Page 1 of 2 12 LastLast
Results 1 to 10 of 17

Thread: Virtumonde Infection

  1. #1
    Junior Member
    Join Date
    Apr 2009
    Posts
    20

    Default Virtumonde Infection

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 5:33:18 PM, on 4/20/2009
    Platform: Windows 2000 SP4 (WinNT 5.00.2195)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    Boot mode: Normal

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\spoolsv.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\hidserv.exe
    C:\WINNT\system32\nvsvc32.exe
    C:\WINNT\system32\regsvc.exe
    C:\WINNT\system32\MSTask.exe
    C:\WINNT\wanmpsvc.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\WINNT\System32\WBEM\WinMgmt.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\Explorer.EXE
    C:\WINNT\system32\ezSP_Px.exe
    c:\progra~1\mcafee.com\vso\mcvsescn.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb09.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: (no name) - {bb7eb98f-ef38-45fb-978c-aef95205914e} - C:\WINNT\system32\javemahi.dll (file missing)
    O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
    O4 - HKLM\..\Run: [VirusScan Online] "C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
    O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\McUpdate.exe
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINNT\system32\ezSP_Px.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb09.exe
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [CPM3fedd658] Rundll32.exe "c:\winnt\system32\zugowuva.dll",a
    O4 - HKLM\..\Run: [3cdee5c4] rundll32.exe "C:\WINNT\system32\neyiwafu.dll",b
    O4 - HKLM\..\Run: [yohutupijo] Rundll32.exe "C:\WINNT\system32\kobogana.dll",s
    O4 - HKCU\..\Run: [Microsoft Location Finder] "C:\Program Files\Microsoft Location Finder\LocationFinder.exe"
    O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
    O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
    O15 - Trusted Zone: *.line6.net
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: c:\winnt\system32\zugowuva.dll,C:\WINNT\system32\gizoroda.dll
    O20 - Winlogon Notify: avgrsstarter - C:\WINNT\SYSTEM32\avgrsstx.dll
    O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\winnt\system32\zugowuva.dll
    O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\winnt\system32\zugowuva.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
    O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Networks Associates Technology, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
    O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
    O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
    O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe

    --
    End of file - 6480 bytes

  2. #2
    In Memoriam -Always in our heart pskelley's Avatar
    Join Date
    Oct 2005
    Location
    Clearwater, Florida
    Posts
    20,252

    Default

    Welcome to Safer Networking, I wish to be sure you have viewed and understand this information.
    "BEFORE you POST" (READ this Procedure before Requesting Assistance) http://forums.spybot.info/showthread.php?t=288
    All advice given is taken at your own risk.
    Please make sure you have read this information so we are on the same page.

    Not my favorite Operating System to work on, but I will do my best.

    You are infected but you are also doing this: running two antivirus programs at the same time and this is not a good thing.
    http://service1.symantec.com/SUPPORT...00031316555206
    "Microsoft recommends that you have only one anti-virus program installed on your computer."
    http://www.washingtonpost.com/wp-dyn...120300087.html
    http://www.smartcomputing.com/editor...38s07/38s07.as

    McAfee & AVG 8 <<< uninstall one of those and when you are running one antivirus program, post a new HJT log.

    Post also an uninstall list: Open Hijackthis.
    Click the "Open the Misc Tools" section Button.
    Click the "Open Uninstall Manager" Button.
    Click the "Save list..." Button.
    Save it to your desktop. Copy and paste the contents into your reply.
    Image: http://img.bleepingcomputer.com/tuto...nstall-man.jpg

    Thanks
    MS-MVP Consumer Security 2007-08-09
    Proud Member ASAP
    UNITE Member 2006

  3. #3
    Junior Member
    Join Date
    Apr 2009
    Posts
    20

    Default

    Okay. I decided to uninstall McAfee. I couldn't find a shortcut to the 'uninstall option' with the program in the start menu, so I decided to use Add/Remove programs. When I selected it and hit remove, it didn't do anything. After trying this several times to no avail, I just started deleting the files. Two of them were unable to be removed. Names: mcvsshl.dll and shlres.dll. Upon trying to delete I receive this message:

    Could not delete *file name*: Access is denied. The source file may be in use.

    I tried ending all of the McAfee things I could in task manager, but for one of them (mstask?) I received an Access Denied error.
    I'm hope that will remove the virus scanner though.

    Note: upon searching my HJT log before posting, I found many instances of McAfee and it appears my removal wasn't successful. If this is the case I apologize and help on uninstalling it would be greatly appreciated.

    Here's the HJT log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 5:36:03 PM, on 4/21/2009
    Platform: Windows 2000 SP4 (WinNT 5.00.2195)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    Boot mode: Normal

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\spoolsv.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\hidserv.exe
    C:\WINNT\system32\nvsvc32.exe
    C:\WINNT\system32\regsvc.exe
    C:\WINNT\system32\MSTask.exe
    C:\WINNT\wanmpsvc.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\WINNT\System32\WBEM\WinMgmt.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\Explorer.EXE
    C:\WINNT\system32\ezSP_Px.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb09.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\WINNT\system32\HPZipm12.exe
    C:\WINNT\system32\rundll32.exe
    C:\WINNT\system32\rundll32.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINNT\system32\notepad.exe
    C:\WINNT\system32\NOTEPAD.EXE

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: (no name) - {bb7eb98f-ef38-45fb-978c-aef95205914e} - C:\WINNT\system32\javemahi.dll (file missing)
    O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
    O4 - HKLM\..\Run: [VirusScan Online] "C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
    O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\McUpdate.exe
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINNT\system32\ezSP_Px.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb09.exe
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [yohutupijo] Rundll32.exe "C:\WINNT\system32\kobogana.dll",s
    O4 - HKLM\..\Run: [3cdee5c4] rundll32.exe "C:\WINNT\system32\nobawitu.dll",b
    O4 - HKLM\..\Run: [CPM3fedd658] Rundll32.exe "c:\winnt\system32\zugowuva.dll",a
    O4 - HKCU\..\Run: [Microsoft Location Finder] "C:\Program Files\Microsoft Location Finder\LocationFinder.exe"
    O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
    O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
    O15 - Trusted Zone: *.line6.net
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: C:\WINNT\system32\gizoroda.dll c:\winnt\system32\zugowuva.dll
    O20 - Winlogon Notify: avgrsstarter - C:\WINNT\SYSTEM32\avgrsstx.dll
    O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\winnt\system32\zugowuva.dll
    O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\winnt\system32\zugowuva.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe (file missing)
    O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Unknown owner - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe (file missing)
    O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
    O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
    O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe

    --
    End of file - 6598 bytes

    Uninstall list:

    7-Zip 4.65
    Ad-Aware
    Adobe Flash Player 10 Plugin
    Adobe Flash Player ActiveX
    Adobe Reader 7.0.5 Language Support
    Adobe Reader 7.0.8
    Adobe Shockwave Player 11
    AIM 6
    American Greetings Crafts!
    AOL Coach Version 1.0(Build:20040229.1 en)
    AOL Instant Messenger
    AOL Uninstaller (Choose which Products to Remove)
    Apple Software Update
    Audacity 1.2.6
    AVG 8.5
    BounceBack Express
    Chicken Invaders v1.30
    C-Media 3D Audio
    Color Wheel Pro
    DGOControls
    DiscWizard for Windows
    DivX Player
    DivX Web Player
    ERUNT 1.1j
    GearBox 1.02 (Remove Only)
    Google Earth
    Google Toolbar for Internet Explorer
    Greetings Workshop
    Guild Wars
    GuitarPort 2.51 (Remove Only)
    HijackThis 2.0.2
    Hotfix for MDAC 2.53 (KB911562)
    Hotfix for MDAC 2.81 (KB927779)
    Hotfix for Microsoft .NET Framework 2.0 Service Pack 1 (KB947748)
    hp photosmart 7700 series
    Intel(R) 537EP Modem
    Internet Speed Monitor
    iTunes
    J2SE Runtime Environment 5.0 Update 10
    J2SE Runtime Environment 5.0 Update 4
    Java 2 Runtime Environment, SE v1.4.2
    Java(TM) 6 Update 5
    Lernout & Hauspie TruVoice for Microsoft Agent
    Macromedia Flash Player 8
    Macromedia Shockwave Player
    Malwarebytes' Anti-Malware
    McAfee SecurityCenter
    McAfee VirusScan
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Hotfix (KB928366)
    Microsoft .NET Framework 1.1 Hotfix (KB947742)
    Microsoft .NET Framework 2.0 Service Pack 1
    Microsoft Access 2000 SR-1 Runtime
    Microsoft AntiSpyware
    Microsoft Base Smart Card Cryptographic Service Provider Package
    Microsoft Location Finder
    Microsoft Office 2000 Disc 2
    Microsoft Office 2000 Professional
    Microsoft Picture It! Express 7.0
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Web Publishing Wizard 1.52
    Microsoft Windows Journal Viewer
    Mozilla Firefox (3.0.8)
    Mozilla Thunderbird (2.0.0.21)
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    MSXML4 Parser
    Native Instruments Sibelius Player
    NCH Tone Generator
    Nero - Burning Rom
    NVIDIA Display Driver
    Ohio National Product Illustrations
    OLYMPUS CAMEDIA Master 4.1
    OpenMG Limited Patch 4.0-04-08-02-01
    OpenMG Secure Module 4.0.00
    Play Music 1.0
    Power Tab Editor 1.7
    PowerDVD
    Protected Music Converter 1.0.0.19
    QuickTime
    QuickTime for Windows (32-bit)
    RealPlayer
    RiffWorks 1.00 (Remove Only)
    Roll
    Security Update for DirectX 9 (KB941568)
    Security Update for DirectX 9 (KB951698)
    Security Update for Windows 2000 (KB904706)
    Security Update for Windows 2000 (KB923689)
    Security Update for Windows 2000 (KB941569)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows Media Player 6.4 (KB954600)
    Security Update for Windows Media Player 9 (KB911565)
    Security Update for Windows Media Player 9 (KB917734)
    Security Update for Windows Media Player 9 (KB936782)
    Sibelius 4
    SpeechRedist
    StepMania (remove only)
    System Requirements Lab
    TuxGuitar 1.0
    Unlocker 1.8.7
    Update Rollup 1 for Windows 2000 SP4
    Ventrilo Client
    VIA Rhine-Family Fast Ethernet Adapter
    Viewpoint Media Player
    ViewSonic Monitor Drivers
    Windows 2000 Hotfix - KB842773
    Windows 2000 Hotfix - KB867282
    Windows 2000 Hotfix - KB883939
    Windows 2000 Hotfix - KB889293
    Windows 2000 Hotfix - KB890046
    Windows 2000 Hotfix - KB890923
    Windows 2000 Hotfix - KB893756
    Windows 2000 Hotfix - KB894320
    Windows 2000 Hotfix - KB896358
    Windows 2000 Hotfix - KB896422
    Windows 2000 Hotfix - KB896423
    Windows 2000 Hotfix - KB896424
    Windows 2000 Hotfix - KB896688
    Windows 2000 Hotfix - KB896727
    Windows 2000 Hotfix - KB897715
    Windows 2000 Hotfix - KB899587
    Windows 2000 Hotfix - KB899588
    Windows 2000 Hotfix - KB899589
    Windows 2000 Hotfix - KB900725
    Windows 2000 Hotfix - KB901017
    Windows 2000 Hotfix - KB901214
    Windows 2000 Hotfix - KB902400
    Windows 2000 Hotfix - KB904368
    Windows 2000 Hotfix - KB905414
    Windows 2000 Hotfix - KB905495
    Windows 2000 Hotfix - KB905749
    Windows 2000 Hotfix - KB905915
    Windows 2000 Hotfix - KB908519
    Windows 2000 Hotfix - KB908523
    Windows 2000 Hotfix - KB908531
    Windows 2000 Hotfix - KB911280
    Windows 2000 Hotfix - KB911567
    Windows 2000 Hotfix - KB912812
    Windows 2000 Hotfix - KB912919
    Windows 2000 Hotfix - KB913580
    Windows 2000 Hotfix - KB914388
    Windows 2000 Hotfix - KB914389
    Windows 2000 Hotfix - KB916281
    Windows 2000 Hotfix - KB917008
    Windows 2000 Hotfix - KB917159
    Windows 2000 Hotfix - KB917422
    Windows 2000 Hotfix - KB917537
    Windows 2000 Hotfix - KB917736
    Windows 2000 Hotfix - KB917953
    Windows 2000 Hotfix - KB918118
    Windows 2000 Hotfix - KB918439
    Windows 2000 Hotfix - KB918899
    Windows 2000 Hotfix - KB920213
    Windows 2000 Hotfix - KB920670
    Windows 2000 Hotfix - KB920683
    Windows 2000 Hotfix - KB920685
    Windows 2000 Hotfix - KB920958
    Windows 2000 Hotfix - KB921398
    Windows 2000 Hotfix - KB921503
    Windows 2000 Hotfix - KB921883
    Windows 2000 Hotfix - KB922582
    Windows 2000 Hotfix - KB922616
    Windows 2000 Hotfix - KB922760
    Windows 2000 Hotfix - KB923191
    Windows 2000 Hotfix - KB923414
    Windows 2000 Hotfix - KB923694
    Windows 2000 Hotfix - KB923810
    Windows 2000 Hotfix - KB923980
    Windows 2000 Hotfix - KB924191
    Windows 2000 Hotfix - KB924270
    Windows 2000 Hotfix - KB924667
    Windows 2000 Hotfix - KB925454
    Windows 2000 Hotfix - KB925486
    Windows 2000 Hotfix - KB925902
    Windows 2000 Hotfix - KB926122
    Windows 2000 Hotfix - KB926436
    Windows 2000 Hotfix - KB927891
    Windows 2000 Hotfix - KB928090
    Windows 2000 Hotfix - KB928843
    Windows 2000 Hotfix - KB929969
    Windows 2000 Hotfix - KB930178
    Windows 2000 Hotfix - KB931768
    Windows 2000 Hotfix - KB931784
    Windows 2000 Hotfix - KB932168
    Windows 2000 Hotfix - KB933566
    Windows 2000 Hotfix - KB933729
    Windows 2000 Hotfix - KB935839
    Windows 2000 Hotfix - KB935840
    Windows 2000 Hotfix - KB936021
    Windows 2000 Hotfix - KB937143
    Windows 2000 Hotfix - KB937894
    Windows 2000 Hotfix - KB938127
    Windows 2000 Hotfix - KB938464
    Windows 2000 Hotfix - KB938827
    Windows 2000 Hotfix - KB938829
    Windows 2000 Hotfix - KB939653
    Windows 2000 Hotfix - KB941202
    Windows 2000 Hotfix - KB941644
    Windows 2000 Hotfix - KB941693
    Windows 2000 Hotfix - KB942615
    Windows 2000 Hotfix - KB943055
    Windows 2000 Hotfix - KB943485
    Windows 2000 Hotfix - KB944338
    Windows 2000 Hotfix - KB944533
    Windows 2000 Hotfix - KB945553
    Windows 2000 Hotfix - KB947864
    Windows 2000 Hotfix - KB948590
    Windows 2000 Hotfix - KB948881
    Windows 2000 Hotfix - KB950749
    Windows 2000 Hotfix - KB950759
    Windows 2000 Hotfix - KB950760
    Windows 2000 Hotfix - KB950974
    Windows 2000 Hotfix - KB951066
    Windows 2000 Hotfix - KB951748
    Windows 2000 Hotfix - KB952954
    Windows 2000 Hotfix - KB953838
    Windows 2000 Hotfix - KB953839
    Windows 2000 Hotfix - KB954211
    Windows 2000 Hotfix - KB955069
    Windows 2000 Hotfix - KB956390
    Windows 2000 Hotfix - KB956391
    Windows 2000 Hotfix - KB956802
    Windows 2000 Hotfix - KB957095
    Windows 2000 Hotfix - KB957097
    Windows 2000 Hotfix - KB958215
    Windows 2000 Hotfix - KB958644
    Windows 2000 Hotfix - KB958687
    Windows 2000 Hotfix - KB958690
    Windows 2000 Hotfix - KB960225
    Windows 2000 Hotfix - KB960714
    Windows 2000 Hotfix - KB960715
    Windows 2000 Hotfix - KB967715
    Windows 2000 Hotfix (SP5) Q818043
    Windows Genuine Advantage v1.3.0254.0
    Windows Installer 3.1 (KB893803)
    Windows Installer 3.1 (KB893803)
    Windows Media Player 9 Hotfix [See KB885492 for more information]
    Windows Media Player Hotfix [See Q828026 for more information]
    Windows Media Player system update (9 Series)
    Wisdom-soft ScreenHunter 4.1 Pro

  4. #4
    In Memoriam -Always in our heart pskelley's Avatar
    Join Date
    Oct 2005
    Location
    Clearwater, Florida
    Posts
    20,252

    Default

    McAfee SecurityCenter <<< you see if that would uninstall McAfee? If that does not do it, look here:

    McAfee Consumer Products Removal tool
    http://www.majorgeeks.com/McAfee_Con...ool_d5420.html

    Post a new HJT log.
    MS-MVP Consumer Security 2007-08-09
    Proud Member ASAP
    UNITE Member 2006

  5. #5
    Junior Member
    Join Date
    Apr 2009
    Posts
    20

    Default

    Okay, I've run the remover.

    New HJT log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 6:28:18 PM, on 4/21/2009
    Platform: Windows 2000 SP4 (WinNT 5.00.2195)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    Boot mode: Normal

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\spoolsv.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\hidserv.exe
    C:\WINNT\system32\nvsvc32.exe
    C:\WINNT\system32\regsvc.exe
    C:\WINNT\system32\MSTask.exe
    C:\WINNT\wanmpsvc.exe
    C:\WINNT\System32\WBEM\WinMgmt.exe
    C:\WINNT\system32\svchost.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\WINNT\Explorer.EXE
    C:\WINNT\system32\ezSP_Px.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\Unlocker\UnlockerAssistant.exe
    C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb09.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\WINNT\system32\rundll32.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: (no name) - {bb7eb98f-ef38-45fb-978c-aef95205914e} - C:\WINNT\system32\javemahi.dll (file missing)
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINNT\system32\ezSP_Px.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb09.exe
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [yohutupijo] Rundll32.exe "C:\WINNT\system32\kobogana.dll",s
    O4 - HKLM\..\Run: [3cdee5c4] rundll32.exe "C:\WINNT\system32\nobawitu.dll",b
    O4 - HKLM\..\Run: [CPM3fedd658] Rundll32.exe "c:\winnt\system32\zugowuva.dll",a
    O4 - HKCU\..\Run: [Microsoft Location Finder] "C:\Program Files\Microsoft Location Finder\LocationFinder.exe"
    O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
    O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
    O15 - Trusted Zone: *.line6.net
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: C:\WINNT\system32\gizoroda.dll c:\winnt\system32\zugowuva.dll c:\winnt\system32\loburako.dll
    O20 - Winlogon Notify: avgrsstarter - C:\WINNT\SYSTEM32\avgrsstx.dll
    O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\winnt\system32\zugowuva.dll
    O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\winnt\system32\zugowuva.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
    O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
    O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe

    --
    End of file - 5998 bytes

  6. #6
    In Memoriam -Always in our heart pskelley's Avatar
    Join Date
    Oct 2005
    Location
    Clearwater, Florida
    Posts
    20,252

    Default

    Follow the directions carefully: Recovery Console will not install on this Operating System, so ignore it.

    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use

    Download ComboFix from here:

    Link 1

    * IMPORTANT !!! Save ComboFix.exe to your Desktop

    • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
    • See this Link for programs that need to be disabled and instruction on how to disable them.
    • Remember to re-enable them when we're done.

    • Double click on ComboFix.exe & follow the prompts.
    • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.


    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

    Click on Yes, to continue scanning for malware.

    When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply along with a New Hijackthis log.

    *If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

    Tutorial if needed
    http://www.bleepingcomputer.com/comb...o-use-combofix


    Uninstall list: I look for malware and security issues and will not know all of your programs, but you should.
    Hackers are using out of date programs to infect folks more and more,
    Here is a small free tool that lets you know when something needs an update if you are interested:
    http://secunia.com/vulnerability_scanning/personal/ While PSI runs in the System Tray for realtime notifications, I personally prefer to turn it off in MSConfig and run it from All Programs when I want to do a check.

