Tech Support Forum banner
Cancel

Can't remove malware via any reputable anti-virus programs.

1010 Views 7 Replies 2 Participants Last post by  forhockey, 
D
More specifically, the Awola virus, as it could be called. Simply put, it's a rogue anti-spyware program that managed to install itself (Imagine that), but the problem is, despite numerous attempts, I can not seem to get rid of it. I am getting a warning window in the lower-right hand side of my screen saying "Your computer is infected! Windows has detected spware infection. It is recommended to use special antispyware tools to prevent data loss..." and so on, yet the thing will never seem to go away, no matter how many times I close the window. Along with it, that boots itself is the actual rogue anti-virus program, Awola, providing false positives for viruses, and prompting me to buy the full version. On top of this, I believe this program may also be downloading other malware on to my computer, as well as hijacking my desktop background into a cheesy (and almost cute) little window, informing me my system is infected.

Anyway, here are my logs:




Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Professional (build 2600) SP 2.0
Architecture: X86; Language: English

CPU 0: AMD Athlon(tm) 64 X2 Dual Core Processor 4600+
CPU 1: AMD Athlon(tm) 64 X2 Dual Core Processor 4600+
Percentage of Memory in Use: 44%
Physical Memory (total/avail): 1022.42 MiB / 571.02 MiB
Pagefile Memory (total/avail): 2459.52 MiB / 2008.48 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1907.34 MiB

A: is Removable (No Media)
C: is Fixed (NTFS) - 93.15 GiB total, 72.64 GiB free.
D: is Fixed (NTFS) - 186.3 GiB total, 69.92 GiB free.
E: is CDROM (CDFS)
F: is CDROM (No Media)

\\.\PHYSICALDRIVE0 - ST3300620AS - 279.46 GiB - 2 partitions
\PARTITION0 (bootable) - Installable File System - 93.15 GiB - C:
\PARTITION1 - Extended w/Extended Int 13 - 186.3 GiB - D:



-- Security Center -------------------------------------------------------------

Windows Internal Firewall is enabled.

FirstRunDisabled is set.

AV: AVG 7.5.519 v7.5.519 (Grisoft)

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\\WINDOWS\\system32\\rundll32.exe"="C:\\WINDOWS\\system32\\rundll32.exe:*:Enabled:Run a DLL as an App"
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe"


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Dave\Application Data
CLASSPATH=.;C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=DAVID
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Dave
LOGONSERVER=\\DAVID
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\Program Files\Internet Explorer;;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\QuickTime\QTSystem\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 75 Stepping 2, AuthenticAMD
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=4b02
ProgramFiles=C:\Program Files
PROMPT=$P$G
QTJAVA=C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\Dave\LOCALS~1\Temp
TMP=C:\DOCUME~1\Dave\LOCALS~1\Temp
USERDOMAIN=DAVID
USERNAME=Dave
USERPROFILE=C:\Documents and Settings\Dave
windir=C:\WINDOWS


-- User Profiles ---------------------------------------------------------------

Dave (admin)


-- Add/Remove Programs ---------------------------------------------------------

--> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Ad-Aware 2007 --> MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin --> C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Shockwave Player --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
AIM 6 --> C:\Program Files\AIM6\uninst.exe
Apple Mobile Device Support --> MsiExec.exe /I{44734179-8A79-4DEE-BB08-73037F065543}
Apple Software Update --> MsiExec.exe /I{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}
AVG 7.5 --> C:\Program Files\Grisoft\AVG7\setup.exe /UNINSTALL
Bonjour --> MsiExec.exe /I{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}
DivX Content Uploader --> C:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
DivX Web Player --> C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Internet Speed Monitor --> C:\Program Files\ISM\Uninstall.exe
iTunes --> MsiExec.exe /I{80FD852F-5AAC-4129-B931-06AAFFA43138}
Java(TM) 6 Update 3 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Logitech QuickCam --> MsiExec.exe /X{945AC98B-3DC8-45BE-BAE0-22CEEE37A103}
Logitech QuickCam Driver Package --> "C:\Program Files\Common Files\LogiShrd\LogiDriverStore\lvdrivers\11.50.1145\LgDrvInst.exe" -remove -instdir"C:\Program Files\Common Files\LogiShrd\LogiDriverStore\lvdrivers\" -enumdelay=2000 -enabledifx -forcedelete -usbhubsfirst -forceremove -cumulativeremove -promptuninstall -arpregkey"lvdrivers_11.50" /clone_wait /hide_progress
Microsoft Office Access MUI (English) 2007 --> MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
Microsoft Office Access Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
Microsoft Office Enterprise 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007 --> MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2007 --> MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Groove MUI (English) 2007 --> MsiExec.exe /X{90120000-00BA-0409-0000-0000000FF1CE}
Microsoft Office Groove Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0114-0409-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (English) 2007 --> MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE}
Microsoft Office OneNote MUI (English) 2007 --> MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2007 --> MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007 --> MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Project MUI (English) 2007 --> MsiExec.exe /X{90120000-00B4-0409-0000-0000000FF1CE}
Microsoft Office Project Professional 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PRJPRO /dll OSETUP.DLL
Microsoft Office Project Professional 2007 --> MsiExec.exe /X{90120000-003B-0000-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007 --> MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007 --> MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007 --> MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007 --> MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Publisher MUI (English) 2007 --> MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007 --> MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007 --> MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Mozilla Firefox (2.0.0.12) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
NVIDIA Drivers --> C:\WINDOWS\system32\nvuninst.exe UninstallGUI
Panda ActiveScan --> C:\WINDOWS\system32\ASUninst.exe Panda ActiveScan
QuickTime --> MsiExec.exe /I{BFD96B89-B769-4CD6-B11E-E79FFD46F067}
RealPlayer --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Rhapsody Player Engine --> MsiExec.exe /I{22DE1881-9D24-4981-B5CC-EC7E9F2F4D52}
SpywareBlaster 4.0 --> "C:\Program Files\SpywareBlaster\unins000.exe"
SUPERAntiSpyware Free Edition --> MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}
Ventrilo Client --> MsiExec.exe /I{789289CA-F73A-4A16-A331-54D498CE069F}
Warcraft III: All Products --> C:\WINDOWS\War3Unin.exe C:\WINDOWS\War3Unin.dat
World of Warcraft --> C:\Program Files\Common Files\Blizzard Entertainment\World of Warcraft\Uninstall.exe
Xtreme Sound PCI --> C:\WINDOWS\CmiPCIUninstall.exe C:\Program Files\Xtreme Sound PCI#C-Media PCI Audio#Xtreme Sound PCI#
Yahoo! Messenger --> C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG


-- Application Event Log -------------------------------------------------------

Event Record #/Type1255 / Error
Event Submitted/Written: 03/16/2008 08:42:23 PM
Event ID/Source: 11 / crypt32
Event Description:
Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: The data is invalid.

Event Record #/Type1252 / Error
Event Submitted/Written: 03/16/2008 08:42:23 PM
Event ID/Source: 11 / crypt32
Event Description:
Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: The data is invalid.

Event Record #/Type1251 / Error
Event Submitted/Written: 03/16/2008 08:42:23 PM
Event ID/Source: 11 / crypt32
Event Description:
Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: The data is invalid.

Event Record #/Type1248 / Error
Event Submitted/Written: 03/16/2008 08:42:22 PM
Event ID/Source: 11 / crypt32
Event Description:
Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: The data is invalid.

Event Record #/Type1247 / Error
Event Submitted/Written: 03/16/2008 08:42:22 PM
Event ID/Source: 11 / crypt32
Event Description:
Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: The data is invalid.



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type2872 / Warning
Event Submitted/Written: 03/16/2008 07:21:22 PM
Event ID/Source: 4226 / Tcpip
Event Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Event Record #/Type2854 / Error
Event Submitted/Written: 03/16/2008 05:00:26 PM
Event ID/Source: 7000 / Service Control Manager
Event Description:
The Task Scheduler service failed to start due to the following error:
%%2

Event Record #/Type2853 / Error
Event Submitted/Written: 03/16/2008 05:00:18 PM
Event ID/Source: 2505 / Server
Event Description:
The server could not bind to the transport \Device\NetBT_Tcpip_{55F0F28E-5399-40B5-8054-ED0F200153B9} because another computer on the network has the same name. The server could not start.

Event Record #/Type2852 / Error
Event Submitted/Written: 03/16/2008 05:00:18 PM
Event ID/Source: 4321 / NetBT
Event Description:
The name "DAVID :20" could not be registered on the Interface with IP address 192.168.100.24.
The machine with the IP address 192.168.100.5 did not allow the name to be claimed by
this machine.

Event Record #/Type2850 / Warning
Event Submitted/Written: 03/16/2008 05:00:09 PM
Event ID/Source: 3033 / MRxSmb
Event Description:
The redirector was unable to register the address for transport NetBT_Tcpip_{55F0F28E-5399-40B5-8054 for the following reason: . Transport has been taken offline.



-- End of Deckard's System Scanner: finished at 2008-03-16 20:43:10 ------------
See less See more
Save
Like
Status
Not open for further replies.
1 - 8 of 8 Posts
forhockey
Hi Darkmuffin,

Please subscribe to this thread so that you are notified when you receive a reply. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Add Subscription.

--------------------------------------------------------------

You managed to only post the extra.txt log. Please run DSS.exe again, and post the main.txt
Save
Like
D
Oh god, I'm terribly sorry for the slow reply and posting the wrong information (but on the bright side, at least it's there if ya need it now =P) I believe I did subscribe already, but I never really check my email... I'll make a habit of it for this.

Anyway, here is the main (and more recent) log.






Deckard's System Scanner v20071014.68
Run by Dave on 2008-03-18 16:38:07
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-03-18 16:38:16
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\QdrPack\QdrPack14.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Common Files\AOL\Loader\aolload.exe
C:\Documents and Settings\Dave\Application Data\eyaoy.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Grisoft\AVG7\avgw.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Dave\Local Settings\Temporary Internet Files\Content.IE5\LG09ZF32\dss[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [CmPCIaudio] RunDll32 CMICNFG3.CPL,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [ntuser] C:\WINDOWS\system32\drivers\ctfmon.exe
O4 - HKLM\..\Run: [autoload] C:\Documents and Settings\Dave\Local Settings\Application Data\spool.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [QdrModule13] "C:\Program Files\QdrModule\QdrModule13.exe"
O4 - HKCU\..\Run: [QdrPack14] "C:\Program Files\QdrPack\QdrPack14.exe"
O4 - HKCU\..\Run: [Microsoft Windows Adapter 5.1.3214] C:\Documents and Settings\Dave\Application Data\eyaoy.exe
O4 - HKCU\..\Run: [autoload] C:\Documents and Settings\Dave\Local Settings\Application Data\spool.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [Awola6] "C:\Documents and Settings\Dave\Application Data\Awola6\Awola6.exe" /MIN
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [autoload] C:\Documents and Settings\LocalService\Local Settings\Application Data\spool.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [autoload] C:\Documents and Settings\LocalService\Local Settings\Application Data\spool.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1205728091796
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{55F0F28E-5399-40B5-8054-ED0F200153B9}: NameServer = 85.255.114.59,85.255.112.80
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{DE639F3A-1727-4AF8-A101-E073AE75B09A}: NameServer = 85.255.114.59,85.255.112.80
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{F8F4E780-5333-408B-8C23-7841C51DE7AF}: NameServer = 85.255.114.59,85.255.112.80
O17 - HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.59 85.255.112.80
O17 - HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.59 85.255.112.80
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.59 85.255.112.80
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Task Scheduler (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\ctfmon.exe


