View Full Version : My computer happen to have winAntiSpyware 2007 4.0.193.0
jamesdang
2007-07-13, 04:41
Happen to have a lot of popups.
Last time problem: http://forums.spybot.info/showthread.php?t=14314
Please help me.
Thanks
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:19:44 PM, on 7/12/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\TextBridge Pro Millennium\Bin\InstantAccess.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\TomTom HOME\TomTomHOME.exe
C:\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe
C:\WINDOWS\retadpu77.exe
C:\Program Files\Common Files\WinAntiSpyware 2007\uwas7cw.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\DOCUME~1\Owner\APPLIC~1\WNSXS~1\spoolsv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\HiJackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar -
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program
Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} -
C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media
Experience\PCMService.exe"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client
Foundation\CFD.exe
O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\Program Files\Visual
Networks\Visual IP InSight\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual
Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [Motive SmartBridge]
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [InstantAccess] C:\Program Files\TextBridge Pro
Millennium\Bin\InstantAccess.exe /h
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common
Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom
HOME\TomTomHOME.exe" -s
O4 - HKLM\..\Run: [poolsv] "C:\WINDOWS\poolsv.exe"
O4 - HKLM\..\Run: [Salestart] "C:\Program Files\Common
Files\WinAntiSpyware 2007\WAS7Mon.exe"
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu77.exe
61A847B5BBF72815358B2B27128065E9C084320161C4661227A755E9C2933154389A
O4 - HKLM\..\Run: [icq.com] rundll32.exe
"C:\WINDOWS\System32\bmjnktrd.dll",forkonce
O4 - HKLM\..\Run: [WinAntiSpyware 2007 Free] "C:\Program
Files\WinAntiSpyware 2007\was7.exe" /min
O4 - HKLM\..\Run: [uwas7cw] "C:\Program Files\Common Files\WinAntiSpyware
2007\uwas7cw.exe" -c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager]
"C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat
7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [Aida] "C:\DOCUME~1\Owner\APPLIC~1\WNSXS~1\spoolsv.exe"
-vt yazb
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default
user')
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program
Files\Common Files\Autodesk Shared\acstart16.exe
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Yahoo! Services -
{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program
Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\MSMSGS.EXE
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) -
http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) -
http://www.gioitre.org/tdserver.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine
Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} - C:\Program
Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support)
- C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} -
http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.2.1.87.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -
http://appldnld.m7z.net/qtinstall.info.apple.com/pthalo/us/win/QuickTimeF
ullInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/w
uweb_site.cab?1137299390562
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/m
uweb_site.cab?1137299378734
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) -
http://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) -
http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {D1792F99-AA90-4D46-8B73-2CE45DADDD3C} (WAFDownloader Class) -
https://www.web-a-file.com/webafiledownloader.cab
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program
Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. -
C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation -
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec
Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec
Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) -
Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel
32\IDriverT.exe
O23 - Service: Intuit Fuse Service - Intuit - C:\Program Files\Common
Files\Intuit\Fuse\Service\Intuit Fuse Service.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero
BackItUp\NBService.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec
AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec
Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program
Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program
Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
--
End of file - 9000 bytes
Hello jamesdang :)
You're infected.
Rename HijackThis.exe to Scanner.exe
Post a fresh HijacKThis (scanner.exe) log to here.
:bigthumb:
jamesdang
2007-07-14, 03:13
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:10:56 PM, on 7/13/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe
C:\Program Files\TextBridge Pro Millennium\Bin\InstantAccess.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\TomTom HOME\TomTomHOME.exe
C:\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe
C:\WINDOWS\retadpu77.exe
C:\Program Files\Common Files\WinAntiSpyware 2007\uwas7cw.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\DOCUME~1\Owner\APPLIC~1\WNSXS~1\spoolsv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\HiJackThis\Scanner.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {30181FF8-D069-F79C-4B17-828DBC2D82EA} - C:\WINDOWS\System32\lxma.dll
O2 - BHO: (no name) - {59322E40-1834-4FEA-B597-942053AF342E} - C:\WINDOWS\System32\ddcyw.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {938A8A03-A938-4019-B764-03FF8D167D79} - C:\WINDOWS\System32\xavxyyhy.dll
O2 - BHO: (no name) - {941508F8-CCD9-44E0-AC29-4F1E141373F7} - C:\WINDOWS\System32\gebxwxu.dll
O2 - BHO: (no name) - {D45A0DAD-8F83-4B56-A4BB-7F28FB7B87D6} - C:\WINDOWS\System32\ddcyw.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [InstantAccess] C:\Program Files\TextBridge Pro Millennium\Bin\InstantAccess.exe /h
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME\TomTomHOME.exe" -s
O4 - HKLM\..\Run: [poolsv] "C:\WINDOWS\poolsv.exe"
O4 - HKLM\..\Run: [Salestart] "C:\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe"
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu77.exe 61A847B5BBF72815358B2B27128065E9C084320161C4661227A755E9C2933154389A
O4 - HKLM\..\Run: [icq.com] rundll32.exe "C:\WINDOWS\System32\xdbuajfv.dll",forkonce
O4 - HKLM\..\Run: [WinAntiSpyware 2007 Free] "C:\Program Files\WinAntiSpyware 2007\was7.exe" /min
O4 - HKLM\..\Run: [uwas7cw] "C:\Program Files\Common Files\WinAntiSpyware 2007\uwas7cw.exe" -c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [Aida] "C:\DOCUME~1\Owner\APPLIC~1\WNSXS~1\spoolsv.exe" -vt yazb
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.gioitre.org/tdserver.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.2.1.87.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/qtinstall.info.apple.com/pthalo/us/win/QuickTimeFullInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1137299390562
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1137299378734
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {D1792F99-AA90-4D46-8B73-2CE45DADDD3C} (WAFDownloader Class) - https://www.web-a-file.com/webafiledownloader.cab
O20 - Winlogon Notify: ddcyw - C:\WINDOWS\System32\ddcyw.dll
O20 - Winlogon Notify: gebxwxu - C:\WINDOWS\SYSTEM32\gebxwxu.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intuit Fuse Service - Intuit - C:\Program Files\Common Files\Intuit\Fuse\Service\Intuit Fuse Service.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
--
End of file - 10055 bytes
Ok let's start the cleaning...
Please download VundoFix.exe (http://www.atribune.org/ccount/click.php?id=4) to your desktop.
Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.
Please post the contents of C:\vundofix.txt and a new HiJackThis log.
Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.
jamesdang
2007-07-14, 19:11
VundoFix V6.5.4
Checking Java version...
Scan started at 9:45:03 AM 7/14/2007
Listing files found while scanning....
C:\windows\system32\bkqkfbsw.ini
C:\windows\system32\bmjnktrd.dll
C:\WINDOWS\System32\ddcyw.dll
C:\windows\system32\drtknjmb.ini
C:\WINDOWS\System32\hdwsbimg.dll
C:\WINDOWS\System32\kwedhxrg.dll
C:\windows\system32\vfjaubdx.ini
C:\windows\system32\wsbfkqkb.dll
C:\WINDOWS\System32\wycdd.bak1
C:\WINDOWS\System32\wycdd.bak2
C:\WINDOWS\System32\wycdd.ini
C:\WINDOWS\System32\wycdd.ini2
C:\WINDOWS\System32\xdbuajfv.dll
Beginning removal...
Attempting to delete C:\windows\system32\bkqkfbsw.ini
C:\windows\system32\bkqkfbsw.ini Has been deleted!
Attempting to delete C:\windows\system32\bmjnktrd.dll
C:\windows\system32\bmjnktrd.dll Has been deleted!
Attempting to delete C:\WINDOWS\System32\ddcyw.dll
C:\WINDOWS\System32\ddcyw.dll Has been deleted!
Attempting to delete C:\windows\system32\drtknjmb.ini
C:\windows\system32\drtknjmb.ini Has been deleted!
Attempting to delete C:\windows\system32\vfjaubdx.ini
C:\windows\system32\vfjaubdx.ini Has been deleted!
Attempting to delete C:\windows\system32\wsbfkqkb.dll
C:\windows\system32\wsbfkqkb.dll Has been deleted!
Attempting to delete C:\WINDOWS\System32\wycdd.bak1
C:\WINDOWS\System32\wycdd.bak1 Has been deleted!
Attempting to delete C:\WINDOWS\System32\wycdd.bak2
C:\WINDOWS\System32\wycdd.bak2 Has been deleted!
Attempting to delete C:\WINDOWS\System32\wycdd.ini
C:\WINDOWS\System32\wycdd.ini Has been deleted!
Attempting to delete C:\WINDOWS\System32\wycdd.ini2
C:\WINDOWS\System32\wycdd.ini2 Has been deleted!
Attempting to delete C:\WINDOWS\System32\xdbuajfv.dll
C:\WINDOWS\System32\xdbuajfv.dll Has been deleted!
Performing Repairs to the registry.