    Adobe Flash Player 10 Plugin
    Adobe Flash Player ActiveX

    Adobe recommends all users of Adobe Flash Player 10.0.12.36 and earlier versions upgrade to the newest version 10.0.22.87
    http://www.adobe.com/support/securit...apsb09-01.html

    Adobe Reader 7.0.8 <<< out of date and unsafe:
    http://news.cnet.com/8301-1009_3-100...ml?tag=nl.e433
    http://www.filehippo.com/download_adobe_reader/
    (if you want a smaller program, look at this one)
    Foxit Reader 2.3 for Windows (make sure to uncheck any toolbars)
    http://www.foxitsoftware.com/pdf/rd_intro.php

    J2SE Runtime Environment 5.0 Update 10
    J2SE Runtime Environment 5.0 Update 4
    Java 2 Runtime Environment, SE v1.4.2 <<< very old
    Java(TM) 6 Update 5

    all out of date and unsafe:
    http://forums.spybot.info/showpost.p...80&postcount=2
    Be aware of this information so you can opt out of anything you do not want.
    Microsoft Does MSN Toolbar Distribution Deal With Java:
    http://searchengineland.com/microsof...java-15413.php
    http://raproducts.org/ <<< should help if you have trouble with uninstalling old version. I belief it works on Win2000

    McAfee SecurityCenter
    McAfee VirusScan

    These should be gone?

    Microsoft AntiSpyware <<< uninstall, obsolete program.

    Viewpoint Media Player
    For your information, Viewpoint is installed by aol probably without your knowledge. I suggest you uninstall this resource waster in Add Remove programs.
    http://www.spywareinfo.com/newslette....php#viewpoint
    http://www.clickz.com/news/article.php/3561546
    http://vil.nai.com/vil/content/v_137262.htm
    MS-MVP Consumer Security 2007-08-09
    Proud Member ASAP
    UNITE Member 2006

  7. #7
    Junior Member
    Join Date
    Apr 2009
    Posts
    20

    Default

    okay done with everything

    HJT Log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 7:29:47 PM, on 4/21/2009
    Platform: Windows 2000 SP4 (WinNT 5.00.2195)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    Boot mode: Normal

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\spoolsv.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\hidserv.exe
    C:\WINNT\system32\nvsvc32.exe
    C:\WINNT\system32\regsvc.exe
    C:\WINNT\system32\MSTask.exe
    C:\WINNT\wanmpsvc.exe
    C:\WINNT\System32\WBEM\WinMgmt.exe
    C:\Program Files\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\Explorer.EXE
    C:\WINNT\system32\ezSP_Px.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Unlocker\UnlockerAssistant.exe
    C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb09.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\WINNT\system32\rundll32.exe
    C:\Program Files\Microsoft Location Finder\LocationFinder.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: (no name) - {bb7eb98f-ef38-45fb-978c-aef95205914e} - C:\WINNT\system32\javemahi.dll (file missing)
    O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINNT\system32\ezSP_Px.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb09.exe
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [3cdee5c4] rundll32.exe "C:\WINNT\system32\nobawitu.dll",b
    O4 - HKLM\..\Run: [yohutupijo] Rundll32.exe "C:\WINNT\system32\kobogana.dll",s
    O4 - HKCU\..\Run: [Microsoft Location Finder] "C:\Program Files\Microsoft Location Finder\LocationFinder.exe"
    O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
    O4 - Startup: Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
    O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
    O15 - Trusted Zone: *.line6.net
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: C:\WINNT\system32\gizoroda.dll
    O20 - Winlogon Notify: avgrsstarter - C:\WINNT\SYSTEM32\avgrsstx.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
    O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
    O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe

    --
    End of file - 5621 bytes

    ComboFix Log:

    ComboFix 09-04-22.02 - Frank Leutheuser 04/21/2009 18:55.1 - NTFSx86
    Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.2047.1654 [GMT -5:00]
    Running from: c:\documents and settings\Frank Leutheuser\Desktop\ComboFix.exe

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\All Users\Application Data\nsv
    c:\documents and settings\All Users\Application Data\nsv\keys.dat
    c:\documents and settings\All Users\Application Data\nsv\wmv0104.dbd
    c:\documents and settings\All Users\Application Data\picsvr
    c:\documents and settings\All Users\Application Data\picsvr\picsvr.inf
    c:\documents and settings\All Users\Application Data\vidmon
    c:\documents and settings\All Users\Application Data\vidmon\vidmon.inf
    c:\documents and settings\Frank Leutheuser\Application Data\GetModule
    c:\documents and settings\Frank Leutheuser\Application Data\GetModule\dicik.gz
    c:\documents and settings\Frank Leutheuser\Application Data\GetModule\kwdik.gz
    c:\documents and settings\Frank Leutheuser\Application Data\GetModule\ofadik.gz
    c:\documents and settings\Frank Leutheuser\Application Data\MCROSO~1.NET
    c:\documents and settings\Frank Leutheuser\Application Data\RACLE~1
    c:\documents and settings\Frank Leutheuser\Application Data\SSEMBL~1
    c:\documents and settings\Frank Leutheuser\Local Settings\Temporary Internet Files\fbk.sts
    c:\documents and settings\Frank Leutheuser\Local Settings\Temporary Internet Files\Ssk.log
    c:\documents and settings\Frank Leutheuser\My Documents\STEM32~1
    C:\lswmv.ini
    c:\program files\\setup.exe
    c:\program files\Common Files\asks~1
    c:\program files\Common Files\fnts~1
    c:\program files\Common Files\mantec~1
    c:\program files\Common Files\sembly~1
    c:\program files\Common Files\wnsxs~1
    c:\program files\Common Files\ymbols~1
    c:\program files\dobe~1
    c:\program files\GetModule
    c:\program files\iCheck
    c:\program files\iCheck\Uninstall.exe
    c:\program files\mantec~1
    c:\program files\smante~1
    c:\winnt\appatc~1
    c:\winnt\pppatc~1
    c:\winnt\racle~1
    c:\winnt\system32\ahorebum.ini
    c:\winnt\system32\appatc~1
    c:\winnt\system32\bfuxkcej.ini
    c:\winnt\system32\dobe~1
    c:\winnt\system32\fnts~1
    c:\winnt\system32\FNVDNXbc.ini
    c:\winnt\system32\FNVDNXbc.ini2
    c:\winnt\system32\irizavet.ini
    c:\winnt\system32\loburako.dll
    c:\winnt\system32\mantec~1
    c:\winnt\system32\mbols~1
    c:\winnt\system32\picsvr
    c:\winnt\system32\pppatc~1
    c:\winnt\system32\rimolodo.dll
    c:\winnt\system32\sembly~1
    c:\winnt\system32\sks~1
    c:\winnt\system32\sstem~1
    c:\winnt\system32\sstem3~1
    c:\winnt\system32\stem~1
    c:\winnt\system32\stem32~1
    c:\winnt\system32\ufawiyen.ini
    c:\winnt\system32\utiwabon.ini
    c:\winnt\system32\vidmon
    c:\winnt\system32\wtsit.exe
    c:\winnt\system32\ymbols~1
    c:\winnt\system32\zip32.dll
    c:\winnt\system32\zugowuva.dll
    c:\winnt\TEMP\_INS0432._MP
    c:\winnt\TEMP\_WUTL95.DLL
    c:\winnt\TEMP\mcu1A7.tmp\McAppIns.exe
    c:\winnt\TEMP\mcu1A7.tmp\mcuninst.dll
    c:\winnt\TEMP\mcu1A7.tmp\UnInst.Dll
    c:\winnt\TEMP\OLD10.tmp
    c:\winnt\TEMP\OLD11.tmp
    c:\winnt\TEMP\OLD12.tmp
    c:\winnt\TEMP\OLD13.tmp
    c:\winnt\TEMP\OLD14.tmp
    c:\winnt\TEMP\OLD15.tmp
    c:\winnt\TEMP\OLD16.tmp
    c:\winnt\TEMP\OLD17.tmp
    c:\winnt\TEMP\OLD19.tmp
    c:\winnt\TEMP\OLD31.tmp
    c:\winnt\TEMP\OLD7A.tmp
    c:\winnt\TEMP\OLD7C.tmp
    c:\winnt\TEMP\OLD80.tmp
    c:\winnt\TEMP\OLD83.tmp
    c:\winnt\TEMP\OLDC.tmp
    c:\winnt\TEMP\OLDD.tmp
    c:\winnt\TEMP\SHFOLDER.DLL
    c:\winnt\Web\default.htt
    c:\winnt\wiaserviv.log

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_MYWEBSEARCHSERVICE
    -------\Legacy_NPF
    -------\Legacy_SVCPROC
    -------\Legacy_ZESOFT


    ((((((((((((((((((((((((( Files Created from 2009-03-22 to 2009-04-22 )))))))))))))))))))))))))))))))
    .