--
End of file - 8813 bytes

-- Files created between 2008-02-18 and 2008-03-18 -----------------------------

2008-03-16 20:27:48 0 d---s---- C:\Documents and Settings\Dave\UserData
2008-03-16 20:23:01 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-16 20:22:45 0 d-------- C:\Program Files\SpywareBlaster
2008-03-16 19:12:02 0 d-------- C:\WINDOWS\system32\ActiveScan
2008-03-16 02:40:37 5120 --a------ C:\Documents and Settings\Dave\ftpdll.dll
2008-03-16 02:40:36 5120 --a------ C:\WINDOWS\system32\ftpdll.dll
2008-03-16 02:40:36 5120 --a------ C:\Documents and Settings\LocalService\ftpdll.dll
2008-03-16 01:55:38 0 d-------- C:\Documents and Settings\Dave\Application Data\Awola6
2008-03-16 01:03:04 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-03-16 01:03:00 0 d-------- C:\Program Files\SUPERAntiSpyware
2008-03-16 01:03:00 0 d-------- C:\Documents and Settings\Dave\Application Data\SUPERAntiSpyware.com
2008-03-16 00:53:33 487936 --a------ C:\Documents and Settings\Dave\installer.exe <Not Verified; Awola Corporation; Awola Anti Spyware>
2008-03-16 00:48:35 0 dr-h----- C:\$VAULT$.AVG
2008-03-15 23:36:54 0 d-------- C:\Program Files\Lavasoft
2008-03-15 23:36:53 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-03-15 21:19:53 0 d-------- C:\Documents and Settings\Dave\Application Data\AVG7
2008-03-15 21:19:46 0 d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2008-03-15 21:19:26 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-15 21:19:26 0 d-------- C:\Documents and Settings\All Users\Application Data\avg7
2008-03-15 21:15:00 0 d-------- C:\Program Files\QdrModule
2008-03-15 21:14:58 0 d-------- C:\Program Files\QdrDrive
2008-03-15 21:14:58 0 d-------- C:\Program Files\ISM
2008-03-15 20:44:36 0 --ahs---- C:\Documents and Settings\Dave\Application Data\0047dca57bb14a93dd623a7a6f1d12696e592b62130ba1e2bc.dat
2008-03-15 20:27:48 0 d-------- C:\Documents and Settings\Dave\Application Data\Anti-Virus-Pro.com
2008-03-15 20:27:46 0 d-------- C:\Program Files\AntiVirusPro
2008-03-15 20:27:36 18432 --a------ C:\WINDOWS\system32\BluetoothAuthorizationAgent.exe
2008-03-15 20:21:03 14336 --a------ C:\Documents and Settings\Dave\Application Data\eyaoy.exe
2008-03-15 20:19:03 14336 --a------ C:\7pxswc.exe
2008-03-15 20:19:02 0 d-------- C:\Program Files\QdrPack
2008-03-14 20:58:41 23040 --a------ C:\WINDOWS\system32\000090.exe
2008-03-02 20:56:04 0 d-------- C:\Documents and Settings\All Users\Application Data\Logishrd
2008-03-02 20:56:02 0 d-------- C:\Program Files\Common Files\LogiShrd
2008-03-02 20:55:58 0 d-------- C:\Program Files\Logitech
2008-03-02 20:55:58 0 d-------- C:\Documents and Settings\All Users\Application Data\Logitech
2008-03-01 20:45:15 70995 --a------ C:\WINDOWS\War3Unin.dat
2008-03-01 20:45:13 2829 --a------ C:\WINDOWS\War3Unin.pif
2008-03-01 20:45:13 139264 --a------ C:\WINDOWS\War3Unin.exe <Not Verified; Blizzard Entertainment; Warcraft III Uninstaller>
2008-03-01 18:03:57 0 d-------- C:\Program Files\Warcraft III
2008-02-29 21:00:15 0 d-------- C:\Program Files\DivX
2008-02-29 21:00:00 672 --a------ C:\WINDOWS\mozver.dat
2008-02-28 21:01:13 0 d-------- C:\Documents and Settings\Dave\Application Data\Ventrilo
2008-02-28 21:01:02 0 d-------- C:\Program Files\Ventrilo
2008-02-28 21:00:52 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-28 21:00:47 0 d-------- C:\WINDOWS\system32\appmgmt
2008-02-28 16:11:49 0 d-------- C:\Program Files\MSBuild
2008-02-28 16:00:32 0 d-------- C:\Program Files\Microsoft Works
2008-02-28 15:59:35 0 d-------- C:\WINDOWS\SHELLNEW
2008-02-28 15:59:16 0 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-02-28 15:59:03 0 dr-h----- C:\MSOCache
2008-02-22 15:44:24 0 d-------- C:\WINDOWS\system32\ReinstallBackups
2008-02-22 15:44:15 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-02-21 22:41:40 0 d-------- C:\Program Files\Common Files\Blizzard Entertainment
2008-02-21 22:41:37 0 d-------- C:\Program Files\World of Warcraft
2008-02-21 21:47:28 0 d-------- C:\WINDOWS\Sun
2008-02-21 21:47:28 0 d-------- C:\Documents and Settings\Dave\Application Data\Sun
2008-02-21 19:32:46 0 d-------- C:\Documents and Settings\Dave\Application Data\Apple Computer
2008-02-21 19:32:37 0 d-------- C:\Program Files\iPod
2008-02-21 19:32:35 0 d-------- C:\Program Files\iTunes
2008-02-21 19:32:29 0 d-------- C:\Program Files\Bonjour
2008-02-21 19:32:12 0 d-------- C:\Program Files\QuickTime
2008-02-21 19:32:11 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-02-21 19:32:03 0 d-------- C:\Program Files\Apple Software Update
2008-02-21 19:32:00 0 d------c- C:\WINDOWS\system32\DRVSTORE
2008-02-21 19:31:33 0 d-------- C:\Program Files\Common Files\Apple
2008-02-21 19:31:32 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-02-21 19:18:32 0 d-------- C:\Program Files\Common Files\xing shared
2008-02-21 19:18:23 0 d-------- C:\Program Files\Real
2008-02-21 19:18:23 0 d-------- C:\Program Files\Common Files\Real
2008-02-21 19:17:45 0 d-------- C:\Documents and Settings\Dave\Application Data\Real
2008-02-21 19:15:57 0 d-------- C:\Program Files\Java
2008-02-21 19:15:41 0 d-------- C:\Program Files\Common Files\Java
2008-02-21 19:10:18 0 d-------- C:\Documents and Settings\Dave\Application Data\Macromedia
2008-02-21 19:10:06 0 d-------- C:\Documents and Settings\Dave\Application Data\Adobe
2008-02-21 19:10:06 0 d-------- C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-02-21 19:09:29 0 d-------- C:\Program Files\Yahoo!
2008-02-21 19:07:42 0 d-------- C:\Documents and Settings\Dave\Application Data\acccore
2008-02-21 19:07:24 0 d-------- C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-02-21 19:07:21 0 d-------- C:\Documents and Settings\All Users\Application Data\AOL
