 ----a-w C:\WINDOWS\system32\es.dll
+ 2008-07-07 20:26:58 253,952 ----a-w C:\WINDOWS\system32\es.dll
- 2008-04-14 00:11:54 691,712 ------w C:\WINDOWS\system32\inetcomm.dll
+ 2008-04-11 19:04:26 691,712 ------w C:\WINDOWS\system32\inetcomm.dll
- 2007-09-25 04:30:28 135,168 ----a-w C:\WINDOWS\system32\java.exe
+ 2008-06-10 06:21:01 135,168 ----a-w C:\WINDOWS\system32\java.exe
- 2007-09-25 04:30:30 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
+ 2008-06-10 06:21:04 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
- 2007-09-25 05:31:42 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
+ 2008-06-10 07:32:34 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
- 2008-04-14 00:11:58 73,728 ----a-w C:\WINDOWS\system32\mscms.dll
+ 2008-06-24 16:43:16 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
- 2008-04-21 06:44:29 3,066,880 ----a-w C:\WINDOWS\system32\mshtml.dll
+ 2008-06-23 15:09:27 3,067,392 ----a-w C:\WINDOWS\system32\mshtml.dll
- 2008-04-14 00:12:05 1,499,136 ----a-w C:\WINDOWS\system32\shdocvw.dll
+ 2008-06-26 08:15:29 1,499,136 ----a-w C:\WINDOWS\system32\shdocvw.dll
- 2008-04-14 00:12:38 60,416 ------w C:\WINDOWS\system32\tzchange.exe
+ 2008-07-11 12:42:28 62,976 ------w C:\WINDOWS\system32\tzchange.exe
- 2008-04-14 00:12:08 619,520 ----a-w C:\WINDOWS\system32\urlmon.dll
+ 2008-06-26 08:15:30 619,520 ----a-w C:\WINDOWS\system32\urlmon.dll
- 2008-04-21 06:44:29 666,112 ----a-w C:\WINDOWS\system32\wininet.dll
+ 2008-06-23 15:09:27 666,112 ----a-w C:\WINDOWS\system32\wininet.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BackupNotify"="c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe" [2003-06-22 23:25 24576]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-04-11 17:52 1409024]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-13 19:12 1695232]
"NVIEW"="nview.dll" [2003-08-19 04:56 852038 C:\WINDOWS\system32\nview.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-08-19 04:56 4841472]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 18:04 52736]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 09:07 114688]
"CamMonitor"="c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 09:23 90112]
"HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2003-05-23 04:55 483328]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-11-04 01:36 45056]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 23:42 212992]
"PS2"="C:\WINDOWS\system32\ps2.exe" [2002-10-16 18:57 81920]
"Sunkist2k"="C:\Program Files\Multimedia Card Reader\shwicon2k.exe" [2003-08-14 21:11 139264]
"CXMon"="C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe" [2001-09-19 11:18 45056]
"Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 10:11 57344]
"PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-10 17:26 406016]
"BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 21:26 368706]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-08 18:33 53096]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 18:30 517768]
"PNAgent"="C:\Program Files\PhatNoise Media Manager\PNAgent.exe" [2006-07-05 16:51 40960]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [2006-04-26 08:29 237568]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 02:08 483328]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"CanonSolutionMenu"="C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 20:01 644696]
"CanonMyPrinter"="C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 20:50 1603152]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 09:03 210472]
"OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 12:02 79400]
"WrtMon.exe"="C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 08:35 20480]
"dmvoq.exe"="C:\WINDOWS\system32\dmvoq.exe" [BU]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"nwiz"="nwiz.exe" [2003-08-19 04:56 323584 C:\WINDOWS\system32\nwiz.exe]
"LTMSG"="LTMSG.exe" [2003-07-14 19:52 40960 C:\WINDOWS\ltmsg.exe]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 14:47 57344 C:\WINDOWS\ALCXMNTR.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-25 20:23 443968]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"POSTRBT"="C:\Program Files\Norton AntiVirus\Navw32.exe" [2007-05-23 12:13 173680]

C:\Documents and Settings\Owner\Start Menu\Programs\Startup\
spamsubtract.lnk - C:\Program Files\interMute\SpamSubtract\SpamSub.exe [2003-10-14 00:24:52 557056]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe [2008-01-13 08:45:57 25214]
SBC Self Support Tool.lnk - C:\Program Files\SBC Self Support Tool\bin\matcli.exe [2005-08-26 15:51:14 217088]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"AllowLegacyWebView"= 1 (0x1)
"AllowUnhashedWebView"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"SpecifyDefaultButtons"= 0 (0x0)
"Btn_Search"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= Pvmjpg21.dll
"VIDC.PIM1"= pclepim1.dll
"vidc.VP31"= vp31vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\KODAK Software Updater.lnk
backup=C:\WINDOWS\pss\KODAK Software Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MindManager PDF Writer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MindManager PDF Writer.lnk
backup=C:\WINDOWS\pss\MindManager PDF Writer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Uploader Oe Integration]
--a------ 2007-06-10 19:02 40960 C:\Program Files\Free Download Manager\FUM\fumoei.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-03-30 10:36 267048 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
--a------ 2003-02-11 22:02 61440 C:\hp\KBD\kbd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
--a------ 2004-09-22 19:20 53248 C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]
--a------ 2003-12-10 04:52 380928 C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-04-13 19:12 1695232 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pamela.exe]
--a------ 2007-12-22 07:57 6742016 C:\Program Files\Pamela\Pamela.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-03-28 23:37 413696 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2008-05-30 15:54 21718312 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YBrowser]
--a------ 2003-07-11 13:51 57344 C:\Program Files\Yahoo!\browser\ybrwicon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\StubInstaller.exe"=
"C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\backWeb-7288971.exe"=
"C:\\Program Files\\Neoteris\\Secure Application Manager\\dsSamProxy.exe"=
"C:\\Program Files\\Best Buy Digital Music Store Powered by Rhapsody\\rhapsody.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 17:24]
R1 NEOFLTR_530_10641;Juniper Networks TDI Filter Driver (NEOFLTR_530_10641);C:\WINDOWS\system32\Drivers\NEOFLTR_530_10641.SYS [2006-04-27 00:40]
R2 IJPLMSVC;PIXMA Extended Survey Program;C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2007-04-13 10:49]
R3 BENDER;Pinnacle AV/DV2 Capture;C:\WINDOWS\system32\drivers\bender.sys [2003-07-09 15:35]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c1e2986f-2c64-11dd-a400-000ea6631781}]
\Shell\AutoRun\command - K:\Launch.exe /run
.
Contents of the 'Scheduled Tasks' folder

2008-08-13 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]

2008-08-09 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Michael.job
- C:\PROGRA~1\NORTON~1\Navw32.exe [2007-05-23 12:13]

2008-08-14 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []

2008-02-16 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-SunJavaUpdateSched - C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-15 10:09:06
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Symantec Shared\CCSETMGR.EXE
C:\Program Files\Common Files\Symantec Shared\CCEVTMGR.EXE
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMNTOR.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\ScsiAccess.EXE
C:\PROGRA~1\HEWLET~1\PHOTOS~1\HPSHAR~1\hpgs2wnf.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
.
**************************************************************************
.
Completion time: 2008-08-15 10:20:48 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-15 15:20:38
ComboFix2.txt 2008-08-13 15:38:22

Pre-Run: 30,958,436,352 bytes free
Post-Run: 30,979,305,472 bytes free

916 --- E O F --- 2008-08-15 03:36:23

*******************

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:28:24 AM, on 8/15/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\LTMSG.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
C:\WINDOWS\System32\hphmon05.exe
C:\WINDOWS\system32\ps2.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe
C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
C:\PROGRA~1\HEWLET~1\PHOTOS~1\HPSHAR~1\hpgs2wnf.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\PhatNoise Media Manager\PNAgent.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray\sgtray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - (no file)
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [PNAgent] "C:\Program Files\PhatNoise Media Manager\PNAgent.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [WrtMon.exe] C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
O4 - HKLM\..\Run: [dmvoq.exe] C:\WINDOWS\system32\dmvoq.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: LimeShop Preferences - file://C:\Program Files\Lime_Shop\Sy700\Tp700\scri700a.htm
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing)
O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - C:\Program Files\Free Download Manager\FUM\fumiebtn.dll (file missing)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?Link...04&clcid=0x409
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.15.38/ttinst.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0689CEC2-8D77-4684-9520-B9193268E020}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{5B7D92DE-C59E-4A96-8384-87D106A9DE5B}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{F9852F02-FE8C-49A1-86BC-15688CF57C8D}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\..\{0689CEC2-8D77-4684-9520-B9193268E020}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS2\Services\Tcpip\..\{0689CEC2-8D77-4684-9520-B9193268E020}: NameServer = 208.67.220.220,208.67.222.222
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

--
End of file - 16488 bytes

Thanks,
Michael.

**TheBruce1** · 08-15-2008, 11:03 AM

Hello again

Did you upload the files to Bleeping Computers, i cannot find those files which were supposed to be uploaded.

Quote:

Originally Posted by mimartin

I'm not aware of any illegal programs (cracked or otherwise) on this computer. It is a family computer so it is possible that someone else installed something. I looked at the combofix log and saw the files in limewire directory. I went there and didn't see those files or any others like that after the scan.

These files found in the Limwire folder and have now been deleted were crack/keygens.

C:\Documents and Settings\Owner\My Documents\Michaels Files\Limewire\Incomplete\T-218-Plus! Digital Media Edition (DME) Key.txt
C:\Documents and Settings\Owner\My Documents\Michaels Files\Limewire\Shared\DVD XCopy Xpress Platinum v3.20+Crack.exe
C:\Documents and Settings\Owner\My Documents\Michaels Files\Limewire\Shared\Microsoft_Windows_95_98_ME_2000_2k_XP_Plus_Office_Product_Keys_Cd_Key_License_Crack.txt.exe
C:\Documents and Settings\Owner\My Documents\Michaels Files\Limewire\Shared\Plus_DME_Crack_A0015556.exe

===========

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any)

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O4 - HKLM\..\Run: [dmvoq.exe] C:\WINDOWS\system32\dmvoq.exe
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.15.38/ttinst.cab

Please remember to close all other windows, including browsers then click Fix checked.

==========

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

==========
Log Required
Hijackthis Log

mimartin · 08-15-2008, 12:31 PM

Hi,

I apologize, I reread my post and realized I didn't mention that Combofix indicated that "Windows cannot find 'C:ComboFix\CF-Submit.htm'." I looked in that directory and there aren't any files in it.

Please advise if I need to rerun it to try again.

I'm going to go do you latest instructions an will post the results.

Thanks,
Michael.

mimartin · 08-15-2008, 12:43 PM

Hi,

I ran Hijack This and selected the 7 entries you noted and clicked "Fix Checked."

Here is the log:
<edited: I posted the wrong log, here is the correct one>

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:46:24 PM, on 8/15/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\LTMSG.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
C:\WINDOWS\System32\hphmon05.exe
C:\WINDOWS\system32\ps2.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe
C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\PROGRA~1\HEWLET~1\PHOTOS~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\PhatNoise Media Manager\PNAgent.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray\sgtray.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [PNAgent] "C:\Program Files\PhatNoise Media Manager\PNAgent.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [WrtMon.exe] C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: LimeShop Preferences - file://C:\Program Files\Lime_Shop\Sy700\Tp700\scri700a.htm
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing)
O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - C:\Program Files\Free Download Manager\FUM\fumiebtn.dll (file missing)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?Link...04&clcid=0x409
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0689CEC2-8D77-4684-9520-B9193268E020}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{5B7D92DE-C59E-4A96-8384-87D106A9DE5B}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{F9852F02-FE8C-49A1-86BC-15688CF57C8D}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\..\{0689CEC2-8D77-4684-9520-B9193268E020}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS2\Services\Tcpip\..\{0689CEC2-8D77-4684-9520-B9193268E020}: NameServer = 208.67.220.220,208.67.222.222
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

--
End of file - 15894 bytes

Thanks,
Michael.

**TheBruce1** · 08-15-2008, 01:06 PM

Hello again

Open notepad and copy/paste the text in the quotebox below into it:

Quote:

http://www.techsupportforum.com/security-center/hijackthis-log-help/279088-windows-security-alert-continues-after-xpantivirus-removed.html
SkipFix::
Collect::
C:\Qoobox\Quarantine

Save this as CFscript

Refering to the picture above, drag CFscript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis.

Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file(s).

==========
Log Required
C:\Combofix.txt

mimartin · 08-15-2008, 01:49 PM

Hi,

Here is the ComboFix log:

ComboFix 08-08-14.03 - Michael 2008-08-15 15:34:42.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.247 [GMT -5:00]
Running from: C:\Documents and Settings\Michael\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Michael\Desktop\CFScript
* Created a new restore point
.
- REDUCED FUNCTIONALITY MODE -
.

((((((((((((((((((((((((( Files Created from 2008-07-15 to 2008-08-15 )))))))))))))))))))))))))))))))
.