Done!
jamesdang
2007-07-14, 19:17
This log is created by Scanner.exe (not HiJackThis.exe).
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:13:14 AM, on 7/14/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe
C:\Program Files\TextBridge Pro Millennium\Bin\InstantAccess.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\TomTom HOME\TomTomHOME.exe
C:\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe
C:\WINDOWS\retadpu77.exe
C:\Program Files\Common Files\WinAntiSpyware 2007\uwas7cw.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\HiJackThis\Scanner.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar -
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program
Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670}
- C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper -
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat
7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {28E93659-479A-42A7-B8EA-5D4187833ED6} -
C:\WINDOWS\System32\vtsqq.dll
O2 - BHO: Yahoo! IE Services Button -
{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program
Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {938A8A03-A938-4019-B764-03FF8D167D79} -
C:\WINDOWS\System32\xavxyyhy.dll
O2 - BHO: (no name) - {941508F8-CCD9-44E0-AC29-4F1E141373F7} -
C:\WINDOWS\System32\gebxwxu.dll
O2 - BHO: (no name) - {CD4AD09A-AFE0-45CA-AD31-484A421A329E} -
C:\WINDOWS\System32\ddcyw.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} -
C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media
Experience\PCMService.exe"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client
Foundation\CFD.exe
O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\Program Files\Visual
Networks\Visual IP InSight\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual
Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [Motive SmartBridge]
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [InstantAccess] C:\Program Files\TextBridge Pro
Millennium\Bin\InstantAccess.exe /h
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common
Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom
HOME\TomTomHOME.exe" -s
O4 - HKLM\..\Run: [poolsv] "C:\WINDOWS\poolsv.exe"
O4 - HKLM\..\Run: [Salestart] "C:\Program Files\Common
Files\WinAntiSpyware 2007\WAS7Mon.exe"
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu77.exe
61A847B5BBF72815358B2B27128065E9C084320161C4661227A755E9C2933154389A
O4 - HKLM\..\Run: [WinAntiSpyware 2007 Free] "C:\Program
Files\WinAntiSpyware 2007\was7.exe" /min
O4 - HKLM\..\Run: [uwas7cw] "C:\Program Files\Common Files\WinAntiSpyware
2007\uwas7cw.exe" -c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager]
"C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat
7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default
user')
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program
Files\Common Files\Autodesk Shared\acstart16.exe
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Yahoo! Services -
{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program
Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\MSMSGS.EXE
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) -
http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) -
http://www.gioitre.org/tdserver.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine
Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} - C:\Program
Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support)
- C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} -
http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.2.1.87.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -
http://appldnld.m7z.net/qtinstall.info.apple.com/pthalo/us/win/QuickTimeF
ullInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/w
uweb_site.cab?1137299390562
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/m
uweb_site.cab?1137299378734
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} -
http://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) -
http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {D1792F99-AA90-4D46-8B73-2CE45DADDD3C} (WAFDownloader Class) -
https://www.web-a-file.com/webafiledownloader.cab
O20 - Winlogon Notify: gebxwxu - C:\WINDOWS\SYSTEM32\gebxwxu.dll
O20 - Winlogon Notify: vtsqq - C:\WINDOWS\System32\vtsqq.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program
Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. -
C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation -
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec
Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec
Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) -
Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel
32\IDriverT.exe
O23 - Service: Intuit Fuse Service - Intuit - C:\Program Files\Common
Files\Intuit\Fuse\Service\Intuit Fuse Service.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero
BackItUp\NBService.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec
AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec
Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program
Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program
Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
--
End of file - 9672 bytes
jamesdang
2007-07-15, 01:31
Hi Mr_JAk3
My computer poped up a lots.
It takes a lot of time:mad: when starting the computer. Look like something running. Icon of Winantivirus is located at everywhere: (1) right bottom corner, (2)right click at Start button, (3) Left click at Start button /Program/Winantivirus. Maybe somewhere else I don't know.
Please help. Thank you very much.
Hello :)
Ok let's get rid of the nasties....
Disable Word Wrap in notepad, that'll make the logs readable.
Notepad -> Format -> Disable Word Wrap
1. Download this file - combofix.exe (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall
jamesdang
2007-07-15, 23:56
I saved combofix.exe on Desktop. Double click, it looks like Dos.
After done, it disappeared. I don't know where the log file. I will find (search) and I will post right after this.
Thanks
jamesdang
2007-07-16, 00:03
Because it is too long. I have to divide by maybe 3. Thanks
This is part 1
"Owner" - 2007-07-15 14:20:45 - ComboFix 07-07-14.6 - Service Pack 1 NTFS
(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINDOWS\system32\kpjmgxvh.dll
C:\WINDOWS\system32\cesrugfw.dll
C:\WINDOWS\system32\dqspyygx.dll
C:\WINDOWS\system32\ftwugjsi.dll
C:\WINDOWS\system32\ikncfsjo.dll
C:\WINDOWS\system32\rkakknvq.dll
C:\WINDOWS\system32\xavxyyhy.dll
C:\WINDOWS\system32\qqstv.bak1
C:\WINDOWS\system32\qqstv.bak2
C:\WINDOWS\system32\qqstv.ini
C:\WINDOWS\system32\qqstv.ini2
C:\WINDOWS\system32\qqstv.tmp
C:\WINDOWS\system32\hvxgmjpk.ini
C:\WINDOWS\system32\vtsqq.dll
C:\WINDOWS\system32\gebxwxu.dll
C:\WINDOWS\system32\gebxwxu.dll
* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\DOCUME~1\ALLUSE~1\APPLIC~1.\salesmonitor
C:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007
C:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007\Data\Abbr
C:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007\Data\ProductCode
C:\DOCUME~1\Owner\APPLIC~1.\macromedia\Flash Player\#SharedObjects\EGYWQCEL\www.broadcaster.com
C:\DOCUME~1\Owner\APPLIC~1.\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\DOCUME~1\Owner\APPLIC~1.\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\DOCUME~1\Owner\APPLIC~1.\winantispyware 2007
C:\DOCUME~1\Owner\APPLIC~1.\winantispyware 2007 free
C:\DOCUME~1\Owner\APPLIC~1.\winantispyware 2007 free\DownloadUWAS7.url
C:\DOCUME~1\Owner\APPLIC~1.\winantispyware 2007\Logs\update.log
C:\DOCUME~1\Owner\Desktop.\internet explorer.lnk
C:\DOCUME~1\Tuan-Anh\APPLIC~1\WinAntiSpyware 2007
C:\DOCUME~1\Tuan-Anh\APPLIC~1\WinAntiSpyware 2007\Logs\update.log
C:\Documents and Settings\Owner.\err.log
C:\Program Files\Common Files\winantispyware 2007
C:\Program Files\Common Files\winantispyware 2007\err.log
C:\Program Files\Common Files\winantispyware 2007\uwas7cw.exe
C:\Program Files\Common Files\winantispyware 2007\WAS7Mon.exe
C:\Program Files\Common Files\Yazzle1122OinAdmin.exe
C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe
C:\Program Files\inetget2
C:\Program Files\network monitor
C:\Program Files\network monitor\netmon.exe
C:\Program Files\outerinfo
C:\Program Files\outerinfo\OiUninstaller.exe
C:\Program Files\outerinfo\outerinfo.ico
C:\Program Files\outerinfo\Terms.rtf
C:\Program Files\poolsv
C:\Program Files\poolsv\k11u72.exe
C:\Program Files\poolsv\WinAntiSpyware2007FreeInstall.exe
C:\Program Files\poolsv\wr-1-0000077.exe
C:\Program Files\poolsv\YazzleBundle-1549.exe
C:\Program Files\winantispyware 2007
C:\Program Files\winantispyware 2007\Activate.dat
C:\Program Files\winantispyware 2007\appupdate.dat
C:\Program Files\winantispyware 2007\AsAgents.dll
C:\Program Files\winantispyware 2007\AsAgents.xml
C:\Program Files\winantispyware 2007\atl71.dll
C:\Program Files\winantispyware 2007\AutoProcess.dat
C:\Program Files\winantispyware 2007\bnlink.dat
C:\Program Files\winantispyware 2007\database\enemies.dat
C:\Program Files\winantispyware 2007\database\knownfiles.dat
C:\Program Files\winantispyware 2007\database\TEBase.dat
C:\Program Files\winantispyware 2007\database\vbpv.dat
C:\Program Files\winantispyware 2007\dbupdate.dat
C:\Program Files\winantispyware 2007\fopnl.dll
C:\Program Files\winantispyware 2007\InstHelp.exe
C:\Program Files\winantispyware 2007\InstUp.exe
C:\Program Files\winantispyware 2007\lapv.dat
C:\Program Files\winantispyware 2007\license.rtf
C:\Program Files\winantispyware 2007\manual.pdf
C:\Program Files\winantispyware 2007\manual.url
C:\Program Files\winantispyware 2007\mfc71.dll
C:\Program Files\winantispyware 2007\monstate.dat
C:\Program Files\winantispyware 2007\msvcp71.dll
C:\Program Files\winantispyware 2007\msvcr71.dll
C:\Program Files\winantispyware 2007\ps.dat
C:\Program Files\winantispyware 2007\pv.dat
C:\Program Files\winantispyware 2007\quaratine.dat\#post_quarantine
C:\Program Files\winantispyware 2007\readme.rtf
jamesdang
2007-07-16, 00:07
This is part 2
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\03ad66abe38c45da6d7abfb5\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\03ad66abe38c45da6d7abfb5\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\0cff50b831394ebbb2c370b4\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\0cff50b831394ebbb2c370b4\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\10bf2922cda34a326ab6639a\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\10bf2922cda34a326ab6639a\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\1c2182852cfe44f3c7e5c79a\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\1c2182852cfe44f3c7e5c79a\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\1fc5c945b4b343d8d3bc3c8d\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\1fc5c945b4b343d8d3bc3c8d\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\20c647d65d3043d7404c5e94\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\20c647d65d3043d7404c5e94\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\20c647d65d3043d7404c5e94\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\23626a318b8748cd4f49878a\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\23626a318b8748cd4f49878a\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\32e01566472d4030b669b8a2\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\32e01566472d4030b669b8a2\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\37e6204810c74b34328326bd\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\37e6204810c74b34328326bd\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\38ac7218572f401cf9b7c0bb\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\38ac7218572f401cf9b7c0bb\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\397fe9c247d945681cc931b5\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\397fe9c247d945681cc931b5\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\397fe9c247d945681cc931b5\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\3a4b0957cc884f4b2c95db8a\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\3a4b0957cc884f4b2c95db8a\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\3b3d05285024456eb6800bab\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\3b3d05285024456eb6800bab\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\45a334447e0b4facda6decb9\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\45a334447e0b4facda6decb9\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\49f921e0638a4a7da37336b0\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\49f921e0638a4a7da37336b0\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\4e4767691b0e4457089eb198\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\4e4767691b0e4457089eb198\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\5fb051e9d5a44c839c65349b\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\5fb051e9d5a44c839c65349b\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\641c321d5daf4bb32b327d8e\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\641c321d5daf4bb32b327d8e\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\70d7eadbcc9d4c82b4c9dc90\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\70d7eadbcc9d4c82b4c9dc90\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\727ab25b77864cf8a494bbb3\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\727ab25b77864cf8a494bbb3\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\75d