    2009-04-20 22:23 . 2009-04-20 22:23 -------- d-----w c:\program files\ERUNT
    2009-04-15 01:44 . 2009-04-20 03:24 -------- d-----w c:\program files\Incomplete
    2009-04-14 00:08 . 2009-04-06 20:32 15504 ----a-w c:\winnt\system32\drivers\mbam.sys
    2009-04-14 00:08 . 2009-04-06 20:32 38496 ----a-w c:\winnt\system32\drivers\mbamswissarmy.sys
    2009-04-13 23:57 . 2009-04-13 23:57 -------- d-----w c:\documents and settings\Frank Leutheuser\Application Data\uTorrent
    2009-04-03 07:17 . 2009-04-03 07:17 -------- d-----w c:\documents and settings\Frank Leutheuser\Application Data\Sibelius Software
    2009-04-02 07:19 . 2009-04-02 07:19 604 ---ha-w c:\winnt\T4
    2009-04-02 07:19 . 2009-04-02 07:19 604 ---ha-w c:\winnt\system32\T3
    2009-04-02 07:19 . 2009-04-02 07:19 -------- d-----w c:\documents and settings\All Users\Application Data\Sibelius Software
    2009-04-02 07:13 . 2004-02-26 00:19 69632 ----a-w c:\winnt\system32\NI_DFD_1_2_9.dll
    2009-04-02 07:13 . 2009-04-02 07:20 -------- d-----w c:\program files\Native Instruments
    2009-04-02 07:11 . 2009-04-02 07:14 -------- d-----w c:\program files\Sibelius Software
    2009-04-02 04:42 . 2009-04-02 04:42 -------- d-----w C:\PSFONTS
    2009-04-02 04:42 . 2009-04-05 17:14 -------- d-----w c:\program files\Finale SongWriter 2007
    2009-04-01 06:36 . 2009-04-21 23:42 -------- d--h--w C:\$AVG8.VAULT$
    2009-04-01 06:36 . 2008-10-16 20:06 208744 ----a-w c:\winnt\system32\muweb.dll
    2009-04-01 06:23 . 2009-04-01 06:23 10520 ----a-w c:\winnt\system32\avgrsstx.dll
    2009-04-01 06:23 . 2009-04-01 06:23 108552 ----a-w c:\winnt\system32\drivers\avgtdix.sys
    2009-04-01 06:22 . 2009-04-01 06:22 325640 ----a-w c:\winnt\system32\drivers\avgldx86.sys
    2009-04-01 06:22 . 2009-04-21 14:51 -------- d-----w c:\winnt\system32\drivers\Avg
    2009-03-31 04:23 . 2009-04-05 17:15 -------- d-----w c:\program files\Hero Editor
    2009-03-30 23:33 . 2009-04-14 00:33 -------- d-----w c:\program files\Diablo II
    2009-03-30 23:10 . 2009-04-14 01:06 -------- d-----w c:\program files\Diablo
    2009-03-30 16:22 . 2009-03-30 16:22 -------- d-----w c:\program files\7-Zip

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-04-21 23:41 . 2009-01-21 23:41 63488 --sha-w c:\winnt\system32\heravole.exe
    2009-04-21 23:31 . 2008-10-01 12:36 -------- d-----w c:\program files\Mozilla Thunderbird
    2009-04-21 23:26 . 2005-10-12 06:40 -------- d-----w c:\program files\Microsoft AntiSpyware
    2009-04-21 22:47 . 2007-04-02 22:49 -------- d-----w c:\program files\StepMania
    2009-04-21 07:41 . 2009-01-21 07:41 99328 --sha-w c:\winnt\system32\nobawitu.dll
    2009-04-20 23:09 . 2007-08-06 12:23 -------- d-----w c:\program files\Guild Wars
    2009-04-20 19:40 . 2009-01-20 19:40 99328 ------w c:\winnt\system32\neyiwafu.dll
    2009-04-20 12:08 . 2009-03-19 05:41 -------- d-----w c:\documents and settings\Frank Leutheuser\Application Data\FrostWire
    2009-04-19 19:40 . 2009-01-19 19:40 69632 --sha-w c:\winnt\system32\nowupoze.dll
    2009-04-14 00:39 . 2008-01-02 18:49 -------- d-----w c:\program files\DivX
    2009-04-14 00:34 . 2004-08-11 17:46 -------- d--h--w c:\program files\InstallShield Installation Information
    2009-04-14 00:34 . 2009-02-25 00:14 -------- d-----w c:\program files\StepMania CVS
    2009-04-14 00:08 . 2009-02-02 23:19 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
    2009-04-08 05:37 . 2009-02-02 06:08 -------- d---a-w c:\documents and settings\All Users\Application Data\avg8
    2009-04-05 17:15 . 2009-03-19 05:33 -------- d-----w c:\program files\BearShare Applications
    2009-04-05 17:13 . 2008-11-28 17:53 -------- d-----w c:\documents and settings\Frank Leutheuser\Application Data\BitZipper
    2009-04-02 23:19 . 2004-08-28 22:10 21840 ----atw c:\winnt\system32\SIntfNT.dll
    2009-04-02 23:19 . 2004-08-28 22:10 17212 ----atw c:\winnt\system32\SIntf32.dll
    2009-04-02 23:19 . 2004-08-28 22:10 12067 ----atw c:\winnt\system32\SIntf16.dll
    2009-04-02 07:21 . 2004-11-28 02:13 102064 ----a-w c:\documents and settings\Frank Leutheuser\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-04-02 07:19 . 2009-04-02 07:19 604 ---ha-w c:\program files\STLL Notifier
    2009-03-31 04:23 . 2006-11-05 15:07 249856 ------w c:\winnt\Setup1.exe
    2009-03-31 04:23 . 2006-11-05 15:02 73216 ----a-w c:\winnt\ST6UNST.EXE
    2009-03-30 19:32 . 2008-09-23 11:26 -------- d-----w c:\program files\SystemRequirementsLab
    2009-03-30 19:32 . 2008-09-23 11:26 -------- d-----w c:\documents and settings\Frank Leutheuser\Application Data\SystemRequirementsLab
    2009-03-24 03:08 . 2008-07-01 20:27 34 ----a-w c:\documents and settings\Frank Leutheuser\jagex_runescape_preferences.dat
    2009-03-23 05:17 . 2009-03-19 04:04 -------- d-----w c:\documents and settings\Frank Leutheuser\Application Data\Orbit
    2009-03-19 06:27 . 2009-03-19 05:23 -------- d-----w c:\documents and settings\Frank Leutheuser\Application Data\LimeWire
    2009-03-19 05:41 . 2009-03-19 05:23 -------- d-----w c:\program files\LimeWire
    2009-03-19 03:37 . 2007-08-04 22:46 -------- d-----w c:\program files\iTunes
    2009-03-14 03:41 . 2009-03-14 03:41 -------- d-----w c:\program files\Hasbro Interactive
    2009-03-14 03:22 . 2008-12-21 18:27 -------- d-----w c:\program files\Common Files\Blizzard Entertainment
    2009-02-25 05:50 . 2009-02-25 05:50 -------- d-----w c:\documents and settings\Frank Leutheuser\Application Data\NCH Software
    2009-02-25 05:49 . 2009-02-25 05:49 -------- d---a-w c:\documents and settings\All Users\Application Data\NCH Software
    2009-02-25 05:49 . 2009-02-25 05:49 -------- d-----w c:\program files\NCH Software
    2009-02-08 16:16 . 2003-06-20 12:00 1644784 ----a-w c:\winnt\system32\WIN32K.SYS
    2009-02-02 23:14 . 2009-02-02 23:14 294 ----a-w C:\VundoFix.txt
    2009-01-12 20:46 . 2009-01-12 20:46 56912 ----a-w c:\documents and settings\Frank Leutheuser\g2mdlhlpx.exe
    2004-04-08 13:50 . 2004-04-08 13:50 271 ---h--w c:\program files\desktop.ini
    2004-04-08 13:50 . 2004-04-08 13:50 21952 ---h--w c:\program files\folder.htt
    2003-08-20 11:06 . 2003-08-20 11:06 2512896 ----a-w c:\program files\PTEditor17.msi
    2003-08-20 11:05 . 2003-08-20 11:05 41 ----a-w c:\program files\Setup.Ini
    2002-08-27 18:04 . 2007-12-25 19:01 58871 ----a-w c:\program files\viewsonicinstruct_2k.pdf
    2001-09-25 20:05 . 2001-09-25 20:05 1707856 ----a-w c:\program files\InstMsiA.Exe
    2001-09-11 23:04 . 2001-09-11 23:04 1821008 ----a-w c:\program files\InstMsiW.Exe
    2008-11-21 21:2008-11-21 21:45 45:38 . c:\program files\mozilla firefox\plugins\msvcm80.dll
    2008-11-21 21:2008-11-21 21:45 45:40 . c:\program files\mozilla firefox\plugins\msvcp80.dll
    2008-11-21 21:2008-11-21 21:45 45:40 . c:\program files\mozilla firefox\plugins\msvcr80.dll
    2009-01-19 19:40 . 2009-01-19 19:40 69632 --sha-w c:\winnt\system32\gizoroda.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Microsoft Location Finder"="c:\program files\Microsoft Location Finder\LocationFinder.exe" [2005-07-22 101080]
    "Aim6"="c:\program files\AIM6\aim6.exe" [2008-10-31 50480]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-16 68856]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "gcasServ"="c:\program files\Microsoft AntiSpyware\gcasServ.exe" [2005-11-15 473928]
    "ezShieldProtector for Px"="c:\winnt\system32\ezSP_Px.exe" [2002-08-20 40960]
    "NvCplDaemon"="c:\winnt\system32\NvCpl.dll" [2003-11-17 3022848]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-03-04 180269]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-04-27 282624]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-07-28 271672]
    "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
    "UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]
    "HPDJ Taskbar Utility"="c:\winnt\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-05-07 188416]
    "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-04-01 1932568]
    "3cdee5c4"="c:\winnt\system32\nobawitu.dll" [2009-04-21 99328]
    "Synchronization Manager"="mobsync.exe" - c:\winnt\system32\mobsync.exe [2003-06-20 111376]

    c:\documents and settings\Frank Leutheuser\Start Menu\Programs\Startup\
    Greetings Workshop Reminders.lnk - c:\program files\Greetings Workshop\GWREMIND.EXE [1996-6-25 40448]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
    2009-04-01 06:23 10520 ----a-w c:\winnt\system32\avgrsstx.dll

    HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
    "aux"= mmdrv.dll
    "wave1"= serwvdrv.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Notification Packages REG_MULTI_SZ scecli c:\winnt\system32\gizoroda.dll

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
    backup=c:\winnt\pss\Adobe Reader Speed Launch.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
    backup=c:\winnt\pss\America Online 9.0 Tray Icon.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BounceBack Launcher.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\BounceBack Launcher.lnk
    backup=c:\winnt\pss\BounceBack Launcher.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^CAMEDIA Master.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\CAMEDIA Master.lnk
    backup=c:\winnt\pss\CAMEDIA Master.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Forget Me Not.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Forget Me Not.lnk
    backup=c:\winnt\pss\Forget Me Not.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
    backup=c:\winnt\pss\Microsoft Office.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "AOLService"=2 (0x2)
    "AOL ACS"=2 (0x2)

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "UpdatesDisableNotify"=dword:00000001