2008-08-15 10:10 . 2008-08-15 10:46 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-08-15 10:10 . 2008-08-15 10:10 1,409 --a------ C:\WINDOWS\QTFont.for
2008-08-14 19:06 . 2008-08-14 19:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-08-14 17:20 . 2008-04-11 14:04 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-08-14 17:20 . 2008-05-01 09:33 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-13 11:17 . 2008-08-13 11:17 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-10 21:29 . 2008-08-10 21:29 <DIR> d-------- C:\Deckard
2008-08-10 20:56 . 2008-08-10 20:56 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-08-10 20:56 . 2008-08-10 20:56 <DIR> d-------- C:\WINDOWS\system32\en
2008-08-10 20:56 . 2008-08-10 20:56 <DIR> d-------- C:\WINDOWS\l2schemas
2008-08-10 20:24 . 2008-04-13 19:12 1,306,624 -----c--- C:\WINDOWS\system32\dllcache\msxml6.dll
2008-08-10 20:23 . 2008-04-13 19:11 650,752 --------- C:\WINDOWS\system32\dot3ui.dll
2008-08-10 19:38 . 2008-08-10 19:38 <DIR> d-------- C:\ie-spyad_zo
2008-08-10 19:27 . 2008-08-10 19:30 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-08-10 16:38 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys
2008-08-10 16:37 . 2008-08-10 16:37 <DIR> d-------- C:\Program Files\Panda Security
2008-08-09 22:32 . 2008-08-09 22:32 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-09 22:32 . 2008-08-09 22:32 <DIR> d-------- C:\Documents and Settings\Michael\Application Data\Malwarebytes
2008-08-09 22:32 . 2008-08-09 22:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-09 22:32 . 2008-07-30 20:14 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-09 22:32 . 2008-07-30 20:14 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-09 16:07 . 2008-08-09 16:07 0 --a------ C:\WINDOWS\system32\FCF.tmp
2008-08-08 21:10 . 2008-08-08 21:10 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Juniper Networks
2008-08-07 06:18 . 2008-08-07 06:18 <DIR> d-------- C:\Documents and Settings\Michael\.Arachnophilia
2008-08-07 06:17 . 2008-08-07 06:17 <DIR> d-------- C:\Program Files\Arachnophilia
2008-07-15 22:03 . 2008-07-15 22:03 40,304 --ah----- C:\WINDOWS\system32\mlfcache.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-15 15:03 --------- d-----w C:\Program Files\Java
2008-08-15 01:09 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-08-13 23:57 --------- d-----w C:\Documents and Settings\Michael\Application Data\Skype
2008-08-13 21:29 --------- d-----w C:\Documents and Settings\Michael\Application Data\skypePM
2008-08-12 10:47 --------- d-----w C:\Program Files\Paint.NET
2008-08-10 13:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-10 12:39 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-08-10 04:01 --------- d-----w C:\Program Files\Lavasoft
2008-08-09 15:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-03 04:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\CanonIJPLM
2008-07-16 02:26 --------- d-----w C:\Program Files\Picasa2
2008-07-12 14:07 --------- d-----w C:\Documents and Settings\Michael\Application Data\ICAClient
2008-07-12 14:06 --------- d-----w C:\Documents and Settings\Michael\Application Data\Runaware
2008-06-30 15:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\BVRP Software
2008-06-30 15:34 --------- d-----w C:\Program Files\Motorola Phone Tools
2008-06-30 15:31 --------- d-----w C:\Program Files\Common Files\Motorola Shared
2008-06-30 15:30 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-30 15:30 --------- d-----w C:\Documents and Settings\User\Application Data\InstallShield
2008-06-27 20:14 --------- d-----w C:\Program Files\Common Files\Skype
2008-06-22 13:27 --------- d-----w C:\Program Files\UltraEdit
2008-06-22 13:25 1,564,236 ----a-w C:\Program Files\UltraEdit.zip
2008-06-20 11:51 361,600 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 11:40 138,496 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 11:08 225,856 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-04-25 16:56 56,912 ----a-w C:\Documents and Settings\Michael\g2mdlhlpx.exe
2008-01-15 03:59 744 ----a-w C:\Documents and Settings\Michael\pass.dat
2007-12-22 12:35 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2005-01-01 06:53 37 ----a-w C:\Documents and Settings\Owner\Application Data\tvmcwrd.dll
2005-01-01 06:52 127 ----a-w C:\Documents and Settings\Owner\Application Data\tvmdmns.dll
2004-12-31 20:46 163 ----a-w C:\Documents and Settings\Michael\Application Data\tvmdmns.dll
2004-12-31 20:03 28 ----a-w C:\Documents and Settings\Michael\Application Data\tvmcwrd.dll
2002-08-29 12:00 94,784 --sh--w C:\WINDOWS\twain.dll
2008-04-14 00:12 50,688 --sh--w C:\WINDOWS\twain_32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BackupNotify"="c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe" [2003-06-22 23:25 24576]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-04-11 17:52 1409024]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-13 19:12 1695232]
"NVIEW"="nview.dll" [2003-08-19 04:56 852038 C:\WINDOWS\system32\nview.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-08-19 04:56 4841472]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 18:04 52736]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 09:07 114688]
"CamMonitor"="c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 09:23 90112]
"HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2003-05-23 04:55 483328]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-11-04 01:36 45056]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 23:42 212992]
"PS2"="C:\WINDOWS\system32\ps2.exe" [2002-10-16 18:57 81920]
"Sunkist2k"="C:\Program Files\Multimedia Card Reader\shwicon2k.exe" [2003-08-14 21:11 139264]
"CXMon"="C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe" [2001-09-19 11:18 45056]
"Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 10:11 57344]
"PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-10 17:26 406016]
"BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 21:26 368706]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-08 18:33 53096]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 18:30 517768]
"PNAgent"="C:\Program Files\PhatNoise Media Manager\PNAgent.exe" [2006-07-05 16:51 40960]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [2006-04-26 08:29 237568]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 02:08 483328]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"CanonSolutionMenu"="C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 20:01 644696]
"CanonMyPrinter"="C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 20:50 1603152]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 09:03 210472]
"OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 12:02 79400]
"WrtMon.exe"="C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 08:35 20480]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"nwiz"="nwiz.exe" [2003-08-19 04:56 323584 C:\WINDOWS\system32\nwiz.exe]
"LTMSG"="LTMSG.exe" [2003-07-14 19:52 40960 C:\WINDOWS\ltmsg.exe]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 14:47 57344 C:\WINDOWS\ALCXMNTR.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-25 20:23 443968]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"POSTRBT"="C:\Program Files\Norton AntiVirus\Navw32.exe" [2007-05-23 12:13 173680]

C:\Documents and Settings\Owner\Start Menu\Programs\Startup\
spamsubtract.lnk - C:\Program Files\interMute\SpamSubtract\SpamSub.exe [2003-10-14 00:24:52 557056]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe [2008-01-13 08:45:57 25214]
SBC Self Support Tool.lnk - C:\Program Files\SBC Self Support Tool\bin\matcli.exe [2005-08-26 15:51:14 217088]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"AllowLegacyWebView"= 1 (0x1)
"AllowUnhashedWebView"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"SpecifyDefaultButtons"= 0 (0x0)
"Btn_Search"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= Pvmjpg21.dll
"VIDC.PIM1"= pclepim1.dll
"vidc.VP31"= vp31vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\KODAK Software Updater.lnk
backup=C:\WINDOWS\pss\KODAK Software Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MindManager PDF Writer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MindManager PDF Writer.lnk
backup=C:\WINDOWS\pss\MindManager PDF Writer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Uploader Oe Integration]
--a------ 2007-06-10 19:02 40960 C:\Program Files\Free Download Manager\FUM\fumoei.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-03-30 10:36 267048 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
--a------ 2003-02-11 22:02 61440 C:\hp\KBD\kbd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
--a------ 2004-09-22 19:20 53248 C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]
--a------ 2003-12-10 04:52 380928 C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-04-13 19:12 1695232 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pamela.exe]
--a------ 2007-12-22 07:57 6742016 C:\Program Files\Pamela\Pamela.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-03-28 23:37 413696 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2008-05-30 15:54 21718312 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YBrowser]
--a------ 2003-07-11 13:51 57344 C:\Program Files\Yahoo!\browser\ybrwicon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\StubInstaller.exe"=
"C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\backWeb-7288971.exe"=
"C:\\Program Files\\Neoteris\\Secure Application Manager\\dsSamProxy.exe"=
"C:\\Program Files\\Best Buy Digital Music Store Powered by Rhapsody\\rhapsody.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 17:24]
R1 NEOFLTR_530_10641;Juniper Networks TDI Filter Driver (NEOFLTR_530_10641);C:\WINDOWS\system32\Drivers\NEOFLTR_530_10641.SYS [2006-04-27 00:40]
R2 IJPLMSVC;PIXMA Extended Survey Program;C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2007-04-13 10:49]
R3 BENDER;Pinnacle AV/DV2 Capture;C:\WINDOWS\system32\drivers\bender.sys [2003-07-09 15:35]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c1e2986f-2c64-11dd-a400-000ea6631781}]
\Shell\AutoRun\command - K:\Launch.exe /run
.
Contents of the 'Scheduled Tasks' folder

2008-08-13 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]

2008-08-09 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Michael.job
- C:\PROGRA~1\NORTON~1\Navw32.exe [2007-05-23 12:13]

2008-08-14 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []

2008-02-16 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-15 15:35:28
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-15 15:45:22
ComboFix-quarantined-files.txt 2008-08-15 20:45:18
ComboFix2.txt 2008-08-13 15:38:22

Pre-Run: 31,308,914,688 bytes free
Post-Run: 31,293,382,656 bytes free

218 --- E O F --- 2008-08-15 03:36:23

Thanks,
Michael.

**TheBruce1** · 08-15-2008, 02:05 PM

Did you submit the file?

What is the time stamp on the zip file.

mimartin · 08-15-2008, 02:21 PM

Hi,

The only thing that came up was the log file that I copied and posted.

There wasn't any other windows after it ran and I didn't get any prompts to send anything.

Internet connection is up as I've been online all day.

Is the file saved somewhere so I could manually send it?

Thanks,
Michael.

**TheBruce1** · 08-15-2008, 02:34 PM

Upload this file:

C:\Qoobox\Quarantine

To this website:
http://www.bleepingcomputer.com/submit-malware.php?channel=4

Include this link into your submission:
http://www.techsupportforum.com/security-center/hijackthis-log-help/279088-windows-security-alert-continues-after-xpantivirus-removed.html

When done let me know, i will not be back until around 6pm(GMT) tomorrow.

mimartin · 08-15-2008, 03:28 PM

Hi,

I zipped C:\Qoobox\Quarantine and tried to send it as directed at bleepingcomputer. The website responded that an unknown error occured. I contacted bleepingcomputer to inform them.

I will try again later today.

Thanks,
Michael.

mimartin · 08-15-2008, 07:43 PM

Hi,

Tried again. Same failure.

Any other suggestions on how to get that info?

Thanks,
Michael.

08-13-2008, 06:22 AM	#2 (permalink)
TheBruce1 Moderator, Analyst, Security Team Join Date: Oct 2006 Location: Dùn Èideann,Scotland. Posts: 4,531 OS: XP	Re: "Windows Security Alert" continues after XPAntivirus removed Hello and welcome to TSF Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. ======== Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear, a lack of symptoms does not mean that it is no longer present. Please DO NOT Attach logs to your posts unless you are advised to do so. ========= P2P P2P - I see you have P2P software LimeWire 4.18.3 installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares and their infections. References for the risk of these programs are Here, Here and Here. ========= Please visit this webpage for instructions for downloading and running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery mode. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. Once the Recovery Console is installed using ComboFix, you should see a message that says: The Recovery Console was successfully installed. Please continue as follows: Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Click Yes to allow ComboFix to continue scanning for malware. When the tool is finished, it will produce a report for you. ========== Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ========== Logs Required C:\Combofix.txt Hijackthis Log __________________ Member of ASAP since 2007 Member of UNITE since 2008 Notice to BT customers BT to dump Phorm, see Here for more information. No DPI If we have helped you in anyway, please consider Donating

