View Full Version : cant get rid of virtumonde.prx plz help
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:44:46 AM, on 10/2/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {03B8848D-EBB2-4445-A334-A07426609133} - C:\WINDOWS\system32\nnnKDVpO.dll (file missing)
O2 - BHO: (no name) - {059E7991-B67F-49F6-ADF9-71269613EC72} - C:\WINDOWS\system32\xxyvwWmM.dll (file missing)
O2 - BHO: (no name) - {08AB940A-A17A-4807-B039-71469C0DFB0C} - C:\WINDOWS\system32\cbXRKEwv.dll (file missing)
O2 - BHO: (no name) - {0B07F5FF-8B66-4367-99CC-2898CCEF6EF6} - C:\WINDOWS\system32\rqRJCUmL.dll (file missing)
O2 - BHO: (no name) - {1B017367-E279-4E75-BBCA-644AEC1146F5} - C:\WINDOWS\system32\iifgFxut.dll (file missing)
O2 - BHO: (no name) - {38EAE9DF-6F48-4852-BA72-E2D30D52E2D0} - C:\WINDOWS\system32\geBQJcBT.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7186704C-C78F-425D-80DC-17A8E83F246F} - C:\WINDOWS\system32\jkkIXpMf.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: {ff046817-b8ec-4478-b9b4-3a8b4291dbb7} - {7bbd1924-b8a3-4b9b-8744-ce8b718640ff} - C:\WINDOWS\system32\fjjazv.dll (file missing)
O2 - BHO: (no name) - {7F583A2A-C70E-4124-8A99-86FB37376AA3} - C:\WINDOWS\system32\yayWnmMF.dll (file missing)
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: (no name) - {D231A04C-D4B9-4598-A340-2B9477A68C30} - C:\WINDOWS\system32\efcCrSjg.dll (file missing)
O2 - BHO: (no name) - {FD448CF7-4807-4642-83A2-5C46F126A3ED} - C:\WINDOWS\system32\xxyawvWm.dll (file missing)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [380352fe] rundll32.exe "C:\WINDOWS\system32\ibtkkqbn.dll",b
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [25763192264555180237812313748101] C:\Program Files\Antivirus 2009\av2009.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingD7973] cmd /c del "C:\WINDOWS\system32\ibtkkqbn.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4927] command /c del "C:\WINDOWS\system32\dbsdrera.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1872] cmd /c del "C:\WINDOWS\system32\dbsdrera.dll_old"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1222087542765
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1217351858239&h=19f8f8a3c31d68c89167a156f7c6e1c9/&filename=jinstall-6u7-windows-i586-jc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll fjjazv.dll
O20 - Winlogon Notify: jkkIXpMf - jkkIXpMf.dll (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: dlbu_device - Dell - C:\WINDOWS\system32\dlbucoms.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
--
End of file - 8822 bytes
Hello and Welcome to the forums!
My name is peku006 and I will be helping you to remove any infection(s) that you may have.
Please observe these rules while we work:
If you don't know, stop and ask! Don't keep going on.
Please reply to this thread. Do not start a new topic.
Please continue to respond until I give you the "All Clear"
If you follow these instructions, everything should go smoothly.
1 - Disable teatimer
Please disable Teatimer as it may interfere with the fix.
First: Right click Spybot in the System Tray (looks like a calendar with a padlock symbol)
Choose Exit Spybot S&D Resident
Second: Open Spybot S&D
Click Mode, check Advanced Mode
Go To Left Panel, Click Tools, then also in left panel, click Resident
If your firewall raises a question, say OK
Uncheck the box labeled Resident Tea-Timer and OK any prompts.
Use File, Exit to terminate Spybot
Reboot your machine for the changes to take effect.
Don't forget to re-enable it, when your computer is clean.
2 - Scan With ComboFix
Please visit this webpage for download links, and instructions for running ComboFix -
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Please ensure you read this guide carefully and install the Recovery Console first.
The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.
Once installed, you should see a blue screen prompt that says -
The Recovery Console was successfully installed.
Please continue as follows -
Close/Disable all anti-virus and anti-malware programs so they do not interfere with the running of ComboFix.
Click Yes to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
A word of warning: Please do not run ComboFix on your own. This tool is not a toy and not for everyday use.
3 - uninstall list
Make an uninstall list using HijackThis
To access the Uninstall Manager you would do the following:
1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
5. Click on the Save list... button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here on your next reply.
4 - Run Hijackthis
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad
5 - Status Check
Please reply with
1. the ComboFix log(C:\ComboFix.txt)
2. the uninstall list
3. a fresh HijackThis log
Thanks peku006
dont know if i have teatimer or i just cant find it on my computer i thought i did download it though
Hi Matt20
Please continue with combofix
when i put the windowsxp icon over combofix it went straight to that next screen i clicked run then it said error downloaded files are corrupt clicked ok and there was a combofix download screen it looked like full in the center of screen but nothing was happening
Hi Matt20
Please do the following...
1 - Download and Run Malwarebytes' Anti-Malware
Please download Malwarebytes' Anti-Malware (http://www.besttechie.net/tools/mbam-setup.exe) to your desktop.
Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to:
Update Malwarebytes' Anti-Malware
Launch Malwarebytes' Anti-Malware
Then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform full scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. please copy and paste the log into your next reply.
If you accidently close it, the log file is saved here and will be named like this: C:\Documents and Settings\<your username>\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
2 - download and run RSIT
Download random's system information tool (RSIT) by random/random from here (http://images.malwareremoval.com/random/RSIT.exe) and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open. Please post the contents of both log.txt<- (will be maximized) and info.txt<- (will be minimized)
3 - Status Check
Please reply with
1.the logs from RSIT (log.txt ,info.txt)
2. the Malwarebytes' Anti-Malware Log
description of any problems you are having with your PC
Thanks peku006
Malwarebytes' Anti-Malware 1.28
Database version: 1232
Windows 5.1.2600 Service Pack 3
10/6/2008 9:42:59 AM
mbam-log-2008-10-06 (09-42-59).txt
Scan type: Full Scan (C:\|D:\|E:\|)
Objects scanned: 205482
Time elapsed: 1 hour(s), 8 minute(s), 50 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 13
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 90
Files Infected: 336
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7186704c-c78f-425d-80dc-17a8e83f246f} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\jkkixpmf (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7186704c-c78f-425d-80dc-17a8e83f246f} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7bbd1924-b8a3-4b9b-8744-ce8b718640ff} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7bbd1924-b8a3-4b9b-8744-ce8b718640ff} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IProxyProvider (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
C:\Program Files\AXPDefender (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum (Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\backup (Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\IESkins (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoOI (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoOI\dynamic (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoOI\static (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoOL (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoOL\dynamic (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoOL\static (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\344stat (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\hstat (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\ustat (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\DownLoad (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Matt.JAMES-EE1A88E7B\Application Data\AXPDefender (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Matt.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Matt.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Matt.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine\Autorun (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Matt.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine\Autorun\HKCU (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Matt.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine\Autorun\HKCU\RunOnce (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Matt.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine\Autorun\HKLM (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Matt.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine\Autorun\HKLM\RunOnce (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Matt.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine\Autorun\StartMenuAllUsers (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Matt.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine\Autorun\StartMenuCurrentUser (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Matt.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine\BrowserObjects (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Matt.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine\Packages (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\James.JAMES-EE1A88E7B\Application Data\AXPDefender (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\James.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\James.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\James.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine\Autorun (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\James.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine\Autorun\HKCU (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\James.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine\Autorun\HKCU\RunOnce (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\James.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine\Autorun\HKLM (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\James.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine\Autorun\HKLM\RunOnce (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\James.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine\Autorun\StartMenuAllUsers (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\James.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine\Autorun\StartMenuCurrentUser (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\James.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine\BrowserObjects (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\James.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine\Packages (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\AXPDefender (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine\Autorun (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine\Autorun\HKCU (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine\Autorun\HKCU\RunOnce (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine\Autorun\HKLM (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine\Autorun\HKLM\RunOnce (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine\Autorun\StartMenuAllUsers (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine\Autorun\StartMenuCurrentUser (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine\BrowserObjects (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\AXPDefender\AXPDefender\Quarantine\Packages (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Matt.JAMES-EE1A88E7B\Application Data\shc760j0e71t (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Matt.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Matt.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Matt.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Matt.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Matt.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Matt.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Matt.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Matt.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Matt.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Matt.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\James.JAMES-EE1A88E7B\Application Data\shc760j0e71t (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\James.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\James.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\James.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\James.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\James.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\James.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\James.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\James.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\James.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\James.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\shc760j0e71t (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\shc760j0e71t\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.