75f618f194f6e6f6428b7\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\75d75f618f194f6e6f6428b7\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\7a382a67a6a149a722a63c9a\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\7a382a67a6a149a722a63c9a\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\84222500bab9410d4051aaae\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\84222500bab9410d4051aaae\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\84ebc7ee91eb4efc604a75a6\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\84ebc7ee91eb4efc604a75a6\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\88a34a1fb6fd467beee554b2\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\88a34a1fb6fd467beee554b2\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\8d9ce2f96ef649844b887ea9\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\8d9ce2f96ef649844b887ea9\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\8e7731cb73c142836c11eea4\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\8e7731cb73c142836c11eea4\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\9171aa56fb384c4bb4950396\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\9171aa56fb384c4bb4950396\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\9175a13435a54ac3da5a59b2\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\9175a13435a54ac3da5a59b2\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\92bc9d2d52f34f3367cdaebc\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\92bc9d2d52f34f3367cdaebc\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\947e43f3658f4c85b38c5d86\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\947e43f3658f4c85b38c5d86\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\9616fcb4de394fd0fe92b895\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\9616fcb4de394fd0fe92b895\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\9f7adb1ec8804604a9dbd586\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\9f7adb1ec8804604a9dbd586\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\a0a09aa1e81740c8c18abb85\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\a0a09aa1e81740c8c18abb85\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\a85e2da7c35346a26f1657bf\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\a85e2da7c35346a26f1657bf\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\a9d82d44e1bc429d37338094\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\a9d82d44e1bc429d37338094\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\ae1eb4d31fa4479677467186\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\ae1eb4d31fa4479677467186\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\b0002ad699d14434728483b3\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\b0002ad699d14434728483b3\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\b07d5f120e894623f3047e8a\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\b07d5f120e894623f3047e8a\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\b33a0808c9204fff8bcdfaa8\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\b33a0808c9204fff8bcdfaa8\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\cd8fc4284be1477fe63515ac\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\cd8fc4284be1477fe63515ac\#settings
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\cd8fc4284be1477fe63515ac\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\d0b5e2fcf1024d29c1f1b28d\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\d0b5e2fcf1024d29c1f1b28d\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\d143686a17e14c7996e4ee87\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\d143686a17e14c7996e4ee87\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\d143686a17e14c7996e4ee87\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\d82aa93430204fb7d8003daa\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\d82aa93430204fb7d8003daa\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\dec451b563e14c469cceed94\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\dec451b563e14c469cceed94\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\e3a9855a40ad449cbbe44d89\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\e3a9855a40ad449cbbe44d89\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\e7c7f82a5d4a4b0466818896\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\e7c7f82a5d4a4b0466818896\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\f7aa822d9b174ccd4c011499\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\f7aa822d9b174ccd4c011499\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\fb0287d5a66c48cd03a28394\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\fb0287d5a66c48cd03a28394\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\fd808d37293b453be7d2eb95\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\fd808d37293b453be7d2eb95\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\#internal
jamesdang
2007-07-16, 00:18
This is part 3
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\16066bffdd8a448f5454fdb5\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\16066bffdd8a448f5454fdb5\12eab4c2183a4de8883c898f\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\16066bffdd8a448f5454fdb5\12eab4c2183a4de8883c898f\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\16066bffdd8a448f5454fdb5\12eab4c2183a4de8883c898f\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\16066bffdd8a448f5454fdb5\2fd16a0ae5e44161a28ddd9f\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\16066bffdd8a448f5454fdb5\2fd16a0ae5e44161a28ddd9f\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\16066bffdd8a448f5454fdb5\2fd16a0ae5e44161a28ddd9f\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\16066bffdd8a448f5454fdb5\f20eb561cddb42652def99a9\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\16066bffdd8a448f5454fdb5\f20eb561cddb42652def99a9\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\16066bffdd8a448f5454fdb5\f20eb561cddb42652def99a9\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\16066bffdd8a448f5454fdb5\fc1d7251ea7c433c07acb2a3\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\16066bffdd8a448f5454fdb5\fc1d7251ea7c433c07acb2a3\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\16066bffdd8a448f5454fdb5\fc1d7251ea7c433c07acb2a3\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\65a60d1c95e640fa3373bfa6\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\65a60d1c95e640fa3373bfa6\2b45ea7b96184b1e26698985\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\65a60d1c95e640fa3373bfa6\2b45ea7b96184b1e26698985\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\65a60d1c95e640fa3373bfa6\2b45ea7b96184b1e26698985\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\65a60d1c95e640fa3373bfa6\8250361803884a4adee821a5\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\65a60d1c95e640fa3373bfa6\8250361803884a4adee821a5\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\65a60d1c95e640fa3373bfa6\8250361803884a4adee821a5\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\65a60d1c95e640fa3373bfa6\9b707620731742926532bfa5\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\65a60d1c95e640fa3373bfa6\9b707620731742926532bfa5\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\65a60d1c95e640fa3373bfa6\9b707620731742926532bfa5\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\65a60d1c95e640fa3373bfa6\cf17b2fc1ffe4a82cb95fcbe\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\65a60d1c95e640fa3373bfa6\cf17b2fc1ffe4a82cb95fcbe\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\65a60d1c95e640fa3373bfa6\cf17b2fc1ffe4a82cb95fcbe\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\02f58ad2a12b4f589c5372be\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\02f58ad2a12b4f589c5372be\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\02f58ad2a12b4f589c5372be\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\03ec5ba96f6f47586dab70ad\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\03ec5ba96f6f47586dab70ad\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\03ec5ba96f6f47586dab70ad\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\09f28183f76b426988ad1e96\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\09f28183f76b426988ad1e96\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\09f28183f76b426988ad1e96\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\0a05d532f10f40eef229c796\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\0a05d532f10f40eef229c796\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\0a05d532f10f40eef229c796\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\0c90fcab5b994c7eb0744db0\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\0c90fcab5b994c7eb0744db0\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\0c90fcab5b994c7eb0744db0\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\0c90fcab5b994c7eb0744db0\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\0d12302efdca4b7ca49e898e\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\0d12302efdca4b7ca49e898e\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\0d12302efdca4b7ca49e898e\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\0f302b00de7e4cb14361c290\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\0f302b00de7e4cb14361c290\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\0f302b00de7e4cb14361c290\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\13090301131141a9680cb98b\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\13090301131141a9680cb98b\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\13090301131141a9680cb98b\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\174731cbc32c4871c174748b\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\174731cbc32c4871c174748b\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\174731cbc32c4871c174748b\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\17bd1a5602224667d5ec7c81\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\17bd1a5602224667d5ec7c81\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\17bd1a5602224667d5ec7c81\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\17bd1a5602224667d5ec7c81\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\219f10cc9e404eac1b629da8\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\219f10cc9e404eac1b629da8\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\219f10cc9e404eac1b629da8\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\2592f750764a476da8a9168a\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\2592f750764a476da8a9168a\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\2592f750764a476da8a9168a\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\26a21175728d40ecf762f399\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\26a21175728d40ecf762f399\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\26a21175728d40ecf762f399\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\291ca87dff0845257bd30f86\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\291ca87dff0845257bd30f86\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\291ca87dff0845257bd30f86\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\291ca87dff0845257bd30f86\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\31184fe8979b4dfd208231bc\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\31184fe8979b4dfd208231bc\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\31184fe8979b4dfd208231bc\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\31184fe8979b4dfd208231bc\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\3db20b5220734750f5e41cb1\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\3db20b5220734750f5e41cb1\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\3db20b5220734750f5e41cb1\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\476d3e2689e245ace88e23af\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\476d3e2689e245ace88e23af\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\476d3e2689e245ace88e23af\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\4b185752577043b8630bdd93\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\4b185752577043b8630bdd93\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\4b185752577043b8630bdd93\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\4d0d23aad2db4ae4d8dbdf9a\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\4d0d23aad2db4ae4d8dbdf9a\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\4d0d23aad2db4ae4d8dbdf9a\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\4d0d23aad2db4ae4d8dbdf9a\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\4d25e213eebc488a1616e99b\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\4d25e213eebc488a1616e99b\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\4d25e213eebc488a1616e99b\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\4d25e213eebc488a1616e99b\Owner
jamesdang
2007-07-16, 00:20
This is part 5