08-14-2008, 05:06 AM	#5 (permalink)
mimartin Registered User Join Date: Aug 2008 Posts: 17 OS: xp, service pack 3	Re: "Windows Security Alert" continues after XPAntivirus removed Hi, Here are the requested logs. ComboFix 08-08-12.01 - Michael 2008-08-13 21:01:44.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.118 [GMT -5:00] Running from: C:\Documents and Settings\Michael\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Michael\Desktop\CFscript * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\fapcjszy C:\Documents and Settings\All Users\Application Data\fapcjszy\vuxszkfw.exe C:\Documents and Settings\All Users\Application Data\Viewpoint C:\Program Files\LimeWire C:\Program Files\LimeWire\hs_err_pid5912.log C:\WINDOWS\system32\1.tmp C:\WINDOWS\system32\krihghct.exe C:\WINDOWS\system32\qbcjyhqd.exe C:\WINDOWS\system32\qvubkbwz.exe C:\WINDOWS\system32\tyjwpglm.exe C:\WINDOWS\system32\xwvobuhg.exe C:\WINDOWS\system32\zcbcvuvw.exe C:\WINDOWS\system32\zohivwrc.exe . ((((((((((((((((((((((((( Files Created from 2008-07-14 to 2008-08-14 ))))))))))))))))))))))))))))))) . 2008-08-13 14:35 . 2008-08-13 14:35 81,920 --a------ C:\WINDOWS\system32\wdgzyfmf.exe 2008-08-13 11:17 . 2008-08-13 11:17 <DIR> d-------- C:\Program Files\Trend Micro 2008-08-12 16:44 . 2008-08-13 20:06 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-08-12 16:44 . 2008-08-12 16:44 1,409 --a------ C:\WINDOWS\QTFont.for 2008-08-10 21:29 . 2008-08-10 21:29 <DIR> d-------- C:\Deckard 2008-08-10 20:56 . 2008-08-10 20:56 <DIR> d-------- C:\WINDOWS\system32\scripting 2008-08-10 20:56 . 2008-08-10 20:56 <DIR> d-------- C:\WINDOWS\system32\en 2008-08-10 20:56 . 2008-08-10 20:56 <DIR> d-------- C:\WINDOWS\l2schemas 2008-08-10 20:24 . 2008-04-13 19:12 1,306,624 -----c--- C:\WINDOWS\system32\dllcache\msxml6.dll 2008-08-10 20:23 . 2008-04-13 19:11 650,752 --------- C:\WINDOWS\system32\dot3ui.dll 2008-08-10 19:38 . 2008-08-10 19:38 <DIR> d-------- C:\ie-spyad_zo 2008-08-10 19:27 . 2008-08-10 19:30 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-08-10 16:38 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys 2008-08-10 16:37 . 2008-08-10 16:37 <DIR> d-------- C:\Program Files\Panda Security 2008-08-09 22:32 . 2008-08-09 22:32 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-08-09 22:32 . 2008-08-09 22:32 <DIR> d-------- C:\Documents and Settings\Michael\Application Data\Malwarebytes 2008-08-09 22:32 . 2008-08-09 22:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-08-09 22:32 . 2008-07-30 20:14 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-08-09 22:32 . 2008-07-30 20:14 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-08-09 16:07 . 2008-08-09 16:07 0 --a------ C:\WINDOWS\system32\FCF.tmp 2008-08-08 21:10 . 2008-08-08 21:10 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Juniper Networks 2008-08-08 20:55 . 2008-08-08 20:55 <DIR> d-------- C:\Program Files\rcecdxf 2008-08-07 06:18 . 2008-08-07 06:18 <DIR> d-------- C:\Documents and Settings\Michael\.Arachnophilia 2008-08-07 06:17 . 2008-08-07 06:17 <DIR> d-------- C:\Program Files\Arachnophilia 2008-07-15 22:03 . 2008-07-15 22:03 40,304 --ah----- C:\WINDOWS\system32\mlfcache.dat . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-13 23:57 --------- d-----w C:\Documents and Settings\Michael\Application Data\Skype 2008-08-13 21:29 --------- d-----w C:\Documents and Settings\Michael\Application Data\skypePM 2008-08-12 10:47 --------- d-----w C:\Program Files\Paint.NET 2008-08-10 13:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-08-10 12:39 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-08-10 04:01 --------- d-----w C:\Program Files\Lavasoft 2008-08-10 04:00 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-08-09 15:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-08-03 04:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\CanonIJPLM 2008-07-16 02:26 --------- d-----w C:\Program Files\Picasa2 2008-07-12 14:07 --------- d-----w C:\Documents and Settings\Michael\Application Data\ICAClient 2008-07-12 14:06 --------- d-----w C:\Documents and Settings\Michael\Application Data\Runaware 2008-06-30 15:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\BVRP Software 2008-06-30 15:34 --------- d-----w C:\Program Files\Motorola Phone Tools 2008-06-30 15:31 --------- d-----w C:\Program Files\Common Files\Motorola Shared 2008-06-30 15:30 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-06-30 15:30 --------- d-----w C:\Documents and Settings\User\Application Data\InstallShield 2008-06-27 20:14 --------- d-----w C:\Program Files\Common Files\Skype 2008-06-22 13:27 --------- d-----w C:\Program Files\UltraEdit 2008-06-22 13:25 1,564,236 ----a-w C:\Program Files\UltraEdit.zip 2008-06-20 11:51 361,600 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 11:40 138,496 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 11:08 225,856 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2008-04-25 16:56 56,912 ----a-w C:\Documents and Settings\Michael\g2mdlhlpx.exe 2008-01-15 03:59 744 ----a-w C:\Documents and Settings\Michael\pass.dat 2007-12-22 12:35 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat 2005-01-01 06:53 37 ----a-w C:\Documents and Settings\Owner\Application Data\tvmcwrd.dll 2005-01-01 06:52 127 ----a-w C:\Documents and Settings\Owner\Application Data\tvmdmns.dll 2004-12-31 20:46 163 ----a-w C:\Documents and Settings\Michael\Application Data\tvmdmns.dll 2004-12-31 20:03 28 ----a-w C:\Documents and Settings\Michael\Application Data\tvmcwrd.dll 2002-08-29 12:00 94,784 --sh--w C:\WINDOWS\twain.dll 2008-04-14 00:12 50,688 --sh--w C:\WINDOWS\twain_32.dll . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ---- Directory of C:\Program Files\rcecdxf ---- 2008-08-08 20:55 118784 --a------ C:\Program Files\rcecdxf\UiHlp.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BackupNotify"="c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe" [2003-06-22 23:25 24576] "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-04-11 17:52 1409024] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-13 19:12 1695232] "NVIEW"="nview.dll" [2003-08-19 04:56 852038 C:\WINDOWS\system32\nview.dll] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-08-19 04:56 4841472] "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 18:04 52736] "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 09:07 114688] "CamMonitor"="c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 09:23 90112] "HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2003-05-23 04:55 483328] "UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-11-04 01:36 45056] "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 23:42 212992] "PS2"="C:\WINDOWS\system32\ps2.exe" [2002-10-16 18:57 81920] "Sunkist2k"="C:\Program Files\Multimedia Card Reader\shwicon2k.exe" [2003-08-14 21:11 139264] "CXMon"="C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe" [2001-09-19 11:18 45056] "Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 10:11 57344] "PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-10 17:26 406016] "BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 21:26 368706] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-08 18:33 53096] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 18:30 517768] "PNAgent"="C:\Program Files\PhatNoise Media Manager\PNAgent.exe" [2006-07-05 16:51 40960] "PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [2006-04-26 08:29 237568] "Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 02:08 483328] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] "CanonSolutionMenu"="C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 20:01 644696] "CanonMyPrinter"="C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 20:50 1603152] "SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 09:03 210472] "OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 12:02 79400] "WrtMon.exe"="C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 08:35 20480] "pRcu5m"="C:\WINDOWS\iysfas.exe" [BU] "jbkyw.exe"="C:\WINDOWS\system32\jbkyw.exe" [BU] "dmvoq.exe"="C:\WINDOWS\system32\dmvoq.exe" [BU] "nwiz"="nwiz.exe" [2003-08-19 04:56 323584 C:\WINDOWS\system32\nwiz.exe] "LTMSG"="LTMSG.exe" [2003-07-14 19:52 40960 C:\WINDOWS\ltmsg.exe] "AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 14:47 57344 C:\WINDOWS\ALCXMNTR.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-25 20:23 443968] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "POSTRBT"="C:\Program Files\Norton AntiVirus\Navw32.exe" [2007-05-23 12:13 173680] C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ spamsubtract.lnk - C:\Program Files\interMute\SpamSubtract\SpamSub.exe [2003-10-14 00:24:52 557056] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe [2008-01-13 08:45:57 25214] SBC Self Support Tool.lnk - C:\Program Files\SBC Self Support Tool\bin\matcli.exe [2005-08-26 15:51:14 217088] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "AllowLegacyWebView"= 1 (0x1) "AllowUnhashedWebView"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "SpecifyDefaultButtons"= 0 (0x0) "Btn_Search"= 0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "UiHlp"= {710EDF3B-3DF0-5723-471A-0AC80455DCAC} - C:\Program Files\rcecdxf\UiHlp.dll [2008-08-08 20:55 118784] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.MJPG"= Pvmjpg21.dll "VIDC.PIM1"= pclepim1.dll "vidc.VP31"= vp31vfw.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\KODAK Software Updater.lnk backup=C:\WINDOWS\pss\KODAK Software Updater.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MindManager PDF Writer.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MindManager PDF Writer.lnk backup=C:\WINDOWS\pss\MindManager PDF Writer.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Uploader Oe Integration] --a------ 2007-06-10 19:02 40960 C:\Program Files\Free Download Manager\FUM\fumoei.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-03-30 10:36 267048 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD] --a------ 2003-02-11 22:02 61440 C:\hp\KBD\kbd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask] --a------ 2004-09-22 19:20 53248 C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge] --a------ 2003-12-10 04:52 380928 C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2008-04-13 19:12 1695232 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pamela.exe] --a------ 2007-12-22 07:57 6742016 C:\Program Files\Pamela\Pamela.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-03-28 23:37 413696 C:\Program Files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2008-05-30 15:54 21718312 C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-09-25 02:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YBrowser] --a------ 2003-07-11 13:51 57344 C:\Program Files\Yahoo!\browser\ybrwicon.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Java\\j2re1.4.2\\bin\\javaw.exe"= "C:\\StubInstaller.exe"= "C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\backWeb-7288971.exe"= "C:\\Program Files\\Neoteris\\Secure Application Manager\\dsSamProxy.exe"= "C:\\Program Files\\Best Buy Digital Music Store Powered by Rhapsody\\rhapsody.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 17:24] R1 NEOFLTR_530_10641;Juniper Networks TDI Filter Driver (NEOFLTR_530_10641);C:\WINDOWS\system32\Drivers\NEOFLTR_530_10641.SYS [2006-04-27 00:40] R2 IJPLMSVC;PIXMA Extended Survey Program;C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2007-04-13 10:49] R3 BENDER;Pinnacle AV/DV2 Capture;C:\WINDOWS\system32\drivers\bender.sys [2003-07-09 15:35] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c1e2986f-2c64-11dd-a400-000ea6631781}] \Shell\AutoRun\command - K:\Launch.exe /run . Contents of the 'Scheduled Tasks' folder 2008-08-13 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57] 2008-08-09 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Michael.job - C:\PROGRA~1\NORTON~1\Navw32.exe [2007-05-23 12:13] 2008-08-04 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job - C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe [] 2008-02-16 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job - C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe [] . - - - - ORPHANS REMOVED - - - - HKCU-Run-ApiSh - C:\WINDOWS\system32\tyjwpglm.exe HKLM-Run-pRcu5múÀaîžaaøY§C:\Program Files\ISTsvc\istsvc.exe - C:\WINDOWS\iysfas.exe *********************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-13 2159 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "pRcu5mú*ÀaîžaaøY§C:\\Program Files\\ISTsvc\\istsvc.exe"="C:\\WINDOWS\\iysfas.exe" . Completion time: 2008-08-13 21:17:36 ComboFix-quarantined-files.txt 2008-08-14 02:17:29 ComboFix2.txt 2008-08-13 15:38:22 Pre-Run: 31,282,102,272 bytes free Post-Run: 31,265,587,200 bytes free 246 --- E O F --- 2008-08-11 14:13:03 -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Thursday, August 14, 2008 Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Thursday, August 14, 2008 03:28:31 Records in database: 1091795 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ F:\ H:\ I:\ J:\ L:\ Scan statistics: Files scanned: 139182 Threat name: 90 Infected objects: 160 Suspicious objects: 0 Duration of the scan: 02:37:59 File name / Threat name / Threats count C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\01945F3A Infected: Trojan-Downloader.Win32.OneClickNetSearch.h 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\03753CEF.def Infected: Trojan-Dropper.Win32.Agent.qsm 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\04C87AE4.exe Infected: Trojan-Downloader.Win32.Agent.uj 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\057C5097 Infected: Trojan-Downloader.Win32.Petrolin.b 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\057F7A94 Infected: Trojan-Downloader.Win32.Petrolin.b 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\061D5AF6 Infected: Trojan-Downloader.Win32.Small.os 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\085E7F20 Infected: Trojan-Downloader.Win32.Dyfuca.dp 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0861291C Infected: Trojan-Downloader.Win32.IstBar.gen 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\08655318 Infected: Trojan-Downloader.Win32.IstBar.gm 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\086B2711 Infected: not-a-virus:AdWare.Win32.SideFind 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\086E510E Infected: Trojan-Downloader.Win32.TSUpdate.f 2 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\08862E17 Infected: Trojan-Downloader.Win32.IstBar.go 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\09670D15.exe Infected: Trojan.Win32.Favadd.ar 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0ACC6445.exe Infected: Trojan.Win32.DNSChanger.de 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0ACE0208 Infected: Trojan-Downloader.Win32.IstBar.gn 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0AD55601 Infected: Trojan-Downloader.Win32.IstBar.gn 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0AF923D9 Infected: Trojan-Downloader.Win32.IstBar.gn 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0B5E6CBE.tmp Infected: Trojan.Java.ClassLoader.ak 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0CC22A21 Infected: Trojan-Downloader.Win32.Dluca.ao 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0F912B88 Infected: Trojan.Win32.Starter.a 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\137C3E7A.dll Infected: not-a-virus:AdWare.Win32.SBSoft.h 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\13BD4CD5 Infected: Trojan-Downloader.Win32.Agent.ab 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\13D747F6 Infected: Trojan.Win32.Starter.a 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1995218A Infected: Trojan-Downloader.Win32.Small.os 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1A9D7AC1 Infected: not-a-virus:AdWare.Win32.DealHelper.aa 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1AC9592E Infected: Trojan.Win32.StartPage.ih 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1B611B4B.tmp Infected: Trojan-Dropper.Java.Beyond.d 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1BF51B1F.tmp Infected: Trojan-Downloader.Java.OpenConnection.v 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1C0C5A33 Infected: Trojan-Downloader.Win32.Dyfuca.cj 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1E130EC2.tmp Infected: Trojan-Downloader.Java.OpenConnection.ao 2 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1E130EC2.tmp Infected: Trojan.Java.ClassLoader.au 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1E474C33 Infected: Trojan-Dropper.Java.Beyond.d 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2082497C Infected: Trojan-Downloader.Win32.TSUpdate.f 2 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\21C7456C.tmp Infected: Trojan.Java.ClassLoader.c 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\236A4912 Infected: Trojan-Downloader.Win32.IstBar.go 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\236D730F Infected: Trojan-Downloader.Win32.IstBar.gm 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\23701D0B Infected: Trojan-Downloader.Win32.IstBar.go 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\23744708 Infected: not-a-virus:AdWare.Win32.BetterInternet 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\241D605D Infected: Trojan-Downloader.Win32.OneClickNetSearch.h 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\24C01173 Infected: Trojan-Downloader.Win32.Small.wk 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\25D40BFD Infected: Trojan-Dropper.Win32.Agent.ad 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\28692C20 Infected: Trojan-Downloader.Win32.Agent.az 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\28D93E03 Infected: Trojan-Dropper.Win32.Delf.z 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\290360CA Infected: Trojan.Win32.Delf.gh 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2A4951DB Infected: Trojan-Downloader.Win32.Dyfuca.gen 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2AE42ED6 Infected: Trojan-Downloader.Win32.TSUpdate.f 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2CEC7D05 Infected: not-a-virus:AdWare.Win32.BiSpy.t 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2D514D9F.tmp Infected: Exploit.Java.Gimsh.b 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2E613EDA Infected: not-a-virus:AdWare.Win32.BetterInternet 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\30F707CD.exe Infected: Trojan-Dropper.Win32.Agent.ch 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\33640CDB Infected: Trojan.Java.ClassLoader.i 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\33EE45B8 Infected: Trojan-Downloader.Win32.IstBar.gen 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\347709BD.tmp Infected: Trojan.Java.ClassLoader.ak 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\35154608 Infected: not-a-virus:AdWare.Win32.DealHelper.v 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\358110D6 Infected: not-a-virus:AdWare.Win32.180Solutions 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\36112230.dll Infected: not-a-virus:AdWare.Win32.HotSearchBar.b 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\36D92355.exe Infected: Net-Worm.Win32.Dedler.u 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\36DF774E.exe Infected: Trojan-DDoS.Win32.Boxed.w 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\36E74259.exe Infected: not-a-virus:FraudTool.Win32.MalwareProtector.d 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\377E2E99.tmp Infected: Trojan.Java.ClassLoader.z 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\37A3417A Infected: Trojan-Downloader.Win32.TSUpdate.f 2 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\38265DE6.tmp Infected: Trojan.Java.ClassLoader.z 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\382907E3.tmp Infected: Trojan.Java.ClassLoader.z 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3839714D Infected: Trojan-Downloader.Win32.TSUpdate.h 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3B9042D2.tmp Infected: Trojan-Downloader.Win32.Small.wk 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3F8718C1 Infected: Trojan-Spy.Win32.Briss.h 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3FA55FDD Infected: not-a-virus:AdWare.Win32.DealHelper.u 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\40163A49 Infected: Trojan-Downloader.Win32.Dyfuca.gen 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\42FF7937 Infected: Trojan-Downloader.Win32.IstBar.go 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\43A62329.tmp Infected: Exploit.Java.ByteVerify 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\441E1CEB Infected: Trojan-Downloader.Win32.Dyfuca.bw 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\442146E8 Infected: Trojan.Win32.Revop.c 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\458E7825.wmf Infected: Trojan-Downloader.Win32.Agent.acd 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\45F712EC Infected: Trojan-Downloader.Win32.Small.vq 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\45FA3CE8 Infected: Trojan-Downloader.Win32.Small.vq 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\46E81FA8.exe Infected: Net-Worm.Win32.Dedler.u 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\46EB49A5.exe Infected: Trojan-DDoS.Win32.Boxed.w 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\46EE2D93 Infected: Exploit.Java.ByteVerify 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\483C497C Infected: not-a-virus:AdWare.Win32.DealHelper.t 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\48833BDD.exe Infected: not-a-virus:AdWare.Win32.Msnagent.b 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\488A0FD6.exe Infected: not-a-virus:AdWare.Win32.FindSpy.a 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\494F61E5.tmp Infected: not-a-virus:AdWare.Win32.Sidesearch.c 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\494F61E5.tmp Infected: Backdoor.Win32.Ruledor.e 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\494F61E5.tmp Infected: not-a-virus:AdWare.Win32.ClearSearch.f 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\499F4026 Infected: not-a-virus:AdWare.Win32.InstaFinder.a 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4A744DFB Infected: Trojan-Downloader.JS.Small.d 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4DFB58D9 Infected: Trojan-Downloader.Win32.Dyfuca.gen 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\504A7F31 Infected: Trojan-Downloader.Win32.IstBar.go 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\51264ABD.tmp Infected: Trojan-Downloader.Java.OpenConnection.v 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\53C40802.exe Infected: Trojan-Spy.Win32.AdvancedKeyLogger.c 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\53C40802.exe Infected: not-a-virus:Monitor.Win32.HandyKeylogger.a 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\53C40802.exe Infected: Trojan-Spy.Win32.AdvancedKeyLogger.a 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\53C40802.exe Infected: not-a-virus:Monitor.Win32.QuickKeyLogger.e 2 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\53C40802.exe Infected: not-a-virus:Monitor.Win32.QuickKeyLogger.a 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\53C40802.exe Infected: not-a-virus:Monitor.Win32.QuickKeyLogger.d 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5867236A Infected: Trojan-Downloader.Win32.IstBar.gen 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\58F05B52 Infected: Trojan-Downloader.Win32.Agent.az 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\59350B51 Infected: Trojan.Win32.Small.ae 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\598C14D8 Infected: Trojan-Downloader.Win32.Agent.ae 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5A214746.wmf Infected: Trojan-Downloader.Win32.Agent.acd 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5AA91F8C.tmp Infected: Trojan.Java.ClassLoader.ao 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5AB31D82.tmp Infected: Trojan.Java.ClassLoader.ao 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5AB9717A.tmp Infected: Trojan.Java.ClassLoader.ao 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5D3D2078.tmp Infected: Trojan.Java.ClassLoader.ap 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5D471E6D.tmp Infected: Trojan.Java.ClassLoader.ap 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5EBE2DAA Infected: not-a-virus:AdWare.Win32.Sahat.h 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\60406FCB Infected: Trojan-Proxy.Win32.Agent.cj 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\62214D7A.exe Infected: not-a-virus:AdWare.Win32.Beginto.b 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\62930F9E Infected: Trojan-Downloader.Win32.TSUpdate.g 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\648173DC Infected: Trojan-Spy.Win32.Briss.h 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\649017FB Infected: Trojan-Downloader.Win32.TSUpdate.i 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\649017FB Infected: Trojan-Downloader.Win32.TSUpdate.g 3 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\649017FB Infected: Trojan-Downloader.Win32.TSUpdate.h 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\651C50D6 Infected: not-a-virus:AdWare.Win32.BetterInternet 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\65E5380F Infected: Trojan-Dropper.Win32.Delf.z 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\664B277C Infected: not-a-virus:AdWare.Win32.BetterInternet 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\664D54DE.tmp Infected: not-a-virus:AdWare.Win32.NewWeb.ay 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\664D54DE.tmp Infected: not-a-virus:AdWare.Win32.BHO.aad 2 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\67241F06 Infected: not-a-virus:AdWare.Win32.MegaSearch.a 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\67D22818 Infected: Trojan-Dropper.Win32.Delf.z 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\69EA6116.tmp Infected: Trojan.Java.ClassLoader.ap 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6E5C203F Infected: Trojan-Downloader.Win32.Small.os 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6EA23BF6 Infected: Trojan.Java.ClassLoader.k 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6FB07D24 Infected: Trojan.Java.ClassLoader.aj 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\70AC0CD5 Infected: Trojan-Downloader.Win32.Dyfuca.dc 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\70E03579.tmp Infected: Trojan.Java.Binny.a 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\71DB637A Infected: Trojan-Downloader.Win32.IstBar.gen 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\72597048 Infected: not-a-virus:AdWare.Win32.HotSearchBar.b 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\725C1A45 Infected: Trojan-Downloader.NSIS.Agent.a 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\736744EB Infected: Trojan-Dropper.Java.Beyond.d 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\73843ECB Infected: Exploit.HTML.CodeBaseExec 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74F771B9.tmp Infected: Trojan-Downloader.Java.OpenConnection.v 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\75D600CF.exe Infected: not-a-virus:FraudTool.Win32.MalwareProtector.d 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\773E14D4 Infected: Trojan-Dropper.Win32.Agent.ad 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\779E734E.wmf Infected: Trojan-Downloader.Win32.Agent.acd 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\784504D7 Infected: not-a-virus:AdWare.Win32.Sahat.h 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\785C2ABE Infected: not-a-virus:AdWare.Win32.F1Organizer.h 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\785E1BDE.tmp Infected: Trojan.Java.Binny.a 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\785F54BA Infected: not-a-virus:AdWare.Win32.F1Organizer.c 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\78627EB6 Infected: Trojan-Downloader.Win32.IstBar.er 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\786628B3 Infected: Trojan-Downloader.Win32.Agent.ae 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\786952AF Infected: Trojan-Downloader.Win32.Agent.ae 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\786C7CAC Infected: Trojan-Downloader.Win32.Agent.ae 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\786F26A8 Infected: not-a-virus:AdWare.Win32.WinComm 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\787350A4 Infected: not-a-virus:AdWare.Win32.BetterInternet 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\78767AA1 Infected: not-a-virus:AdWare.Win32.WinComm 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\795F2B5A Infected: Trojan-Downloader.Win32.TSUpdate.g 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\797C3615.tmp Infected: Trojan-Downloader.Java.OpenConnection.v 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7EC9501C Infected: Trojan-Downloader.Win32.TSUpdate.g 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7FEC710A.tmp Infected: Exploit.Java.Gimsh.b 1 C:\Documents and Settings\Owner\My Documents\Michaels Files\Limewire\Shared\Microsoft_Windows_95_98_ME_2000_2k_XP_Plus_Office_Product_Keys_Cd_Key_License_Crack.txt.exe Infected: Trojan.Win32.DusBunn 1 C:\QooBox\Quarantine\C\WINDOWS\system32\1.tmp.vir Infected: not-a-virus:FraudTool.Win32.MalwareProtector.d 1 The selected area was scanned. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 6:33:07 AM, on 8/14/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\LTMSG.exe C:\windows\system\hpsysdrv.exe C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe C:\WINDOWS\System32\hphmon05.exe C:\WINDOWS\system32\ps2.exe C:\Program Files\Multimedia Card Reader\shwicon2k.exe C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe C:\WINDOWS\ALCXMNTR.EXE C:\Program Files\BroadJump\Client Foundation\CFD.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\HEWLET~1\PHOTOS~1\HPSHAR~1\hpgs2wnf.exe C:\Program Files\PhatNoise Media Manager\PNAgent.exe C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Canon\MyPrinter\BJMyPrt.exe C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\ScsiAccess.EXE C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE C:\Program Files\Common Files\Sonic\Update Manager\sgtray\sgtray.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O1 - Hosts: localhost 127.0.0.1 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file) O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - (no file) O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7 O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe" O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [PNAgent] "C:\Program Files\PhatNoise Media Manager\PNAgent.exe" O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe" O4 - HKLM\..\Run: [WrtMon.exe] C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe O4 - HKLM\..\Run: [pRcu5m] C:\WINDOWS\iysfas.exe O4 - HKLM\..\Run: [jbkyw.exe] C:\WINDOWS\system32\jbkyw.exe O4 - HKLM\..\Run: [dmvoq.exe] C:\WINDOWS\system32\dmvoq.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'Default user') O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user') O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ? O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: LimeShop Preferences - file://C:\Program Files\Lime_Shop\Sy700\Tp700\scri700a.htm O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing) O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - C:\Program Files\Free Download Manager\FUM\fumiebtn.dll (file missing) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?Link...04&clcid=0x409 O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.15.38/ttinst.cab O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{0689CEC2-8D77-4684-9520-B9193268E020}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CCS\Services\Tcpip\..\{5B7D92DE-C59E-4A96-8384-87D106A9DE5B}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CCS\Services\Tcpip\..\{F9852F02-FE8C-49A1-86BC-15688CF57C8D}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CS1\Services\Tcpip\..\{0689CEC2-8D77-4684-9520-B9193268E020}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CS2\Services\Tcpip\..\{0689CEC2-8D77-4684-9520-B9193268E020}: NameServer = 208.67.220.220,208.67.222.222 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O21 - SSODL: UiHlp - {710EDF3B-3DF0-5723-471A-0AC80455DCAC} - C:\Program Files\rcecdxf\UiHlp.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe -- End of file - 16872 bytes I really appreciate your help with this! Thanks, Michael.