    R3 GPWADrv;Service for L6 GuitarPort Driver (WDM);c:\winnt\system32\Drivers\GPWADrv.sys [2004-10-25 331776]
    R3 MBAMSwissArmy;MBAMSwissArmy;c:\winnt\system32\drivers\mbamswissarmy.sys [2009-04-06 38496]
    R3 viafilter;VIA USB Filter;c:\winnt\System32\Drivers\viausb.sys [2003-06-18 9038]
    R4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
    S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\winnt\System32\Drivers\avgldx86.sys [2009-04-01 325640]
    S1 AvgTdiX;AVG Free8 Network Redirector;c:\winnt\System32\Drivers\avgtdix.sys [2009-04-01 108552]
    S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-04-01 298264]
    S2 portD;CMS PortIO Service;c:\winnt\system32\DRIVERS\portd2k.sys [2004-02-23 14976]
    S3 L6DP;L6DP;c:\winnt\system32\Drivers\l6dp.sys [2005-12-10 27392]
    S3 usbhub20;USB 2.0 Root Hub Support;c:\winnt\system32\DRIVERS\usbhub20.sys [2003-06-19 49776]


    --- Other Services/Drivers In Memory ---

    *NewlyCreated* - IPNAT
    *NewlyCreated* - RASAUTO
    *NewlyCreated* - SHAREDACCESS
    .
    Contents of the 'Scheduled Tasks' folder

    2009-04-19 c:\winnt\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 20:57]
    .
    - - - - ORPHANS REMOVED - - - -

    BHO-{bb7eb98f-ef38-45fb-978c-aef95205914e} - c:\winnt\system32\javemahi.dll
    WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - c:\program files\AskBarDis\bar\bin\askBar.dll
    HKLM-Run-yohutupijo - c:\winnt\system32\kobogana.dll


    .
    ------- Supplementary Scan -------
    .
    mSearch Bar =
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    IE: &AIM Search - c:\program files\AIM Toolbar\AIMBar.dll/aimsearch.htm
    IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
    LSP: %SystemRoot%\system32\msafd.dll
    Trusted Zone: line6.net
    FF - ProfilePath - c:\documents and settings\Frank Leutheuser\Application Data\Mozilla\Firefox\Profiles\r9mw7ztk.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/firefox
    FF - plugin: c:\documents and settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npaxctrl.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npitunes.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npracplug.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
    FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
    FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

    ---- FIREFOX POLICIES ----
    c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDFE0BD779-44EE-4A4B-AA2E-743C63F2E5E6", "AllAccess");
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-04-21 19:05
    Windows 5.0.2195 Service Pack 4 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    c:\winnt\system32\utiwabon.ini 1399323 bytes


    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(236)
    c:\winnt\system32\wzcdlg.dll
    c:\winnt\system32\WZCSAPI.DLL

    - - - - - - - > 'lsass.exe'(276)
    c:\winnt\system32\gizoroda.dll

    - - - - - - - > 'explorer.exe'(2080)
    c:\winnt\AppPatch\AcLayers.DLL
    c:\program files\Unlocker\UnlockerHook.dll
    c:\winnt\system32\nobawitu.dll
    c:\winnt\system32\gizoroda.dll
    c:\winnt\system32\SHDOCVW.DLL
    .
    Completion time: 2009-04-22 19:12 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-04-22 00:10

    Pre-Run: 37,527,175,168 bytes free
    Post-Run: 38,333,521,920 bytes free

    306 --- E O F --- 2009-04-01 09:03

  8. #8
    In Memoriam -Always in our heart pskelley's Avatar
    Join Date
    Oct 2005
    Location
    Clearwater, Florida
    Posts
    20,252

    Default

    See this posted information:
    File Sharing, otherwise known as Peer To Peer. (P2P)
    http://forums.spybot.info/showthread.php?t=282
    If your helper detects the presence of such programs on your computer he/she will ask you to remove them. Help will be withdrawn should you not agree to their removal.
    Follow these directions carefully and in the numbered order.

    1) Please download ATF Cleaner by Atribune
    http://www.atribune.org/public-beta/ATF-Cleaner.exe
    Save it to your Desktop. We will use this later.

    2) Open notepad and copy/paste the text in the codebox below into it:

    Code:
    File::
    C:\VundoFix.txt
    C:\WINNT\system32\nobawitu.dll
    C:\WINNT\system32\kobogana.dll
    C:\WINNT\system32\gizoroda.dll
    c:\winnt\system32\heravole.exe
    c:\winnt\system32\neyiwafu.dll
    c:\winnt\system32\nowupoze.dll
    
    Registry::
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=-
    
    Folder::
    c:\program files\LimeWire
    c:\program files\Microsoft AntiSpyware
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire
    c:\documents and settings\Frank Leutheuser\Application Data\uTorrent
    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire
    c:\program files\BearShare Applications
    Save this as CFScript



    Referring to the picture above, drag CFScript into ComboFix.exe.

    This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log. (wait until you finish to post the logs)

    3) Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

    O2 - BHO: (no name) - {bb7eb98f-ef38-45fb-978c-aef95205914e} - C:\WINNT\system32\javemahi.dll (file missing)
    O4 - HKLM\..\Run: [3cdee5c4] rundll32.exe "C:\WINNT\system32\nobawitu.dll",b
    O4 - HKLM\..\Run: [yohutupijo] Rundll32.exe "C:\WINNT\system32\kobogana.dll",s
    O15 - Trusted Zone: *.line6.net
    O20 - AppInit_DLLs: C:\WINNT\system32\gizoroda.dll

    Close all programs but HJT and all browser windows, then click on "Fix Checked"

    4) Run ATF Cleaner
    Double-click ATF-Cleaner.exe to run the program.
    Click Select All found at the bottom of the list.
    Click the Empty Selected button.
    Click Exit on the Main menu to close the program.

    *Cleaning Prefetch may result in a few slow starts until the folder is repopulated:
    http://www.windowsnetworking.com/art...efetch-XP.html

    (if you still have MBAM, no need to download it again, but make sure you update and run it as instructed)

    5) Download Malwarebytes' Anti-Malware to your Desktop
    http://www.malwarebytes.org/

    * Double-click mbam-setup.exe and follow the prompts to install the program.
    * Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select Perform FULL SCAN, then click Scan.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Be sure that everything is checked, and click Remove Selected.
    * When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt
    * Please post the log from CFScript, the log from MBAM and a new HJT log.

    Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

    Tutorial if needed:
    http://www.techsupportteam.org/forum...ware-mbam.html

    How is the computer running?

    Thanks
    MS-MVP Consumer Security 2007-08-09
    Proud Member ASAP
    UNITE Member 2006

  9. #9
    Junior Member
    Join Date
    Apr 2009
    Posts
    20

    Default

    O20 - AppInit_DLLs: C:\WINNT\system32\gizoroda.dll
    That file didn't appear in the HJT scan so I obviously couldn't check the box, but I guess that means it's gone anyways.

    HJT log wouldn't fit so I'll doublepost I guess.

    Computer seems to be running good! No pop-ups lately, thanks for the help so far!!

    MBAM Log:

    Malwarebytes' Anti-Malware 1.36
    Database version: 2028
    Windows 5.0.2195 Service Pack 4

    4/22/2009 6:23:17 PM
    mbam-log-2009-04-22 (18-23-17).txt

    Scan type: Full Scan (C:\|)
    Objects scanned: 172785
    Time elapsed: 42 minute(s), 45 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 3
    Registry Values Infected: 0
    Registry Data Items Infected: 1
    Folders Infected: 1
    Files Infected: 6

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Error Nuker (Rogue.ErrorNuker) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWay) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Folders Infected:
    C:\Documents and Settings\Frank Leutheuser\Application Data\cogad (Trojan.Agent) -> Quarantined and deleted successfully.

    Files Infected:
    C:\WINNT\system32\jebojope.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINNT\system32\epojobej.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINNT\system32\heravole.exe.vir (Trojan.Vundo.V) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINNT\system32\loburako.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINNT\system32\neyiwafu.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINNT\system32\zugowuva.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.

    ComboFix CFScript Log:

    ComboFix 09-04-23.02 - Frank Leutheuser 04/22/2009 17:16.2 - NTFSx86
    Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.2047.1678 [GMT -5:00]
    Running from: c:\documents and settings\Frank Leutheuser\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Frank Leutheuser\Desktop\CFScript.txt