Files Infected:
C:\WINDOWS\system32\jkkIXpMf.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fjjazv.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{95ADF239-1A29-484C-B553-3F5DDFCF2611}\RP84\A0020161.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\udepmy.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vxuumyws.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hmmqcxls.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pqkhtx.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dxehmxan.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ltlhzx.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nbgcxcrs.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xfffgx.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\znirpk.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ihiene.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\qknhuign.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tsgfhvwj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Program Files\AXPDefender\AXPDefender.exe.local (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Program Files\AXPDefender\AXPDefenderSkin.dll (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Program Files\AXPDefender\license.txt (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Program Files\AXPDefender\MFC71.dll (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Program Files\AXPDefender\MFC71ENU.DLL (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Program Files\AXPDefender\msvcp71.dll (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Program Files\AXPDefender\msvcr71.dll (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Program Files\AXPDefender\Uninstall.exe (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\report.csv (Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\backup\9_23_2008.reg (Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\skbar.log (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\1.sdf (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\1056318.sdf (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\1396506.sdf (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\1398985.sdf (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\221540.sdf (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\2885069.sdf (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\3340762.sdf (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\3421532.sdf (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\3423589.sdf (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\3756141.sdf (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\3855415.sdf (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\600583.sdf (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\819382.sdf (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\987130.sdf (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\ASPL1.dat (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\domains.txt (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\hstat\350e.dat (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\hstat\350f.dat (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\1000048226 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\12772 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\135035 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\13617 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\15541 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\159328 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\16087 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\16173 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\1643 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\17025 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\17040 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\20478 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\20570 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\22254 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\2302 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\24996 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\25031 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\25469 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\26125 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\26340 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\26664 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\270795 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\27503 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\28150 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\282887 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\290893 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\29115 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\2932 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\32127 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\32137 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\32171 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\32639 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\34237 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\361427 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\366767 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\367116 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\399636 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\401332 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\40999 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\4142 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\422734 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\427075 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\4382 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\43979 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\44100 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\44228 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\44878 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\49821 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\49923 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\50991 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\51666 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\527755 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\53481 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\540999 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\559580 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\56133 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\56962 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\579718 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\59287 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\59598 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\59905 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\59913 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\59923 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\61212 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\64517 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\66836 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\67831 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\69325 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\69556 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\70650 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\71098 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\72521 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\738022 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\745110 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\745220 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\745356 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\745472 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\745865 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\74798 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\751209 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\753009 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\78600 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\79257 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\79805 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\80639 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\82292 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\86380 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\89673 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\90358 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\93899 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\93921 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\93934 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\93958 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\94407 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\95692 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\99163 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\TooltipXML\99739 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\dynamic\ustat\350f.dat (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\btntrans.idx (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\btntrans1.dat (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\buttondir.txt (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\components.cdf (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\default.cdf (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Default_511745-514279.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Default_bidzC_ZT_IE-ca.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Default_bidzC_ZT_IE-us.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Default_categorize.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Default_comparison.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Default_explorer-Mails.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Default_explorer-people.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Default_favorites.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Default_Games.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Default_Hide.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Default_hotbarcom.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Default_Hotmail.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Default_hsskin.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Default_jemster.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Default_jemsterie.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Default_jemsteruk.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Default_jobsearch.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Default_Mails.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Default_MobileSidewalk.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Default_MobileSW-US.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Default_new.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Default_premium.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Default_reun.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Default_ringtones.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Default_SearchBoxTrapper.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Default_searchfor.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Default_searchgo.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Default_weather.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Default_yellowpages.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\d_icons_buttons_1000.res (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\d_icons_buttons_2000.res (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\d_icons_buttons_3000.res (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\d_icons_buttons_bar.res (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\d_icons_buttons_bbar1.res (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\d_icons_buttons_logos.res (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\d_icons_buttons_other.res (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\d_icons_weather.res (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\email-def-511724-548964.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\email-def-511724-9595.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\email-t1-bg.res (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\icons2.res (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\keywords.idx (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\keywords1.dat (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\layout.cdf (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\linkpathlegal.txt (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\progress.res (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\sales_buttons.res (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\seekmo.res (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\s_icons_buttons.res (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\t2_bg.res (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\theweb.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\top7.cdf (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\Top7_theweb.mnu (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\1\tsd_bg.res (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\DownLoad\BtnTrans.xip (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\DownLoad\BtnTrans1.xip (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\DownLoad\buttondir.xip (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\DownLoad\default.xip (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\DownLoad\d_icons_buttons_1000.xip (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\DownLoad\d_icons_buttons_2000.xip (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\DownLoad\d_icons_buttons_3000.xip (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\DownLoad\d_icons_buttons_bar.xip (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\DownLoad\d_icons_buttons_bbar1.xip (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\DownLoad\d_icons_buttons_logos.xip (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\DownLoad\d_icons_buttons_other.xip (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\DownLoad\d_icons_weather.xip (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\DownLoad\email-t1-bg.xip (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\DownLoad\icons2.xip (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\DownLoad\keywords.xip (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\DownLoad\keywords1.xip (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\DownLoad\layout.xip (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\DownLoad\linkpathlegal.xip (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\DownLoad\progress.xip (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\DownLoad\sales_buttons.xip (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\DownLoad\samplegroups2.txt (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\DownLoad\samplegroups2.xip (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\DownLoad\seekmo.xip (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\DownLoad\s_icons_buttons.xip (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\DownLoad\t2_bg.xip (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\DownLoad\top7.xip (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\SeekmoToolbar\v3.0\SeekmoToolbar\static\DownLoad\tsd_bg.xip (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\BM3b306162.