08-14-2008, 06:30 AM	#6 (permalink)
TheBruce1 Moderator, Analyst, Security Team Join Date: Oct 2006 Location: Dùn Èideann,Scotland. Posts: 4,531 OS: XP	Re: "Windows Security Alert" continues after XPAntivirus removed Please download MGADiag.exe to your desktop. Double-click MGADiag.exe and click Continue in the bottom right of the window to run the tool. When it's done, capture a screenshot of the finished scan, and post that. In Windows a screenshot of the entire monitor, complete with taskbar, can be copied to the system clipboard by pressing the Print screen key (normally located in the top row on the right-hand side of the keyboard).. You can then paste the clipboard into a program like MS Paint to save it as an image file or paste it directly into a document. Press the Print screen key Click the "Start" button (normally located in the bottom left of your screen). Click "Run" & type "mspaint" (without quotes) & click the "OK" button. Wait while the application "Paint" opens. Once it is open, proceed to the next step. Click the "Edit" menu and select "Paste". Click the "File" menu and select "Save As...". A dialog box will appear. In the "File name" field, enter a name of your choice. Click the "Save as type" drop-down and select "JPEG (.JPG;.JPEG;.JPE;.JFIF)". Click the "Save" button. Attach it in your next reply, please. To attach a file to a new post, simply Click the[Manage Attachments] button under Additional Options > Attach Files on the post composition page, browse to where you saved the file, and Click Upload. __________________ Member of ASAP since 2007 Member of UNITE since 2008 Notice to BT customers BT to dump Phorm, see Here for more information. No DPI If we have helped you in anyway, please consider Donating