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\4e90069959a04d16d30634b5\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\4e90069959a04d16d30634b5\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\4e90069959a04d16d30634b5\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\526ab164519a41e49392a49f\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\526ab164519a41e49392a49f\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\526ab164519a41e49392a49f\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\561b3cbf0f9041745383ecb8\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\561b3cbf0f9041745383ecb8\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\561b3cbf0f9041745383ecb8\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5a383e2757474408e20b9ca4\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5a383e2757474408e20b9ca4\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5a383e2757474408e20b9ca4\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5a3a7cfc7ec44b62f58de98c\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5a3a7cfc7ec44b62f58de98c\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5a3a7cfc7ec44b62f58de98c\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5a6c9ea1ed164b1b740bc89c\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5a6c9ea1ed164b1b740bc89c\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5a6c9ea1ed164b1b740bc89c\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5c0531c9c38e41813f84f7a9\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5c0531c9c38e41813f84f7a9\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5c0531c9c38e41813f84f7a9\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5c0531c9c38e41813f84f7a9\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5e445d1464ff400ccd121f86\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5e445d1464ff400ccd121f86\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5e445d1464ff400ccd121f86\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5e445d1464ff400ccd121f86\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\6312a3695e3e4d0770062a97\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\6312a3695e3e4d0770062a97\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\6312a3695e3e4d0770062a97\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\7f8bd0bf44134d99163a148b\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\7f8bd0bf44134d99163a148b\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\7f8bd0bf44134d99163a148b\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\801bc23e40c1467d44851088\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\801bc23e40c1467d44851088\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\801bc23e40c1467d44851088\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\8170a21d69a8412804b1ca85\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\8170a21d69a8412804b1ca85\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\8170a21d69a8412804b1ca85\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\8170a21d69a8412804b1ca85\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\8afda875126d4730d99d6a8e\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\8afda875126d4730d99d6a8e\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\8afda875126d4730d99d6a8e\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\92529a0f066840f296695da2\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\92529a0f066840f296695da2\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\92529a0f066840f296695da2\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\9bc0d9d433b64a862614fcad\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\9bc0d9d433b64a862614fcad\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\9bc0d9d433b64a862614fcad\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\9bc0d9d433b64a862614fcad\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\9e8ac280c7b14eda52397395\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\9e8ac280c7b14eda52397395\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\9e8ac280c7b14eda52397395\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\a17bfefddc9d46e1e9494d9e\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\a17bfefddc9d46e1e9494d9e\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\a17bfefddc9d46e1e9494d9e\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\a6d37cb33c4742d93074b9b7\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\a6d37cb33c4742d93074b9b7\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\a6d37cb33c4742d93074b9b7\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\a6d37cb33c4742d93074b9b7\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\a7bfd917ba404041d849018d\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\a7bfd917ba404041d849018d\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\a7bfd917ba404041d849018d\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\a7bfd917ba404041d849018d\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\ad515cc0221340f5bd8225ac\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\ad515cc0221340f5bd8225ac\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\ad515cc0221340f5bd8225ac\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\ad515cc0221340f5bd8225ac\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\ade235fa33c34c91b56f0aa0\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\ade235fa33c34c91b56f0aa0\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\ade235fa33c34c91b56f0aa0\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\ade235fa33c34c91b56f0aa0\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\af735fc9770a4657ea482788\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\af735fc9770a4657ea482788\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\af735fc9770a4657ea482788\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\bcbf0fd22dd64ad736cfd595\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\bcbf0fd22dd64ad736cfd595\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\bcbf0fd22dd64ad736cfd595\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\c0b53ecee33943eaa8f095b9\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\c0b53ecee33943eaa8f095b9\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\c0b53ecee33943eaa8f095b9\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\c0b53ecee33943eaa8f095b9\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\c1c98000f59946c13171d1b4\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\c1c98000f59946c13171d1b4\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\c1c98000f59946c13171d1b4\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\c2c1611edf3d4a38257fe284\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\c2c1611edf3d4a38257fe284\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\c2c1611edf3d4a38257fe284\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\c2c1611edf3d4a38257fe284\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\c3862ab545714913838a3993\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\c3862ab545714913838a3993\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\c3862ab545714913838a3993\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\cb15418d360643ba4b7e7a9f\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\cb15418d360643ba4b7e7a9f\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\cb15418d360643ba4b7e7a9f\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\ccfabf172559411976bcdaac\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\ccfabf172559411976bcdaac\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\ccfabf172559411976bcdaac\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\ccfabf172559411976bcdaac\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\d12b001d81e64e51d449ba93\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\d12b001d81e64e51d449ba93\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\d12b001d81e64e51d449ba93\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\d12b001d81e64e51d449ba93\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\d16061ab569c4580ade514a5\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\d16061ab569c4580ade514a5\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\d16061ab569c4580ade514a5\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\d4d10e6a24db4efcc16ce788\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\d4d10e6a24db4efcc16ce788\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\d4d10e6a24db4efcc16ce788\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\d4d10e6a24db4efcc16ce788\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\db19d2aa66a143ddfaf273b6\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\db19d2aa66a143ddfaf273b6\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\db19d2aa66a143ddfaf273b6\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\db19d2aa66a143ddfaf273b6\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\e2686755445f45166aba229c\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\e2686755445f45166aba229c\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\e2686755445f45166aba229c\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\e882c9d6cd2146dc8a94fe98\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\e882c9d6cd2146dc8a94fe98\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\e882c9d6cd2146dc8a94fe98\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\e882c9d6cd2146dc8a94fe98\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f01ba2b44f894c2ed3fc97b5\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f01ba2b44f894c2ed3fc97b5\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f01ba2b44f894c2ed3fc97b5\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f1d93cca32184b49339c9981\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f1d93cca32184b49339c9981\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f1d93cca32184b49339c9981\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f27e110f60934b9192ac81be\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f27e110f60934b9192ac81be\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f27e110f60934b9192ac81be\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f27e110f60934b9192ac81be\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f2c97edc61174d893be93da1\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f2c97edc61174d893be93da1\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f2c97edc61174d893be93da1\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f392ce0d68d645a806d700b4\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f392ce0d68d645a806d700b4\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f392ce0d68d645a806d700b4\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f656fc2a47404e91352314b2\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f656fc2a47404e91352314b2\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f656fc2a47404e91352314b2\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f9d00726d37c4073ea7f9ead\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f9d00726d37c4073ea7f9ead\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f9d00726d37c4073ea7f9ead\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\fb7250c9e7ae42aaddaac486\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\fb7250c9e7ae42aaddaac486\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\fb7250c9e7ae42aaddaac486\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\fd22e38830714bee4eedf89f\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\fd22e38830714bee4eedf89f\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\fd22e38830714bee4eedf89f\#name
jamesdang
2007-07-16, 00:22
End of log
C:\Program Files\winantispyware 2007\scanlog.xml
C:\Program Files\winantispyware 2007\settings.ini
C:\Program Files\winantispyware 2007\shellext.dll
C:\Program Files\winantispyware 2007\shellext.xml
C:\Program Files\winantispyware 2007\sr.log
C:\Program Files\winantispyware 2007\Summary.dat
C:\Program Files\winantispyware 2007\support.url
C:\Program Files\winantispyware 2007\tasks.dat
C:\Program Files\winantispyware 2007\threatnet.dat
C:\Program Files\winantispyware 2007\threatnet.ini
C:\Program Files\winantispyware 2007\unins000.dat
C:\Program Files\winantispyware 2007\unins000.exe
C:\Program Files\winantispyware 2007\uninstall.ico
C:\Program Files\winantispyware 2007\UnWizard.exe
C:\Program Files\winantispyware 2007\unwizard.xml
C:\Program Files\winantispyware 2007\up.dat
C:\Program Files\winantispyware 2007\updater.dat
C:\Program Files\winantispyware 2007\was7.exe
C:\Program Files\winantispyware 2007\WAS7.url
C:\Program Files\winantispyware 2007\WAS7.xml
C:\temp\0b9
C:\temp\iee
C:\WINDOWS\b136.exe
C:\WINDOWS\poolsv.exe
C:\WINDOWS\retadpu77.exe
C:\WINDOWS\SmFtZXMgRGFuZw\asappsrv.dll
C:\WINDOWS\SmFtZXMgRGFuZw\command.exe
C:\WINDOWS\system32\acbfqtex.exe
C:\WINDOWS\system32\atmtd.dll
C:\WINDOWS\system32\atmtd.dll._
C:\WINDOWS\system32\drivers\ApiMon.sys
C:\WINDOWS\system32\drivers\fopn.sys
C:\WINDOWS\system32\fsymagie.exe
C:\WINDOWS\system32\ifnarpju.exe
C:\WINDOWS\system32\jie.dll
C:\WINDOWS\system32\jkgbjyox.exe
C:\WINDOWS\system32\kxyvomvf.exe
C:\WINDOWS\system32\ndamjddn.exe
C:\WINDOWS\system32\o09PrEz
C:\WINDOWS\system32\rwbepnza.dll
C:\WINDOWS\system32\sstem~1
C:\WINDOWS\system32\sstem~1\rundll.exe
C:\WINDOWS\system32\stera.exe
C:\WINDOWS\system32\wnstssv.exe
C:\WINDOWS\uninstall_nmon.vbs
C:\WINDOWS\wr.txt
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
-------\LEGACY_CMDSERVICE
-------\LEGACY_IPRIP
-------\LEGACY_NETWORK_MONITOR
-------\cmdService
-------\Network Monitor
((((((((((((((((((((((((( Files Created from 2007-06-15 to 2007-07-15 )))))))))))))))))))))))))))))))
2007-07-15 14:48 616,448 --ah----- C:\StashIMAPI.bin
2007-07-15 14:19 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-14 18:52 <DIR> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\Yahoo!