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BM3b306162.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\Microsoft\Internet Explorer\Quick Launch\Malware Protector 2008.lnk (Rogue.MalwareProtector2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Application Data\Microsoft\Internet Explorer\Quick Launch\AXPDefender.lnk (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\1748-1-2008-1-21-0-29-32-437.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\1748-10-2008-1-21-0-29-43-859.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\1748-11-2008-1-21-0-29-45-531.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\1748-12-2008-1-21-0-29-46-937.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\1748-13-2008-1-21-0-29-47-906.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\1748-2-2008-1-21-0-29-33-812.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\1748-3-2008-1-21-0-29-35-109.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\1748-4-2008-1-21-0-29-36-312.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\1748-5-2008-1-21-0-29-37-421.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\1748-6-2008-1-21-0-29-38-906.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\1748-7-2008-1-21-0-29-40-312.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\1748-8-2008-1-21-0-29-41-687.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\1748-9-2008-1-21-0-29-42-828.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\2668-15-2008-3-5-23-16-9-468.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\2668-16-2008-3-5-23-16-9-515.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\2668-17-2008-3-5-23-16-9-562.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\2668-18-2008-3-5-23-16-9-593.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\2668-19-2008-3-5-23-16-9-640.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\2668-20-2008-3-5-23-16-9-671.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\2668-21-2008-3-5-23-16-9-703.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\2668-22-2008-3-5-23-16-9-750.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\2668-23-2008-3-5-23-16-9-796.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\2668-24-2008-3-5-23-16-9-828.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\2668-25-2008-3-5-23-16-9-859.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\2668-26-2008-3-5-23-16-9-906.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\2668-27-2008-3-5-23-16-9-937.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\2668-28-2008-3-5-23-16-9-984.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\3336-1-2007-12-26-20-9-26-531.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\3336-2-2007-12-26-20-9-27-750.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\3336-4-2007-12-26-20-9-31-140.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\mpa00936.jpg (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\1071_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\1e59_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\364f_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\366e_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\3ed_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\464b_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\501f_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\5342_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\5bb5_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\5d16_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\5d6c_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\5dd0_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\610f_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\62a2_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\64d4_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\658_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\65ce_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\6d2b_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\6d56_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\6dec_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\7bc1_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\7d22_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\7ec0_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\80cd_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\8130_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\8f19_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\9006_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\9269_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\943f_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\9511_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\9f3_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\a37c_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\a4d6_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\a94a_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\ae1e_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\b373_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\b918_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\bcfb_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\c09c_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\c2fe_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\c3ae_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\c59b_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\cc37_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\currentversion.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\d29d_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\d904_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\de39_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\e1dc_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\e9da_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\ea9e_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\ee01_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\f988_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\fd0b_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\log.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\searchurl.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\text.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\ThereInstallHelperSummary.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\VLBInstallCompatLog.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\VLBInstallCompatSummary.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\.tt4.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\.tt5.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\.tt6.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\.tt7.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\.tt8.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\.tt9.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\.ttA.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\.ttB.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\.ttC.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\.ttD.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\.ttE.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ben.JAMES-EE1A88E7B\Local Settings\Temp\.ttF.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
Logfile of random's system information tool 1.04 (written by random/random)
Run by Matt at 2008-10-06 09:46:04
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 48 GB (63%) free of 76 GB
Total RAM: 1534 MB (63% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:46:20 AM, on 10/6/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
C:\WINDOWS\system32\dlbucoms.exe
C:\Documents and Settings\Matt.MATT-255781CAAD\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Matt.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {03B8848D-EBB2-4445-A334-A07426609133} - C:\WINDOWS\system32\nnnKDVpO.dll (file missing)
O2 - BHO: (no name) - {059E7991-B67F-49F6-ADF9-71269613EC72} - C:\WINDOWS\system32\xxyvwWmM.dll (file missing)
O2 - BHO: (no name) - {08AB940A-A17A-4807-B039-71469C0DFB0C} - C:\WINDOWS\system32\cbXRKEwv.dll (file missing)
O2 - BHO: (no name) - {0B07F5FF-8B66-4367-99CC-2898CCEF6EF6} - C:\WINDOWS\system32\rqRJCUmL.dll (file missing)
O2 - BHO: (no name) - {1B017367-E279-4E75-BBCA-644AEC1146F5} - C:\WINDOWS\system32\iifgFxut.dll (file missing)
O2 - BHO: (no name) - {38EAE9DF-6F48-4852-BA72-E2D30D52E2D0} - C:\WINDOWS\system32\geBQJcBT.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7F583A2A-C70E-4124-8A99-86FB37376AA3} - C:\WINDOWS\system32\yayWnmMF.dll (file missing)
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: (no name) - {D231A04C-D4B9-4598-A340-2B9477A68C30} - C:\WINDOWS\system32\efcCrSjg.dll (file missing)
O2 - BHO: (no name) - {FD448CF7-4807-4642-83A2-5C46F126A3ED} - C:\WINDOWS\system32\xxyawvWm.dll (file missing)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [25763192264555180237812313748101] C:\Program Files\Antivirus 2009\av2009.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1222087542765
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1217351858239&h=19f8f8a3c31d68c89167a156f7c6e1c9/&filename=jinstall-6u7-windows-i586-jc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll fjjazv.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: dlbu_device - Dell - C:\WINDOWS\system32\dlbucoms.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
--
End of file - 7854 bytes
======Scheduled tasks folder======
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{03B8848D-EBB2-4445-A334-A07426609133}]
C:\WINDOWS\system32\nnnKDVpO.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{059E7991-B67F-49F6-ADF9-71269613EC72}]
C:\WINDOWS\system32\xxyvwWmM.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{08AB940A-A17A-4807-B039-71469C0DFB0C}]
C:\WINDOWS\system32\cbXRKEwv.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0B07F5FF-8B66-4367-99CC-2898CCEF6EF6}]
C:\WINDOWS\system32\rqRJCUmL.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1B017367-E279-4E75-BBCA-644AEC1146F5}]
C:\WINDOWS\system32\iifgFxut.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{38EAE9DF-6F48-4852-BA72-E2D30D52E2D0}]
C:\WINDOWS\system32\geBQJcBT.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-09-15 1562960]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F583A2A-C70E-4124-8A99-86FB37376AA3}]
C:\WINDOWS\system32\yayWnmMF.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}]
AVG Security Toolbar - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [2008-07-05 2055960]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - c:\program files\google\googletoolbar2.dll [2008-07-29 2403392]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll [2008-09-13 737776]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D231A04C-D4B9-4598-A340-2B9477A68C30}]
C:\WINDOWS\system32\efcCrSjg.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD448CF7-4807-4642-83A2-5C46F126A3ED}]
C:\WINDOWS\system32\xxyawvWm.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{A057A204-BACC-4D26-9990-79A187E2698E} - AVG Security Toolbar - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [2008-07-05 2055960]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar2.dll [2008-07-29 2403392]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2008-09-29 1234712]
"dla"=C:\WINDOWS\system32\dla\tfswctrl.exe [2004-08-13 122939]
"UpdateManager"=C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe [2004-01-07 110592]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]
"ATICCC"=C:\Program Files\ATI Technologies\ATI.ACE\cli.exe [2006-01-02 45056]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2008-09-06 413696]
"AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2008-09-03 111936]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-09-08 289576]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-08-01 68856]
"25763192264555180237812313748101"=C:\Program Files\Antivirus 2009\av2009.exe []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="avgrsstx.dll fjjazv.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2006-05-03 61440]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{7186704C-C78F-425D-80DC-17A8E83F246F}"= []
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
C:\WINDOWS\system32\xxyvwWmM
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\AVG\AVG8\avgupd.exe"="C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe"
"C:\Program Files\AVG\AVG8\avgemc.exe"="C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
======List of files/folders created in the last 1 months======
2008-10-06 09:46:04 ----D---- C:\rsit
2008-10-06 08:28:48 ----D---- C:\Documents and Settings\Matt.MATT-255781CAAD\Application Data\Malwarebytes
2008-10-06 08:28:44 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-06 08:28:44 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
2008-10-04 20:59:06 ----D---- C:\32788R22FWJFW
2008-10-02 06:45:21 ----A---- C:\WINDOWS\system32\mucltui.dll.mui
2008-10-02 06:45:20 ----A---- C:\WINDOWS\system32\mucltui.dll
2008-09-28 07:33:44 ----SH---- C:\WINDOWS\system32\yjatmtrr.ini
2008-09-27 06:49:02 ----SH---- C:\WINDOWS\system32\nbqkktbi.ini
2008-09-27 06:45:50 ----ASH---- C:\WINDOWS\system32\MmWwvyxx.ini2
2008-09-27 06:45:50 ----ASH---- C:\WINDOWS\system32\MmWwvyxx.ini
2008-09-26 15:40:57 ----SH---- C:\WINDOWS\system32\onjxciay.ini
2008-09-26 15:37:47 ----ASH---- C:\WINDOWS\system32\LmUCJRqr.ini2
2008-09-26 15:37:46 ----ASH---- C:\WINDOWS\system32\LmUCJRqr.ini
2008-09-25 08:39:49 ----D---- C:\Program Files\Spybot - Search & Destroy
2008-09-25 08:30:41 ----SH---- C:\WINDOWS\system32\ihaqnmgu.ini
2008-09-25 08:27:31 ----ASH---- C:\WINDOWS\system32\vwEKRXbc.ini2
2008-09-25 08:27:31 ----ASH---- C:\WINDOWS\system32\vwEKRXbc.ini
2008-09-25 06:42:08 ----SH---- C:\WINDOWS\system32\vnjnjwed.ini
2008-09-25 06:40:35 ----A---- C:\WINDOWS\system32\uyebgniv.dll
2008-09-24 05:44:50 ----SH---- C:\WINDOWS\system32\mhmmkekn.ini
2008-09-24 05:42:25 ----A---- C:\WINDOWS\system32\ptklcwdk.dll
2008-09-24 05:41:44 ----ASH---- C:\WINDOWS\system32\mWvwayxx.ini2
2008-09-24 05:41:44 ----ASH---- C:\WINDOWS\system32\mWvwayxx.ini
2008-09-23 10:45:04 ----SH---- C:\WINDOWS\system32\pytxsner.ini
2008-09-23 10:41:42 ----ASH---- C:\WINDOWS\system32\FMmnWyay.ini2
2008-09-23 10:41:42 ----ASH---- C:\WINDOWS\system32\FMmnWyay.ini
2008-09-22 09:55:13 ----A---- C:\WINDOWS\system32\urqOiFVM.dll
2008-09-22 09:55:11 ----A---- C:\WINDOWS\system32\upejxwfq.dll
2008-09-22 09:55:00 ----A---- C:\WINDOWS\system32\uiwqjqji.dll
2008-09-22 09:54:19 ----ASH---- C:\WINDOWS\system32\nTAIOnnn.ini2
2008-09-22 09:54:19 ----ASH---- C:\WINDOWS\system32\nTAIOnnn.ini
2008-09-22 06:50:27 ----SH---- C:\WINDOWS\system32\aJTuCJjl.ini
2008-09-22 06:50:19 ----A---- C:\WINDOWS\system32\yuueypvy.dll
2008-09-22 06:50:04 ----A---- C:\WINDOWS\system32\fmaxehnp.dll
2008-09-22 06:49:22 ----ASH---- C:\WINDOWS\system32\OpVDKnnn.ini2
2008-09-22 06:49:22 ----ASH---- C:\WINDOWS\system32\OpVDKnnn.ini
2008-09-21 07:24:34 ----SH---- C:\WINDOWS\system32\uBeOqqss.ini
2008-09-21 07:24:26 ----A---- C:\WINDOWS\system32\bapyjhsq.dll
2008-09-21 07:22:05 ----A---- C:\WINDOWS\system32\flkvxpwv.dll
2008-09-21 07:21:23 ----ASH---- C:\WINDOWS\system32\tuxFgfii.ini2
2008-09-21 07:21:23 ----ASH---- C:\WINDOWS\system32\tuxFgfii.ini