08-15-2008, 09:07 AM	#10 (permalink)
mimartin Registered User Join Date: Aug 2008 Posts: 17 OS: xp, service pack 3	Re: "Windows Security Alert" continues after XPAntivirus removed Hi, Thanks for your continued support with this issue. I haven't seen the "Windows Security Alert" in a couple of days now. Also the XPAntivirus and Joke.Blusod are not showing up as well. I'm not aware of any illegal programs (cracked or otherwise) on this computer. It is a family computer so it is possible that someone else installed something. I looked at the combofix log and saw the files in limewire directory. I went there and didn't see those files or any others like that after the scan. But if you can see something else that isn't legit, please let me know and I will remove. I cleared the Norton quarantine folder. I ran combofix using the CFScript text you provided. Combofix said a newer version was available when it started so I accepted to update it. It then ran. It did reboot before ending. I then ran HJT Here are the logs. *********************** ComboFix 08-08-14.03 - Michael 2008-08-15 10:00:38.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.224 [GMT -5:00] Running from: C:\Documents and Settings\Michael\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Michael\Desktop\CFScript * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@2o7[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@a.hasbro[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@ad.yieldmanager[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@ads.pointroll[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@bellaonline[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@belointeractive[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@boxofficemojo[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@casalemedia[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@catalog.target[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@cuc.famousfootwear[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@ebaumsworld[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@ebay[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@edge.ru4[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@ejbdotcom[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@expedia[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@famousfootwear[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@insightexpressai[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@livescience[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@mapquest[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@metacafe[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@metrics.adobe[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@my.clearchannelradio[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@myspace[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@nextag[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@partner2profit[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@photobucket[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@questionmarket[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@revsci[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@rtm[4].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@sanangelostandardtimes[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@shopzilla[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@specificclick[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@statcounter[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@trafficmp[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@tribalfusion[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@turn[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@tvguide[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@walmart[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@weather[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@weather[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@weather[3].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@www.potpourrigift[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@yahoo[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@yellowpages[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\owner@youtube[2].txt C:\Documents and Settings\Owner\My Documents\Michaels Files\Limewire C:\Documents and Settings\Owner\My Documents\Michaels Files\Limewire\Incomplete\downloads.bak C:\Documents and Settings\Owner\My Documents\Michaels Files\Limewire\Incomplete\downloads.dat C:\Documents and Settings\Owner\My Documents\Michaels Files\Limewire\Incomplete\T-218-Plus! Digital Media Edition (DME) Key.txt C:\Documents and Settings\Owner\My Documents\Michaels Files\Limewire\Shared\DVD XCopy Xpress Platinum v3.20+Crack.exe C:\Documents and Settings\Owner\My Documents\Michaels Files\Limewire\Shared\Microsoft_Windows_95_98_ME_2000_2k_XP_Plus_Office_Product_Keys_Cd_Key_License_Crack.txt.exe C:\Documents and Settings\Owner\My Documents\Michaels Files\Limewire\Shared\Plus_DME_Crack_A0015556.exe C:\Documents and Settings\User\Application Data\Earthlink\6.0\mmlm@earthlink.net\Cookies\user@my.clearchannelradio[2].txt C:\Program Files\Java\jre1.6.0_03 C:\Program Files\Java\jre1.6.0_03\bin\awt.dll C:\Program Files\Java\jre1.6.0_03\bin\axbridge.dll C:\Program Files\Java\jre1.6.0_03\bin\client\classes.jsa C:\Program Files\Java\jre1.6.0_03\bin\client\jvm.dll C:\Program Files\Java\jre1.6.0_03\bin\client\Xusage.txt C:\Program Files\Java\jre1.6.0_03\bin\cmm.dll C:\Program Files\Java\jre1.6.0_03\bin\dcpr.dll C:\Program Files\Java\jre1.6.0_03\bin\deploy.dll C:\Program Files\Java\jre1.6.0_03\bin\dt_shmem.dll C:\Program Files\Java\jre1.6.0_03\bin\dt_socket.dll C:\Program Files\Java\jre1.6.0_03\bin\fontmanager.dll C:\Program Files\Java\jre1.6.0_03\bin\hpi.dll C:\Program Files\Java\jre1.6.0_03\bin\hprof.dll C:\Program Files\Java\jre1.6.0_03\bin\instrument.dll C:\Program Files\Java\jre1.6.0_03\bin\ioser12.dll C:\Program Files\Java\jre1.6.0_03\bin\j2pcsc.dll C:\Program Files\Java\jre1.6.0_03\bin\j2pkcs11.dll C:\Program Files\Java\jre1.6.0_03\bin\jaas_nt.dll C:\Program Files\Java\jre1.6.0_03\bin\java-rmi.exe C:\Program Files\Java\jre1.6.0_03\bin\java.dll C:\Program Files\Java\jre1.6.0_03\bin\java.exe C:\Program Files\Java\jre1.6.0_03\bin\java_crw_demo.dll C:\Program Files\Java\jre1.6.0_03\bin\javacpl.cpl C:\Program Files\Java\jre1.6.0_03\bin\javacpl.exe C:\Program Files\Java\jre1.6.0_03\bin\javaw.exe C:\Program Files\Java\jre1.6.0_03\bin\javaws.exe C:\Program Files\Java\jre1.6.0_03\bin\jawt.dll C:\Program Files\Java\jre1.6.0_03\bin\JdbcOdbc.dll C:\Program Files\Java\jre1.6.0_03\bin\jdwp.dll C:\Program Files\Java\jre1.6.0_03\bin\jli.dll C:\Program Files\Java\jre1.6.0_03\bin\jpeg.dll C:\Program Files\Java\jre1.6.0_03\bin\jpicom.dll C:\Program Files\Java\jre1.6.0_03\bin\jpiexp.dll C:\Program Files\Java\jre1.6.0_03\bin\jpinscp.dll C:\Program Files\Java\jre1.6.0_03\bin\jpioji.dll C:\Program Files\Java\jre1.6.0_03\bin\jpishare.dll C:\Program Files\Java\jre1.6.0_03\bin\jsound.dll C:\Program Files\Java\jre1.6.0_03\bin\jsoundds.dll C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe C:\Program Files\Java\jre1.6.0_03\bin\jureg.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Java\jre1.6.0_03\bin\keytool.exe C:\Program Files\Java\jre1.6.0_03\bin\kinit.exe C:\Program Files\Java\jre1.6.0_03\bin\klist.exe C:\Program Files\Java\jre1.6.0_03\bin\ktab.exe C:\Program Files\Java\jre1.6.0_03\bin\management.dll C:\Program Files\Java\jre1.6.0_03\bin\msvcr71.dll C:\Program Files\Java\jre1.6.0_03\bin\net.dll C:\Program Files\Java\jre1.6.0_03\bin\nio.dll C:\Program Files\Java\jre1.6.0_03\bin\npjava11.dll C:\Program Files\Java\jre1.6.0_03\bin\npjava12.dll C:\Program Files\Java\jre1.6.0_03\bin\npjava13.dll C:\Program Files\Java\jre1.6.0_03\bin\npjava14.dll C:\Program Files\Java\jre1.6.0_03\bin\npjava32.dll C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll C:\Program Files\Java\jre1.6.0_03\bin\npoji610.dll C:\Program Files\Java\jre1.6.0_03\bin\npt.dll C:\Program Files\Java\jre1.6.0_03\bin\orbd.exe C:\Program Files\Java\jre1.6.0_03\bin\pack200.exe C:\Program Files\Java\jre1.6.0_03\bin\policytool.exe C:\Program Files\Java\jre1.6.0_03\bin\regutils.dll C:\Program Files\Java\jre1.6.0_03\bin\rmi.dll C:\Program Files\Java\jre1.6.0_03\bin\rmid.exe C:\Program Files\Java\jre1.6.0_03\bin\rmiregistry.exe C:\Program Files\Java\jre1.6.0_03\bin\servertool.exe C:\Program Files\Java\jre1.6.0_03\bin\splashscreen.dll C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll C:\Program Files\Java\jre1.6.0_03\bin\sunmscapi.dll C:\Program Files\Java\jre1.6.0_03\bin\tnameserv.exe C:\Program Files\Java\jre1.6.0_03\bin\unpack.dll C:\Program Files\Java\jre1.6.0_03\bin\unpack200.exe C:\Program Files\Java\jre1.6.0_03\bin\verify.dll C:\Program Files\Java\jre1.6.0_03\bin\w2k_lsa_auth.dll C:\Program Files\Java\jre1.6.0_03\bin\wsdetect.dll C:\Program Files\Java\jre1.6.0_03\bin\zip.dll C:\Program Files\Java\jre1.6.0_03\COPYRIGHT C:\Program Files\Java\jre1.6.0_03\lib\applet\WMPNS.jar C:\Program Files\Java\jre1.6.0_03\lib\calendars.properties C:\Program Files\Java\jre1.6.0_03\lib\classlist C:\Program Files\Java\jre1.6.0_03\lib\cmm\CIEXYZ.pf C:\Program Files\Java\jre1.6.0_03\lib\cmm\GRAY.pf C:\Program Files\Java\jre1.6.0_03\lib\cmm\LINEAR_RGB.pf C:\Program Files\Java\jre1.6.0_03\lib\cmm\sRGB.pf C:\Program Files\Java\jre1.6.0_03\lib\content-types.properties C:\Program Files\Java\jre1.6.0_03\lib\deploy.jar C:\Program Files\Java\jre1.6.0_03\lib\deploy\ffjcext.zip C:\Program Files\Java\jre1.6.0_03\lib\deploy\messages.properties C:\Program Files\Java\jre1.6.0_03\lib\deploy\messages_de.properties C:\Program Files\Java\jre1.6.0_03\lib\deploy\messages_es.properties C:\Program Files\Java\jre1.6.0_03\lib\deploy\messages_fr.properties C:\Program Files\Java\jre1.6.0_03\lib\deploy\messages_it.properties C:\Program Files\Java\jre1.6.0_03\lib\deploy\messages_ja.properties C:\Program Files\Java\jre1.6.0_03\lib\deploy\messages_ko.properties C:\Program Files\Java\jre1.6.0_03\lib\deploy\messages_sv.properties C:\Program Files\Java\jre1.6.0_03\lib\deploy\messages_zh_CN.properties C:\Program Files\Java\jre1.6.0_03\lib\deploy\messages_zh_HK.properties C:\Program Files\Java\jre1.6.0_03\lib\deploy\messages_zh_TW.properties C:\Program Files\Java\jre1.6.0_03\lib\deploy\splash.jpg C:\Program Files\Java\jre1.6.0_03\lib\ext\dnsns.jar C:\Program Files\Java\jre1.6.0_03\lib\ext\meta-index C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip C:\Program Files\Java\jre1.6.0_03\lib\ext\sunjce_provider.jar C:\Program Files\Java\jre1.6.0_03\lib\ext\sunmscapi.jar C:\Program Files\Java\jre1.6.0_03\lib\ext\sunpkcs11.jar C:\Program Files\Java\jre1.6.0_03\lib\flavormap.properties C:\Program Files\Java\jre1.6.0_03\lib\fontconfig.98.bfc C:\Program Files\Java\jre1.6.0_03\lib\fontconfig.98.properties.src C:\Program Files\Java\jre1.6.0_03\lib\fontconfig.bfc C:\Program Files\Java\jre1.6.0_03\lib\fontconfig.properties.src C:\Program Files\Java\jre1.6.0_03\lib\fonts\LucidaSansRegular.ttf C:\Program Files\Java\jre1.6.0_03\lib\i386\jvm.cfg C:\Program Files\Java\jre1.6.0_03\lib\im\indicim.jar C:\Program Files\Java\jre1.6.0_03\lib\im\thaiim.jar C:\Program Files\Java\jre1.6.0_03\lib\images\cursors\cursors.properties C:\Program Files\Java\jre1.6.0_03\lib\images\cursors\invalid32x32.gif C:\Program Files\Java\jre1.6.0_03\lib\images\cursors\win32_CopyDrop32x32.gif C:\Program Files\Java\jre1.6.0_03\lib\images\cursors\win32_CopyNoDrop32x32.gif C:\Program Files\Java\jre1.6.0_03\lib\images\cursors\win32_LinkDrop32x32.gif C:\Program Files\Java\jre1.6.0_03\lib\images\cursors\win32_LinkNoDrop32x32.gif C:\Program Files\Java\jre1.6.0_03\lib\images\cursors\win32_MoveDrop32x32.gif C:\Program Files\Java\jre1.6.0_03\lib\images\cursors\win32_MoveNoDrop32x32.gif C:\Program Files\Java\jre1.6.0_03\lib\javaws.jar C:\Program Files\Java\jre1.6.0_03\lib\jce.jar C:\Program Files\Java\jre1.6.0_03\lib\jsse.jar C:\Program Files\Java\jre1.6.0_03\lib\jvm.hprof.txt C:\Program Files\Java\jre1.6.0_03\lib\logging.properties C:\Program Files\Java\jre1.6.0_03\lib\management-agent.jar C:\Program Files\Java\jre1.6.0_03\lib\management\jmxremote.access C:\Program Files\Java\jre1.6.0_03\lib\management\jmxremote.password.template C:\Program Files\Java\jre1.6.0_03\lib\management\management.properties C:\Program Files\Java\jre1.6.0_03\lib\management\snmp.acl.template C:\Program Files\Java\jre1.6.0_03\lib\meta-index C:\Program Files\Java\jre1.6.0_03\lib\net.properties C:\Program Files\Java\jre1.6.0_03\lib\plugin.jar C:\Program Files\Java\jre1.6.0_03\lib\psfont.properties.ja C:\Program Files\Java\jre1.6.0_03\lib\psfontj2d.properties C:\Program Files\Java\jre1.6.0_03\lib\resources.jar C:\Program Files\Java\jre1.6.0_03\lib\rt.jar C:\Program Files\Java\jre1.6.0_03\lib\security\cacerts C:\Program Files\Java\jre1.6.0_03\lib\security\java.policy C:\Program Files\Java\jre1.6.0_03\lib\security\java.security C:\Program Files\Java\jre1.6.0_03\lib\security\javaws.policy C:\Program Files\Java\jre1.6.0_03\lib\security\local_policy.jar C:\Program Files\Java\jre1.6.0_03\lib\security\US_export_policy.jar C:\Program Files\Java\jre1.6.0_03\lib\sound.properties C:\Program Files\Java\jre1.6.0_03\lib\tzmappings C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Abidjan C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Accra C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Addis_Ababa C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Algiers C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Asmara C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Bamako C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Bangui C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Banjul C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Bissau C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Blantyre C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Brazzaville C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Bujumbura C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Cairo C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Casablanca C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Ceuta C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Conakry C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Dakar C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Dar_es_Salaam C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Djibouti C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Douala C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\El_Aaiun C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Freetown C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Gaborone C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Harare C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Johannesburg C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Kampala C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Khartoum C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Kigali C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Kinshasa C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Lagos C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Libreville C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Lome C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Luanda C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Lubumbashi C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Lusaka C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Malabo C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Maputo C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Maseru C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Mbabane C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Mogadishu C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Monrovia C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Nairobi C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Ndjamena C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Niamey C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Nouakchott C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Ouagadougou C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Porto-Novo C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Sao_Tome C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Tripoli C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Tunis C:\Program Files\Java\jre1.6.0_03\lib\zi\Africa\Windhoek C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Adak C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Anchorage C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Anguilla C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Antigua C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Araguaina C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Argentina\Buenos_Aires C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Argentina\Catamarca C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Argentina\Cordoba C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Argentina\Jujuy C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Argentina\La_Rioja C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Argentina\Mendoza C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Argentina\Rio_Gallegos C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Argentina\San_Juan C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Argentina\Tucuman C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Argentina\Ushuaia C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Aruba C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Asuncion C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Atikokan C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Bahia C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Barbados C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Belem C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Belize C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Blanc-Sablon C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Boa_Vista C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Bogota C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Boise C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Cambridge_Bay C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Campo_Grande C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Cancun C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Caracas C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Cayenne C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Cayman C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Chicago C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Chihuahua C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Costa_Rica C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Cuiaba C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Curacao C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Danmarkshavn C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Dawson C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Dawson_Creek C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Denver C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Detroit C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Dominica C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Edmonton C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Eirunepe C:\Program Files\Java\jre1.6.0_03\lib\zi\America\El_Salvador C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Fortaleza C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Glace_Bay C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Godthab C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Goose_Bay C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Grand_Turk C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Grenada C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Guadeloupe C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Guatemala C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Guayaquil C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Guyana C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Halifax C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Havana C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Hermosillo C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Indiana\Indianapolis C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Indiana\Knox C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Indiana\Marengo C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Indiana\Petersburg C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Indiana\Tell_City C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Indiana\Vevay C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Indiana\Vincennes C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Indiana\Winamac C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Inuvik C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Iqaluit C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Jamaica C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Juneau C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Kentucky\Louisville C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Kentucky\Monticello C:\Program Files\Java\jre1.6.0_03\lib\zi\America\La_Paz C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Lima C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Los_Angeles C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Maceio C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Managua C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Manaus C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Martinique C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Mazatlan C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Menominee C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Merida C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Mexico_City C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Miquelon C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Moncton C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Monterrey C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Montevideo C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Montreal C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Montserrat C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Nassau C:\Program Files\Java\jre1.6.0_03\lib\zi\America\New_York C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Nipigon C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Nome C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Noronha C:\Program Files\Java\jre1.6.0_03\lib\zi\America\North_Dakota\Center C:\Program Files\Java\jre1.6.0_03\lib\zi\America\North_Dakota\New_Salem C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Panama C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Pangnirtung C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Paramaribo C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Phoenix C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Port-au-Prince C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Port_of_Spain C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Porto_Velho C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Puerto_Rico C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Rainy_River C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Rankin_Inlet C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Recife C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Regina C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Resolute C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Rio_Branco C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Santiago C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Santo_Domingo C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Sao_Paulo C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Scoresbysund C:\Program Files\Java\jre1.6.0_03\lib\zi\America\St_Johns C:\Program Files\Java\jre1.6.0_03\lib\zi\America\St_Kitts C:\Program Files\Java\jre1.6.0_03\lib\zi\America\St_Lucia C:\Program Files\Java\jre1.6.0_03\lib\zi\America\St_Thomas C:\Program Files\Java\jre1.6.0_03\lib\zi\America\St_Vincent C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Swift_Current C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Tegucigalpa C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Thule C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Thunder_Bay C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Tijuana C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Toronto C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Tortola C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Vancouver C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Whitehorse C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Winnipeg C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Yakutat C:\Program Files\Java\jre1.6.0_03\lib\zi\America\Yellowknife C:\Program Files\Java\jre1.6.0_03\lib\zi\Antarctica\Casey C:\Program Files\Java\jre1.6.0_03\lib\zi\Antarctica\Davis C:\Program Files\Java\jre1.6.0_03\lib\zi\Antarctica\DumontDUrville C:\Program Files\Java\jre1.6.0_03\lib\zi\Antarctica\Mawson C:\Program Files\Java\jre1.6.0_03\lib\zi\Antarctica\McMurdo C:\Program Files\Java\jre1.6.0_03\lib\zi\Antarctica\Palmer C:\Program Files\Java\jre1.6.0_03\lib\zi\Antarctica\Rothera C:\Program Files\Java\jre1.6.0_03\lib\zi\Antarctica\Syowa C:\Program Files\Java\jre1.6.0_03\lib\zi\Antarctica\Vostok C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Aden C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Almaty C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Amman C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Anadyr C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Aqtau C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Aqtobe C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Ashgabat C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Baghdad C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Bahrain C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Baku C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Bangkok C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Beirut C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Bishkek C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Brunei C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Calcutta C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Choibalsan C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Chongqing C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Colombo C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Damascus C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Dhaka C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Dili C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Dubai C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Dushanbe C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Gaza C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Harbin C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Hong_Kong C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Hovd C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Irkutsk C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Jakarta C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Jayapura C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Jerusalem C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Kabul C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Kamchatka C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Karachi C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Kashgar C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Katmandu C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Krasnoyarsk C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Kuala_Lumpur C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Kuching C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Kuwait C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Macau C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Magadan C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Makassar C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Manila C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Muscat C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Nicosia C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Novosibirsk C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Omsk C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Oral C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Phnom_Penh