2007-07-14 18:16 <DIR> d--hs---- C:\WINDOWS\SmFtZXMgRGFuZw
2007-07-14 18:16 <DIR> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\NetMon
2007-07-14 09:45 <DIR> d-------- C:\VundoFix Backups
2007-07-13 13:09 <DIR> d-------- C:\DOCUME~1\Tuan-Anh\APPLIC~1\DivX
2007-07-10 20:04 24,576 --------- C:\WINDOWS\SvcCon.exe
2007-06-22 02:07 <DIR> d-------- C:\DOCUME~1\UNCLET~1\APPLIC~1\DivX
2007-06-21 16:03 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion
2007-06-21 13:56 <DIR> d-------- C:\DOCUME~1\UNCLEQ~1\APPLIC~1\DivX
2007-06-19 20:02 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\TomTom
2007-06-18 19:55 <DIR> d-------- C:\Program Files\TomTom HOME
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-07-15 21:34:50 -------- d-----w C:\Program Files\Symantec AntiVirus
2007-07-14 17:14:12 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\SolidWorks
2007-07-10 14:11:26 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\AdobeUM
2007-06-22 04:25:27 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\Yahoo!
2007-06-21 22:31:50 -------- d-----w C:\Program Files\Yahoo!
2007-06-19 02:55:39 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-06-10 17:38:28 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\DivX
2007-06-08 01:09:14 -------- d-----w C:\Program Files\DivX
2007-06-01 16:01:16 -------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-06-01 16:00:45 -------- d-----w C:\Program Files\Symantec
2007-06-01 15:54:00 -------- d-----w C:\Program Files\SBC Self Support Tool
2007-06-01 15:53:31 -------- d-----w C:\Program Files\Common Files\Motive
2007-06-01 15:48:00 -------- d-----w C:\Program Files\Common Files\Scanner
2007-06-01 01:13:37 -------- d-----w C:\Program Files\Messenger
2007-06-01 01:07:28 1,542,513 --sha-w C:\WINDOWS\system32\ijllm.ini2
2007-06-01 01:06:08 1,541,681 --sha-w C:\WINDOWS\system32\ijllm.bak2
2007-05-31 01:52:22 444 ----a-w C:\WINDOWS\system32\d3d8caps.dat
2007-05-30 20:30:27 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2007-05-30 20:30:24 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-05-30 20:30:21 36,624 ----a-w C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-05-30 20:30:21 2,560 ----a-w C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-05-30 20:30:21 2,432 ----a-w C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-05-30 20:30:21 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll
2007-05-30 20:30:21 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe
2007-05-30 20:30:21 116,472 ----a-w C:\WINDOWS\system32\pxcpyi64.exe
2007-05-30 20:30:18 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-05-30 20:30:18 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-05-30 20:27:55 73,728 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-05-30 20:27:55 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2007-05-30 20:27:54 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-05-30 20:27:53 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-05-30 20:27:53 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2007-05-30 20:27:53 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2007-05-30 20:27:53 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2007-05-30 20:27:53 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2007-05-30 20:27:51 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-05-30 20:27:51 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2007-05-30 20:27:51 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2007-05-30 20:27:51 740,442 ----a-w C:\WINDOWS\system32\DivX.dll
2007-05-30 20:27:23 124,472 ----a-w C:\WINDOWS\system32\DivXCodecUpdateChecker.exe
2007-05-30 20:27:23 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-05-24 01:33:08 -------- d-----w C:\Program Files\Computrainer
2007-05-24 00:04:10 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\Error Safe Free
2007-05-22 04:06:42 1,498,299 --sha-w C:\WINDOWS\system32\ijllm.bak1
2007-05-19 00:32:29 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\Vso
2007-05-19 00:32:28 87,608 ----a-w C:\DOCUME~1\Owner\APPLIC~1\ezpinst.exe
2007-05-19 00:32:28 47,360 ----a-w C:\DOCUME~1\Owner\APPLIC~1\pcouffin.sys
2007-05-19 00:30:46 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys
2005-07-29 23:24:26 472 --sha-r C:\WINDOWS\SmFtZXMgRGFuZw\mAIQtrg0l3IRtT.vbs
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
2007-03-20 14:39 803864 --a------ C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-12-18 05:16 59032 --a------ C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}]
2006-10-31 13:33 198136 --a------ C:\Program Files\Yahoo!\Common\yiesrvc.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{641914A9-D968-F69C-1217-828DBC2D80BC}]
C:\WINDOWS\System32\jie.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CD4AD09A-AFE0-45CA-AD31-484A421A329E}]
C:\WINDOWS\System32\ddcyw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2003-08-26 20:47]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 05:59 C:\WINDOWS\BCMSMMSG.exe]
"BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 22:26]
"IPInSightLAN 02"="C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" [2003-06-11 02:52]
"IPInSightMonitor 02"="C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe" [2003-06-11 02:52]
"Motive SmartBridge"="C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe" []
"InstantAccess"="C:\Program Files\TextBridge Pro Millennium\Bin\InstantAccess.exe" [2000-01-19 16:43]
"NWEReboot"="" []
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 17:40]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-02-29 16:44]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2004-03-12 15:18]
"TomTomHOME.exe"="C:\Program Files\TomTom HOME\TomTomHOME.exe" [2007-03-14 16:52]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [2003-07-16 13:26]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-06-11 18:16]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 14:32]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 17:45]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{4567AB12-B980-44A5-B259-9B09EBEA6331}"="C:\Program Files\WinAntiSpyware 2007\shellext.dll" []
**************************************************************************
catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-15 14:48:08
Windows 5.1.2600 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
Completion time: 2007-07-15 14:50:01 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-07-15 14:49
--- E O F ---
jamesdang
2007-07-16, 00:25
post # 13 should be This is part 4 not part 5
Thanks.
OK let's see...
Look in your control panels add/remove programs for any of these and uninstall them:
WinAntivirus
Oin
Yazzle by Oin
Purityscan by Oin
Snowballwars by Oin
or anything similar with Oin or Outerinfo in it.