2008-02-21 19:07:21 0 d-------- C:\Documents and Settings\All Users\Application Data\AOL OCP
2008-02-21 19:07:09 0 d-------- C:\Program Files\Common Files\AOL
2008-02-21 19:06:55 0 d-------- C:\Program Files\AIM6
2008-02-21 17:26:56 0 d-------- C:\WINDOWS\nview
2008-02-21 17:26:36 0 d-------- C:\NVIDIA
2008-02-21 17:18:13 53248 --a------ C:\WINDOWS\CmiPCIUninstall.exe <Not Verified; C-Media Corporation; CmiUSBUninstall Application>
2008-02-21 17:18:12 32768 --a------ C:\WINDOWS\system32\UDAPROP3.DLL <Not Verified; C-Media Corporation; CMI8738/CMI9738/CMI9739 Audio Device>
2008-02-21 17:18:12 1355456 --a------ C:\WINDOWS\system32\drivers\cmuda3.sys <Not Verified; C-Media Inc; C-Media Audio Driver (WDM)>
2008-02-21 17:18:12 36864 --a------ C:\WINDOWS\system32\CMUDA3.DLL <Not Verified; C-Media; C-Media cmuda.dll>
2008-02-21 17:18:12 233472 --a------ C:\WINDOWS\system32\CMRMDRV3.exe <Not Verified; ; CmiRemoveDriver Application>
2008-02-21 17:18:12 28672 --a------ C:\WINDOWS\system32\CMRMDRV3.DLL
2008-02-21 17:18:12 712704 --a------ C:\WINDOWS\system32\AUDIO3D3.DLL <Not Verified; Sensaura Ltd; Sensaura>
2008-02-21 17:18:12 712704 --a------ C:\WINDOWS\system32\a3d.dll <Not Verified; Sensaura Ltd; Sensaura>
2008-02-21 17:18:12 917504 --a------ C:\WINDOWS\system\CMDS3D3.DLL <Not Verified; C-Media Electronics Inc.; C-Media Cmids3d>
2008-02-21 17:18:12 0 d-------- C:\Program Files\Xtreme Sound PCI
2008-02-21 17:17:34 0 d-------- C:\Program Files\Xtreme Sound Setup Files
2008-02-21 17:16:59 0 d-------- C:\Diamond
2008-02-21 17:13:05 0 --a------ C:\WINDOWS\nsreg.dat
2008-02-21 17:13:04 0 d-------- C:\Documents and Settings\Dave\Application Data\Mozilla
2008-02-21 17:08:33 0 d-------- C:\Linksys Driver
2008-02-21 16:57:35 0 d-------- C:\Program Files\Broadcom
2008-02-21 16:45:06 94208 -----n--- C:\WINDOWS\system32\GTW32N50.dll
2008-02-21 16:45:06 15872 -----n--- C:\WINDOWS\system32\GTNDIS5.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
2008-02-21 16:44:54 0 d-------- C:\Program Files\Common Files\InstallShield
2008-02-21 15:20:58 0 d-------- C:\Documents and Settings\Dave\Application Data\Identities
2008-02-21 15:20:46 0 d--h----- C:\Documents and Settings\Dave\Templates
2008-02-21 15:20:46 0 dr------- C:\Documents and Settings\Dave\Start Menu
2008-02-21 15:20:46 0 dr-h----- C:\Documents and Settings\Dave\SendTo
2008-02-21 15:20:46 0 dr-h----- C:\Documents and Settings\Dave\Recent
2008-02-21 15:20:46 0 d--h----- C:\Documents and Settings\Dave\PrintHood
2008-02-21 15:20:46 2621440 --ah----- C:\Documents and Settings\Dave\NTUSER.DAT
2008-02-21 15:20:46 0 d--h----- C:\Documents and Settings\Dave\NetHood
2008-02-21 15:20:46 0 dr------- C:\Documents and Settings\Dave\My Documents
2008-02-21 15:20:46 0 d--h----- C:\Documents and Settings\Dave\Local Settings
2008-02-21 15:20:46 0 dr------- C:\Documents and Settings\Dave\Favorites
2008-02-21 15:20:46 0 d-------- C:\Documents and Settings\Dave\Desktop
2008-02-21 15:20:46 0 d---s---- C:\Documents and Settings\Dave\Cookies
2008-02-21 15:20:46 0 dr-h----- C:\Documents and Settings\Dave\Application Data
2008-02-21 15:20:08 0 d-------- C:\WINDOWS\SoftwareDistribution
2008-02-21 15:20:07 0 d---s---- C:\WINDOWS\system32\Microsoft
2008-02-21 15:20:07 0 d-------- C:\WINDOWS\Prefetch
2008-02-21 15:20:06 262144 --ah----- C:\Documents and Settings\LocalService\NTUSER.DAT
2008-02-21 15:20:06 0 d--h----- C:\Documents and Settings\LocalService\Local Settings
2008-02-21 15:20:06 0 d---s---- C:\Documents and Settings\LocalService\Cookies
2008-02-21 15:20:06 0 d-------- C:\Documents and Settings\LocalService\Application Data
2008-02-21 15:20:06 0 d---s---- C:\Documents and Settings\LocalService\Application Data\Microsoft
2008-02-21 15:14:27 225280 --ah----- C:\Documents and Settings\NetworkService\NTUSER.DAT
2008-02-21 15:14:27 0 d--h----- C:\Documents and Settings\NetworkService\Local Settings
2008-02-21 15:14:27 0 d---s---- C:\Documents and Settings\NetworkService\Cookies
2008-02-21 15:14:27 0 d-------- C:\Documents and Settings\NetworkService\Application Data
2008-02-21 15:14:27 0 d---s---- C:\Documents and Settings\NetworkService\Application Data\Microsoft
2008-02-21 15:12:09 0 d-------- C:\WINDOWS\system32\xircom
2008-02-21 15:12:09 0 d-------- C:\Program Files\microsoft frontpage
2008-02-21 15:12:00 225280 ---h----- C:\Documents and Settings\Default User\NTUSER.DAT
2008-02-21 15:11:52 0 -rahs---- C:\MSDOS.SYS
2008-02-21 15:11:52 0 -rahs---- C:\IO.SYS
2008-02-21 15:11:52 0 --a------ C:\CONFIG.SYS
2008-02-21 15:11:52 0 --a------ C:\AUTOEXEC.BAT
2008-02-21 15:11:12 0 d--hs---- C:\Documents and Settings\All Users\DRM
2008-02-21 15:11:05 0 dr------- C:\WINDOWS\Offline Web Pages
2008-02-21 15:11:05 0 d---s---- C:\WINDOWS\Downloaded Program Files
2008-02-21 15:10:58 0 d--h----- C:\Program Files\WindowsUpdate
2008-02-21 15:10:45 0 d-------- C:\WINDOWS\system32\DirectX
2008-02-21 15:10:21 0 d---s---- C:\WINDOWS\Tasks
2008-02-21 15:10:21 0 d-------- C:\Program Files\Common Files\MSSoap
2008-02-21 15:10:18 0 d-------- C:\WINDOWS\srchasst
2008-02-21 15:10:17 0 d-------- C:\WINDOWS\system32\Macromed
2008-02-21 15:10:12 0 d-------- C:\Program Files\Movie Maker
2008-02-21 15:10:07 0 d-------- C:\WINDOWS\system32\Restore
2008-02-21 15:09:38 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat
2008-02-21 15:09:27 0 d-------- C:\WINDOWS\Registration
2008-02-21 15:09:22 0 d-------- C:\Program Files\Online Services
2008-02-21 15:09:18 0 d-------- C:\Program Files\Messenger
2008-02-21 15:09:15 0 d-------- C:\Program Files\MSN Gaming Zone
2008-02-21 15:08:44 0 d-------- C:\Program Files\Windows NT
2008-02-21 15:08:42 0 d-------- C:\WINDOWS\system32\MsDtc
2008-02-21 15:08:40 0 d-------- C:\WINDOWS\system32\Com