C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Pontianak C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Pyongyang C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Qatar C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Qyzylorda C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Rangoon C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Riyadh C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Riyadh87 C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Riyadh88 C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Riyadh89 C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Saigon C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Sakhalin C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Samarkand C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Seoul C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Shanghai C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Singapore C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Taipei C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Tashkent C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Tbilisi C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Tehran C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Thimphu C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Tokyo C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Ulaanbaatar C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Urumqi C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Vientiane C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Vladivostok C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Yakutsk C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Yekaterinburg C:\Program Files\Java\jre1.6.0_03\lib\zi\Asia\Yerevan C:\Program Files\Java\jre1.6.0_03\lib\zi\Atlantic\Azores C:\Program Files\Java\jre1.6.0_03\lib\zi\Atlantic\Bermuda C:\Program Files\Java\jre1.6.0_03\lib\zi\Atlantic\Canary C:\Program Files\Java\jre1.6.0_03\lib\zi\Atlantic\Cape_Verde C:\Program Files\Java\jre1.6.0_03\lib\zi\Atlantic\Faroe C:\Program Files\Java\jre1.6.0_03\lib\zi\Atlantic\Madeira C:\Program Files\Java\jre1.6.0_03\lib\zi\Atlantic\Reykjavik C:\Program Files\Java\jre1.6.0_03\lib\zi\Atlantic\South_Georgia C:\Program Files\Java\jre1.6.0_03\lib\zi\Atlantic\St_Helena C:\Program Files\Java\jre1.6.0_03\lib\zi\Atlantic\Stanley C:\Program Files\Java\jre1.6.0_03\lib\zi\Australia\Adelaide C:\Program Files\Java\jre1.6.0_03\lib\zi\Australia\Brisbane C:\Program Files\Java\jre1.6.0_03\lib\zi\Australia\Broken_Hill C:\Program Files\Java\jre1.6.0_03\lib\zi\Australia\Currie C:\Program Files\Java\jre1.6.0_03\lib\zi\Australia\Darwin C:\Program Files\Java\jre1.6.0_03\lib\zi\Australia\Eucla C:\Program Files\Java\jre1.6.0_03\lib\zi\Australia\Hobart C:\Program Files\Java\jre1.6.0_03\lib\zi\Australia\Lindeman C:\Program Files\Java\jre1.6.0_03\lib\zi\Australia\Lord_Howe C:\Program Files\Java\jre1.6.0_03\lib\zi\Australia\Melbourne C:\Program Files\Java\jre1.6.0_03\lib\zi\Australia\Perth C:\Program Files\Java\jre1.6.0_03\lib\zi\Australia\Sydney C:\Program Files\Java\jre1.6.0_03\lib\zi\CET C:\Program Files\Java\jre1.6.0_03\lib\zi\CST6CDT C:\Program Files\Java\jre1.6.0_03\lib\zi\EET C:\Program Files\Java\jre1.6.0_03\lib\zi\EST C:\Program Files\Java\jre1.6.0_03\lib\zi\EST5EDT C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT-1 C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT-10 C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT-11 C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT-12 C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT-13 C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT-14 C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT-2 C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT-3 C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT-4 C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT-5 C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT-6 C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT-7 C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT-8 C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT-9 C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\GMT C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\UCT C:\Program Files\Java\jre1.6.0_03\lib\zi\Etc\UTC C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Amsterdam C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Andorra C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Athens C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Belgrade C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Berlin C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Brussels C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Bucharest C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Budapest C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Chisinau C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Copenhagen C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Dublin C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Gibraltar C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Helsinki C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Istanbul C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Kaliningrad C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Kiev C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Lisbon C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\London C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Luxembourg C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Madrid C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Malta C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Minsk C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Monaco C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Moscow C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Oslo C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Paris C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Prague C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Riga C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Rome C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Samara C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Simferopol C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Sofia C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Stockholm C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Tallinn C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Tirane C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Uzhgorod C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Vaduz C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Vienna C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Vilnius C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Volgograd C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Warsaw C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Zaporozhye C:\Program Files\Java\jre1.6.0_03\lib\zi\Europe\Zurich C:\Program Files\Java\jre1.6.0_03\lib\zi\GMT C:\Program Files\Java\jre1.6.0_03\lib\zi\HST C:\Program Files\Java\jre1.6.0_03\lib\zi\Indian\Antananarivo C:\Program Files\Java\jre1.6.0_03\lib\zi\Indian\Chagos C:\Program Files\Java\jre1.6.0_03\lib\zi\Indian\Christmas C:\Program Files\Java\jre1.6.0_03\lib\zi\Indian\Cocos C:\Program Files\Java\jre1.6.0_03\lib\zi\Indian\Comoro C:\Program Files\Java\jre1.6.0_03\lib\zi\Indian\Kerguelen C:\Program Files\Java\jre1.6.0_03\lib\zi\Indian\Mahe C:\Program Files\Java\jre1.6.0_03\lib\zi\Indian\Maldives C:\Program Files\Java\jre1.6.0_03\lib\zi\Indian\Mauritius C:\Program Files\Java\jre1.6.0_03\lib\zi\Indian\Mayotte C:\Program Files\Java\jre1.6.0_03\lib\zi\Indian\Reunion C:\Program Files\Java\jre1.6.0_03\lib\zi\MET C:\Program Files\Java\jre1.6.0_03\lib\zi\MST C:\Program Files\Java\jre1.6.0_03\lib\zi\MST7MDT C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Apia C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Auckland C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Chatham C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Easter C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Efate C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Enderbury C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Fakaofo C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Fiji C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Funafuti C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Galapagos C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Gambier C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Guadalcanal C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Guam C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Honolulu C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Johnston C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Kiritimati C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Kosrae C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Kwajalein C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Majuro C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Marquesas C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Midway C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Nauru C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Niue C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Norfolk C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Noumea C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Pago_Pago C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Palau C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Pitcairn C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Ponape C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Port_Moresby C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Rarotonga C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Saipan C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Tahiti C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Tarawa C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Tongatapu C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Truk C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Wake C:\Program Files\Java\jre1.6.0_03\lib\zi\Pacific\Wallis C:\Program Files\Java\jre1.6.0_03\lib\zi\PST8PDT C:\Program Files\Java\jre1.6.0_03\lib\zi\SystemV\AST4 C:\Program Files\Java\jre1.6.0_03\lib\zi\SystemV\AST4ADT C:\Program Files\Java\jre1.6.0_03\lib\zi\SystemV\CST6 C:\Program Files\Java\jre1.6.0_03\lib\zi\SystemV\CST6CDT C:\Program Files\Java\jre1.6.0_03\lib\zi\SystemV\EST5 C:\Program Files\Java\jre1.6.0_03\lib\zi\SystemV\EST5EDT C:\Program Files\Java\jre1.6.0_03\lib\zi\SystemV\HST10 C:\Program Files\Java\jre1.6.0_03\lib\zi\SystemV\MST7 C:\Program Files\Java\jre1.6.0_03\lib\zi\SystemV\MST7MDT C:\Program Files\Java\jre1.6.0_03\lib\zi\SystemV\PST8 C:\Program Files\Java\jre1.6.0_03\lib\zi\SystemV\PST8PDT C:\Program Files\Java\jre1.6.0_03\lib\zi\SystemV\YST9 C:\Program Files\Java\jre1.6.0_03\lib\zi\SystemV\YST9YDT C:\Program Files\Java\jre1.6.0_03\lib\zi\WET C:\Program Files\Java\jre1.6.0_03\lib\zi\ZoneInfoMappings C:\Program Files\Java\jre1.6.0_03\LICENSE C:\Program Files\Java\jre1.6.0_03\PATCH.ERR C:\Program Files\Java\jre1.6.0_03\README.txt C:\Program Files\Java\jre1.6.0_03\THIRDPARTYLICENSEREADME.txt C:\Program Files\Java\jre1.6.0_03\Welcome.html C:\Program Files\rcecdxf C:\Program Files\rcecdxf\UiHlp.dll C:\WINDOWS\system32\wdgzyfmf.exe . ((((((((((((((((((((((((( Files Created from 2008-07-15 to 2008-08-15 ))))))))))))))))))))))))))))))) . 2008-08-15 10:10 . 2008-08-15 10:10 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-08-15 10:10 . 2008-08-15 10:10 1,409 --a------ C:\WINDOWS\QTFont.for 2008-08-14 19:06 . 2008-08-14 19:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage 2008-08-14 17:20 . 2008-04-11 14:04 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll 2008-08-14 17:20 . 2008-05-01 09:33 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll 2008-08-13 11:17 . 2008-08-13 11:17 <DIR> d-------- C:\Program Files\Trend Micro 2008-08-10 21:29 . 2008-08-10 21:29 <DIR> d-------- C:\Deckard 2008-08-10 20:56 . 2008-08-10 20:56 <DIR> d-------- C:\WINDOWS\system32\scripting 2008-08-10 20:56 . 2008-08-10 20:56 <DIR> d-------- C:\WINDOWS\system32\en 2008-08-10 20:56 . 2008-08-10 20:56 <DIR> d-------- C:\WINDOWS\l2schemas 2008-08-10 20:24 . 2008-04-13 19:12 1,306,624 -----c--- C:\WINDOWS\system32\dllcache\msxml6.dll 2008-08-10 20:23 . 2008-04-13 19:11 650,752 --------- C:\WINDOWS\system32\dot3ui.dll 2008-08-10 19:38 . 2008-08-10 19:38 <DIR> d-------- C:\ie-spyad_zo 2008-08-10 19:27 . 2008-08-10 19:30 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-08-10 16:38 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys 2008-08-10 16:37 . 2008-08-10 16:37 <DIR> d-------- C:\Program Files\Panda Security 2008-08-09 22:32 . 2008-08-09 22:32 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-08-09 22:32 . 2008-08-09 22:32 <DIR> d-------- C:\Documents and Settings\Michael\Application Data\Malwarebytes 2008-08-09 22:32 . 2008-08-09 22:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-08-09 22:32 . 2008-07-30 20:14 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-08-09 22:32 . 2008-07-30 20:14 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-08-09 16:07 . 2008-08-09 16:07 0 --a------ C:\WINDOWS\system32\FCF.tmp 2008-08-08 21:10 . 2008-08-08 21:10 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Juniper Networks 2008-08-07 06:18 . 2008-08-07 06:18 <DIR> d-------- C:\Documents and Settings\Michael\.Arachnophilia 2008-08-07 06:17 . 2008-08-07 06:17 <DIR> d-------- C:\Program Files\Arachnophilia 2008-07-15 22:03 . 2008-07-15 22:03 40,304 --ah----- C:\WINDOWS\system32\mlfcache.dat . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-15 15:03 --------- d-----w C:\Program Files\Java 2008-08-15 01:09 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-08-13 23:57 --------- d-----w C:\Documents and Settings\Michael\Application Data\Skype 2008-08-13 21:29 --------- d-----w C:\Documents and Settings\Michael\Application Data\skypePM 2008-08-12 10:47 --------- d-----w C:\Program Files\Paint.NET 2008-08-10 13:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-08-10 12:39 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-08-10 04:01 --------- d-----w C:\Program Files\Lavasoft 2008-08-09 15:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-08-03 04:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\CanonIJPLM 2008-07-16 02:26 --------- d-----w C:\Program Files\Picasa2 2008-07-12 14:07 --------- d-----w C:\Documents and Settings\Michael\Application Data\ICAClient 2008-07-12 14:06 --------- d-----w C:\Documents and Settings\Michael\Application Data\Runaware 2008-06-30 15:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\BVRP Software 2008-06-30 15:34 --------- d-----w C:\Program Files\Motorola Phone Tools 2008-06-30 15:31 --------- d-----w C:\Program Files\Common Files\Motorola Shared 2008-06-30 15:30 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-06-30 15:30 --------- d-----w C:\Documents and Settings\User\Application Data\InstallShield 2008-06-27 20:14 --------- d-----w C:\Program Files\Common Files\Skype 2008-06-22 13:27 --------- d-----w C:\Program Files\UltraEdit 2008-06-22 13:25 1,564,236 ----a-w C:\Program Files\UltraEdit.zip 2008-06-20 11:51 361,600 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 11:40 138,496 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 11:08 225,856 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2008-04-25 16:56 56,912 ----a-w C:\Documents and Settings\Michael\g2mdlhlpx.exe 2008-01-15 03:59 744 ----a-w C:\Documents and Settings\Michael\pass.dat 2007-12-22 12:35 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat 2005-01-01 06:53 37 ----a-w C:\Documents and Settings\Owner\Application Data\tvmcwrd.dll 2005-01-01 06:52 127 ----a-w C:\Documents and Settings\Owner\Application Data\tvmdmns.dll 2004-12-31 20:46 163 ----a-w C:\Documents and Settings\Michael\Application Data\tvmdmns.dll 2004-12-31 20:03 28 ----a-w C:\Documents and Settings\Michael\Application Data\tvmcwrd.dll 2002-08-29 12:00 94,784 --sh--w C:\WINDOWS\twain.dll 2008-04-14 00:12 50,688 --sh--w C:\WINDOWS\twain_32.dll . ((((((((((((((((((((((((((((( snapshot@2008-08-13_10.37.03.40 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-15 01:09:33 59,904 ----a-r C:\WINDOWS\Installer\{7EC96FCD-0C12-46D3-988A-FB802F138BEB}\IconA3AFE979.exe + 2008-07-07 20:26:58 253,952 -c----w C:\WINDOWS\system32\dllcache\es.dll + 2008-06-24 16:43:16 74,240 -c----w C:\WINDOWS\system32\dllcache\mscms.dll - 2008-04-21 06:44:29 3,066,880 -c----w C:\WINDOWS\system32\dllcache\mshtml.dll + 2008-06-23 15:09:27 3,067,392 -c----w C:\WINDOWS\system32\dllcache\mshtml.dll + 2008-06-26 08:15:29 1,499,136 -c----w C:\WINDOWS\system32\dllcache\shdocvw.dll + 2008-06-26 08:15:30 619,520 -c----w C:\WINDOWS\system32\dllcache\urlmon.dll - 2008-04-21 06:44:29 666,112 -c----w C:\WINDOWS\system32\dllcache\wininet.dll + 2008-06-23 15:09:27 666,112 -c----w C:\WINDOWS\system32\dllcache\wininet.dll - 2008-04-14 00:11:53 246,272 ----a-w C:\WINDOWS\system32\es.dll + 2008-07-07 20:26:58 253,952 ----a-w C:\WINDOWS\system32\es.dll - 2008-04-14 00:11:54 691,712 ------w C:\WINDOWS\system32\inetcomm.dll + 2008-04-11 19:04:26 691,712 ------w C:\WINDOWS\system32\inetcomm.dll - 2007-09-25 04:30:28 135,168 ----a-w C:\WINDOWS\system32\java.exe + 2008-06-10 06:21:01 135,168 ----a-w C:\WINDOWS\system32\java.exe - 2007-09-25 04:30:30 135,168 ----a-w C:\WINDOWS\system32\javaw.exe + 2008-06-10 06:21:04 135,168 ----a-w C:\WINDOWS\system32\javaw.exe - 2007-09-25 05:31:42 139,264 ----a-w C:\WINDOWS\system32\javaws.exe + 2008-06-10 07:32:34 139,264 ----a-w C:\WINDOWS\system32\javaws.exe - 2008-04-14 00:11:58 73,728 ----a-w C:\WINDOWS\system32\mscms.dll + 2008-06-24 16:43:16 74,240 ----a-w C:\WINDOWS\system32\mscms.dll - 2008-04-21 06:44:29 3,066,880 ----a-w C:\WINDOWS\system32\mshtml.dll + 2008-06-23 15:09:27 3,067,392 ----a-w C:\WINDOWS\system32\mshtml.dll - 2008-04-14 00:12:05 1,499,136 ----a-w C:\WINDOWS\system32\shdocvw.dll + 2008-06-26 08:15:29 1,499,136 ----a-w C:\WINDOWS\system32\shdocvw.dll - 2008-04-14 00:12:38 60,416 ------w C:\WINDOWS\system32\tzchange.exe + 2008-07-11 12:42:28 62,976 ------w C:\WINDOWS\system32\tzchange.exe - 2008-04-14 00:12:08 619,520 ----a-w C:\WINDOWS\system32\urlmon.dll + 2008-06-26 08:15:30 619,520 ----a-w C:\WINDOWS\system32\urlmon.dll - 2008-04-21 06:44:29 666,112 ----a-w C:\WINDOWS\system32\wininet.dll + 2008-06-23 15:09:27 666,112 ----a-w C:\WINDOWS\system32\wininet.dll . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BackupNotify"="c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe" [2003-06-22 23:25 24576] "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-04-11 17:52 1409024] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-13 19:12 1695232] "NVIEW"="nview.dll" [2003-08-19 04:56 852038 C:\WINDOWS\system32\nview.dll] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-08-19 04:56 4841472] "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 18:04 52736] "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 09:07 114688] "CamMonitor"="c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 09:23 90112] "HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2003-05-23 04:55 483328] "UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-11-04 01:36 45056] "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 23:42 212992] "PS2"="C:\WINDOWS\system32\ps2.exe" [2002-10-16 18:57 81920] "Sunkist2k"="C:\Program Files\Multimedia Card Reader\shwicon2k.exe" [2003-08-14 21:11 139264] "CXMon"="C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe" [2001-09-19 11:18 45056] "Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 10:11 57344] "PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-10 17:26 406016] "BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 21:26 368706] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-08 18:33 53096] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 18:30 517768] "PNAgent"="C:\Program Files\PhatNoise Media Manager\PNAgent.exe" [2006-07-05 16:51 40960] "PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [2006-04-26 08:29 237568] "Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 02:08 483328] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] "CanonSolutionMenu"="C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 20:01 644696] "CanonMyPrinter"="C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 20:50 1603152] "SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 09:03 210472] "OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 12:02 79400] "WrtMon.exe"="C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 08:35 20480] "dmvoq.exe"="C:\WINDOWS\system32\dmvoq.exe" [BU] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784] "nwiz"="nwiz.exe" [2003-08-19 04:56 323584 C:\WINDOWS\system32\nwiz.exe] "LTMSG"="LTMSG.exe" [2003-07-14 19:52 40960 C:\WINDOWS\ltmsg.exe] "AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 14:47 57344 C:\WINDOWS\ALCXMNTR.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-25 20:23 443968] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "POSTRBT"="C:\Program Files\Norton AntiVirus\Navw32.exe" [2007-05-23 12:13 173680] C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ spamsubtract.lnk - C:\Program Files\interMute\SpamSubtract\SpamSub.exe [2003-10-14 00:24:52 557056] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe [2008-01-13 08:45:57 25214] SBC Self Support Tool.lnk - C:\Program Files\SBC Self Support Tool\bin\matcli.exe [2005-08-26 15:51:14 217088] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "AllowLegacyWebView"= 1 (0x1) "AllowUnhashedWebView"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "SpecifyDefaultButtons"= 0 (0x0) "Btn_Search"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.MJPG"= Pvmjpg21.dll "VIDC.PIM1"= pclepim1.dll "vidc.VP31"= vp31vfw.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\KODAK Software Updater.lnk backup=C:\WINDOWS\pss\KODAK Software Updater.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MindManager PDF Writer.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MindManager PDF Writer.lnk backup=C:\WINDOWS\pss\MindManager PDF Writer.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Uploader Oe Integration] --a------ 2007-06-10 19:02 40960 C:\Program Files\Free Download Manager\FUM\fumoei.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-03-30 10:36 267048 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD] --a------ 2003-02-11 22:02 61440 C:\hp\KBD\kbd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask] --a------ 2004-09-22 19:20 53248 C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge] --a------ 2003-12-10 04:52 380928 C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2008-04-13 19:12 1695232 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pamela.exe] --a------ 2007-12-22 07:57 6742016 C:\Program Files\Pamela\Pamela.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-03-28 23:37 413696 C:\Program Files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2008-05-30 15:54 21718312 C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YBrowser] --a------ 2003-07-11 13:51 57344 C:\Program Files\Yahoo!\browser\ybrwicon.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\StubInstaller.exe"= "C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\backWeb-7288971.exe"= "C:\\Program Files\\Neoteris\\Secure Application Manager\\dsSamProxy.exe"= "C:\\Program Files\\Best Buy Digital Music Store Powered by Rhapsody\\rhapsody.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 17:24] R1 NEOFLTR_530_10641;Juniper Networks TDI Filter Driver (NEOFLTR_530_10641);C:\WINDOWS\system32\Drivers\NEOFLTR_530_10641.SYS [2006-04-27 00:40] R2 IJPLMSVC;PIXMA Extended Survey Program;C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2007-04-13 10:49] R3 BENDER;Pinnacle AV/DV2 Capture;C:\WINDOWS\system32\drivers\bender.sys [2003-07-09 15:35] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c1e2986f-2c64-11dd-a400-000ea6631781}] \Shell\AutoRun\command - K:\Launch.exe /run . Contents of the 'Scheduled Tasks' folder 2008-08-13 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57] 2008-08-09 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Michael.job - C:\PROGRA~1\NORTON~1\Navw32.exe [2007-05-23 12:13] 2008-08-14 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job - C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe [] 2008-02-16 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job - C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe [] . - - - - ORPHANS REMOVED - - - - MSConfigStartUp-SunJavaUpdateSched - C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe ************************************************************************ catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-15 10:09:06 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Common Files\Symantec Shared\CCSETMGR.EXE C:\Program Files\Common Files\Symantec Shared\CCEVTMGR.EXE C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMNTOR.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\ScsiAccess.EXE C:\PROGRA~1\HEWLET~1\PHOTOS~1\HPSHAR~1\hpgs2wnf.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\iPod\bin\iPodService.exe C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE . ********************************************************************** . Completion time: 2008-08-15 10:20:48 - machine was rebooted ComboFix-quarantined-files.txt 2008-08-15 15:20:38 ComboFix2.txt 2008-08-13 15:38:22 Pre-Run: 30,958,436,352 bytes free Post-Run: 30,979,305,472 bytes free 916 --- E O F --- 2008-08-15 03:36:23 ***************** Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:28:24 AM, on 8/15/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\ScsiAccess.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\LTMSG.exe C:\windows\system\hpsysdrv.exe C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe C:\WINDOWS\System32\hphmon05.exe C:\WINDOWS\system32\ps2.exe C:\Program Files\Multimedia Card Reader\shwicon2k.exe C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe C:\PROGRA~1\HEWLET~1\PHOTOS~1\HPSHAR~1\hpgs2wnf.exe C:\WINDOWS\ALCXMNTR.EXE C:\Program Files\BroadJump\Client Foundation\CFD.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\PhatNoise Media Manager\PNAgent.exe C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Canon\MyPrinter\BJMyPrt.exe C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\iPod\bin\iPodService.exe C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE C:\WINDOWS\explorer.exe C:\Program Files\Common Files\Sonic\Update Manager\sgtray\sgtray.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - (no file) O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7 O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe" O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [PNAgent] "C:\Program Files\PhatNoise Media Manager\PNAgent.exe" O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe" O4 - HKLM\..\Run: [WrtMon.exe] C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe O4 - HKLM\..\Run: [dmvoq.exe] C:\WINDOWS\system32\dmvoq.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'Default user') O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user') O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ? O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: LimeShop Preferences - file://C:\Program Files\Lime_Shop\Sy700\Tp700\scri700a.htm O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing) O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - C:\Program Files\Free Download Manager\FUM\fumiebtn.dll (file missing) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?Link...04&clcid=0x409 O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.15.38/ttinst.cab O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{0689CEC2-8D77-4684-9520-B9193268E020}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CCS\Services\Tcpip\..\{5B7D92DE-C59E-4A96-8384-87D106A9DE5B}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CCS\Services\Tcpip\..\{F9852F02-FE8C-49A1-86BC-15688CF57C8D}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CS1\Services\Tcpip\..\{0689CEC2-8D77-4684-9520-B9193268E020}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CS2\Services\Tcpip\..\{0689CEC2-8D77-4684-9520-B9193268E020}: NameServer = 208.67.220.220,208.67.222.222 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe -- End of file - 16488 bytes Thanks, Michael.