Zolero
Tizzletalk
MediaTickets
Cowabanga
and any other programs you didn't install or don't recognize - if your not sure please ask first
Download and run this uninstaller:
http://www.outerinfo.com/OiUninstaller.exe
Tutorial for the uninstaller if needed (http://www.outerinfo.com/howto.html)
Then run ComboFix again and post it's fresh log to here (it should be a bit shorter than the last one). Also please post a fresh HijackThis log :bigthumb:
jamesdang
2007-07-18, 05:51
"Owner" - 2007-07-17 20:40:58 - ComboFix 07-07-14.6 - Service Pack 1 NTFS
((((((((((((((((((((((((( Files Created from 2007-06-18 to 2007-07-18 )))))))))))))))))))))))))))))))
2007-07-15 14:19 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-14 18:52 <DIR> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\Yahoo!
2007-07-14 18:16 <DIR> d--hs---- C:\WINDOWS\SmFtZXMgRGFuZw
2007-07-14 18:16 <DIR> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\NetMon
2007-07-14 09:45 <DIR> d-------- C:\VundoFix Backups
2007-07-13 13:09 <DIR> d-------- C:\DOCUME~1\Tuan-Anh\APPLIC~1\DivX
2007-07-10 20:04 24,576 --------- C:\WINDOWS\SvcCon.exe
2007-06-22 02:07 <DIR> d-------- C:\DOCUME~1\UNCLET~1\APPLIC~1\DivX
2007-06-21 13:56 <DIR> d-------- C:\DOCUME~1\UNCLEQ~1\APPLIC~1\DivX
2007-06-19 20:02 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\TomTom
2007-06-18 19:55 <DIR> d-------- C:\Program Files\TomTom HOME
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-07-18 03:22:11 -------- d-----w C:\Program Files\Symantec AntiVirus
2007-07-18 03:21:14 -------- d-----w C:\Program Files\Yahoo!
2007-07-14 17:14:12 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\SolidWorks
2007-07-10 14:11:26 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\AdobeUM
2007-06-22 04:25:27 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\Yahoo!
2007-06-19 02:55:39 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-06-10 17:38:28 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\DivX
2007-06-08 01:09:14 -------- d-----w C:\Program Files\DivX
2007-06-01 16:01:16 -------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-06-01 16:00:45 -------- d-----w C:\Program Files\Symantec
2007-06-01 15:54:00 -------- d-----w C:\Program Files\SBC Self Support Tool
2007-06-01 15:53:31 -------- d-----w C:\Program Files\Common Files\Motive
2007-06-01 15:48:00 -------- d-----w C:\Program Files\Common Files\Scanner
2007-06-01 01:13:37 -------- d-----w C:\Program Files\Messenger
2007-06-01 01:07:28 1,542,513 --sha-w C:\WINDOWS\system32\ijllm.ini2
2007-06-01 01:06:08 1,541,681 --sha-w C:\WINDOWS\system32\ijllm.bak2
2007-05-31 01:52:22 444 ----a-w C:\WINDOWS\system32\d3d8caps.dat
2007-05-30 20:30:27 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2007-05-30 20:30:24 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-05-30 20:30:21 36,624 ----a-w C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-05-30 20:30:21 2,560 ----a-w C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-05-30 20:30:21 2,432 ----a-w C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-05-30 20:30:21 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll
2007-05-30 20:30:21 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe
2007-05-30 20:30:21 116,472 ----a-w C:\WINDOWS\system32\pxcpyi64.exe
2007-05-30 20:30:18 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-05-30 20:30:18 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-05-30 20:27:55 73,728 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-05-30 20:27:55 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2007-05-30 20:27:54 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-05-30 20:27:53 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-05-30 20:27:53 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2007-05-30 20:27:53 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2007-05-30 20:27:53 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2007-05-30 20:27:53 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2007-05-30 20:27:51 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-05-30 20:27:51 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2007-05-30 20:27:51 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2007-05-30 20:27:51 740,442 ----a-w C:\WINDOWS\system32\DivX.dll
2007-05-30 20:27:23 124,472 ----a-w C:\WINDOWS\system32\DivXCodecUpdateChecker.exe
2007-05-30 20:27:23 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-05-24 01:33:08 -------- d-----w C:\Program Files\Computrainer
2007-05-24 00:04:10 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\Error Safe Free
2007-05-22 04:06:42 1,498,299 --sha-w C:\WINDOWS\system32\ijllm.bak1
2007-05-19 00:32:29 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\Vso
2007-05-19 00:32:28 87,608 ----a-w C:\DOCUME~1\Owner\APPLIC~1\ezpinst.exe
2007-05-19 00:32:28 47,360 ----a-w C:\DOCUME~1\Owner\APPLIC~1\pcouffin.sys
2007-05-19 00:30:46 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys
2005-07-29 23:24:26 472 --sha-r C:\WINDOWS\SmFtZXMgRGFuZw\mAIQtrg0l3IRtT.vbs
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-12-18 05:16 59032 --a------ C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{641914A9-D968-F69C-1217-828DBC2D80BC}]
C:\WINDOWS\System32\jie.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CD4AD09A-AFE0-45CA-AD31-484A421A329E}]
C:\WINDOWS\System32\ddcyw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2003-08-26 20:47]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 05:59 C:\WINDOWS\BCMSMMSG.exe]
"BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 22:26]
"IPInSightLAN 02"="C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" [2003-06-11 02:52]
"IPInSightMonitor 02"="C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe" [2003-06-11 02:52]
"Motive SmartBridge"="C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe" []
"InstantAccess"="C:\Program Files\TextBridge Pro Millennium\Bin\InstantAccess.exe" [2000-01-19 16:43]
"NWEReboot"="" []
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 17:40]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-02-29 16:44]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2004-03-12 15:18]
"TomTomHOME.exe"="C:\Program Files\TomTom HOME\TomTomHOME.exe" [2007-03-14 16:52]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [2003-07-16 13:26]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-06-11 18:16]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 14:32]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 17:45]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{4567AB12-B980-44A5-B259-9B09EBEA6331}"="C:\Program Files\WinAntiSpyware 2007\shellext.dll" []
**************************************************************************
catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-17 20:47:55
Windows 5.1.2600 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 2007-07-17 20:48:42
C:\ComboFix-quarantined-files.txt ... 2007-07-17 20:48
C:\ComboFix2.txt ... 2007-07-15 14:50
--- E O F ---
jamesdang
2007-07-18, 05:54
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:53:23 PM, on 7/17/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe
C:\Program Files\TextBridge Pro Millennium\Bin\InstantAccess.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\TomTom HOME\TomTomHOME.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\HiJackThis\Scanner.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {641914A9-D968-F69C-1217-828DBC2D80BC} - C:\WINDOWS\System32\jie.dll (file missing)
O2 - BHO: (no name) - {CD4AD09A-AFE0-45CA-AD31-484A421A329E} - C:\WINDOWS\System32\ddcyw.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [InstantAccess] C:\Program Files\TextBridge Pro Millennium\Bin\InstantAccess.exe /h
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME\TomTomHOME.exe" -s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.gioitre.org/tdserver.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.2.1.87.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/qtinstall.info.apple.com/pthalo/us/win/QuickTimeFullInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1137299390562
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1137299378734
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {D1792F99-AA90-4D46-8B73-2CE45DADDD3C} (WAFDownloader Class) - https://www.web-a-file.com/webafiledownloader.cab
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intuit Fuse Service - Intuit - C:\Program Files\Common Files\Intuit\Fuse\Service\Intuit Fuse Service.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
--
End of file - 7909 bytes
Hi again, we'll continue :)
You should print these instructions or save these to a text file. Follow these instructions carefully.
Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/
Install AVG Anti-Spyware by double clicking the installer.
Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
On the main screen under Your Computer's security.
Click on Change state next to Resident shield. It should now change to inactive.
Click on Change state next to Automatic updates. It should now change to inactive.
Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
Wait until you see the Update succesfull message.
Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates (http://www.ewido.net/en/download/updates/).
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.
Download ATF Cleaner (http://www.atribune.org/ccount/click.php?id=1) by Atribune to your desktop.
Do NOT run yet.
Make your hidden files visible:
Go to My Computer
Select the Tools menu and click Folder Options
Click the View tab.
Checkmark the "Display the contents of system folders"
Under the Hidden files and folders select "Show hidden files and folders"
Uncheck "Hide protected operating system files"
Click Apply and then the OK and close My Computer.
==================
Open Control Panel -> Add/Remove programs -> Remove all the of the following or similar entries if found:
Error Safe Free
and any other programs you didn't install or don't recognize - if your not sure please ask first
Run HijackThis, click Do a system scan only, and check the box next to each of these entries if still present. Close all other windows and press Fix checked. If something isn't there, please continue with the next entry in the list.
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {641914A9-D968-F69C-1217-828DBC2D80BC} - C:\WINDOWS\System32\jie.dll (file missing)
O2 - BHO: (no name) - {CD4AD09A-AFE0-45CA-AD31-484A421A329E} - C:\WINDOWS\System32\ddcyw.dll (file missing)
Restart your computer to the safe mode:
Restart your computer
Start tapping the F8 key when the computer restarts.