2008-02-21 07:02:34 0 d--hs---- C:\WINDOWS\Installer
2008-02-21 07:02:33 0 d-------- C:\Program Files\Common Files\ODBC
2008-02-21 07:02:31 0 dr------- C:\Program Files
2008-02-21 07:02:31 0 d-------- C:\Program Files\Common Files
2008-02-21 07:02:31 0 d-------- C:\Program Files\Common Files\SpeechEngines
2008-02-21 07:02:11 0 d--h----- C:\Documents and Settings\Default User\Templates
2008-02-21 07:02:11 0 dr------- C:\Documents and Settings\Default User\Start Menu
2008-02-21 07:02:11 0 dr-h----- C:\Documents and Settings\Default User\SendTo
2008-02-21 07:02:11 0 d--h----- C:\Documents and Settings\Default User\Recent
2008-02-21 07:02:11 0 d--h----- C:\Documents and Settings\Default User\PrintHood
2008-02-21 07:02:11 0 d--h----- C:\Documents and Settings\Default User\NetHood
2008-02-21 07:02:11 0 d-------- C:\Documents and Settings\Default User\My Documents
2008-02-21 07:02:11 0 dr-h----- C:\Documents and Settings\Default User\Local Settings
2008-02-21 07:02:11 0 d-------- C:\Documents and Settings\Default User\Favorites
2008-02-21 07:02:11 0 d-------- C:\Documents and Settings\Default User\Desktop
2008-02-21 07:02:11 0 d---s---- C:\Documents and Settings\Default User\Cookies
2008-02-21 07:02:11 0 d--h----- C:\Documents and Settings\All Users\Templates
2008-02-21 07:02:11 0 dr------- C:\Documents and Settings\All Users\Start Menu
2008-02-21 07:02:11 0 d-------- C:\Documents and Settings\All Users\Favorites
2008-02-21 07:02:11 0 dr------- C:\Documents and Settings\All Users\Documents
2008-02-21 07:02:11 0 d-------- C:\Documents and Settings\All Users\Desktop
2008-02-21 07:00:22 0 d-------- C:\WINDOWS\system32\CatRoot2
2008-02-21 07:00:22 0 d-------- C:\WINDOWS\system32\CatRoot
2008-02-21 07:00:17 0 dr-h----- C:\Documents and Settings\Default User\Application Data
2008-02-21 07:00:17 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft
2008-02-21 07:00:17 0 dr-h----- C:\Documents and Settings\All Users\Application Data
2008-02-21 07:00:17 0 d---s---- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-02-21 06:59:59 0 d--hs---- C:\System Volume Information
2008-02-21 06:59:59 0 d-------- C:\Documents and Settings
2008-02-21 06:56:13 0 d-------- C:\WINDOWS
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\WinSxS
2008-02-21 06:56:13 0 dr------- C:\WINDOWS\Web
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\twain_32
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\wins
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\wbem
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\usmt
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\spool
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\ShellExt
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\Setup
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\ras
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\oobe
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\npp
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\mui
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\inetsrv
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\IME
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\icsxml
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\ias
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\export
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\drivers
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\drivers\etc
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\drivers\disdn
2008-02-21 06:56:13 0 dr-hs--c- C:\WINDOWS\system32\dllcache
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\dhcp
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\config
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\3com_dmi
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\3076
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\2052
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\1054
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\1042
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\1041
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\1037
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\1033
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\1031
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\1028
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system32\1025
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\system
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\security
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\Resources
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\repair
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\Provisioning
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\PeerNet
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\pchealth
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\mui
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\msapps
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\msagent
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\Media
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\java
2008-02-21 06:56:13 0 d--h----- C:\WINDOWS\inf
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\ime
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\Help
2008-02-21 06:56:13 0 dr--s---- C:\WINDOWS\Fonts
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\ehome
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\Driver Cache
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\Debug
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\Cursors
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\Connection Wizard
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\Config
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\AppPatch
2008-02-21 06:56:13 0 d-------- C:\WINDOWS\addins