08-15-2008, 12:31 PM	#12 (permalink)
mimartin Registered User Join Date: Aug 2008 Posts: 17 OS: xp, service pack 3	Re: "Windows Security Alert" continues after XPAntivirus removed Hi, I apologize, I reread my post and realized I didn't mention that Combofix indicated that "Windows cannot find 'C:ComboFix\CF-Submit.htm'." I looked in that directory and there aren't any files in it. Please advise if I need to rerun it to try again. I'm going to go do you latest instructions an will post the results. Thanks, Michael.

08-15-2008, 12:43 PM	#13 (permalink)
mimartin Registered User Join Date: Aug 2008 Posts: 17 OS: xp, service pack 3	Re: "Windows Security Alert" continues after XPAntivirus removed Hi, I ran Hijack This and selected the 7 entries you noted and clicked "Fix Checked." Here is the log: <edited: I posted the wrong log, here is the correct one> Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:46:24 PM, on 8/15/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\ScsiAccess.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\LTMSG.exe C:\windows\system\hpsysdrv.exe C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe C:\WINDOWS\System32\hphmon05.exe C:\WINDOWS\system32\ps2.exe C:\Program Files\Multimedia Card Reader\shwicon2k.exe C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe C:\WINDOWS\ALCXMNTR.EXE C:\PROGRA~1\HEWLET~1\PHOTOS~1\HPSHAR~1\hpgs2wnf.exe C:\Program Files\BroadJump\Client Foundation\CFD.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\PhatNoise Media Manager\PNAgent.exe C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Canon\MyPrinter\BJMyPrt.exe C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\Program Files\Messenger\msmsgs.exe C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe C:\WINDOWS\explorer.exe C:\Program Files\Common Files\Sonic\Update Manager\sgtray\sgtray.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7 O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe" O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [PNAgent] "C:\Program Files\PhatNoise Media Manager\PNAgent.exe" O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe" O4 - HKLM\..\Run: [WrtMon.exe] C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [POSTRBT] C:\Program Files\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'Default user') O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user') O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ? O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: LimeShop Preferences - file://C:\Program Files\Lime_Shop\Sy700\Tp700\scri700a.htm O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing) O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - C:\Program Files\Free Download Manager\FUM\fumiebtn.dll (file missing) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?Link...04&clcid=0x409 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{0689CEC2-8D77-4684-9520-B9193268E020}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CCS\Services\Tcpip\..\{5B7D92DE-C59E-4A96-8384-87D106A9DE5B}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CCS\Services\Tcpip\..\{F9852F02-FE8C-49A1-86BC-15688CF57C8D}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CS1\Services\Tcpip\..\{0689CEC2-8D77-4684-9520-B9193268E020}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CS2\Services\Tcpip\..\{0689CEC2-8D77-4684-9520-B9193268E020}: NameServer = 208.67.220.220,208.67.222.222 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe -- End of file - 15894 bytes Thanks, Michael. Last edited by mimartin; 08-15-2008 at 12:49 PM. Reason: Posted the wrong log