2008-09-20 10:40:30 ----D---- C:\Documents and Settings\Matt.MATT-255781CAAD\Application Data\Leadertech
2008-09-20 07:31:58 ----SH---- C:\WINDOWS\system32\abdKRqss.ini
2008-09-20 07:31:50 ----A---- C:\WINDOWS\system32\clfcngsl.dll
2008-09-20 02:16:56 ----A---- C:\WINDOWS\system32\xsqlllbf.dll
2008-09-20 02:16:14 ----ASH---- C:\WINDOWS\system32\TBcJQBeg.ini2
2008-09-20 02:16:14 ----ASH---- C:\WINDOWS\system32\TBcJQBeg.ini
2008-09-19 15:49:32 ----SH---- C:\WINDOWS\system32\DJlnnUtv.ini
2008-09-19 15:48:47 ----A---- C:\WINDOWS\system32\spvawcde.dll
2008-09-19 15:42:55 ----A---- C:\WINDOWS\system32\dnfbhhmr.dll
2008-09-19 15:42:13 ----A---- C:\WINDOWS\system32\truhjuah.dll
2008-09-19 15:41:45 ----A---- C:\WINDOWS\system32\33209680-.txt
2008-09-19 08:25:58 ----ASH---- C:\WINDOWS\system32\gjSrCcfe.ini2
2008-09-19 08:25:58 ----ASH---- C:\WINDOWS\system32\gjSrCcfe.ini
2008-09-10 11:56:58 ----D---- C:\Program Files\Freeze.com
2008-09-10 06:59:24 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-09-10 06:58:39 ----D---- C:\Program Files\Bonjour
2008-09-10 06:56:34 ----A---- C:\WINDOWS\system32\usbaaplrc.dll
2008-09-10 05:01:39 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
2008-09-10 05:01:22 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$
2008-09-09 16:48:13 ----A---- C:\WINDOWS\system32\kbdkor.dll
2008-09-09 16:48:13 ----A---- C:\WINDOWS\system32\kbdjpn.dll
2008-09-09 16:48:13 ----A---- C:\WINDOWS\system32\kbd103.dll
2008-09-09 16:48:13 ----A---- C:\WINDOWS\system32\kbd101c.dll
2008-09-09 16:48:09 ----A---- C:\WINDOWS\system32\kbd101b.dll
2008-09-09 16:48:08 ----A---- C:\WINDOWS\system32\kbd106.dll
======List of files/folders modified in the last 1 months======
2008-10-06 09:46:20 ----D---- C:\WINDOWS\Temp
2008-10-06 09:46:01 ----D---- C:\WINDOWS\Prefetch
2008-10-06 09:42:57 ----RAD---- C:\Program Files
2008-10-06 09:42:57 ----D---- C:\WINDOWS
2008-10-06 09:42:57 ----AD---- C:\WINDOWS\system32
2008-10-06 08:36:24 ----A---- C:\WINDOWS\dellstat.ini
2008-10-06 08:30:23 ----D---- C:\WINDOWS\system32\drivers
2008-10-06 07:21:08 ----A---- C:\WINDOWS\SchedLgU.Txt
2008-10-04 15:32:21 ----D---- C:\WINDOWS\system32\CatRoot2
2008-10-04 14:19:35 ----HD---- C:\$AVG8.VAULT$
2008-10-03 09:47:54 ----D---- C:\DELL
2008-10-02 16:27:07 ----HD---- C:\WINDOWS\inf
2008-10-02 16:17:46 ----SHD---- C:\WINDOWS\Installer
2008-10-02 16:17:46 ----SHD---- C:\Config.Msi
2008-10-02 09:42:47 ----D---- C:\Program Files\Trend Micro
2008-10-01 12:27:10 ----RSD---- C:\WINDOWS\assembly
2008-10-01 12:27:10 ----D---- C:\WINDOWS\Microsoft.NET
2008-10-01 10:15:28 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-10-01 10:15:19 ----D---- C:\WINDOWS\WinSxS
2008-10-01 09:57:08 ----D---- C:\WINDOWS\system32\CatRoot
2008-09-30 10:10:54 ----D---- C:\Documents and Settings
2008-09-29 08:34:25 ----SD---- C:\WINDOWS\Tasks
2008-09-28 19:09:35 ----A---- C:\WINDOWS\wininit.ini
2008-09-25 09:05:15 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-09-22 08:45:50 ----SD---- C:\WINDOWS\Downloaded Program Files
2008-09-20 12:05:00 ----D---- C:\WINDOWS\network diagnostic
2008-09-20 10:37:22 ----HD---- C:\Program Files\InstallShield Installation Information
2008-09-20 08:04:50 ----D---- C:\Program Files\LimeWire
2008-09-19 06:48:57 ----DC---- C:\WINDOWS\system32\dllcache
2008-09-19 06:48:28 ----D---- C:\WINDOWS\Help
2008-09-19 06:48:14 ----RSD---- C:\WINDOWS\Fonts
2008-09-10 07:07:29 ----D---- C:\Program Files\Apple Software Update
2008-09-10 06:59:39 ----DC---- C:\WINDOWS\system32\DRVSTORE
2008-09-10 06:59:38 ----D---- C:\Program Files\iTunes
2008-09-10 06:59:25 ----D---- C:\Program Files\iPod
2008-09-10 06:58:16 ----D---- C:\Program Files\QuickTime
2008-09-10 05:01:26 ----A---- C:\WINDOWS\imsins.BAK
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 AvgLdx86;AVG AVI Loader Driver x86; C:\WINDOWS\System32\Drivers\avgldx86.sys [2008-08-29 97928]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86; C:\WINDOWS\System32\Drivers\avgmfx86.sys [2008-07-05 26824]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
R1 OMCI;OMCI; C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS [2001-08-22 13632]
R1 sscdbhk5;sscdbhk5; C:\WINDOWS\system32\drivers\sscdbhk5.sys [2004-07-14 5627]
R1 ssrtln;ssrtln; C:\WINDOWS\system32\drivers\ssrtln.sys [2004-07-14 23545]
R2 AvgTdiX;AVG8 Network Redirector; C:\WINDOWS\System32\Drivers\avgtdix.sys [2008-07-05 76040]
R2 drvnddm;drvnddm; C:\WINDOWS\system32\drivers\drvnddm.sys [2004-08-13 40544]
R2 tfsnboio;tfsnboio; C:\WINDOWS\system32\dla\tfsnboio.sys [2004-08-13 25723]
R2 tfsncofs;tfsncofs; C:\WINDOWS\system32\dla\tfsncofs.sys [2004-08-13 34843]
R2 tfsndrct;tfsndrct; C:\WINDOWS\system32\dla\tfsndrct.sys [2004-08-13 4123]
R2 tfsndres;tfsndres; C:\WINDOWS\system32\dla\tfsndres.sys [2004-08-13 2239]
R2 tfsnifs;tfsnifs; C:\WINDOWS\system32\dla\tfsnifs.sys [2004-08-13 86202]
R2 tfsnopio;tfsnopio; C:\WINDOWS\system32\dla\tfsnopio.sys [2004-08-13 14715]
R2 tfsnpool;tfsnpool; C:\WINDOWS\system32\dla\tfsnpool.sys [2004-08-13 6363]
R2 tfsnudf;tfsnudf; C:\WINDOWS\system32\dla\tfsnudf.sys [2004-08-13 98714]
R2 tfsnudfa;tfsnudfa; C:\WINDOWS\system32\dla\tfsnudfa.sys [2004-08-13 100603]
R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2002-04-01 4816]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2006-05-03 1540608]
R3 E100B;Intel(R) PRO Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2005-06-13 162816]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntelC51;IntelC51; C:\WINDOWS\system32\DRIVERS\IntelC51.sys [2004-03-05 1233525]
R3 IntelC52;IntelC52; C:\WINDOWS\system32\DRIVERS\IntelC52.sys [2004-03-05 647929]
R3 IntelC53;IntelC53; C:\WINDOWS\system32\DRIVERS\IntelC53.sys [2004-03-05 60949]
R3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
R3 mohfilt;mohfilt; C:\WINDOWS\system32\DRIVERS\mohfilt.sys [2004-03-05 37048]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2004-04-09 612352]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-12 12160]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2008-09-05 36864]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-09-05 116040]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2006-05-03 413696]
R2 avg8emc;AVG8 E-mail Scanner; C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-29 875288]
R2 avg8wd;AVG8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-29 231704]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
R2 spkrmon;spkrmon; C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe [2003-08-28 61440]
R3 dlbu_device;dlbu_device; C:\WINDOWS\system32\dlbucoms.exe [2004-07-01 421888]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-09-08 536872]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2006-05-03 520192]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-07-29 138168]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
-----------------EOF-----------------
info.txt logfile of random's system information tool 1.04 2008-10-06 09:46:21
======Uninstall list======
-->C:\WINDOWS\system32\\MSIEXEC.EXE /I {09DA4F91-2A09-4232-AB8C-6BC740096DE3} REMOVE=UpdateMgrFeature
-->C:\WINDOWS\system32\\MSIEXEC.EXE /x {1206EF92-2E83-4859-ACCB-2048C3CB7DA6}
-->C:\WINDOWS\system32\\MSIEXEC.EXE /x {9541FED0-327F-4df0-8B96-EF57EF622F19}
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Acrobat.com-->C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe -uninstall com.adobe.mauby 4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
Acrobat.com-->MsiExec.exe /I{77DCDCE3-2DED-62F3-8154-05E745472D07}
Adobe AIR-->C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{00203668-8170-44A0-BE44-B632FA4D780F}
Adobe Flash Player ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A90000000001}
Apple Mobile Device Support-->MsiExec.exe /I{C7C895CA-331B-4D7D-A0FB-D3BC637949F9}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
ATI - Software Uninstall Utility-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Catalyst Control Center-->MsiExec.exe /I{B85BC765-84F3-4316-A493-794218085BE2}
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
ATI Parental Control & Encoder-->MsiExec.exe /I{8D70145A-3BD3-4DBF-9CBF-223EF4A43257}
AVG Free 8.0-->C:\Program Files\AVG\AVG8\setup.exe /UNINSTALL
Bonjour-->MsiExec.exe /I{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}
Bowflex i-Trainer-->MsiExec.exe /I{4179D189-A9DB-4979-ACC6-E4B02151C9CC}
Data Access Objects (DAO) 3.5-->C:\Program Files\Common Files\Microsoft Shared\DAO\Remove.EXE C:\WINDOWS\UNINST.EXE -fC:\PROGRA~1\COMMON~1\MICROS~1\DAO\DeIsL2.isu
Dell Photo AIO Printer 942-->C:\WINDOWS\system32\spool\drivers\w32x86\3\DLBUUNST.EXE -NOLICENSE
Dell ResourceCD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D78653C3-A8FF-415F-92E6-D774E634FF2D}\setup.exe"
Galactic Civilizations II-->C:\PROGRA~1\Stardock\TOTALG~1\GalCiv2\UNWISE.EXE C:\PROGRA~1\Stardock\TOTALG~1\GalCiv2\INSTALL.LOG
Google Toolbar for Internet Explorer-->MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar2.dll"
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows Media Player 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Intel(R) 537EP V9x DF PCI Modem-->rundll32 IntelCci.dll,iSMUninstallation "Intel(R) 537EP V9x DF PCI Modem"
Intel(R) PRO Network Connections Drivers-->Prounstl.exe
iTunes-->MsiExec.exe /I{EA418519-2160-43A0-AABD-6608DDD8D87F}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
LimeWire 4.18.8-->"C:\Program Files\LimeWire\uninstall.exe"
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
MapSource - BlueChart Americas v6.5-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{46DB9CE1-185D-4FF1-A8CB-76358D194566} /l1033
MapSource-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5E3CFCA6-C95A-47CB-A822-7FA80D423AF2}\Setup.exe" -l0x9 AddRemove
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
MobileMe Control Panel-->MsiExec.exe /I{6DA9102E-199F-43A0-A36B-6EF48081A658}
Netflix Movie Viewer-->MsiExec.exe /X{BCE72AED-3332-4863-9567-C5DCB9052CA2}
QuickTime-->MsiExec.exe /I{8DC42D05-680B-41B0-8878-6C14D24602DB}
Safari-->MsiExec.exe /I{C9D96682-5A4D-45FA-BA3E-DDCB2B0CB868}
Security Update for Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Security Update for Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Sonic DLA-->MsiExec.exe /I{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}
Sonic MyDVD-->MsiExec.exe /I{21657574-BD54-48A2-9450-EB03B2C7FC29}
Sonic RecordNow!-->MsiExec.exe /I{9541FED0-327F-4DF0-8B96-EF57EF622F19}
Sonic Update Manager-->MsiExec.exe /I{09DA4F91-2A09-4232-AB8C-6BC740096DE3}
SoundMAX-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\setup.exe"
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Update for Windows XP (KB942763)-->"C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe"
Update for Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Update for Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Windows Internet Explorer 7-->"C:\WINDOWS\ie7\spuninst\spuninst.exe"
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WordPerfect Office 12-->MsiExec.exe /I{AF19F291-F22F-4798-9662-525305AE9E48}
Yahoo! Install Manager-->C:\WINDOWS\system32\regsvr32 /u C:\PROGRA~1\Yahoo!\Common\YINSTH~1.DLL
======Hosts File======
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
======Security center information======
AV: AVG Anti-Virus Free
======Environment variables======
"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\PROGRA~1\COMMON~1\SONICS~1\;C:\Program Files\ATI Technologies\ATI.ACE\;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 3 Stepping 4, GenuineIntel
"PROCESSOR_REVISION"=0304
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip
-----------------EOF-----------------
i dont notice any problems now should i turn back on teatimer
Hi Matt20
should i turn back on teatimer
Not yet ,when your computer is clean
IMPORTANT I notice there are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer.
LimeWire
I'd like you to read this thread (http://forums.spybot.info/showthread.php?t=282)
Please go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red).NOW
1 - OTMoveIt3
Download OTMoveIt3 (http://oldtimer.geekstogo.com/OTMoveIt3.exe) by Old Timer and save it to your Desktop.
Double-click OTMoveIt3.exe to run it.
Copy the lines in the codebox below.
:processes
explorer.exe
:files
C:\WINDOWS\system32\nnnKDVpO.dll
C:\WINDOWS\system32\xxyvwWmM.dll
C:\WINDOWS\system32\cbXRKEwv.dll
C:\WINDOWS\system32\rqRJCUmL.dll
C:\WINDOWS\system32\iifgFxut.dll
C:\WINDOWS\system32\geBQJcBT.dll
C:\WINDOWS\system32\yayWnmMF.dll
C:\WINDOWS\system32\efcCrSjg.dll
C:\WINDOWS\system32\xxyawvWm.dll
C:\Program Files\Antivirus 2009
C:\WINDOWS\system32\yjatmtrr.ini
C:\WINDOWS\system32\nbqkktbi.ini
C:\WINDOWS\system32\MmWwvyxx.ini2
C:\WINDOWS\system32\MmWwvyxx.ini
C:\WINDOWS\system32\onjxciay.ini
C:\WINDOWS\system32\LmUCJRqr.ini2
C:\WINDOWS\system32\LmUCJRqr.ini
C:\WINDOWS\system32\ihaqnmgu.ini
C:\WINDOWS\system32\vwEKRXbc.ini2
C:\WINDOWS\system32\vwEKRXbc.ini
C:\WINDOWS\system32\vnjnjwed.ini
C:\WINDOWS\system32\uyebgniv.dll
C:\WINDOWS\system32\mhmmkekn.ini
C:\WINDOWS\system32\ptklcwdk.dll
C:\WINDOWS\system32\mWvwayxx.ini2
C:\WINDOWS\system32\mWvwayxx.ini
C:\WINDOWS\system32\pytxsner.ini
C:\WINDOWS\system32\FMmnWyay.ini2
C:\WINDOWS\system32\FMmnWyay.ini
C:\WINDOWS\system32\urqOiFVM.dll
C:\WINDOWS\system32\upejxwfq.dll
C:\WINDOWS\system32\uiwqjqji.dll
C:\WINDOWS\system32\nTAIOnnn.ini2
C:\WINDOWS\system32\nTAIOnnn.ini
C:\WINDOWS\system32\aJTuCJjl.ini
C:\WINDOWS\system32\yuueypvy.dll
C:\WINDOWS\system32\fmaxehnp.dll
C:\WINDOWS\system32\OpVDKnnn.ini2
C:\WINDOWS\system32\OpVDKnnn.ini
C:\WINDOWS\system32\uBeOqqss.ini
C:\WINDOWS\system32\bapyjhsq.dll
C:\WINDOWS\system32\flkvxpwv.dll
C:\WINDOWS\system32\tuxFgfii.ini2
C:\WINDOWS\system32\tuxFgfii.ini
C:\WINDOWS\system32\abdKRqss.ini
C:\WINDOWS\system32\clfcngsl.dll
C:\WINDOWS\system32\xsqlllbf.dll
C:\WINDOWS\system32\TBcJQBeg.ini2
C:\WINDOWS\system32\TBcJQBeg.ini
C:\WINDOWS\system32\DJlnnUtv.ini
C:\WINDOWS\system32\spvawcde.dll
C:\WINDOWS\system32\dnfbhhmr.dll
C:\WINDOWS\system32\truhjuah.dll
C:\WINDOWS\system32\33209680-.txt
C:\WINDOWS\system32\gjSrCcfe.ini2
C:\WINDOWS\system32\gjSrCcfe.ini
C:\WINDOWS\system32\usbaaplrc.dll
C:\WINDOWS\Temp
:reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{03B8848D-EBB2-4445-A334-A07426609133}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{059E7991-B67F-49F6-ADF9-71269613EC72}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{08AB940A-A17A-4807-B039-71469C0DFB0C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0B07F5FF-8B66-4367-99CC-2898CCEF6EF6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1B017367-E279-4E75-BBCA-644AEC1146F5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{38EAE9DF-6F48-4852-BA72-E2D30D52E2D0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F583A2A-C70E-4124-8A99-86FB37376AA3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D231A04C-D4B9-4598-A340-2B9477A68C30}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD448CF7-4807-4642-83A2-5C46F126A3ED}]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"25763192264555180237812313748101"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{7186704C-C78F-425D-80DC-17A8E83F246F}"=-
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\ lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00
:commands
[emptytemp]
[start explorer]
Return to OTMoveIt3, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar), and paste it in your next reply.