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE ::
    C:\VundoFix.txt
    c:\winnt\system32\gizoroda.dll
    c:\winnt\system32\heravole.exe
    c:\winnt\system32\kobogana.dll
    c:\winnt\system32\neyiwafu.dll
    c:\winnt\system32\nobawitu.dll
    c:\winnt\system32\nowupoze.dll
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire
    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire\.AppSpecialShare\Lil Wayne - Da Drought 3 - CD 1(Bootleg)2007.torrent
    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire\.AppSpecialShare\The_Empire_And_Lil_Wayne-The_Drought_Is_Over_Pt._6_(The_Reincarnation)-2008-MIXFIEND.torrent
    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire\.AppSpecialShare\The_Empire_And_Lil_Wayne-The_Drought_Is_Over_Pt._6_(The_Reincarnation)-2008-MIXFIEND.torrent.bak
    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire\.NetworkShare\Incomplete\T-4506256-LimeWireWin4.16.6.exe
    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire\checkandupdate.txt
    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire\createtimes.cache
    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire\downloads.dat
    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire\fileurns.bak
    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire\fileurns.cache
    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire\filters.props
    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire\frostwire.props
    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire\gnutella.net
    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire\installation.props
    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire\intent.props
    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire\library.dat
    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire\mojito.props
    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire\questions.props
    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire\responses.cache
    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire\simpp.xml
    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire\spam.dat
    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire\tables.props
    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire\themes\frostwirePro_theme.fwtp
    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire\themes\frostwirePro_theme\theme.txt
    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire\themes\frostwirePro_theme\version.txt
    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire\ttrees.cache
    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire\ttroot.cache
    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire\version.xml
    c:\documents and settings\Frank Leutheuser\Application Data\FrostWire\xml\data\audio.sxml2
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xul-v2.0b2.4-do-not-remove
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\AccessibleMarshal.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\chrome\branding.jar
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\chrome\branding.manifest
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\chrome\classic.jar
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\chrome\classic.manifest
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\chrome\comm.jar
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\chrome\comm.manifest
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\chrome\en-US.jar
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\chrome\en-US.manifest
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\chrome\limewire.jar
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\chrome\limewire.manifest
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\chrome\pippki.jar
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\chrome\pippki.manifest
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\chrome\toolkit.jar
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\chrome\toolkit.manifest
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\accessibility-msaa.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\accessibility.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\alerts.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\appshell.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\appshell_modal.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\appshell_modal.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\appstartup.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\auth.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\autocomplete.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\autoconfig.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\autoconfig.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\caps.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\chardet.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\chrome.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\commandhandler.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\commandlines.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\composer.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\content_base.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\content_html.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\content_htmldoc.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\content_xmldoc.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\content_xslt.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\content_xtf.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\contentprefs.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\cookie.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\directory.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\docshell_base.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\dom.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\dom_base.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\dom_canvas.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\dom_core.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\dom_css.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\dom_events.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\dom_html.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\dom_json.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\dom_loadsave.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\dom_offline.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\dom_range.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\dom_sidebar.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\dom_storage.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\dom_stylesheets.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\dom_svg.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\dom_traversal.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\dom_views.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\dom_xbl.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\dom_xpath.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\dom_xul.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\downloads.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\editor.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\embed_base.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\extensions.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\exthandler.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\exthelper.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\fastfind.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\FeedProcessor.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\feeds.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\find.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\gfx.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\htmlparser.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\imgicon.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\imglib2.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\inspector.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\intl.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\jar.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\jsconsole-clhandler.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\jsdservice.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\layout_base.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\layout_printing.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\layout_xul.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\layout_xul_tree.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\locale.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\loginmgr.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\lwbrk.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\mimetype.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\mozbrwsr.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\mozfind.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\necko.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\necko_about.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\necko_cache.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\necko_cookie.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\necko_dns.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\necko_file.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\necko_ftp.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\necko_http.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\necko_res.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\necko_socket.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\necko_strconv.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\necko_viewsource.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\nsAddonRepository.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\nsBadCertHandler.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\nsBlocklistService.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\nsContentDispatchChooser.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\nsContentPrefService.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\nsDefaultCLH.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\nsDictionary.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\nsDownloadManagerUI.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\nsExtensionManager.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\nsHandlerService.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\nsHelperAppDlg.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\nsLivemarkService.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\nsLoginInfo.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\nsLoginManager.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\nsLoginManagerPrompter.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\nsPostUpdateWin.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\nsProgressDialog.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\nsProxyAutoConfig.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\nsResetPref.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\nsTaggingService.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\nsTryToClose.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\nsUpdateService.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\nsURLFormatter.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\nsWebHandlerApp.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\nsXmlRpcClient.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\nsXULAppInstall.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\oji.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\parentalcontrols.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\pipboot.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\pipboot.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\pipnss.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\pipnss.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\pippki.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\pippki.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\places.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\plugin.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\pluginGlue.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\pref.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\prefetch.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\profile.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\proxyObject.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\rdf.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\satchel.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\saxparser.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\shistory.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\spellchecker.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\storage-Legacy.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\storage.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\toolkitprofile.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\transformiix.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\txEXSLTRegExFunctions.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\txmgr.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\txtsvc.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\uconv.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\unicharutil.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\universalchardet.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\update.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\uriloader.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\urlformatter.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\webBrowser_core.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\webbrowserpersist.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\webshell_idls.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\websrvcs.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\widget.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\windowds.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\windowwatcher.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\xml-rpc.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\xmlextras.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\xpcom_base.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\xpcom_components.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\xpcom_ds.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\xpcom_io.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\xpcom_system.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\xpcom_thread.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\xpcom_xpti.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\xpconnect.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\xpinstall.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\xulapp.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\xulapp_setup.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\xuldoc.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\xultmpl.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\xulutil.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\components\zipwriter.xpt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\crashreporter.exe
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\crashreporter.ini
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\defaults\autoconfig\platform.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\defaults\autoconfig\prefcalls.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\defaults\pref\xulrunner.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\defaults\profile\chrome\userChrome-example.css
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\defaults\profile\chrome\userContent-example.css
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\defaults\profile\localstore.rdf
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\defaults\profile\US\chrome\userChrome-example.css
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\defaults\profile\US\chrome\userContent-example.css
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\defaults\profile\US\localstore.rdf
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\dependentlibs.list
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\dictionaries\en-US.aff
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\dictionaries\en-US.dic
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\freebl3.chk
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\freebl3.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\greprefs\all.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\greprefs\security-prefs.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\greprefs\xpinstall.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\IA2Marshal.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\javaxpcom.jar
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\javaxpcomglue.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\js3250.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\LICENSE
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\modules\debug.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\modules\DownloadUtils.jsm
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\modules\ISO8601DateUtils.jsm
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\modules\JSON.jsm
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\modules\Microformats.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\modules\PluralForm.jsm
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\modules\utils.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\modules\XPCOMUtils.jsm
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\mozctl.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\mozctlx.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\MSVCP71.DLL
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\msvcr71.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\nspr4.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\nss3.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\nssckbi.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\nssdbm3.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\nssutil3.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\platform.ini
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\plc4.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\plds4.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\plugins\npnul32.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\README.txt
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\arrow.gif
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\arrowd.gif
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\broken-image.gif
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\charsetalias.properties
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\charsetData.properties
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\contenteditable.css
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\designmode.css
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\dtd\mathml.dtd
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\dtd\xhtml11.dtd
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\EditorOverride.css
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\entityTables\html40Latin1.properties
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\entityTables\html40Special.properties
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\entityTables\html40Symbols.properties
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\entityTables\htmlEntityVersions.properties
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\entityTables\mathml20.properties
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\entityTables\transliterate.properties
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfont.properties
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontStandardSymbolsL.properties
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontSTIXNonUnicode.properties
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontSTIXSize1.properties
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontSymbol.properties
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontUnicode.properties
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\forms.css
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\grabber.gif
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\hiddenWindow.html
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\html.css
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\html\folder.png
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\langGroups.properties
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\language.properties
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\loading-image.gif
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\mathml.css
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\quirk.css
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\svg.css
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\table-add-column-after-active.gif
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\table-add-column-after-hover.gif
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\table-add-column-after.gif
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\table-add-column-before-active.gif
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\table-add-column-before-hover.gif
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\table-add-column-before.gif
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\table-add-row-after-active.gif
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\table-add-row-after-hover.gif
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\table-add-row-after.gif
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\table-add-row-before-active.gif
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\table-add-row-before-hover.gif
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\table-add-row-before.gif
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\table-remove-column-active.gif
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\table-remove-column-hover.gif
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\table-remove-column.gif
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\table-remove-row-active.gif
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\table-remove-row-hover.gif
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\table-remove-row.gif
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\ua.css
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\viewsource.css
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\res\wincharset.properties
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\smime3.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\softokn3.chk
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\softokn3.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\sqlite3.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\ssl3.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\updater.exe
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\version.properties
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\xpcom.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\xpcshell.exe
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\xpicleanup.exe
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\xpidl.exe
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\xpt_dump.exe
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\xpt_link.exe
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\xul.dll
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\xulrunner-stub.exe
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\browser\xulrunner\xulrunner.exe
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\createtimes.cache
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\downloads.dat
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\gnutella.net
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\installation.props
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\library.dat
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\library5.dat
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\limewire.props
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\mojito.props
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\mozilla-profile\.autoreg
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\mozilla-profile\Cache\_CACHE_001_
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\mozilla-profile\Cache\_CACHE_002_
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\mozilla-profile\Cache\_CACHE_003_
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\mozilla-profile\Cache\_CACHE_MAP_
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\mozilla-profile\Cache\3816C1E5d01
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\mozilla-profile\Cache\757EA3CAd01
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\mozilla-profile\Cache\7BD6A121d01
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\mozilla-profile\Cache\AE98BDF8d01
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\mozilla-profile\Cache\B09EF8CDd01
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\mozilla-profile\Cache\BAFF9A99d01
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\mozilla-profile\cert8.db
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\mozilla-profile\compreg.dat
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\mozilla-profile\cookies.sqlite
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\mozilla-profile\downloads.sqlite
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\mozilla-profile\extensions.cache
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\mozilla-profile\extensions.ini
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\mozilla-profile\history.dat
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\mozilla-profile\key3.db
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\mozilla-profile\permissions.sqlite
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\mozilla-profile\places.sqlite-journal
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\mozilla-profile\places.sqlite
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\mozilla-profile\pluginreg.dat
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\mozilla-profile\prefs.js
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\mozilla-profile\secmod.db
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\mozilla-profile\XPC.mfl
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\mozilla-profile\xpti.dat
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\promotion\promodb.properties
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\promotion\promodb.script
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\questions.props
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\responses.cache
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\spam.dat
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\tables.props
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\version.xml
    c:\documents and settings\Frank Leutheuser\Application Data\LimeWire\versions.props
    c:\documents and settings\Frank Leutheuser\Application Data\uTorrent
    c:\documents and settings\Frank Leutheuser\Application Data\uTorrent\dht.dat
    c:\documents and settings\Frank Leutheuser\Application Data\uTorrent\resume.dat
    c:\documents and settings\Frank Leutheuser\Application Data\uTorrent\rss.dat
    c:\documents and settings\Frank Leutheuser\Application Data\uTorrent\settings.dat
    c:\program files\BearShare Applications
    c:\program files\LimeWire
    c:\program files\LimeWire\.NetworkShare\LimeWireWin5.1.2.exe
    c:\program files\LimeWire\lib\additional_resources.jar
    c:\program files\LimeWire\lib\aopalliance.jar
    c:\program files\LimeWire\lib\AppFramework.jar
    c:\program files\LimeWire\lib\base64-2.2.2.jar
    c:\program files\LimeWire\lib\clink.jar
    c:\program files\LimeWire\lib\commons-codec-1.3.jar
    c:\program files\LimeWire\lib\commons-logging.jar
    c:\program files\LimeWire\lib\commons-math-1.2.jar
    c:\program files\LimeWire\lib\daap.jar
    c:\program files\LimeWire\lib\dnsjava-2.0.6.jar
    c:\program files\LimeWire\lib\EventBus-1.2b.jar
    c:\program files\LimeWire\lib\gettext-commons.jar
    c:\program files\LimeWire\lib\glazedlists-1.7.0_java15.jar
    c:\program files\LimeWire\lib\guice-assistedinject-snapshot.jar
    c:\program files\LimeWire\lib\guice-snapshot.jar
    c:\program files\LimeWire\lib\hsqldb.jar
    c:\program files\LimeWire\lib\httpclient-4.0-beta1.jar
    c:\program files\LimeWire\lib\httpcore-4.0-beta2.jar
    c:\program files\LimeWire\lib\httpcore-nio-4.0-beta2.jar
    c:\program files\LimeWire\lib\icu4j.jar
    c:\program files\LimeWire\lib\iTunes-0.0.1.jar
    c:\program files\LimeWire\lib\jacob-1.14.1.jar
    c:\program files\LimeWire\lib\jaudiotagger.jar
    c:\program files\LimeWire\lib\jcip-annotations.jar
    c:\program files\LimeWire\lib\jcraft.jar
    c:\program files\LimeWire\lib\jdic.dll
    c:\program files\LimeWire\lib\jdic.jar
    c:\program files\LimeWire\lib\jdic_stub.jar
    c:\program files\LimeWire\lib\jflac.jar
    c:\program files\LimeWire\lib\jl.jar
    c:\program files\LimeWire\lib\jmdns.jar
    c:\program files\LimeWire\lib\jna.jar
    c:\program files\LimeWire\lib\jogg.jar
    c:\program files\LimeWire\lib\jorbis.jar
    c:\program files\LimeWire\lib\jxlayer.jar
    c:\program files\LimeWire\lib\LimeWire.jar
    c:\program files\LimeWire\lib\log4j.jar
    c:\program files\LimeWire\lib\messages.jar
    c:\program files\LimeWire\lib\miglayout.jar
    c:\program files\LimeWire\lib\mozdom4java.jar
    c:\program files\LimeWire\lib\MozillaGlue-1.9.jar
    c:\program files\LimeWire\lib\MozillaInterfaces-1.9.jar
    c:\program files\LimeWire\lib\mozswing.jar
    c:\program files\LimeWire\lib\mp3spi.jar
    c:\program files\LimeWire\lib\onion-common.jar
    c:\program files\LimeWire\lib\onion-fec.jar
    c:\program files\LimeWire\lib\smack.jar
    c:\program files\LimeWire\lib\smackx-debug.jar
    c:\program files\LimeWire\lib\smackx.jar
    c:\program files\LimeWire\lib\swing-worker-1.1.jar
    c:\program files\LimeWire\lib\swingx-0.9.4.jar
    c:\program files\LimeWire\lib\SystemUtilities.dll
    c:\program files\LimeWire\lib\tritonus.jar
    c:\program files\LimeWire\lib\vorbisspi.jar
    c:\program files\LimeWire\LimeWire.exe
    c:\program files\Microsoft AntiSpyware
    c:\program files\Microsoft AntiSpyware\cleaner.log
    c:\program files\Microsoft AntiSpyware\DeactivatedItems\D47A5B23-2FE6-4E95-92C5-41E1E7.asq
    c:\program files\Microsoft AntiSpyware\errors.log
    c:\program files\Microsoft AntiSpyware\gcAgentsData.gcd
    c:\program files\Microsoft AntiSpyware\gcAgentsDataStoreData.gcd
    c:\program files\Microsoft AntiSpyware\gcDeterminationDataUser.gcd
    c:\program files\Microsoft AntiSpyware\gcEventsData.gcd
    c:\program files\Microsoft AntiSpyware\gcExplorersData.gcd
    c:\program files\Microsoft AntiSpyware\gcThreatAuditIgnoredThreatsData.gcd
    c:\program files\Microsoft AntiSpyware\gcThreatAuditQuarantineData.gcd
    c:\program files\Microsoft AntiSpyware\gcThreatAuditScanHistoryData.gcd
    c:\program files\Microsoft AntiSpyware\gcThreatAuditSettingsData.gcd
    c:\program files\Microsoft AntiSpyware\gcUserData.gcd
    c:\program files\Microsoft AntiSpyware\softwareupdates.log
    c:\program files\Microsoft AntiSpyware\TempUpdates\microsoftantispywareinstall.exe
    c:\program files\Microsoft AntiSpyware\TempUpdates\windowsdefender.exe
    C:\VundoFix.txt
    c:\winnt\system32\heravole.exe
    c:\winnt\system32\neyiwafu.dll
    c:\winnt\system32\nowupoze.dll