08-15-2008, 01:49 PM	#15 (permalink)
mimartin Registered User Join Date: Aug 2008 Posts: 17 OS: xp, service pack 3	Re: "Windows Security Alert" continues after XPAntivirus removed Hi, Here is the ComboFix log: ComboFix 08-08-14.03 - Michael 2008-08-15 15:34:42.4 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.247 [GMT -5:00] Running from: C:\Documents and Settings\Michael\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Michael\Desktop\CFScript * Created a new restore point . - REDUCED FUNCTIONALITY MODE - . ((((((((((((((((((((((((( Files Created from 2008-07-15 to 2008-08-15 ))))))))))))))))))))))))))))))) . 2008-08-15 10:10 . 2008-08-15 10:46 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-08-15 10:10 . 2008-08-15 10:10 1,409 --a------ C:\WINDOWS\QTFont.for 2008-08-14 19:06 . 2008-08-14 19:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage 2008-08-14 17:20 . 2008-04-11 14:04 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll 2008-08-14 17:20 . 2008-05-01 09:33 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll 2008-08-13 11:17 . 2008-08-13 11:17 <DIR> d-------- C:\Program Files\Trend Micro 2008-08-10 21:29 . 2008-08-10 21:29 <DIR> d-------- C:\Deckard 2008-08-10 20:56 . 2008-08-10 20:56 <DIR> d-------- C:\WINDOWS\system32\scripting 2008-08-10 20:56 . 2008-08-10 20:56 <DIR> d-------- C:\WINDOWS\system32\en 2008-08-10 20:56 . 2008-08-10 20:56 <DIR> d-------- C:\WINDOWS\l2schemas 2008-08-10 20:24 . 2008-04-13 19:12 1,306,624 -----c--- C:\WINDOWS\system32\dllcache\msxml6.dll 2008-08-10 20:23 . 2008-04-13 19:11 650,752 --------- C:\WINDOWS\system32\dot3ui.dll 2008-08-10 19:38 . 2008-08-10 19:38 <DIR> d-------- C:\ie-spyad_zo 2008-08-10 19:27 . 2008-08-10 19:30 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-08-10 16:38 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys 2008-08-10 16:37 . 2008-08-10 16:37 <DIR> d-------- C:\Program Files\Panda Security 2008-08-09 22:32 . 2008-08-09 22:32 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-08-09 22:32 . 2008-08-09 22:32 <DIR> d-------- C:\Documents and Settings\Michael\Application Data\Malwarebytes 2008-08-09 22:32 . 2008-08-09 22:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-08-09 22:32 . 2008-07-30 20:14 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-08-09 22:32 . 2008-07-30 20:14 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-08-09 16:07 . 2008-08-09 16:07 0 --a------ C:\WINDOWS\system32\FCF.tmp 2008-08-08 21:10 . 2008-08-08 21:10 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Juniper Networks 2008-08-07 06:18 . 2008-08-07 06:18 <DIR> d-------- C:\Documents and Settings\Michael\.Arachnophilia 2008-08-07 06:17 . 2008-08-07 06:17 <DIR> d-------- C:\Program Files\Arachnophilia 2008-07-15 22:03 . 2008-07-15 22:03 40,304 --ah----- C:\WINDOWS\system32\mlfcache.dat . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-15 15:03 --------- d-----w C:\Program Files\Java 2008-08-15 01:09 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-08-13 23:57 --------- d-----w C:\Documents and Settings\Michael\Application Data\Skype 2008-08-13 21:29 --------- d-----w C:\Documents and Settings\Michael\Application Data\skypePM 2008-08-12 10:47 --------- d-----w C:\Program Files\Paint.NET 2008-08-10 13:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-08-10 12:39 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-08-10 04:01 --------- d-----w C:\Program Files\Lavasoft 2008-08-09 15:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-08-03 04:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\CanonIJPLM 2008-07-16 02:26 --------- d-----w C:\Program Files\Picasa2 2008-07-12 14:07 --------- d-----w C:\Documents and Settings\Michael\Application Data\ICAClient 2008-07-12 14:06 --------- d-----w C:\Documents and Settings\Michael\Application Data\Runaware 2008-06-30 15:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\BVRP Software 2008-06-30 15:34 --------- d-----w C:\Program Files\Motorola Phone Tools 2008-06-30 15:31 --------- d-----w C:\Program Files\Common Files\Motorola Shared 2008-06-30 15:30 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-06-30 15:30 --------- d-----w C:\Documents and Settings\User\Application Data\InstallShield 2008-06-27 20:14 --------- d-----w C:\Program Files\Common Files\Skype 2008-06-22 13:27 --------- d-----w C:\Program Files\UltraEdit 2008-06-22 13:25 1,564,236 ----a-w C:\Program Files\UltraEdit.zip 2008-06-20 11:51 361,600 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 11:40 138,496 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 11:08 225,856 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2008-04-25 16:56 56,912 ----a-w C:\Documents and Settings\Michael\g2mdlhlpx.exe 2008-01-15 03:59 744 ----a-w C:\Documents and Settings\Michael\pass.dat 2007-12-22 12:35 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat 2005-01-01 06:53 37 ----a-w C:\Documents and Settings\Owner\Application Data\tvmcwrd.dll 2005-01-01 06:52 127 ----a-w C:\Documents and Settings\Owner\Application Data\tvmdmns.dll 2004-12-31 20:46 163 ----a-w C:\Documents and Settings\Michael\Application Data\tvmdmns.dll 2004-12-31 20:03 28 ----a-w C:\Documents and Settings\Michael\Application Data\tvmcwrd.dll 2002-08-29 12:00 94,784 --sh--w C:\WINDOWS\twain.dll 2008-04-14 00:12 50,688 --sh--w C:\WINDOWS\twain_32.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BackupNotify"="c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe" [2003-06-22 23:25 24576] "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-04-11 17:52 1409024] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-13 19:12 1695232] "NVIEW"="nview.dll" [2003-08-19 04:56 852038 C:\WINDOWS\system32\nview.dll] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-08-19 04:56 4841472] "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 18:04 52736] "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 09:07 114688] "CamMonitor"="c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 09:23 90112] "HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2003-05-23 04:55 483328] "UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-11-04 01:36 45056] "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 23:42 212992] "PS2"="C:\WINDOWS\system32\ps2.exe" [2002-10-16 18:57 81920] "Sunkist2k"="C:\Program Files\Multimedia Card Reader\shwicon2k.exe" [2003-08-14 21:11 139264] "CXMon"="C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe" [2001-09-19 11:18 45056] "Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 10:11 57344] "PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-10 17:26 406016] "BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 21:26 368706] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-08 18:33 53096] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 18:30 517768] "PNAgent"="C:\Program Files\PhatNoise Media Manager\PNAgent.exe" [2006-07-05 16:51 40960] "PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [2006-04-26 08:29 237568] "Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 02:08 483328] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] "CanonSolutionMenu"="C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 20:01 644696] "CanonMyPrinter"="C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 20:50 1603152] "SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 09:03 210472] "OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 12:02 79400] "WrtMon.exe"="C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 08:35 20480] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784] "nwiz"="nwiz.exe" [2003-08-19 04:56 323584 C:\WINDOWS\system32\nwiz.exe] "LTMSG"="LTMSG.exe" [2003-07-14 19:52 40960 C:\WINDOWS\ltmsg.exe] "AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 14:47 57344 C:\WINDOWS\ALCXMNTR.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-25 20:23 443968] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "POSTRBT"="C:\Program Files\Norton AntiVirus\Navw32.exe" [2007-05-23 12:13 173680] C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ spamsubtract.lnk - C:\Program Files\interMute\SpamSubtract\SpamSub.exe [2003-10-14 00:24:52 557056] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe [2008-01-13 08:45:57 25214] SBC Self Support Tool.lnk - C:\Program Files\SBC Self Support Tool\bin\matcli.exe [2005-08-26 15:51:14 217088] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "AllowLegacyWebView"= 1 (0x1) "AllowUnhashedWebView"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "SpecifyDefaultButtons"= 0 (0x0) "Btn_Search"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.MJPG"= Pvmjpg21.dll "VIDC.PIM1"= pclepim1.dll "vidc.VP31"= vp31vfw.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\KODAK Software Updater.lnk backup=C:\WINDOWS\pss\KODAK Software Updater.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MindManager PDF Writer.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MindManager PDF Writer.lnk backup=C:\WINDOWS\pss\MindManager PDF Writer.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Uploader Oe Integration] --a------ 2007-06-10 19:02 40960 C:\Program Files\Free Download Manager\FUM\fumoei.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-03-30 10:36 267048 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD] --a------ 2003-02-11 22:02 61440 C:\hp\KBD\kbd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask] --a------ 2004-09-22 19:20 53248 C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge] --a------ 2003-12-10 04:52 380928 C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2008-04-13 19:12 1695232 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pamela.exe] --a------ 2007-12-22 07:57 6742016 C:\Program Files\Pamela\Pamela.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-03-28 23:37 413696 C:\Program Files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2008-05-30 15:54 21718312 C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YBrowser] --a------ 2003-07-11 13:51 57344 C:\Program Files\Yahoo!\browser\ybrwicon.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\StubInstaller.exe"= "C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\backWeb-7288971.exe"= "C:\\Program Files\\Neoteris\\Secure Application Manager\\dsSamProxy.exe"= "C:\\Program Files\\Best Buy Digital Music Store Powered by Rhapsody\\rhapsody.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 17:24] R1 NEOFLTR_530_10641;Juniper Networks TDI Filter Driver (NEOFLTR_530_10641);C:\WINDOWS\system32\Drivers\NEOFLTR_530_10641.SYS [2006-04-27 00:40] R2 IJPLMSVC;PIXMA Extended Survey Program;C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2007-04-13 10:49] R3 BENDER;Pinnacle AV/DV2 Capture;C:\WINDOWS\system32\drivers\bender.sys [2003-07-09 15:35] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c1e2986f-2c64-11dd-a400-000ea6631781}] \Shell\AutoRun\command - K:\Launch.exe /run . Contents of the 'Scheduled Tasks' folder 2008-08-13 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57] 2008-08-09 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Michael.job - C:\PROGRA~1\NORTON~1\Navw32.exe [2007-05-23 12:13] 2008-08-14 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job - C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe [] 2008-02-16 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job - C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe [] . ************************************************************************ catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-15 15:35:28 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . Completion time: 2008-08-15 15:45:22 ComboFix-quarantined-files.txt 2008-08-15 20:45:18 ComboFix2.txt 2008-08-13 15:38:22 Pre-Run: 31,308,914,688 bytes free Post-Run: 31,293,382,656 bytes free 218 --- E O F --- 2008-08-15 03:36:23 Thanks, Michael.

08-15-2008, 02:05 PM	#16 (permalink)
TheBruce1 Moderator, Analyst, Security Team Join Date: Oct 2006 Location: Dùn Èideann,Scotland. Posts: 4,531 OS: XP	Re: "Windows Security Alert" continues after XPAntivirus removed Did you submit the file? What is the time stamp on the zip file. __________________ Member of ASAP since 2007 Member of UNITE since 2008 Notice to BT customers BT to dump Phorm, see Here for more information. No DPI If we have helped you in anyway, please consider Donating

08-15-2008, 02:21 PM	#17 (permalink)
mimartin Registered User Join Date: Aug 2008 Posts: 17 OS: xp, service pack 3	Re: "Windows Security Alert" continues after XPAntivirus removed Hi, The only thing that came up was the log file that I copied and posted. There wasn't any other windows after it ran and I didn't get any prompts to send anything. Internet connection is up as I've been online all day. Is the file saved somewhere so I could manually send it? Thanks, Michael.

08-15-2008, 02:34 PM	#18 (permalink)
TheBruce1 Moderator, Analyst, Security Team Join Date: Oct 2006 Location: Dùn Èideann,Scotland. Posts: 4,531 OS: XP	Re: "Windows Security Alert" continues after XPAntivirus removed Upload this file: C:\Qoobox\Quarantine To this website: http://www.bleepingcomputer.com/submit-malware.php?channel=4 Include this link into your submission: http://www.techsupportforum.com/security-center/hijackthis-log-help/279088-windows-security-alert-continues-after-xpantivirus-removed.html When done let me know, i will not be back until around 6pm(GMT) tomorrow. __________________ Member of ASAP since 2007 Member of UNITE since 2008 Notice to BT customers BT to dump Phorm, see Here for more information. No DPI If we have helped you in anyway, please consider Donating

08-15-2008, 03:28 PM	#19 (permalink)
mimartin Registered User Join Date: Aug 2008 Posts: 17 OS: xp, service pack 3	Re: "Windows Security Alert" continues after XPAntivirus removed Hi, I zipped C:\Qoobox\Quarantine and tried to send it as directed at bleepingcomputer. The website responded that an unknown error occured. I contacted bleepingcomputer to inform them. I will try again later today. Thanks, Michael.

08-15-2008, 07:43 PM	#20 (permalink)
mimartin Registered User Join Date: Aug 2008 Posts: 17 OS: xp, service pack 3	Re: "Windows Security Alert" continues after XPAntivirus removed Hi, Tried again. Same failure. Any other suggestions on how to get that info? Thanks, Michael.