Close OTMoveIt3
2 - Run Hijackthis
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad
3 - Status Check
Please reply with
1. the OTMoveIt3 Log
2. a fresh HijackThis log
Thanks peku006
========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
File/Folder C:\WINDOWS\system32\nnnKDVpO.dll not found.
File/Folder C:\WINDOWS\system32\xxyvwWmM.dll not found.
File/Folder C:\WINDOWS\system32\cbXRKEwv.dll not found.
File/Folder C:\WINDOWS\system32\rqRJCUmL.dll not found.
File/Folder C:\WINDOWS\system32\iifgFxut.dll not found.
File/Folder C:\WINDOWS\system32\geBQJcBT.dll not found.
File/Folder C:\WINDOWS\system32\yayWnmMF.dll not found.
File/Folder C:\WINDOWS\system32\efcCrSjg.dll not found.
File/Folder C:\WINDOWS\system32\xxyawvWm.dll not found.
File/Folder C:\Program Files\Antivirus 2009 not found.
C:\WINDOWS\system32\yjatmtrr.ini moved successfully.
C:\WINDOWS\system32\nbqkktbi.ini moved successfully.
C:\WINDOWS\system32\MmWwvyxx.ini2 moved successfully.
C:\WINDOWS\system32\MmWwvyxx.ini moved successfully.
C:\WINDOWS\system32\onjxciay.ini moved successfully.
C:\WINDOWS\system32\LmUCJRqr.ini2 moved successfully.
C:\WINDOWS\system32\LmUCJRqr.ini moved successfully.
C:\WINDOWS\system32\ihaqnmgu.ini moved successfully.
C:\WINDOWS\system32\vwEKRXbc.ini2 moved successfully.
C:\WINDOWS\system32\vwEKRXbc.ini moved successfully.
C:\WINDOWS\system32\vnjnjwed.ini moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\uyebgniv.dll
C:\WINDOWS\system32\uyebgniv.dll NOT unregistered.
C:\WINDOWS\system32\uyebgniv.dll moved successfully.
C:\WINDOWS\system32\mhmmkekn.ini moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\ptklcwdk.dll
C:\WINDOWS\system32\ptklcwdk.dll NOT unregistered.
C:\WINDOWS\system32\ptklcwdk.dll moved successfully.
C:\WINDOWS\system32\mWvwayxx.ini2 moved successfully.
C:\WINDOWS\system32\mWvwayxx.ini moved successfully.
C:\WINDOWS\system32\pytxsner.ini moved successfully.
C:\WINDOWS\system32\FMmnWyay.ini2 moved successfully.
C:\WINDOWS\system32\FMmnWyay.ini moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\urqOiFVM.dll
C:\WINDOWS\system32\urqOiFVM.dll NOT unregistered.
C:\WINDOWS\system32\urqOiFVM.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\upejxwfq.dll
C:\WINDOWS\system32\upejxwfq.dll NOT unregistered.
C:\WINDOWS\system32\upejxwfq.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\uiwqjqji.dll
C:\WINDOWS\system32\uiwqjqji.dll NOT unregistered.
C:\WINDOWS\system32\uiwqjqji.dll moved successfully.
C:\WINDOWS\system32\nTAIOnnn.ini2 moved successfully.
C:\WINDOWS\system32\nTAIOnnn.ini moved successfully.
C:\WINDOWS\system32\aJTuCJjl.ini moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\yuueypvy.dll
C:\WINDOWS\system32\yuueypvy.dll NOT unregistered.
C:\WINDOWS\system32\yuueypvy.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\fmaxehnp.dll
C:\WINDOWS\system32\fmaxehnp.dll NOT unregistered.
C:\WINDOWS\system32\fmaxehnp.dll moved successfully.
C:\WINDOWS\system32\OpVDKnnn.ini2 moved successfully.
C:\WINDOWS\system32\OpVDKnnn.ini moved successfully.
C:\WINDOWS\system32\uBeOqqss.ini moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\bapyjhsq.dll
C:\WINDOWS\system32\bapyjhsq.dll NOT unregistered.
C:\WINDOWS\system32\bapyjhsq.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\flkvxpwv.dll
C:\WINDOWS\system32\flkvxpwv.dll NOT unregistered.
C:\WINDOWS\system32\flkvxpwv.dll moved successfully.
C:\WINDOWS\system32\tuxFgfii.ini2 moved successfully.
C:\WINDOWS\system32\tuxFgfii.ini moved successfully.
C:\WINDOWS\system32\abdKRqss.ini moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\clfcngsl.dll
C:\WINDOWS\system32\clfcngsl.dll NOT unregistered.
C:\WINDOWS\system32\clfcngsl.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\xsqlllbf.dll
C:\WINDOWS\system32\xsqlllbf.dll NOT unregistered.
C:\WINDOWS\system32\xsqlllbf.dll moved successfully.
C:\WINDOWS\system32\TBcJQBeg.ini2 moved successfully.
C:\WINDOWS\system32\TBcJQBeg.ini moved successfully.
C:\WINDOWS\system32\DJlnnUtv.ini moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\spvawcde.dll
C:\WINDOWS\system32\spvawcde.dll NOT unregistered.
C:\WINDOWS\system32\spvawcde.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\dnfbhhmr.dll
C:\WINDOWS\system32\dnfbhhmr.dll NOT unregistered.
C:\WINDOWS\system32\dnfbhhmr.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\truhjuah.dll
C:\WINDOWS\system32\truhjuah.dll NOT unregistered.
C:\WINDOWS\system32\truhjuah.dll moved successfully.
C:\WINDOWS\system32\33209680-.txt moved successfully.
C:\WINDOWS\system32\gjSrCcfe.ini2 moved successfully.
C:\WINDOWS\system32\gjSrCcfe.ini moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\usbaaplrc.dll
C:\WINDOWS\system32\usbaaplrc.dll NOT unregistered.
C:\WINDOWS\system32\usbaaplrc.dll moved successfully.
C:\WINDOWS\Temp\Diamond\Catalyst65\WDM_ALL\WDM_SP\XP moved successfully.
C:\WINDOWS\Temp\Diamond\Catalyst65\WDM_ALL\WDM_SP moved successfully.
C:\WINDOWS\Temp\Diamond\Catalyst65\WDM_ALL\RIO\XP moved successfully.
C:\WINDOWS\Temp\Diamond\Catalyst65\WDM_ALL\RIO moved successfully.
C:\WINDOWS\Temp\Diamond\Catalyst65\WDM_ALL\AVS_T200\XP moved successfully.
C:\WINDOWS\Temp\Diamond\Catalyst65\WDM_ALL\AVS_T200 moved successfully.
C:\WINDOWS\Temp\Diamond\Catalyst65\WDM_ALL moved successfully.
C:\WINDOWS\Temp\Diamond\Catalyst65\NET32 moved successfully.
C:\WINDOWS\Temp\Diamond\Catalyst65\MDX9c moved successfully.
C:\WINDOWS\Temp\Diamond\Catalyst65\Driver\2KXP_INF\B_32846 moved successfully.
C:\WINDOWS\Temp\Diamond\Catalyst65\Driver\2KXP_INF moved successfully.
C:\WINDOWS\Temp\Diamond\Catalyst65\Driver moved successfully.
C:\WINDOWS\Temp\Diamond\Catalyst65\BIN moved successfully.
C:\WINDOWS\Temp\Diamond\Catalyst65\ATIPCE moved successfully.
C:\WINDOWS\Temp\Diamond\Catalyst65\ATIMCECP moved successfully.
C:\WINDOWS\Temp\Diamond\Catalyst65\ACE moved successfully.
C:\WINDOWS\Temp\Diamond\Catalyst65 moved successfully.
C:\WINDOWS\Temp\Diamond moved successfully.
C:\WINDOWS\Temp moved successfully.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{03B8848D-EBB2-4445-A334-A07426609133}\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{059E7991-B67F-49F6-ADF9-71269613EC72}\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{08AB940A-A17A-4807-B039-71469C0DFB0C}\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0B07F5FF-8B66-4367-99CC-2898CCEF6EF6}\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1B017367-E279-4E75-BBCA-644AEC1146F5}\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{38EAE9DF-6F48-4852-BA72-E2D30D52E2D0}\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F583A2A-C70E-4124-8A99-86FB37376AA3}\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D231A04C-D4B9-4598-A340-2B9477A68C30}\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD448CF7-4807-4642-83A2-5C46F126A3ED}\\ deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\25763192264555180237812313748101 deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\"AppInit_DLLS"|" /E : value set successfully!
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{7186704C-C78F-425D-80DC-17A8E83F246F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7186704C-C78F-425D-80DC-17A8E83F246F}\ not found.
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\ lsa\\"Authentication Packages"|hex(7):6d,73,76,31,5f,30,00,00 /E : value set successfully!