When the start menu opens, choose Safe mode
Press Enter. The computer then begins to start in Safe mode.
Go to the My Computer and delete the following files (if present):
C:\WINDOWS\system32\ijllm.ini2
C:\WINDOWS\system32\ijllm.bak2
C:\WINDOWS\system32\ijllm.bak1
Go to the My Computer and delete the following folders (if present):
C:\Documents and Settings\Owner\Application Data\Error Safe Free
C:\WINDOWS\SmFtZXMgRGFuZw
C:\Documents and Settings\Local Settings\Application Data\NetMon
Run ATF Cleaner Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
Restart the computer to the normal mode.
Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
Click on Scanner on the toolbar.
Click on the Settings tab.
Under How to act?
Click on Recommended Action and choose Quarantine from the popup menu.
Under How to scan?
All checkboxes should be ticked.
Under Possibly unwanted software:
All checkboxes should be ticked.
Under Reports:
Select Automatically generate report after every scan and uncheck Only if threats were found.
Under What to scan?
Select Scan every file.
Click on the Scan tab.
Click on Complete System Scan to start the scan process.
Let the program scan the machine.
When the scan has finished, follow the instructions below.
IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
At the bottom of the window click on the Apply all Actions button. (3)
http://img509.imageshack.us/img509/4851/scanavgjk2.jpg
When done, click the Save Scan Report button. (4)
Click the Save Report as button.
Save the report to your Desktop.
Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
================
When you're ready, please post the following logs to here:
- AVG's report
- a fresh HijackThis log
jamesdang
2007-07-19, 07:02
First step: from download AVG anti-Syyware to Show hidden files and folder, unchecked "hide protected operating system files".
Run HijackThis and fix checked. Ok.
There is no problems here.
The problem at: "Restart your computer to the safe mode".
jamesdang
2007-07-19, 07:13
I restart my computer, F8, selected "Safe mode".
There is no windows shown, only lines like "dos": see below for more info
multi(0)dish(0)rdisk(0)partition (1)\windows\systems32\C-437.nls
multi(0)dish(0)rdisk(0)partition (1)\windows\systems32\l-intl.nls
multi(0)dish(0)rdisk(0)partition (1)\windows\Fonts\vgaoem.fon
multi(0)dish(0)rdisk(0)partition (1)\windows\App Patch\drvmain.sdb
multi(0)dish(0)rdisk(0)partition (1)\windows\systems32\drivers\ACPI.sgs
multi(0)dish(0)rdisk(0)partition (1)\windows\systems32\drivers\Wmilib.
multi(0)dish(0)rdisk(0)partition (1)\windows\systems32\drivers\pci
multi(0)dish(0)rdisk(0)partition (1)\windows\systems32\drivers\isapnp
multi(0)dish(0)rdisk(0)partition (1)\windows\systems32\drivers\pciide...
...
...
alot of lines like above.
So, I can not go to Mycomputer to delete the files and folders (if present).
and I can not run ATF Cleaner in Safe mode.
So, I run ATF cleaner in normal windows.
jamesdang
2007-07-19, 07:19
Run a full scan and followed instructed steps, only in the middle, I do some internet searching.
There are 57 file infected with high, medium,...
But it did not let me save the log so i can not put up here. Maybe, last time I run this sofware 1 month ago (see linked post #1, this thread), trial time was over, so it won't let me "save report".
Next, I will post a fresh log file of hijackthis.
jamesdang
2007-07-19, 07:22
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:54:22 PM, on 7/18/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe
C:\Program Files\TextBridge Pro Millennium\Bin\InstantAccess.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\TomTom HOME\TomTomHOME.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\HiJackThis\Scanner.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [InstantAccess] C:\Program Files\TextBridge Pro Millennium\Bin\InstantAccess.exe /h
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME\TomTomHOME.exe" -s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.gioitre.org/tdserver.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.2.1.87.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/qtinstall.info.apple.com/pthalo/us/win/QuickTimeFullInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1137299390562
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1137299378734
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {D1792F99-AA90-4D46-8B73-2CE45DADDD3C} (WAFDownloader Class) - https://www.web-a-file.com/webafiledownloader.cab
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intuit Fuse Service - Intuit - C:\Program Files\Common Files\Intuit\Fuse\Service\Intuit Fuse Service.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
--
End of file - 7663 bytes
Hi :)
Ok looks better now. How is the computer running at the moment?
Please do an online scan with Kaspersky WebScanner (http://www.kaspersky.com/virusscanner)
Click on Kaspersky Online Scanner
You will be promted to install an ActiveX component from Kaspersky, Click Yes.
The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:
Scan using the following Anti-Virus database:
Extended (if available otherwise Standard)
Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan:Select My Computer
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button:
Save the file to your desktop.
Copy and paste that information in your next post.
jamesdang
2007-07-20, 00:27
1. My computer can not work on safe mode. Could you help me to fix it?
2. My computer take about 3 minutes for me to use at Start up (when I restart computer, Start button and all icons desktop screen shown). Looks like something running (the mouse pointer showed as "Working in Background").
After going home from work today, I will run the Kasper scanner.
Thanks.
jamesdang
2007-07-20, 06:35
Thursday, July 19, 2007 8:32:28 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 1 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 20/07/2007
Kaspersky Anti-Virus database records: 365368
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
A:\
C:\
D:\
Scan Statistics:
Total number of scanned objects: 121997
Number of viruses found: 16
Number of infected objects: 54 / 0
Number of suspicious objects: 0
Duration of the scan process: 01:39:43
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\00F80000.VBN Infected: Trojan-Dropper.Win32.Agent.bfr skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\00F80001.VBN Infected: not-a-virus:AdWare.Win32.PurityScan.fn skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01F40000.VBN Infected: Trojan-Downloader.Win32.Tiny.id skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01F40001.VBN Infected: Trojan.Win32.Agent.aoy skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\03C80000.VBN Infected: Trojan.Win32.Agent.aoy skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\03C80001.VBN Infected: Trojan-Downloader.Win32.Tiny.id skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\03C80002.VBN Infected: Trojan-Downloader.Win32.Tiny.id skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05780000.VBN Infected: Trojan-Downloader.Win32.Tiny.id skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05780001.VBN Infected: Trojan.Win32.Agent.aoy skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05780002.VBN Infected: Trojan-Downloader.Win32.Tiny.id skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\079C0000.VBN Infected: not-a-virus:AdWare.Win32.Virtumonde.kr skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\History\History.IE5\MSHist012007071920070720\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner\ntuser.dat Object is locked skipped
C:\Documents and Settings\Owner\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped
C:\QooBox\Quarantine\C\Program Files\poolsv\wr-1-0000077.exe.vir Infected: Trojan-Downloader.Win32.Small.eqn skipped
C:\QooBox\Quarantine\C\Program Files\poolsv\YazzleBundle-1549.exe.vir/data0002 Infected: Trojan-Downloader.Win32.PurityScan.eg skipped
C:\QooBox\Quarantine\C\Program Files\poolsv\YazzleBundle-1549.exe.vir NSIS: infected - 1 skipped
C:\QooBox\Quarantine\C\Program Files\WinAntiSpyware 2007\InstUp.exe.vir/file2 Infected: not-a-virus:Downloader.Win32.WinFixer.t skipped
C:\QooBox\Quarantine\C\Program Files\WinAntiSpyware 2007\InstUp.exe.vir Inno: infected - 1 skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\cesrugfw.dll.vir Infected: Trojan.Win32.BHO.bd skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\dqspyygx.dll.vir Infected: Trojan.Win32.BHO.bd skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ftwugjsi.dll.vir Infected: Trojan.Win32.BHO.bd skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\gebxwxu.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\kpjmgxvh.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.ar skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\rkakknvq.dll.vir Infected: Trojan.Win32.BHO.bd skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\vtsqq.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.kr skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP34\A0007858.exe/file2 Infected: not-a-virus:Downloader.Win32.WinFixer.t skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP34\A0007858.exe Inno: infected - 1 skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP36\A0010978.exe Infected: Trojan-Downloader.Win32.PurityScan.eg skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP36\A0012010.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kr skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP37\A0014084.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ar skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP37\A0014085.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ar skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP37\A0015112.exe Infected: Trojan-Downloader.Win32.Small.eqn skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP37\A0015113.exe/data0002 Infected: Trojan-Downloader.Win32.PurityScan.eg skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP37\A0015113.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP37\A0015118.exe/file2 Infected: not-a-virus:Downloader.Win32.WinFixer.t skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP37\A0015118.exe Inno: infected - 1 skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP37\A0015136.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ar skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP37\A0015137.dll Infected: Trojan.Win32.BHO.bd skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP37\A0015138.dll Infected: Trojan.Win32.BHO.bd skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP37\A0015139.dll Infected: Trojan.Win32.BHO.bd skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP37\A0015141.dll Infected: Trojan.Win32.BHO.bd skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP37\A0015147.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kr skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP37\A0015148.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP40\A0016535.exe/stream/data0002/data0002 Infected: Trojan-Downloader.Win32.PurityScan.eh skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP40\A0016535.exe/stream/data0002 Infected: Trojan-Downloader.Win32.PurityScan.eh skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP40\A0016535.exe/stream/data0004 Infected: not-a-virus:AdWare.Win32.Softomate.u skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP40\A0016535.exe/stream Infected: not-a-virus:AdWare.Win32.Softomate.u skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP40\A0016535.exe NSIS: infected - 4 skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP40\A0016537.exe/stream/data0002 Infected: Trojan-Downloader.Win32.Small.buy skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP40\A0016537.exe/stream/data0004 Infected: not-a-virus:AdWare.Win32.Softomate.u skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP40\A0016537.exe/stream Infected: not-a-virus:AdWare.Win32.Softomate.u skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP40\A0016537.exe NSIS: infected - 3 skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP40\A0016538.exe/data0002 Infected: not-a-virus:AdWare.Win32.PurityScan.fk skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP40\A0016538.exe/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.bu skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP40\A0016538.exe NSIS: infected - 2 skipped
C:\System Volume Information\_restore{1621D2DD-8C01-45DF-84EC-7553CD8DA3ED}\RP41\change.log Object is locked skipped
C:\VundoFix Backups\ddcyw.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.kr skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\MEMORY.DMP Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_25c.dat Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
Scan process completed.
Hello and sorry for the long delay, I was away...
Ok let's try to fix the safe mode issue first:
Download avz4en.zip here (http://z-oleg.com/avz4en.zip)
Unzip it to a folder on your desktop
Double click on AVZ.exe
Click on the file tab and then click on System recovery
Put a checkmark next to Restore SafeBoot registry keys
Click on Execute selected operations
Restart the computer and try to boot to the safe mode.
Let me know :)
jamesdang
2007-07-22, 20:55
Now, I can do in windows safe mode.
First, it still show line same as post # 21 (above). Wait a minute, it changed to windows in safe mode. In there, I saw shortcut icon "download winantivirus" and I deleted the icon "download winantivirus" (in safe mode).:bigthumb:
So, what I do next?
Thanks
Hmm so still winantivirus....
Ok please post a fresh HijackThis log to here.
Download F-Secure Blacklight (http://www.f-secure.com/blacklight/try_blacklight.html) and save it to your desktop.
Doubleclick fsbl.exe, accept the agreement, click Scan, then click Next
You'll see a list what have been found. A log will appear to your desktop, it is named fsbl.xxxxxxx.log (xxxxxxx will be random numbers).
DON'T choose Rename if something was found!
Post the contents of fsbl.xxxx.log to here (blacklight log from your desktop)
jamesdang
2007-07-24, 05:00
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:58:19 PM, on 7/23/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe
C:\Program Files\TextBridge Pro Millennium\Bin\InstantAccess.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\TomTom HOME\TomTomHOME.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\HiJackThis\Scanner.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [InstantAccess] C:\Program Files\TextBridge Pro Millennium\Bin\InstantAccess.exe /h
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME\TomTomHOME.exe" -s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKUS\S-1-5-21-484763869-746137067-1417001333-1009\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe (User 'Uncle MinhThuy')
O4 - HKUS\S-1-5-21-484763869-746137067-1417001333-1009\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (User 'Uncle MinhThuy')
O4 - HKUS\S-1-5-21-484763869-746137067-1417001333-1009\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'Uncle MinhThuy')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.gioitre.org/tdserver.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.2.1.87.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/qtinstall.info.apple.com/pthalo/us/win/QuickTimeFullInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1137299390562
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1137299378734
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {D1792F99-AA90-4D46-8B73-2CE45DADDD3C} (WAFDownloader Class) - https://www.web-a-file.com/webafiledownloader.cab
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intuit Fuse Service - Intuit - C:\Program Files\Common Files\Intuit\Fuse\Service\Intuit Fuse Service.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
--
End of file - 8398 bytes
jamesdang
2007-07-24, 06:26
07/23/07 21:14:21 [Info]: BlackLight Engine 1.0.64 initialized
07/23/07 21:14:21 [Info]: OS: 5.1 build 2600 (Service Pack 1)
07/23/07 21:14:21 [Note]: 7019 4
07/23/07 21:14:21 [Note]: 7005 0
07/23/07 21:14:27 [Note]: 7006 0
07/23/07 21:14:27 [Note]: 7011 3512
07/23/07 21:14:27 [Note]: 7026 0
07/23/07 21:14:27 [Note]: 7026 0
07/23/07 21:14:32 [Note]: FSRAW library version 1.7.1022
07/23/07 21:23:34 [Note]: 2000 1012
Ok looks quite good now :)
How is the computer running? Any issues?
jamesdang
2007-07-25, 00:56
Post # 7
-----------------------------
"My computer poped up a lots.
It takes a lot of time when starting the computer. Look like something running. Icon of Winantivirus is located at everywhere: (1) right bottom corner, (2)right click at Start button, (3) Left click at Start button /Program/Winantivirus. Maybe somewhere else I don't know.
Please help. Thank you very much."
-----------------------------
Now, my computer looks like no more poped up. All icon of Winantivirus is gone.:bigthumb:
However, it still takes a lot of time.....something running."
How to make my computer start faster? Thanks
jamesdang
2007-07-25, 00:58
Post #21
before my computer can not work on safe mode. So, i can not do some of your instructed steps in post #19
"Restart your computer to the safe mode:
Restart your computer
Start tapping the F8 key when the computer restarts.
When the start menu opens, choose Safe mode
Press Enter. The computer then begins to start in Safe mode.
Go to the My Computer and delete the following files (if present):
C:\WINDOWS\system32\ijllm.ini2
C:\WINDOWS\system32\ijllm.bak2
C:\WINDOWS\system32\ijllm.bak1
Go to the My Computer and delete the following folders (if present):
C:\Documents and Settings\Owner\Application Data\Error Safe Free
C:\WINDOWS\SmFtZXMgRGFuZw
C:\Documents and Settings\Local Settings\Application Data\NetMon"
Do I need to re-do this step?
jamesdang
2007-07-25, 01:00
Kaspersky Online Scanner Report
------------------------------
Scan Statistics:
Total number of scanned objects: 121997
Number of viruses found: 16
Number of infected objects: 54 / 0
----------------------------------
In Kaspersky Online Scanner, I can not do anything when I saw the report above. I have to close it without doing anything.
Do I need to do something about it?
Thanks
hello :)
Go to the My Computer and delete the following files (if present):
C:\WINDOWS\system32\ijllm.ini2
C:\WINDOWS\system32\ijllm.bak2
C:\WINDOWS\system32\ijllm.bak1
Go to the My Computer and delete the following folders (if present):
C:\Documents and Settings\Owner\Application Data\Error Safe Free
C:\WINDOWS\SmFtZXMgRGFuZw
C:\Documents and Settings\Local Settings\Application Data\NetMon"
Did you remove those in normal mode then? If not, do it now.
You don't have to do anything to that Kaspersky report.
Let me know when you're ready and I'll give the prevention instructions .
jamesdang
2007-07-26, 03:43
Post #21
Go to the My Computer and delete the following files (if present):
C:\WINDOWS\system32\ijllm.ini2
C:\WINDOWS\system32\ijllm.bak2
C:\WINDOWS\system32\ijllm.bak1
Go to the My Computer and delete the following folders (if present):
C:\Documents and Settings\Owner\Application Data\Error Safe Free
C:\WINDOWS\SmFtZXMgRGFuZw
C:\Documents and Settings\Local Settings\Application Data\NetMon"
In system32, those files (ijllm.ini2, ijllm.bak and ijllm.bak1) are not present.
I saw and deleted the 3 above files: Error Safe Free, NetMon, Error Safe Free.
Only one more problem: everytime when I do a search in window explorer, it automatic open a window like it try to install the Solidworks 2005 SPO software (my computer has this software, and there is no problem with the software). It running and then it open an another window (look like a window installation). In the window, it tell me: "The feature you are trying to use is on a CD Rom, or other removable disk that is not available. Insert the 'Solidworks 2005 SPO' disk and click OK." If I hit cancel, a window popup and said"Error 1706. No valid source could be found for product SolidWorks 2005 SOI. The Window Installer cannot continue. OK"
What should I do now?
Hello :)
OK the installer issue... What happens if you insert the Solidworks 2005 SPO disk in the drive?
jamesdang
2007-07-28, 06:23
Now, I have to search the Solidworks 2005 SPO disk. I will post after I found the CD.
This topic has been moved to archives.
If you need the thread re-opened, please send me a private message (pm) and provide a link.
Applies only to the original poster, anyone else with similar problems please start your own topic.
Thank you Mr_JAk3.