    .
    ((((((((((((((((((((((((( Files Created from 2009-03-22 to 2009-04-22 )))))))))))))))))))))))))))))))
    .

    2009-04-22 11:42 . 2009-04-22 12:03 1408555 --sh--w c:\winnt\system32\epojobej.ini
    2009-04-22 00:43 . 2009-04-22 12:09 -------- d-----w c:\program files\Mozilla Sunbird
    2009-04-22 00:27 . 2009-04-22 00:27 -------- d-----w c:\program files\Secunia
    2009-04-22 00:17 . 2009-04-22 00:17 -------- d-----w c:\documents and settings\Frank Leutheuser\Application Data\Foxit
    2009-04-22 00:17 . 2009-04-22 00:17 -------- d-----w c:\program files\Foxit Software
    2009-04-22 00:06 . 2009-04-22 00:34 1399336 --sh--w c:\winnt\system32\utiwabon.ini
    2009-04-20 22:23 . 2009-04-20 22:23 -------- d-----w c:\program files\ERUNT
    2009-04-15 01:44 . 2009-04-20 03:24 -------- d-----w c:\program files\Incomplete
    2009-04-14 00:08 . 2009-04-06 20:32 15504 ----a-w c:\winnt\system32\drivers\mbam.sys
    2009-04-14 00:08 . 2009-04-06 20:32 38496 ----a-w c:\winnt\system32\drivers\mbamswissarmy.sys
    2009-04-03 07:17 . 2009-04-03 07:17 -------- d-----w c:\documents and settings\Frank Leutheuser\Application Data\Sibelius Software
    2009-04-02 07:19 . 2009-04-02 07:19 604 ---ha-w c:\winnt\T4
    2009-04-02 07:19 . 2009-04-02 07:19 604 ---ha-w c:\winnt\system32\T3
    2009-04-02 07:19 . 2009-04-02 07:19 -------- d-----w c:\documents and settings\All Users\Application Data\Sibelius Software
    2009-04-02 07:13 . 2004-02-26 00:19 69632 ----a-w c:\winnt\system32\NI_DFD_1_2_9.dll
    2009-04-02 07:13 . 2009-04-02 07:20 -------- d-----w c:\program files\Native Instruments
    2009-04-02 07:11 . 2009-04-02 07:14 -------- d-----w c:\program files\Sibelius Software
    2009-04-02 04:42 . 2009-04-02 04:42 -------- d-----w C:\PSFONTS
    2009-04-02 04:42 . 2009-04-05 17:14 -------- d-----w c:\program files\Finale SongWriter 2007
    2009-04-01 06:36 . 2009-04-22 22:09 -------- d--h--w C:\$AVG8.VAULT$
    2009-04-01 06:36 . 2008-10-16 20:06 208744 ----a-w c:\winnt\system32\muweb.dll
    2009-04-01 06:23 . 2009-04-01 06:23 10520 ----a-w c:\winnt\system32\avgrsstx.dll
    2009-04-01 06:23 . 2009-04-01 06:23 108552 ----a-w c:\winnt\system32\drivers\avgtdix.sys
    2009-04-01 06:22 . 2009-04-01 06:22 325640 ----a-w c:\winnt\system32\drivers\avgldx86.sys
    2009-04-01 06:22 . 2009-04-22 22:12 -------- d-----w c:\winnt\system32\drivers\Avg
    2009-03-31 04:23 . 2009-04-05 17:15 -------- d-----w c:\program files\Hero Editor
    2009-03-30 23:33 . 2009-04-14 00:33 -------- d-----w c:\program files\Diablo II
    2009-03-30 23:10 . 2009-04-14 01:06 -------- d-----w c:\program files\Diablo
    2009-03-30 16:22 . 2009-03-30 16:22 -------- d-----w c:\program files\7-Zip
    2009-03-24 11:03 . 2009-03-24 11:03 7808 ----a-w c:\winnt\system32\drivers\psi_mf.sys