-- Find3M Report ---------------------------------------------------------------

2008-03-16 01:55:38 33 --a------ C:\Documents and Settings\Dave\Application Data\install.ini
2008-02-21 07:02:11 62 --ahs---- C:\Documents and Settings\Dave\Application Data\desktop.ini


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" []
"CmPCIaudio"="CMICNFG3.CPL" []
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [12/05/2007 01:41 AM]
"nwiz"="nwiz.exe" [12/05/2007 01:41 AM C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [12/05/2007 01:41 AM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [09/25/2007 01:11 AM]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [02/21/2008 07:18 PM]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [01/31/2008 11:13 PM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [02/19/2008 01:10 PM]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [10/27/2006 12:47 AM]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [10/25/2007 04:33 PM]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [10/25/2007 04:37 PM]
"ntuser"="C:\WINDOWS\system32\drivers\ctfmon.exe" []
"autoload"="C:\Documents and Settings\Dave\Local Settings\Application Data\spool.exe" []
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [03/16/2008 12:00 AM]
"KernelFaultCheck"="C:\WINDOWS\system32\dumprep 0 -k" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [01/03/2008 08:15 AM]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [08/30/2007 05:43 PM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/03/2004 04:56 PM]
"QdrModule13"="C:\Program Files\QdrModule\QdrModule13.exe" [03/06/2008 05:22 PM]
"QdrPack14"="C:\Program Files\QdrPack\QdrPack14.exe" [03/13/2008 01:02 PM]
"Microsoft Windows Adapter 5.1.3214"="C:\Documents and Settings\Dave\Application Data\eyaoy.exe" [03/15/2008 08:19 PM]
"autoload"="C:\Documents and Settings\Dave\Local Settings\Application Data\spool.exe" []
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [02/29/2008 04:03 PM]
"Awola6"="C:\Documents and Settings\Dave\Application Data\Awola6\Awola6.exe" [03/16/2008 12:53 AM]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"autoload"=C:\Documents and Settings\LocalService\Local Settings\Application Data\spool.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [12/20/2006 12:55 PM 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"System"="kdhwv.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 04/19/2007 12:41 PM 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\System Reserved]
@="Driver Group"




-- End of Deckard's System Scanner: finished at 2008-03-18 16:39:33 ------------
See less See more
Save
Like
forhockey
Hi Darkmuffin,

Not a problem. This is going to take a few rounds to cleanup, so please stick with me until I say your system is clean.

--------------------------------------------------------------

Please download FixWareout from one of these sites:
http://downloads.subratam.org/Fixwareout.exe
http://download.bleepingcomputer.com/lonny/Fixwareout.exe
  • Save it to your desktop and run it.
  • Click "Next", then Install, make sure "Run fixit" is checked and click Finish.
  • The fix will begin: Please follow the prompts.
  • You will be asked to reboot your computer: Please do so.
  • Your system may take longer than usual to load and this is normal.
Once the desktop loads post the text that will open (report.txt)

--------------------------------------------------------------

Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix


IMPORTANT: Make sure you install the Recovery Console before running ComboFix.

--------------------------------------------------------------

Please reply back with the following:

C:\fixwareout\report.txt
C:\ComboFix.txt
See less See more
Save
Like
D
Okay, wasn't sure if you wanted me to attach them or not, but here they are.

Attachments

Save
Like
forhockey
5
Hi Darkmuffin,

Open notepad and copy/paste the text in the quotebox below into it:

Code: 
http://www.techsupportforum.com/security-center/hijackthis-log-help/230918-can-t-remove-malware-via-any-reputable-anti-virus-programs.html#post1381135

Collect::
C:\WINDOWS\system32\sbitgf.bmp
C:\Documents and Settings\Dave\Application Data\eyaoy.exe
C:\7pxswc.exe
C:\WINDOWS\system32\krilsbqp.bmp
C:\WINDOWS\system32\kfehkridcrepgf.bmp
C:\WINDOWS\system32\ahcjipcbmt.bmp
C:\WINDOWS\system32\oddweuus.tmp
C:\WINDOWS\system32\bqlcj.bmp
Folder::
C:\Program Files\AntiVirusPro
C:\Documents and Settings\Dave\Application Data\Anti-Virus-Pro.com
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QdrPack14"=-
Save this as CFScript


Referring to the picture above, drag CFScript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis. Please submit "[4]-Submit_Date_Time.zip" by following the prompts.

--------------------------------------------------------------

Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file.

Perform an online scan with Internet Explorer with Panda ActiveScan
  1. Click on
    located at the bottom of the page.
  2. A "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
  3. Enter your e-mail address, country, and state & click "Free Online Scan" *The download of the 8 MB Panda's ActiveX control will take place*
Begin the scan by selecting
  • If it finds any malware, it will offer you a report.
  • Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
  • Click on
    then click
* You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
* Turn off the real time scanner of any existing antivirus program while performing the online scan

--------------------------------------------------------------

Please reply back with the following:

C:\ComboFix.txt
Panda online scan results
New HiJackThis log
Update on system behaviour?
See less See more
Save
Like
D
Okay, again, sorry for the slow reply, but spring break and all that, I'm sure you understand =P Also, I can't get the panda activescan to run again, so I hope it's not too vital, but I got the other things you requested.

As for my system behavior, it appears to be running perfectly normal, no sign of the virus I originally had complaints of except for the uninstall feature for it, but I don't even intend on touching that in fear of becoming cursed with it again.

Anyway, here is the HijackThis log.




Deckard's System Scanner v20071014.68
Run by Dave on 2008-03-23 02:41:32
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as Dave.exe) ------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:41:50 AM, on 3/23/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\AIM6\aim6.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\AOL\Loader\aolload.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Dave\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Dave.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O4 - HKLM\..\Run: [CmPCIaudio] RunDll32 CMICNFG3.CPL,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1205728091796
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6488 bytes

-- Files created between 2008-02-23 and 2008-03-23 -----------------------------

2008-03-23 02:41:43 0 d-------- C:\Program Files\Trend Micro
2008-03-20 11:36:58 0 d-------- C:\Program Files\GameSpy Arcade
2008-03-20 11:36:54 0 d-------- C:\Program Files\MSXML 4.0
2008-03-20 11:32:19 0 d-------- C:\Program Files\Microsoft Games
2008-03-19 23:54:51 416 --a------ C:\WINDOWS\system32\vcredist_x86.bat
2008-03-19 23:54:50 2682880 --a------ C:\WINDOWS\system32\vcredist_x86.exe <Not Verified; Microsoft Corporation; Microsoft Visual C++ 2005 Redistributable>
2008-03-18 21:37:48 0 d-------- C:\cmdcons
2008-03-18 21:37:25 68096 --a------ C:\WINDOWS\system32\zip.exe
2008-03-18 21:37:25 98816 --a------ C:\WINDOWS\system32\sed.exe
2008-03-18 21:37:25 80412 --a------ C:\WINDOWS\system32\grep.exe
2008-03-18 21:37:25 73728 --a------ C:\WINDOWS\system32\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-03-16 20:27:48 0 d---s---- C:\Documents and Settings\Dave\UserData
2008-03-16 20:23:01 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-16 20:22:45 0 d-------- C:\Program Files\SpywareBlaster
2008-03-16 19:12:02 0 d-------- C:\WINDOWS\system32\ActiveScan
2008-03-16 01:03:04 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-03-16 01:03:00 0 d-------- C:\Program Files\SUPERAntiSpyware
2008-03-16 01:03:00 0 d-------- C:\Documents and Settings\Dave\Application Data\SUPERAntiSpyware.com
2008-03-16 00:53:33 487936 --a------ C:\Documents and Settings\Dave\installer.exe
2008-03-16 00:48:35 0 dr-h----- C:\$VAULT$.AVG
2008-03-15 23:36:53 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-03-15 21:19:53 0 d-------- C:\Documents and Settings\Dave\Application Data\AVG7
2008-03-15 21:19:46 0 d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2008-03-15 21:19:26 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-15 21:19:26 0 d-------- C:\Documents and Settings\All Users\Application Data\avg7
2008-03-15 20:44:36 0 --ahs---- C:\Documents and Settings\Dave\Application Data\0047dca57bb14a93dd623a7a6f1d12696e592b62130ba1e2bc.dat
2008-03-02 20:56:04 0 d-------- C:\Documents and Settings\All Users\Application Data\Logishrd
2008-03-02 20:56:02 0 d-------- C:\Program Files\Common Files\LogiShrd
2008-03-02 20:55:58 0 d-------- C:\Program Files\Logitech
2008-03-02 20:55:58 0 d-------- C:\Documents and Settings\All Users\Application Data\Logitech
2008-03-01 20:45:15 70995 --a------ C:\WINDOWS\War3Unin.dat
2008-03-01 20:45:13 2829 --a------ C:\WINDOWS\War3Unin.pif
2008-03-01 20:45:13 139264 --a------ C:\WINDOWS\War3Unin.exe <Not Verified; Blizzard Entertainment; Warcraft III Uninstaller>
2008-03-01 18:03:57 0 d-------- C:\Program Files\Warcraft III
2008-02-29 21:00:15 0 d-------- C:\Program Files\DivX
2008-02-29 21:00:00 672 --a------ C:\WINDOWS\mozver.dat
2008-02-28 21:01:13 0 d-------- C:\Documents and Settings\Dave\Application Data\Ventrilo
2008-02-28 21:01:02 0 d-------- C:\Program Files\Ventrilo
2008-02-28 21:00:52 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-28 21:00:47 0 d-------- C:\WINDOWS\system32\appmgmt
2008-02-28 16:11:49 0 d-------- C:\Program Files\MSBuild
2008-02-28 16:00:32 0 d-------- C:\Program Files\Microsoft Works
2008-02-28 15:59:35 0 d-------- C:\WINDOWS\SHELLNEW
2008-02-28 15:59:16 0 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-02-28 15:59:03 0 dr-h----- C:\MSOCache


-- Find3M Report ---------------------------------------------------------------

2008-03-20 10:32:55 0 d-------- C:\Documents and Settings\Dave\Application Data\Real
2008-03-16 19:26:38 0 d-------- C:\Program Files\iTunes
2008-03-16 19:25:18 0 d-------- C:\Program Files\Bonjour
2008-03-16 19:25:18 0 d-------- C:\Program Files\AIM6
2008-03-16 01:55:38 33 --a------ C:\Documents and Settings\Dave\Application Data\install.ini
2008-03-16 00:48:36 0 d-------- C:\Program Files\Common Files
2008-03-12 19:15:52 0 d-------- C:\Program Files\World of Warcraft
2008-02-22 15:44:15 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-02-21 22:41:40 0 d-------- C:\Program Files\Common Files\Blizzard Entertainment
2008-02-21 21:47:28 0 d-------- C:\Documents and Settings\Dave\Application Data\Sun
2008-02-21 19:32:46 0 d-------- C:\Documents and Settings\Dave\Application Data\Apple Computer
2008-02-21 19:32:37 0 d-------- C:\Program Files\iPod
2008-02-21 19:32:26 0 d-------- C:\Program Files\QuickTime
2008-02-21 19:32:04 0 d-------- C:\Program Files\Apple Software Update
2008-02-21 19:31:33 0 d-------- C:\Program Files\Common Files\Apple
2008-02-21 19:18:32 0 d-------- C:\Program Files\Real
2008-02-21 19:18:32 0 d-------- C:\Program Files\Common Files\xing shared
2008-02-21 19:18:29 0 d-------- C:\Program Files\Common Files\Real
2008-02-21 19:16:09 0 d-------- C:\Program Files\Java
2008-02-21 19:15:41 0 d-------- C:\Program Files\Common Files\Java
2008-02-21 19:10:18 0 d-------- C:\Documents and Settings\Dave\Application Data\Macromedia
2008-02-21 19:10:06 0 d-------- C:\Documents and Settings\Dave\Application Data\Adobe
2008-02-21 19:09:50 0 d-------- C:\Program Files\Yahoo!
2008-02-21 19:07:42 0 d-------- C:\Documents and Settings\Dave\Application Data\acccore
2008-02-21 19:07:09 0 d-------- C:\Program Files\Common Files\AOL
2008-02-21 17:18:12 0 d-------- C:\Program Files\Xtreme Sound PCI
2008-02-21 17:17:50 0 d-------- C:\Program Files\Common Files\InstallShield
2008-02-21 17:17:45 0 d-------- C:\Program Files\Xtreme Sound Setup Files
2008-02-21 17:13:05 0 --a------ C:\WINDOWS\nsreg.dat
2008-02-21 17:13:04 0 d-------- C:\Documents and Settings\Dave\Application Data\Mozilla
2008-02-21 16:57:35 0 d-------- C:\Program Files\Broadcom
2008-02-21 15:20:58 0 d-------- C:\Documents and Settings\Dave\Application Data\Identities
2008-02-21 15:12:09 0 d-------- C:\Program Files\microsoft frontpage
2008-02-21 15:11:52 0 -rahs---- C:\MSDOS.SYS
2008-02-21 15:11:52 0 -rahs---- C:\IO.SYS
2008-02-21 15:11:52 0 --a------ C:\CONFIG.SYS
2008-02-21 15:11:52 0 --a------ C:\AUTOEXEC.BAT
2008-02-21 15:10:58 0 d--h----- C:\Program Files\WindowsUpdate
2008-02-21 15:10:21 0 d-------- C:\Program Files\Common Files\MSSoap
2008-02-21 15:10:14 0 d-------- C:\Program Files\Movie Maker
2008-02-21 15:09:38 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat
2008-02-21 15:09:22 0 d-------- C:\Program Files\Online Services
2008-02-21 15:09:19 0 d-------- C:\Program Files\Messenger
2008-02-21 15:09:15 0 d-------- C:\Program Files\MSN Gaming Zone
2008-02-21 15:09:10 0 d-------- C:\Program Files\Windows NT
2008-02-21 07:02:33 0 d-------- C:\Program Files\Common Files\ODBC
2008-02-21 07:02:31 0 d-------- C:\Program Files\Common Files\SpeechEngines
2008-02-21 07:02:11 62 --ahs---- C:\Documents and Settings\Dave\Application Data\desktop.ini


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CmPCIaudio"="CMICNFG3.CPL" []
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [12/05/2007 01:41 AM]
"nwiz"="nwiz.exe" [12/05/2007 01:41 AM C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [12/05/2007 01:41 AM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [09/25/2007 01:11 AM]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [02/21/2008 07:18 PM]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [01/31/2008 11:13 PM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [02/19/2008 01:10 PM]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [10/27/2006 12:47 AM]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [10/25/2007 04:33 PM]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [10/25/2007 04:37 PM]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [03/16/2008 12:00 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [01/03/2008 08:15 AM]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [08/30/2007 05:43 PM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/03/2004 04:56 PM]




-- End of Deckard's System Scanner: finished at 2008-03-23 02:42:07 ------------

Attachments

See less See more
Save
Like
forhockey
2
Sorry for the delay, as its been rather busy for me these past few days.


Your logs are looking much better... Lets try a different online scanner.


Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.

  • The program will then begin downloading the latest definition files.
  • Once the files have been downloaded click on NEXT
  • Locate the Scan Settings button & configure to:
    • Scan using the following Anti-Virus database:
      • Extended
    • Scan Options:
      • Scan Archives[*]Scan Mail Bases
  • Click OK & have it scan My Computer
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.





  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply
* Turn off the real time scanner of any existing antivirus program while performing the online scan
See less See more
Save
Like
1 - 8 of 8 Posts
Status
Not open for further replies.
Tech Support Forum
A forum community dedicated to tech experts and enthusiasts. Come join the discussion about articles, computer security, Mac, Microsoft, Linux, hardware, networking, gaming, reviews, accessories, and more!
Full Forum Listing
Explore Our Forums
Windows XP Support Windows 7 , Windows Vista Support Motherboards, Bios|UEFI & CPU Networking Support Laptop Support
Top