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\MATT~1.MAT\LOCALS~1\Temp\Perflib_Perfdata_9c0.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\MATT~1.MAT\LOCALS~1\Temp\Perflib_Perfdata_bac.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\MATT~1.MAT\LOCALS~1\Temp\Perflib_Perfdata_be8.dat scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.
Explorer started successfully
OTMoveIt3 by OldTimer - Version 1.0.4.2 log created on 10072008_084047
Files moved on Reboot...
File C:\DOCUME~1\MATT~1.MAT\LOCALS~1\Temp\Perflib_Perfdata_9c0.dat not found!
File C:\DOCUME~1\MATT~1.MAT\LOCALS~1\Temp\Perflib_Perfdata_bac.dat not found!
File C:\DOCUME~1\MATT~1.MAT\LOCALS~1\Temp\Perflib_Perfdata_be8.dat not found!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:50:03 AM, on 10/7/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\notepad.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1222087542765
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1217351858239&h=19f8f8a3c31d68c89167a156f7c6e1c9/&filename=jinstall-6u7-windows-i586-jc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: dlbu_device - Dell - C:\WINDOWS\system32\dlbucoms.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
--
End of file - 6787 bytes
Hi Matt20
Looks much better........
How is the computer running now?
1 - Clean temp files
Download and Run ATF Cleaner
Download ATF (Atribune Temp File) CleanerÂĐ by Atribune (http://www.atribune.org/ccount/click.php?id=1) to your desktop.Double-click ATF Cleaner.exe to open it.
Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.
if you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
if you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
Click Exit on the Main menu to close the program
2 - Kaspersky Online Scan
Please go to Kaspersky website (http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html) and perform an online antivirus scan.
Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Mail databases Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply.
3 - Run Hijackthis
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad
4 - Status Check
Please reply with
1 the Kaspersky online scanner report
2. a fresh HijackThis log
Thanks peku006
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Tuesday, October 7, 2008
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Wednesday, October 08, 2008 03:06:14
Records in database: 1298821
--------------------------------------------------------------------------------
Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes
Scan area - My Computer:
C:\
D:\
E:\
F:\
Scan statistics:
Files scanned: 64262
Threat name: 7
Infected objects: 14
Suspicious objects: 0
Duration of the scan: 00:56:02
File name / Threat name / Threats count
C:\Documents and Settings\ben.MATT-255781CAAD\My Documents\LimeWire\Saved\Xzibit - Concentrate.wma Infected: Trojan-Downloader.WMA.GetCodec.a 1
C:\Program Files\Uninstall My Global Search Bar.dll Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.dh 1
C:\_OTMoveIt\MovedFiles\10072008_084047\WINDOWS\system32\bapyjhsq.dll Infected: Trojan.Win32.Monder.psh 1
C:\_OTMoveIt\MovedFiles\10072008_084047\WINDOWS\system32\clfcngsl.dll Infected: Trojan.Win32.Monder.psh 1
C:\_OTMoveIt\MovedFiles\10072008_084047\WINDOWS\system32\dnfbhhmr.dll Infected: Trojan.Win32.Monder.psg 1
C:\_OTMoveIt\MovedFiles\10072008_084047\WINDOWS\system32\fmaxehnp.dll Infected: Trojan.Win32.Monder.qie 1
C:\_OTMoveIt\MovedFiles\10072008_084047\WINDOWS\system32\ptklcwdk.dll Infected: Trojan.Win32.Monder.qif 1
C:\_OTMoveIt\MovedFiles\10072008_084047\WINDOWS\system32\spvawcde.dll Infected: Trojan.Win32.Monder.psh 1
C:\_OTMoveIt\MovedFiles\10072008_084047\WINDOWS\system32\truhjuah.dll Infected: Trojan.Win32.Monder.psg 1
C:\_OTMoveIt\MovedFiles\10072008_084047\WINDOWS\system32\uiwqjqji.dll Infected: Trojan.Win32.Monder.qie 1
C:\_OTMoveIt\MovedFiles\10072008_084047\WINDOWS\system32\upejxwfq.dll Infected: Trojan.Win32.Monder.psh 1
C:\_OTMoveIt\MovedFiles\10072008_084047\WINDOWS\system32\urqOiFVM.dll Infected: Trojan.Win32.Monder.psh 1
C:\_OTMoveIt\MovedFiles\10072008_084047\WINDOWS\system32\uyebgniv.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.alqc 1
C:\_OTMoveIt\MovedFiles\10072008_084047\WINDOWS\system32\yuueypvy.dll Infected: Trojan.Win32.Monder.psh 1
The selected area was scanned.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:35:21 PM, on 10/7/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1222087542765
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1217351858239&h=19f8f8a3c31d68c89167a156f7c6e1c9/&filename=jinstall-6u7-windows-i586-jc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: dlbu_device - Dell - C:\WINDOWS\system32\dlbucoms.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
--
End of file - 6612 bytes
Hi Matt20
Congratulations, your log looks clean! :)
Time for some housekeeping
Next we remove all used tools.
Double click OTMoveIt3.exe to launch the programme.
Click on the CleanUp! button.
OTMoveIt will download a list from the Internet, if your firewall or other defensive programmes alerts you, allow it access.
Select Yes when the "Begin cleanup Process?" prompt appears.
If you are prompted to Reboot during the cleanup, select Yes.
When finished exit out of OTMoveIt
The tool will delete itself once it finishes, if not delete it by yourself.
Note: If you receive a warning from your firewall or other security programs regarding OTCleanIt attempting to contact the internet, please allow it to do so.
Clear system restore points
This is a good time to clear your existing system restore points and establish a new clean restore point:
Go to Start > All Programs > Accessories > System Tools > System Restore
Select Create a restore point, and Ok it.
Next, go to Start > Run and type in cleanmgr
Select the More options tab
Choose the option to clean up system restore and OK it.
This will remove all restore points except the new one you just created.
Here are some free programs I recommend that could help you improve your computer's security.
Spybot Search and Destroy 1.6
Download it from here (http://www.safer-networking.org/en/mirrors/index.html). Just choose a mirror and off you go.
Find here the tutorial on how to use Spybot properly here (http://www.bleepingcomputer.com/tutorials/tutorial43.html)
Install SpyWare Blaster 4.1
Download it from here (http://www.javacoolsoftware.com/spywareblaster.html)
Find here the tutorial on how to use Spyware Blaster here (http://www.bleepingcomputer.com/tutorials/tutorial49.html)
Install WinPatrol
Download it from here (http://www.winpatrol.com/download.html)
Here you can find information about how WinPatrol works here (http://www.winpatrol.com/features.html)
Install FireTrust SiteHound
You can find information and download it from here (http://www.firetrust.com/en/products/sitehound)
Install MVPS Hosts File from here (http://mvps.org/winhelp2002/hosts.htm)
The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer.
Find Tutorial here : http://www.mvps.org/winhelp2002/hosts.htm
Note:"Be sure to disable the service "DNS Client" FIRST to allow the use of large HOSTS files without slowdowns.
If this isn't done first, the next reboot may take a VERY LONG TIME.
This is how to do it. First be sure you are signed in as a user with administrative privileges:
Stop and Disable the DNS Client Service
Go to Start, Run and type Services.msc and click OK.
Under the Extended Tab, Scroll down and find this service.
DNS Client
Right-Click on the DNS Client Service. Choose Properties
Select the General tab. Click on the Stop button.
Click the Arrow-down tab on the right-hand side at the Start-up Type box.
From the drop-down menu, click on Manual
Click the Apply tab, then click OK
Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector (http://secunia.com/software_inspector/)
F-secure Health Check (http://www.f-secure.com/weblog/archives/00001356.html)
Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com
Note: If you are running Windows XP SP2, you should upgrade to SP3.
Please check out Tony Klein's article "How did I get infected in the first place?" (http://castlecops.com/t7736-So_how_did_I_get_infected_in_the_first_place.html)
Read some information here (http://users.telenet.be/bluepatchy/miekiemoes/prevention.html) how to prevent Malware.
Happy safe surfing! :bigthumb:
Thank u very much i do have one question though i hav avg right now if o get the others above should i get rid of avg
Hi Matt20
No, you need a anti virus program
Please read this
How to prevent Malware (http://users.telenet.be/bluepatchy/miekiemoes/prevention.html)
well first spybot for some reason is starting as soon as i start up computer and then after that a couple of black screens come up then goes to another screen after those go away and says system window 32 not found or not running not sure which it says
my brother downloaded limewire behind my back he got the virus again i deleted limewire again sorry about this but i need ur help one more time hopefull this is the last time.
Hi Matt20
my brother downloaded limewire behind my back he got the virus again
Things Happen,:D: don't worry about it.
re-run rsit and post back a fresh log.txt
Thanks peku006
Logfile of random's system information tool 1.04 (written by random/random)
Run by Matt at 2008-10-08 22:13:56
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 52 GB (68%) free of 76 GB
Total RAM: 1534 MB (68% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:14:10 PM, on 10/8/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Documents and Settings\Matt.MATT-255781CAAD\Local Settings\Temporary Internet Files\Content.IE5\TM8CVFQU\RSIT[1].exe
C:\Program Files\Trend Micro\HijackThis\Matt.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {03B8848D-EBB2-4445-A334-A07426609133} - C:\WINDOWS\system32\nnnKDVpO.dll (file missing)
O2 - BHO: (no name) - {059E7991-B67F-49F6-ADF9-71269613EC72} - C:\WINDOWS\system32\xxyvwWmM.dll (file missing)
O2 - BHO: (no name) - {08AB940A-A17A-4807-B039-71469C0DFB0C} - C:\WINDOWS\system32\cbXRKEwv.dll (file missing)
O2 - BHO: (no name) - {0B07F5FF-8B66-4367-99CC-2898CCEF6EF6} - C:\WINDOWS\system32\rqRJCUmL.dll (file missing)
O2 - BHO: (no name) - {1B017367-E279-4E75-BBCA-644AEC1146F5} - C:\WINDOWS\system32\iifgFxut.dll (file missing)
O2 - BHO: (no name) - {38EAE9DF-6F48-4852-BA72-E2D30D52E2D0} - C:\WINDOWS\system32\geBQJcBT.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7186704C-C78F-425D-80DC-17A8E83F246F} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7bbd1924-b8a3-4b9b-8744-ce8b718640ff} - (no file)
O2 - BHO: (no name) - {7F583A2A-C70E-4124-8A99-86FB37376AA3} - C:\WINDOWS\system32\yayWnmMF.dll (file missing)
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Fire-Trust SiteHound - {C86AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - C:\Program Files\FireTrust\SiteHound\SiteHound.dll
O2 - BHO: (no name) - {D231A04C-D4B9-4598-A340-2B9477A68C30} - C:\WINDOWS\system32\efcCrSjg.dll (file missing)
O2 - BHO: (no name) - {FD448CF7-4807-4642-83A2-5C46F126A3ED} - C:\WINDOWS\system32\xxyawvWm.dll (file missing)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: SiteHound - {73F7F495-A325-4C52-BE48-5F97FA511E89} - C:\Program Files\FireTrust\SiteHound\SiteHound.dll
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [380352fe] rundll32.exe "C:\WINDOWS\system32\ibtkkqbn.dll",b
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingD7973] cmd /c del "C:\WINDOWS\system32\ibtkkqbn.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4927] command /c del "C:\WINDOWS\system32\dbsdrera.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1872] cmd /c del "C:\WINDOWS\system32\dbsdrera.dll_old"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {11316B13-33F0-4C9F-BD55-09994CCFA8EB} - C:\Program Files\FireTrust\SiteHound\SiteHound.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1222087542765
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1217351858239&h=19f8f8a3c31d68c89167a156f7c6e1c9/&filename=jinstall-6u7-windows-i586-jc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: jkkIXpMf - C:\WINDOWS\
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: dlbu_device - Dell - C:\WINDOWS\system32\dlbucoms.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
--
End of file - 9092 bytes
======Scheduled tasks folder======
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{03B8848D-EBB2-4445-A334-A07426609133}]
C:\WINDOWS\system32\nnnKDVpO.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{059E7991-B67F-49F6-ADF9-71269613EC72}]
C:\WINDOWS\system32\xxyvwWmM.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{08AB940A-A17A-4807-B039-71469C0DFB0C}]
C:\WINDOWS\system32\cbXRKEwv.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0B07F5FF-8B66-4367-99CC-2898CCEF6EF6}]
C:\WINDOWS\system32\rqRJCUmL.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1B017367-E279-4E75-BBCA-644AEC1146F5}]
C:\WINDOWS\system32\iifgFxut.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{38EAE9DF-6F48-4852-BA72-E2D30D52E2D0}]
C:\WINDOWS\system32\geBQJcBT.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-09-15 1562960]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7186704C-C78F-425D-80DC-17A8E83F246F}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7bbd1924-b8a3-4b9b-8744-ce8b718640ff}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F583A2A-C70E-4124-8A99-86FB37376AA3}]
C:\WINDOWS\system32\yayWnmMF.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}]
AVG Security Toolbar - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [2008-07-05 2055960]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - c:\program files\google\googletoolbar2.dll [2008-07-29 2403392]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll [2008-09-13 737776]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C86AE9C0-0909-4DDC-B661-C1AFB9F5AE53}]
CPub Object - C:\Program Files\FireTrust\SiteHound\SiteHound.dll [2008-03-13 1592416]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D231A04C-D4B9-4598-A340-2B9477A68C30}]
C:\WINDOWS\system32\efcCrSjg.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD448CF7-4807-4642-83A2-5C46F126A3ED}]
C:\WINDOWS\system32\xxyawvWm.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{A057A204-BACC-4D26-9990-79A187E2698E} - AVG Security Toolbar - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [2008-07-05 2055960]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar2.dll [2008-07-29 2403392]
{73F7F495-A325-4C52-BE48-5F97FA511E89} - SiteHound - C:\Program Files\FireTrust\SiteHound\SiteHound.dll [2008-03-13 1592416]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2008-09-29 1234712]
"UpdateManager"=C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe [2004-01-07 110592]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]
"ATICCC"=C:\Program Files\ATI Technologies\ATI.ACE\cli.exe [2006-01-02 45056]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2008-09-06 413696]
"AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2008-09-03 111936]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-09-08 289576]
"dla"=C:\WINDOWS\system32\dla\tfswctrl.exe [2004-08-13 122939]
"380352fe"=C:\WINDOWS\system32\ibtkkqbn.dll []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Spybot - Search & Destroy"=C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe [2008-07-07 4891472]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-08-01 68856]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2008-09-16 1833296]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SpybotDeletingD7973"=cmd /c del C:\WINDOWS\system32\ibtkkqbn.dll_old []
"SpybotDeletingB4927"=command /c del C:\WINDOWS\system32\dbsdrera.dll_old []
"SpybotDeletingD1872"=cmd /c del C:\WINDOWS\system32\dbsdrera.dll_old []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2006-05-03 61440]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\jkkIXpMf]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
C:\WINDOWS\system32\xxyvwWmM
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\AVG\AVG8\avgupd.exe"="C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe"
"C:\Program Files\AVG\AVG8\avgemc.exe"="C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
======List of files/folders created in the last 1 months======
2008-10-08 10:14:57 ----AD---- C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
2008-10-08 10:14:50 ----A---- C:\WINDOWS\system32\MSSTDFMT.DLL
2008-10-08 10:04:43 ----D---- C:\Documents and Settings\Matt.MATT-255781CAAD\Application Data\SiteHound
2008-10-08 10:04:40 ----D---- C:\Program Files\FireTrust
2008-10-08 06:42:23 ----D---- C:\WINDOWS\Temp
2008-10-06 09:46:04 ----D---- C:\rsit
2008-10-06 08:28:48 ----D---- C:\Documents and Settings\Matt.MATT-255781CAAD\Application Data\Malwarebytes
2008-10-06 08:28:44 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-06 08:28:44 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
2008-10-04 20:59:06 ----D---- C:\32788R22FWJFW
2008-10-02 06:45:21 ----A---- C:\WINDOWS\system32\mucltui.dll.mui
2008-10-02 06:45:20 ----A---- C:\WINDOWS\system32\mucltui.dll
2008-09-25 08:39:49 ----D---- C:\Program Files\Spybot - Search & Destroy
2008-09-20 10:40:30 ----D---- C:\Documents and Settings\Matt.MATT-255781CAAD\Application Data\Leadertech
2008-09-10 11:56:58 ----D---- C:\Program Files\Freeze.com
2008-09-10 06:59:24 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-09-10 06:58:39 ----D---- C:\Program Files\Bonjour
2008-09-10 05:01:39 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
2008-09-10 05:01:22 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$
2008-09-09 16:48:13 ----A---- C:\WINDOWS\system32\kbdkor.dll
2008-09-09 16:48:13 ----A---- C:\WINDOWS\system32\kbdjpn.dll
2008-09-09 16:48:13 ----A---- C:\WINDOWS\system32\kbd103.dll
2008-09-09 16:48:13 ----A---- C:\WINDOWS\system32\kbd101c.dll
2008-09-09 16:48:09 ----A---- C:\WINDOWS\system32\kbd101b.dll
2008-09-09 16:48:08 ----A---- C:\WINDOWS\system32\kbd106.dll
======List of files/folders modified in the last 1 months======
2008-10-08 22:14:04 ----D---- C:\WINDOWS\Prefetch
2008-10-08 22:09:40 ----D---- C:\WINDOWS
2008-10-08 21:36:43 ----A---- C:\WINDOWS\SchedLgU.Txt
2008-10-08 15:39:23 ----D---- C:\Program Files\LimeWire
2008-10-08 12:51:50 ----RAD---- C:\Program Files
2008-10-08 10:14:50 ----AD---- C:\WINDOWS\system32
2008-10-08 06:43:02 ----DC---- C:\WINDOWS\system32\dllcache
2008-10-08 06:42:55 ----D---- C:\WINDOWS\Help
2008-10-08 06:42:38 ----RSD---- C:\WINDOWS\Fonts
2008-10-08 06:42:21 ----D---- C:\WINDOWS\system32\CatRoot2
2008-10-06 09:06:04 ----HD---- C:\$AVG8.VAULT$
2008-10-06 08:36:24 ----A---- C:\WINDOWS\dellstat.ini
2008-10-06 08:30:23 ----D---- C:\WINDOWS\system32\drivers
2008-10-03 09:47:54 ----D---- C:\DELL
2008-10-02 16:27:07 ----HD---- C:\WINDOWS\inf
2008-10-02 16:17:46 ----SHD---- C:\WINDOWS\Installer
2008-10-02 16:17:46 ----SHD---- C:\Config.Msi
2008-10-02 09:42:47 ----D---- C:\Program Files\Trend Micro
2008-10-01 12:27:10 ----RSD---- C:\WINDOWS\assembly
2008-10-01 12:27:10 ----D---- C:\WINDOWS\Microsoft.NET
2008-10-01 10:15:28 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-10-01 10:15:19 ----D---- C:\WINDOWS\WinSxS
2008-10-01 09:57:08 ----D---- C:\WINDOWS\system32\CatRoot
2008-09-30 10:10:54 ----D---- C:\Documents and Settings
2008-09-29 08:34:25 ----SD---- C:\WINDOWS\Tasks
2008-09-28 19:09:35 ----A---- C:\WINDOWS\wininit.ini
2008-09-25 09:05:15 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-09-22 08:45:50 ----SD---- C:\WINDOWS\Downloaded Program Files
2008-09-20 12:05:00 ----D---- C:\WINDOWS\network diagnostic
2008-09-20 10:37:22 ----HD---- C:\Program Files\InstallShield Installation Information
2008-09-10 07:07:29 ----D---- C:\Program Files\Apple Software Update
2008-09-10 06:59:39 ----DC---- C:\WINDOWS\system32\DRVSTORE
2008-09-10 06:59:38 ----D---- C:\Program Files\iTunes
2008-09-10 06:59:25 ----D---- C:\Program Files\iPod
2008-09-10 06:58:16 ----D---- C:\Program Files\QuickTime
2008-09-10 05:01:26 ----A---- C:\WINDOWS\imsins.BAK
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 AvgLdx86;AVG AVI Loader Driver x86; C:\WINDOWS\System32\Drivers\avgldx86.sys [2008-08-29 97928]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86; C:\WINDOWS\System32\Drivers\avgmfx86.sys [2008-07-05 26824]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
R1 OMCI;OMCI; C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS [2001-08-22 13632]
R1 sscdbhk5;sscdbhk5; C:\WINDOWS\system32\drivers\sscdbhk5.sys [2004-07-14 5627]
R1 ssrtln;ssrtln; C:\WINDOWS\system32\drivers\ssrtln.sys [2004-07-14 23545]
R2 AvgTdiX;AVG8 Network Redirector; C:\WINDOWS\System32\Drivers\avgtdix.sys [2008-07-05 76040]
R2 drvnddm;drvnddm; C:\WINDOWS\system32\drivers\drvnddm.sys [2004-08-13 40544]
R2 tfsnboio;tfsnboio; C:\WINDOWS\system32\dla\tfsnboio.sys [2004-08-13 25723]
R2 tfsncofs;tfsncofs; C:\WINDOWS\system32\dla\tfsncofs.sys [2004-08-13 34843]
R2 tfsndrct;tfsndrct; C:\WINDOWS\system32\dla\tfsndrct.sys [2004-08-13 4123]
R2 tfsndres;tfsndres; C:\WINDOWS\system32\dla\tfsndres.sys [2004-08-13 2239]
R2 tfsnifs;tfsnifs; C:\WINDOWS\system32\dla\tfsnifs.sys [2004-08-13 86202]
R2 tfsnopio;tfsnopio; C:\WINDOWS\system32\dla\tfsnopio.sys [2004-08-13 14715]
R2 tfsnpool;tfsnpool; C:\WINDOWS\system32\dla\tfsnpool.sys [2004-08-13 6363]
R2 tfsnudf;tfsnudf; C:\WINDOWS\system32\dla\tfsnudf.sys [2004-08-13 98714]
R2 tfsnudfa;tfsnudfa; C:\WINDOWS\system32\dla\tfsnudfa.sys [2004-08-13 100603]
R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2002-04-01 4816]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2006-05-03 1540608]
R3 E100B;Intel(R) PRO Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2005-06-13 162816]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntelC51;IntelC51; C:\WINDOWS\system32\DRIVERS\IntelC51.sys [2004-03-05 1233525]
R3 IntelC52;IntelC52; C:\WINDOWS\system32\DRIVERS\IntelC52.sys [2004-03-05 647929]
R3 IntelC53;IntelC53; C:\WINDOWS\system32\DRIVERS\IntelC53.sys [2004-03-05 60949]
R3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
R3 mohfilt;mohfilt; C:\WINDOWS\system32\DRIVERS\mohfilt.sys [2004-03-05 37048]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2004-04-09 612352]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys []
S3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-12 12160]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2008-09-05 36864]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-09-05 116040]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2006-05-03 413696]
R2 avg8emc;AVG8 E-mail Scanner; C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-29 875288]
R2 avg8wd;AVG8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-29 231704]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
R2 spkrmon;spkrmon; C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe [2003-08-28 61440]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-09-08 536872]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2006-05-03 520192]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 dlbu_device;dlbu_device; C:\WINDOWS\system32\dlbucoms.exe [2004-07-01 421888]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-07-29 138168]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
-----------------EOF-----------------
Hi Matt20
OTMoveIt3
Download OTMoveIt3 (http://oldtimer.geekstogo.com/OTMoveIt3.exe) by Old Timer and save it to your Desktop.
Double-click OTMoveIt3.exe to run it.
Copy the lines in the codebox below.
:processes
explorer.exe
:files
C:\WINDOWS\system32\nnnKDVpO.dll
C:\WINDOWS\system32\xxyvwWmM.dll
C:\WINDOWS\system32\cbXRKEwv.dll
C:\WINDOWS\system32\rqRJCUmL.dll
C:\WINDOWS\system32\iifgFxut.dll
C:\WINDOWS\system32\geBQJcBT.dll
C:\WINDOWS\system32\yayWnmMF.dll
C:\WINDOWS\system32\efcCrSjg.dll
C:\WINDOWS\system32\xxyawvWm.dll
C:\WINDOWS\system32\ibtkkqbn.dll
C:\WINDOWS\system32\ibtkkqbn.dll_old
C:\WINDOWS\system32\dbsdrera.dll_old
C:\WINDOWS\system32\dbsdrera.dll_old
C:\32788R22FWJFW
C:\Documents and Settings\All Users.WINDOWS\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
C:\WINDOWS\Temp
:reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{03B8848D-EBB2-4445-A334-A07426609133}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{059E7991-B67F-49F6-ADF9-71269613EC72}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{08AB940A-A17A-4807-B039-71469C0DFB0C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0B07F5FF-8B66-4367-99CC-2898CCEF6EF6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1B017367-E279-4E75-BBCA-644AEC1146F5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{38EAE9DF-6F48-4852-BA72-E2D30D52E2D0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7186704C-C78F-425D-80DC-17A8E83F246F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7bbd1924-b8a3-4b9b-8744-ce8b718640ff}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F583A2A-C70E-4124-8A99-86FB37376AA3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D231A04C-D4B9-4598-A340-2B9477A68C30}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD448CF7-4807-4642-83A2-5C46F126A3ED}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"380352fe"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\jkkIXpMf]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\ lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00
:commands
[emptytemp]
[start explorer]
Return to OTMoveIt3, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar), and paste it in your next reply.
Close OTMoveIt3
Then rerun Malwarebytes Anti-Malware like you did earlier......
Please reply with
1. the OTMoveIt3 Log
2. the Malwarebytes' Anti-Malware Log
3. a fresh HijackThis log
========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
File/Folder C:\WINDOWS\system32\nnnKDVpO.dll not found.
File/Folder C:\WINDOWS\system32\xxyvwWmM.dll not found.
File/Folder C:\WINDOWS\system32\cbXRKEwv.dll not found.
File/Folder C:\WINDOWS\system32\rqRJCUmL.dll not found.
File/Folder C:\WINDOWS\system32\iifgFxut.dll not found.
File/Folder C:\WINDOWS\system32\geBQJcBT.dll not found.
File/Folder C:\WINDOWS\system32\yayWnmMF.dll not found.
File/Folder C:\WINDOWS\system32\efcCrSjg.dll not found.
File/Folder C:\WINDOWS\system32\xxyawvWm.dll not found.
File/Folder C:\WINDOWS\system32\ibtkkqbn.dll not found.
File/Folder C:\WINDOWS\system32\ibtkkqbn.dll_old not found.
File/Folder C:\WINDOWS\system32\dbsdrera.dll_old not found.
File/Folder C:\WINDOWS\system32\dbsdrera.dll_old not found.
C:\32788R22FWJFW moved successfully.
C:\Documents and Settings\All Users.WINDOWS\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86\x86 moved successfully.
C:\Documents and Settings\All Users.WINDOWS\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86 moved successfully.
C:\Documents and Settings\All Users.WINDOWS\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} moved successfully.
C:\WINDOWS\Temp moved successfully.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{03B8848D-EBB2-4445-A334-A07426609133}\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{059E7991-B67F-49F6-ADF9-71269613EC72}\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{08AB940A-A17A-4807-B039-71469C0DFB0C}\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0B07F5FF-8B66-4367-99CC-2898CCEF6EF6}\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1B017367-E279-4E75-BBCA-644AEC1146F5}\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{38EAE9DF-6F48-4852-BA72-E2D30D52E2D0}\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7186704C-C78F-425D-80DC-17A8E83F246F}\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7bbd1924-b8a3-4b9b-8744-ce8b718640ff}\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F583A2A-C70E-4124-8A99-86FB37376AA3}\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D231A04C-D4B9-4598-A340-2B9477A68C30}\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD448CF7-4807-4642-83A2-5C46F126A3ED}\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\jkkIXpMf\\ deleted successfully.
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\ lsa\\"Authentication Packages"|hex(7):6d,73,76,31,5f,30,00,00 /E : value set successfully!
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\MATT~1.MAT\LOCALS~1\Temp\Perflib_Perfdata_9fc.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\MATT~1.MAT\LOCALS~1\Temp\Perflib_Perfdata_a28.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\MATT~1.MAT\LOCALS~1\Temp\Perflib_Perfdata_e40.dat scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.
Explorer started successfully
OTMoveIt3 by OldTimer - Version 1.0.4.2 log created on 10092008_082646
Files moved on Reboot...
File C:\DOCUME~1\MATT~1.MAT\LOCALS~1\Temp\Perflib_Perfdata_9fc.dat not found!
File C:\DOCUME~1\MATT~1.MAT\LOCALS~1\Temp\Perflib_Perfdata_a28.dat not found!
File C:\DOCUME~1\MATT~1.MAT\LOCALS~1\Temp\Perflib_Perfdata_e40.dat not found!
Malwarebytes' Anti-Malware 1.28
Database version: 1246
Windows 5.1.2600 Service Pack 3
10/9/2008 9:32:57 AM
mbam-log-2008-10-09 (09-32-57).txt
Scan type: Full Scan (C:\|D:\|E:\|)
Objects scanned: 166508
Time elapsed: 51 minute(s), 29 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\380352fe (Trojan.Vundo) -> Quarantined and deleted successfully.
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:34:44 AM, on 10/9/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Fire-Trust SiteHound - {C86AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - C:\Program Files\FireTrust\SiteHound\SiteHound.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: SiteHound - {73F7F495-A325-4C52-BE48-5F97FA511E89} - C:\Program Files\FireTrust\SiteHound\SiteHound.dll
O4 - HKLM\..\Run: [380352fe] rundll32.exe "C:\WINDOWS\system32\ibtkkqbn.dll",b
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingD7973] cmd /c del "C:\WINDOWS\system32\ibtkkqbn.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4927] command /c del "C:\WINDOWS\system32\dbsdrera.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1872] cmd /c del "C:\WINDOWS\system32\dbsdrera.dll_old"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {11316B13-33F0-4C9F-BD55-09994CCFA8EB} - C:\Program Files\FireTrust\SiteHound\SiteHound.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1222087542765
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1217351858239&h=19f8f8a3c31d68c89167a156f7c6e1c9/&filename=jinstall-6u7-windows-i586-jc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: dlbu_device - Dell - C:\WINDOWS\system32\dlbucoms.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
--
End of file - 6594 bytes
Hi Matt20
1 - Remove bad HijackThis entries
Run HijackThis
Click on the Scan button
Put a check beside all of the items listed below (if present):
O4 - HKLM\..\Run: [380352fe] rundll32.exe "C:\WINDOWS\system32\ibtkkqbn.dll",b
O4 - HKCU\..\RunOnce: [SpybotDeletingD7973] cmd /c del "C:\WINDOWS\system32\ibtkkqbn.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4927] command /c del "C:\WINDOWS\system32\dbsdrera.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1872] cmd /c del "C:\WINDOWS\system32\dbsdrera.dll_old"
Close all open windows and browsers/email, etc...
Click on the "Fix Checked" button
When completed, close the application.
2 - Kaspersky Online Scan
Please go to Kaspersky website (http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html) and perform an online antivirus scan.
Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Mail databases Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply.
3 - Run Hijackthis
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad
4 - Status Check
Please reply with
1. the Kaspersky online scanner report
2. a fresh HijackThis log
description of any problems you are having with your PC
Thanks peku006
cant find those on hijackthis there not there
Hi Matt20
Donīt worry if you donīt have those
Please do that online scan with Kaspersky
Please reply with
1. the Kaspersky online scanner report
2. a fresh HijackThis log
Thanks peku006
Hello!
Do you still need help
It has been three days since my last post.
Do you still need help with this?
Do you need more time?
Are you having problems following my instructions?
Note: If after 48hrs you have not replied to this thread then it will have to be CLOSED!
Matt20, this topic has been archived due to inactivity.
As it has been five days or more since your last post, and your helper posted a response to which you did not reply, this topic has been archived and will not be reopened.
Thank you peku006. :)