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-04-22 22:08 . 2009-02-02 06:08 -------- d---a-w c:\documents and settings\All Users\Application Data\avg8
    2009-04-22 22:08 . 2008-10-01 12:36 -------- d-----w c:\program files\Mozilla Thunderbird
    2009-04-22 11:42 . 2009-01-22 11:42 101376 --sha-w c:\winnt\system32\jebojope.dll
    2009-04-22 11:42 . 2009-01-22 11:42 62976 --sha-w c:\winnt\system32\kerodaru.exe
    2009-04-22 00:21 . 2004-09-15 00:11 -------- d---a-w c:\documents and settings\All Users\Application Data\Viewpoint
    2009-04-22 00:21 . 2004-09-15 00:11 -------- d-----w c:\program files\Viewpoint
    2009-04-22 00:20 . 2004-09-20 01:55 -------- d-----w c:\program files\Java
    2009-04-21 22:47 . 2007-04-02 22:49 -------- d-----w c:\program files\StepMania
    2009-04-20 23:09 . 2007-08-06 12:23 -------- d-----w c:\program files\Guild Wars
    2009-04-14 00:39 . 2008-01-02 18:49 -------- d-----w c:\program files\DivX
    2009-04-14 00:34 . 2004-08-11 17:46 -------- d--h--w c:\program files\InstallShield Installation Information
    2009-04-14 00:34 . 2009-02-25 00:14 -------- d-----w c:\program files\StepMania CVS
    2009-04-14 00:08 . 2009-02-02 23:19 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
    2009-04-05 17:13 . 2008-11-28 17:53 -------- d-----w c:\documents and settings\Frank Leutheuser\Application Data\BitZipper
    2009-04-02 23:19 . 2004-08-28 22:10 21840 ----atw c:\winnt\system32\SIntfNT.dll
    2009-04-02 23:19 . 2004-08-28 22:10 17212 ----atw c:\winnt\system32\SIntf32.dll
    2009-04-02 23:19 . 2004-08-28 22:10 12067 ----atw c:\winnt\system32\SIntf16.dll
    2009-04-02 07:21 . 2004-11-28 02:13 102064 ----a-w c:\documents and settings\Frank Leutheuser\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-04-02 07:19 . 2009-04-02 07:19 604 ---ha-w c:\program files\STLL Notifier
    2009-03-31 04:23 . 2006-11-05 15:07 249856 ------w c:\winnt\Setup1.exe
    2009-03-31 04:23 . 2006-11-05 15:02 73216 ----a-w c:\winnt\ST6UNST.EXE
    2009-03-30 19:32 . 2008-09-23 11:26 -------- d-----w c:\program files\SystemRequirementsLab
    2009-03-30 19:32 . 2008-09-23 11:26 -------- d-----w c:\documents and settings\Frank Leutheuser\Application Data\SystemRequirementsLab
    2009-03-24 03:08 . 2008-07-01 20:27 34 ----a-w c:\documents and settings\Frank Leutheuser\jagex_runescape_preferences.dat
    2009-03-23 05:17 . 2009-03-19 04:04 -------- d-----w c:\documents and settings\Frank Leutheuser\Application Data\Orbit
    2009-03-19 03:37 . 2007-08-04 22:46 -------- d-----w c:\program files\iTunes
    2009-03-14 03:41 . 2009-03-14 03:41 -------- d-----w c:\program files\Hasbro Interactive
    2009-03-14 03:22 . 2008-12-21 18:27 -------- d-----w c:\program files\Common Files\Blizzard Entertainment
    2009-02-25 05:50 . 2009-02-25 05:50 -------- d-----w c:\documents and settings\Frank Leutheuser\Application Data\NCH Software
    2009-02-25 05:49 . 2009-02-25 05:49 -------- d---a-w c:\documents and settings\All Users\Application Data\NCH Software
    2009-02-25 05:49 . 2009-02-25 05:49 -------- d-----w c:\program files\NCH Software
    2009-02-08 16:16 . 2003-06-20 12:00 1644784 ----a-w c:\winnt\system32\WIN32K.SYS
    2009-01-12 20:46 . 2009-01-12 20:46 56912 ----a-w c:\documents and settings\Frank Leutheuser\g2mdlhlpx.exe
    2004-04-08 13:50 . 2004-04-08 13:50 271 ---h--w c:\program files\desktop.ini
    2004-04-08 13:50 . 2004-04-08 13:50 21952 ---h--w c:\program files\folder.htt
    2003-08-20 11:06 . 2003-08-20 11:06 2512896 ----a-w c:\program files\PTEditor17.msi
    2003-08-20 11:05 . 2003-08-20 11:05 41 ----a-w c:\program files\Setup.Ini
    2002-08-27 18:04 . 2007-12-25 19:01 58871 ----a-w c:\program files\viewsonicinstruct_2k.pdf
    2001-09-25 20:05 . 2001-09-25 20:05 1707856 ----a-w c:\program files\InstMsiA.Exe
    2001-09-11 23:04 . 2001-09-11 23:04 1821008 ----a-w c:\program files\InstMsiW.Exe
    2008-11-21 21:2008-11-21 21:45 45:38 . c:\program files\mozilla firefox\plugins\msvcm80.dll
    2008-11-21 21:2008-11-21 21:45 45:40 . c:\program files\mozilla firefox\plugins\msvcp80.dll
    2008-11-21 21:2008-11-21 21:45 45:40 . c:\program files\mozilla firefox\plugins\msvcr80.dll
    .

    ((((((((((((((((((((((((((((( SnapShot@2009-04-22_00.05.53 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2007-05-29 15:31 . 2009-04-22 00:15 84661 c:\winnt\system32\Macromed\Flash\uninstall_plugin.exe
    + 2009-02-03 02:15 . 2009-02-03 02:15 240544 c:\winnt\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
    + 2009-02-03 02:15 . 2009-02-03 02:15 3771296 c:\winnt\system32\Macromed\Flash\NPSWF32.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bb7eb98f-ef38-45fb-978c-aef95205914e}]
    c:\winnt\system32\javemahi.dll [BU]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Microsoft Location Finder"="c:\program files\Microsoft Location Finder\LocationFinder.exe" [2005-07-22 101080]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-16 68856]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ezShieldProtector for Px"="c:\winnt\system32\ezSP_Px.exe" [2002-08-20 40960]
    "NvCplDaemon"="c:\winnt\system32\NvCpl.dll" [2003-11-17 3022848]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-03-04 180269]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-04-27 282624]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-07-28 271672]
    "UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]
    "HPDJ Taskbar Utility"="c:\winnt\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-05-07 188416]
    "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-04-01 1932568]
    "yohutupijo"="c:\winnt\system32\kobogana.dll" [BU]
    "3cdee5c4"="c:\winnt\system32\jebojope.dll" [2009-04-22 101376]
    "Synchronization Manager"="mobsync.exe" - c:\winnt\system32\mobsync.exe [2003-06-20 111376]

    c:\documents and settings\Frank Leutheuser\Start Menu\Programs\Startup\
    Greetings Workshop Reminders.lnk - c:\program files\Greetings Workshop\GWREMIND.EXE [1996-6-25 40448]
    Secunia PSI.lnk - c:\program files\Secunia\PSI\psi.exe [2009-3-24 748840]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
    2009-04-01 06:23 10520 ----a-w c:\winnt\system32\avgrsstx.dll

    HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
    "aux"= mmdrv.dll
    "wave1"= serwvdrv.dll

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
    backup=c:\winnt\pss\Adobe Reader Speed Launch.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
    backup=c:\winnt\pss\America Online 9.0 Tray Icon.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BounceBack Launcher.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\BounceBack Launcher.lnk
    backup=c:\winnt\pss\BounceBack Launcher.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^CAMEDIA Master.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\CAMEDIA Master.lnk
    backup=c:\winnt\pss\CAMEDIA Master.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Forget Me Not.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Forget Me Not.lnk
    backup=c:\winnt\pss\Forget Me Not.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
    backup=c:\winnt\pss\Microsoft Office.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "AOLService"=2 (0x2)
    "AOL ACS"=2 (0x2)

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "UpdatesDisableNotify"=dword:00000001

    R3 GPWADrv;Service for L6 GuitarPort Driver (WDM);c:\winnt\system32\Drivers\GPWADrv.sys [2004-10-25 331776]
    R3 MBAMSwissArmy;MBAMSwissArmy;c:\winnt\system32\drivers\mbamswissarmy.sys [2009-04-06 38496]
    R3 PSI;PSI;c:\winnt\system32\DRIVERS\psi_mf.sys [2009-03-24 7808]
    R3 viafilter;VIA USB Filter;c:\winnt\System32\Drivers\viausb.sys [2003-06-18 9038]
    R4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
    S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\winnt\System32\Drivers\avgldx86.sys [2009-04-01 325640]
    S1 AvgTdiX;AVG Free8 Network Redirector;c:\winnt\System32\Drivers\avgtdix.sys [2009-04-01 108552]
    S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-04-01 298264]
    S2 portD;CMS PortIO Service;c:\winnt\system32\DRIVERS\portd2k.sys [2004-02-23 14976]
    S3 L6DP;L6DP;c:\winnt\system32\Drivers\l6dp.sys [2005-12-10 27392]
    S3 usbhub20;USB 2.0 Root Hub Support;c:\winnt\system32\DRIVERS\usbhub20.sys [2003-06-19 49776]

    .
    Contents of the 'Scheduled Tasks' folder

    2009-04-19 c:\winnt\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 20:57]
    .
    - - - - ORPHANS REMOVED - - - -

    HKCU-Run-Aim6 - (no file)
    HKLM-Run-CPM3fedd658 - c:\winnt\system32\huwulita.dll


    .
    ------- Supplementary Scan -------
    .
    mSearch Bar =
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    IE: &AIM Search - c:\program files\AIM Toolbar\AIMBar.dll/aimsearch.htm
    IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
    LSP: %SystemRoot%\system32\msafd.dll
    Trusted Zone: line6.net
    FF - ProfilePath - c:\documents and settings\Frank Leutheuser\Application Data\Mozilla\Firefox\Profiles\r9mw7ztk.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/firefox
    FF - plugin: c:\documents and settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npaxctrl.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npitunes.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npracplug.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
    FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll

    ---- FIREFOX POLICIES ----
    c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDFE0BD779-44EE-4A4B-AA2E-743C63F2E5E6", "AllAccess");
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-04-22 17:24
    Windows 5.0.2195 Service Pack 4 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(236)
    c:\winnt\system32\wzcdlg.dll
    c:\winnt\system32\WZCSAPI.DLL

    - - - - - - - > 'explorer.exe'(944)
    c:\winnt\AppPatch\AcLayers.DLL
    c:\program files\Unlocker\UnlockerHook.dll
    c:\winnt\system32\SHDOCVW.DLL
    .
    Completion time: 2009-04-22 17:33 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-04-22 22:32
    ComboFix2.txt 2009-04-22 00:12

    Pre-Run: 38,702,854,144 bytes free
    Post-Run: 38,673,125,376 bytes free

    679 --- E O F --- 2009-04-01 09:03

  10. #10
    Junior Member
    Join Date
    Apr 2009
    Posts
    20

    Default

    HJT Log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 6:31:46 PM, on 4/22/2009
    Platform: Windows 2000 SP4 (WinNT 5.00.2195)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    Boot mode: Normal

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\spoolsv.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\hidserv.exe
    C:\WINNT\system32\nvsvc32.exe
    C:\WINNT\system32\regsvc.exe
    C:\WINNT\system32\MSTask.exe
    C:\WINNT\wanmpsvc.exe
    C:\WINNT\System32\WBEM\WinMgmt.exe
    C:\WINNT\system32\svchost.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\WINNT\Explorer.EXE
    C:\WINNT\system32\ezSP_Px.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Unlocker\UnlockerAssistant.exe
    C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb09.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINNT\system32\wuauclt.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINNT\system32\ezSP_Px.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb09.exe
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKCU\..\Run: [Microsoft Location Finder] "C:\Program Files\Microsoft Location Finder\LocationFinder.exe"
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
    O4 - Startup: Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
    O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - Winlogon Notify: avgrsstarter - C:\WINNT\SYSTEM32\avgrsstx.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
    O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
    O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe

    --
    End of file - 5037 bytes

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •