Is 600pics.com a problem?

[HSPower1972]

I have recently noticed--using the WhatsRunning application--that I have four IP connections to 600pics.com. I can't remember ever visiting the site. I recently removed some malware that was diverting google links to bestwebsearches.com. Now I no longer go there when I click on a link in a google search. This is in IE8. Both www.600pics.com and 600pics.com are in my hosts file, so I can't access the site. Are these connections of concern? The app being I also notice two of these reference the svchost.exe file the other two reference iexplore.exe. Also, two IP connections to this same site open up when I have Outlook running or minimized to the tray.

Here is my hjt log of this date:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:21:53 PM, on 6/29/2009
Platform: Windows XP SP3, v.3311 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS2\System32\smss.exe
C:\WINDOWS2\system32\winlogon.exe
C:\WINDOWS2\system32\services.exe
C:\WINDOWS2\system32\lsass.exe
C:\WINDOWS2\system32\svchost.exe
C:\WINDOWS2\System32\svchost.exe
C:\WINDOWS2\system32\spoolsv.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS2\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS2\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\NETGEAR\WG111v3\WG111v3.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.zpecialoffer.com/indexie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.0.5:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: X1IEHook Class - {52706EF7-D7A2-49AD-A615-E903858CF284} - C:\Program Files\NetZero\qsacc\X1IEBHO.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll (file missing)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS2\system32\dla\tfswshx.dll
O2 - BHO: WsftpBrowserHelper Class - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\Ipswitch\WS_FTP Pro\wsbho2k0.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {8B2A62D8-E333-42C1-955B-DC5278F9FF4D} - C:\WINDOWS2\system32\vtsqq.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: ZeroBar - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - C:\Program Files\NetZero\toolbar.dll
O3 - Toolbar: ZeroBar - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\Program Files\NetZero\Toolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: NETGEAR WG111v3 Smart Wizard.lnk = C:\Program Files\NETGEAR\WG111v3\WG111v3.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Display All Images with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/228
O8 - Extra context menu item: Display Image with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/227
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS2\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS2\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.att.net
O15 - Trusted Zone: http://*.att.net
O15 - Trusted Zone: *.sbcglobal.net
O15 - Trusted Zone: http://*.sbcglobal.net
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/sof...iveXPlugin.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F9CDFA58-BAA3-4C29-BD94-83FBB681E11B}: NameServer = 207.69.188.185,207.69.188.186
O18 - Protocol: ezpp - {810403FA-E82E-11D5-8AAB-0010A404A3DE} - C:\WINDOWS2\system32\EZTOOL~1.DLL
O20 - Winlogon Notify: byxvvtr - byxvvtr.dll (file missing)
O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS2\system32\ieframe.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 8487 bytes

Thanks for any help.

[Blade81]

Hi,

Those are normal when you have them included in hosts file. However, there is some malware related stuff there. Better check things more throughly.

Download DDS and save it to your desktop from here or here or here.
Disable any script blocker, and then double click dds.scr to run the tool.

• When done, DDS will open two (2) logs:
  1. DDS.txt
  2. Attach.txt
• Save both reports to your desktop. Post them back to your topic.

[HSPower1972]

Here is the DDS.txt file contents:


DDS (Ver_09-06-26.01) - NTFSx86
Run by DBP at 18:46:12.90 on Fri 07/03/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_01
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.230 [GMT -7:00]


============== Running Processes ===============

C:\WINDOWS2\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS2\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS2\system32\spoolsv.exe
C:\WINDOWS2\system32\msiexec.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS2\system32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS2\system32\wuauclt.exe
C:\WINDOWS2\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\NETGEAR\WG111v3\WG111v3.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\DBP\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
uInternet Settings,ProxyServer = 192.168.0.5:8080
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com
mSearchAssistant = hxxp://www.zpecialoffer.com/indexie.html
uURLSearchHooks: H - No File
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: X1IEHook Class: {52706ef7-d7a2-49ad-a615-e903858cf284} - c:\program files\netzero\qsacc\X1IEBHO.dll
BHO: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\progra~1\yahoo!\common\yiesrvc.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows2\system32\dla\tfswshx.dll
BHO: WsftpBrowserHelper Class: {601ed020-fb6c-11d3-87d8-0050da59922b} - c:\program files\ipswitch\ws_ftp pro\wsbho2k0.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_01\bin\ssv.dll
BHO: {8b2a62d8-e333-42c1-955b-dc5278f9ff4d} - c:\windows2\system32\vtsqq.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
BHO: SidebarAutoLaunch Class: {f2aa9440-6328-4933-b7c9-a6ccdf9cbf6d} - c:\program files\yahoo!\browser\YSidebarIEBHO.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
TB: ZeroBar: {f5735c15-1fb2-41fe-ba12-242757e69dde} - c:\program files\netzero\toolbar.dll
TB: ZeroBar: {f0f8ecbe-d460-4b34-b007-56a92e8f84a7} - c:\program files\netzero\Toolbar.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - No File
TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File
TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File
TB: {5854FAC4-5BF0-47DD-B5A9-A5EA8CFF3CF4} - No File
TB: {0C6DD65A-F36B-4AC8-89EB-6175AEE6BB8C} - No File
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
dRun: [ALUAlert] c:\program files\symantec\liveupdate\ALUNotify.exe
StartupFolder: c:\docume~1\dbp\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\docume~1\dbp\startm~1\programs\startup\webshots.lnk - c:\program files\webshots\Launcher.exe
StartupFolder: c:\docume~1\alluse~2.win\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear\wg111v3\WG111v3.exe
IE: Display All Images with Full Quality - c:\program files\netzero\qsacc\appres.dll/228
IE: Display Image with Full Quality - c:\program files\netzero\qsacc\appres.dll/227
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_01\bin\ssv.dll
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\progra~1\yahoo!\common\yiesrvc.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
Trusted Zone: att.net
Trusted Zone: microsoft.com\office
Trusted Zone: sbcglobal.net
Trusted Zone: yahoo.com
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS2/Java/classes/xmldso.cab
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://go.microsoft.com/fwlink/?linkid=58813
DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} - hxxps://support.microsoft.com/OAS/ActiveX/MSDcode.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/5/b/0/5b0d4654-aa20-495c-b89f-c1c34c691085/LegitCheckControl.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} - hxxps://webdl.symantec.com/activex/symdlmgr.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} - hxxp://www.sibelius.com/download/software/win/ActiveXPlugin.cab
DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - hxxp://zone.msn.com/bingame/popcaploader_v10.cab
TCP: {F9CDFA58-BAA3-4C29-BD94-83FBB681E11B} = 207.69.188.185,207.69.188.186
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
Handler: ezpp - {810403FA-E82E-11D5-8AAB-0010A404A3DE} - c:\windows2\system32\EZTOOL~1.DLL
Handler: junomsg - {C4D10830-379D-11d4-9B2D-00C04F1579A5} - c:\program files\juno\bin\jmsgpph.dll
Notify: byxvvtr - byxvvtr.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows2\system32\WPDShServiceObj.dll
STS: IE Component Categories cache daemon: {553858a7-4922-4e7e-b1c1-97140c1c16ef} - c:\windows2\system32\ieframe.dll
LSA: Authentication Packages = msv1_0 c:\windows2\system32\vtsqq.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\dbp\applic~1\mozilla\firefox\profiles\offgqknp.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.msn.com
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows2\system32\drivers\Lbd.sys [2009-6-14 64160]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows2\system32\drivers\EAPPkt.sys [2007-10-9 38144]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 1005904]
R3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows2\system32\drivers\wg111v3.sys [2007-12-28 287232]
S1 driverdrv;driverdrv;\??\c:\program files\driver\driver.sys --> c:\program files\driver\driver.sys [?]
S1 tdpipee;tdpipee;c:\windows2\system32\drivers\tdpipee.sys --> c:\windows2\system32\drivers\tdpipee.sys [?]
S3 acfva;acfva;c:\windows2\system32\drivers\acfva.sys [2006-9-2 28445]
S3 ADSFilter;ADSFilter - (Aluria Filter Driver);c:\windows2\system32\drivers\adsfilter.sys --> c:\windows2\system32\drivers\ADSFilter.sys [?]
S3 BW2NDIS5;BW2NDIS5;c:\windows2\system32\drivers\bw2ndis5.sys --> c:\windows2\system32\drivers\BW2NDIS5.sys [?]
S3 WlanUIG;2Wire 802.11g USB Driver;c:\windows2\system32\drivers\WlanUIG.sys [2007-1-13 347648]
S4 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2007-1-9 108648]
S4 ccPwdSvc;Symantec Password Validation;c:\program files\common files\symantec shared\CCPWDSVC.EXE [2004-12-13 79520]
S4 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2007-1-9 108648]

=============== Created Last 30 ================

2009-06-29 17:13 <DIR> --d----- c:\program files\Trend Micro
2009-06-27 11:06 <DIR> --d-h--- c:\windows2\msdownld.tmp
2009-06-27 11:06 <DIR> --d----- c:\windows2\Logs
2009-06-20 08:22 <DIR> --d----- c:\program files\XZAKTFrontFXTools1
2009-06-14 19:46 15,688 a------- c:\windows2\system32\lsdelete.exe
2009-06-14 17:56 64,160 a------- c:\windows2\system32\drivers\Lbd.sys
2009-06-14 17:45 <DIR> -cd-h--- c:\docume~1\alluse~2.win\applic~1\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-06-14 17:45 <DIR> --d----- c:\program files\Lavasoft
2009-06-11 17:17 <DIR> --d----- c:\windows2\system32\wbem\Repository
2009-06-11 17:15 <DIR> --d----- c:\program files\common files\WORDsearch
2009-06-11 17:15 <DIR> --d----- c:\docume~1\alluse~2.win\applic~1\wsc
2009-06-11 17:15 <DIR> --d----- c:\docume~1\dbp\applic~1\EBookSys
2009-06-10 22:15 66 a----r-- c:\windows2\amunres.lsl

==================== Find3M ====================

2009-06-30 22:02 524,288 a------- c:\windows2\system32\Busy_Wait.exe
2008-05-13 19:49 13 ----h--- c:\docume~1\alluse~2.win\applic~1\ÝÃÄΛÒ3113›.sys
2008-03-30 08:45 2,400,784 a------- c:\documents and settings\dbp\WLinstaller.exe
2008-03-04 11:10 724,984 a------- c:\documents and settings\dbp\gotomypc_437.exe
2008-02-27 01:05 774,144 a------- c:\program files\RngInterstitial.dll
2008-02-08 14:03 13 ----h--- c:\docume~1\alluse~2.win\applic~1\ÐÒÝÃÄ3113›˜.sys
2007-12-28 15:02 287,232 a------- c:\windows2\inf\wg111v3\wg111v3.sys
2007-12-28 14:59 342,528 a------- c:\windows2\inf\wg111v3\vista64\wg111v3.sys
2007-11-27 17:53 63,488 a------- c:\windows2\inf\wg111v3\SetDrv64.exe
2007-11-27 17:52 32,768 a------- c:\windows2\inf\wg111v3\SetDrv.exe
2007-08-21 14:10 3,902,784 a------- c:\documents and settings\dbp\gosetup.exe
2007-08-21 11:28 491 a------- c:\program files\UnInst.log
2007-01-25 21:28 722,176 a------- c:\documents and settings\dbp\gotomypc_428.exe
2007-01-20 10:01 563,712 a------- c:\documents and settings\dbp\gotomypc_370.exe
2006-12-15 11:30 315,392 a------- c:\windows2\inf\wg111v3\InstallDriver.exe
2006-12-15 11:30 212,992 a------- c:\windows2\inf\wg111v3\CopyWHQLDriver.exe
2006-12-15 11:30 98,304 a------- c:\windows2\inf\wg111v3\UScanM.exe
2006-12-15 11:30 20,480 a------- c:\windows2\inf\wg111v3\RTWUPath.exe
2006-12-15 11:30 19,968 a------- c:\windows2\inf\wg111v3\RTWREFU.EXE
2006-03-07 17:09 13 ----h--- c:\docume~1\alluse~2.win\applic~1\ÝÙÃÄ3113›.sys
2006-02-07 12:36 563,712 a------- c:\documents and settings\dbp\370_gotomypc.exe
2005-11-22 10:40 483,401 a------- c:\documents and settings\dbp\314_gotomypc.exe
2005-11-02 20:01 13 ----h--- c:\docume~1\alluse~2.win\applic~1\13.sys
2008-02-26 06:36 32,768 a--sh--- c:\windows2\system32\config\systemprofile\local settings\history\history.ie5\mshist012008022620080227\index.dat

============= FINISH: 18:47:45.96 ===============

And here are the contents of the Attach.txt file:


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-06-26.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 1/15/2008 4:31:47 PM
System Uptime: 7/3/2009 6:35:51 PM (0 hours ago)

Motherboard: Dell Computer Corp. | | 0N6381
Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz | Microprocessor | 2793/533mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 72 GiB total, 22.444 GiB free.
D: is CDROM ()
E: is FIXED (NTFS) - 31 GiB total, 20.013 GiB free.

==== Disabled Device Manager Items =============

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Intel(R) PRO/100 VE Network Connection
Device ID: PCI\VEN_8086&DEV_1050&SUBSYS_019D1028&REV_02\4&1C660DD6&0&40F0
Manufacturer: Intel
Name: Intel(R) PRO/100 VE Network Connection
PNP Device ID: PCI\VEN_8086&DEV_1050&SUBSYS_019D1028&REV_02\4&1C660DD6&0&40F0
Service: E100B

==== System Restore Points ===================

RP553: 4/19/2009 1:20:20 PM - System Checkpoint
RP554: 4/20/2009 11:18:59 PM - System Checkpoint
RP555: 4/22/2009 12:50:38 AM - System Checkpoint
RP556: 4/23/2009 12:57:49 AM - System Checkpoint
RP557: 4/24/2009 11:37:19 AM - System Checkpoint
RP558: 4/25/2009 12:25:21 PM - System Checkpoint
RP559: 4/25/2009 2:05:06 PM - Installed Xara3D6
RP560: 4/25/2009 2:06:14 PM - Installed Xara Menu Maker 1.1
RP561: 4/25/2009 9:16:09 PM - Installed Xara X1
RP562: 4/26/2009 10:04:56 PM - System Checkpoint
RP563: 4/27/2009 10:58:09 PM - System Checkpoint
RP564: 8/24/2004 12:17:21 AM - System Checkpoint
RP565: 4/28/2009 2:03:10 PM - System Checkpoint
RP566: 4/29/2009 2:36:40 PM - Installed NETGEAR WG111v3 wireless USB 2.0 adapter
RP567: 4/30/2009 2:41:48 AM - Software Distribution Service 3.0
RP568: 5/1/2009 1:17:25 AM - Installed Compatibility Pack for the 2007 Office system
RP569: 5/2/2009 12:19:14 PM - Installed Windows Internet Explorer 8.
RP570: 5/3/2009 3:04:34 PM - System Checkpoint
RP571: 5/4/2009 3:11:57 PM - System Checkpoint
RP572: 5/5/2009 4:37:37 PM - System Checkpoint
RP573: 5/6/2009 5:06:49 PM - System Checkpoint
RP574: 5/7/2009 5:58:38 PM - Installed Windows Media Player 10
RP575: 5/8/2009 6:15:21 PM - System Checkpoint
RP576: 5/10/2009 3:12:43 PM - System Checkpoint
RP577: 5/11/2009 4:17:21 PM - System Checkpoint
RP578: 5/12/2009 4:38:48 PM - System Checkpoint
RP579: 5/13/2009 4:41:28 PM - System Checkpoint
RP580: 5/13/2009 7:45:18 PM - Upgrading Flash to Version 8
RP581: 5/13/2009 7:47:12 PM - Removed Macromedia Flash MX 2004
RP582: 5/13/2009 7:58:56 PM - Installed Macromedia Flash 8
RP583: 5/13/2009 8:02:47 PM - Restore Operation
RP584: 5/14/2009 8:08:16 PM - System Checkpoint
RP585: 5/14/2009 11:14:04 PM - Installed Macromedia Flash 8
RP586: 5/15/2009 11:39:12 PM - System Checkpoint
RP587: 5/17/2009 3:06:19 AM - System Checkpoint
RP588: 5/17/2009 8:39:54 PM - Removed Apple Mobile Device Support
RP589: 5/17/2009 8:41:32 PM - Removed Apple Software Update
RP590: 5/18/2009 9:37:04 PM - System Checkpoint
RP591: 5/19/2009 12:52:38 AM - Removed Doomi
RP592: 5/20/2009 2:55:11 AM - System Checkpoint
RP593: 5/21/2009 3:27:14 AM - System Checkpoint
RP594: 5/21/2009 10:43:58 PM - Configured NETGEAR WG111v3 wireless USB 2.0 adapter
RP595: 5/21/2009 10:46:27 PM - Installed NETGEAR WG111v3 wireless USB 2.0 adapter
RP596: 5/23/2009 1:36:22 AM - System Checkpoint
RP597: 5/24/2009 1:55:53 PM - System Checkpoint
RP598: 5/25/2009 3:09:01 PM - System Checkpoint
RP599: 5/26/2009 3:55:09 PM - System Checkpoint
RP600: 5/27/2009 4:09:47 PM - System Checkpoint
RP601: 5/28/2009 7:39:38 PM - System Checkpoint
RP602: 5/30/2009 6:51:39 AM - System Checkpoint
RP603: 5/31/2009 8:14:48 AM - System Checkpoint
RP604: 6/1/2009 8:35:49 AM - System Checkpoint
RP605: 6/2/2009 9:13:41 AM - System Checkpoint
RP606: 6/3/2009 9:27:08 AM - System Checkpoint
RP607: 6/4/2009 10:20:15 AM - System Checkpoint
RP608: 6/5/2009 4:54:31 PM - System Checkpoint
RP609: 6/6/2009 9:34:53 PM - System Checkpoint
RP610: 6/8/2009 6:31:18 AM - System Checkpoint
RP611: 6/8/2009 8:50:45 PM - Removed Xara3D6
RP612: 6/8/2009 9:21:29 PM - Removed Xara X1
RP613: 6/9/2009 6:08:54 AM - Software Distribution Service 3.0
RP614: 6/10/2009 6:33:03 PM - System Checkpoint
RP615: 6/10/2009 10:16:49 PM - Removed Visual Infinite Menus
RP616: 6/11/2009 3:03:01 PM - Removed Xara Menu Maker 1.1
RP617: 6/11/2009 3:45:52 PM - Software Distribution Service 3.0
RP618: 6/11/2009 4:51:22 PM - Restore Operation
RP619: 6/11/2009 5:09:53 PM - Restore Operation
RP620: 6/12/2009 7:13:01 PM - System Checkpoint
RP621: 6/13/2009 10:14:43 PM - System Checkpoint
RP622: 6/14/2009 10:56:59 PM - System Checkpoint
RP623: 6/16/2009 3:47:55 PM - System Checkpoint
RP624: 6/17/2009 4:38:19 PM - System Checkpoint
RP625: 6/18/2009 5:02:32 PM - System Checkpoint
RP626: 6/19/2009 8:10:48 PM - System Checkpoint
RP627: 6/20/2009 8:22:33 AM - Installed XZAKT Media FrontFXTools+1
RP628: 6/21/2009 2:59:12 PM - System Checkpoint
RP629: 6/22/2009 8:35:47 PM - System Checkpoint
RP630: 6/23/2009 10:06:35 PM - System Checkpoint
RP631: 6/24/2009 11:06:56 PM - System Checkpoint
RP632: 6/25/2009 11:12:48 PM - System Checkpoint
RP633: 6/27/2009 12:05:16 PM - System Checkpoint
RP634: 6/28/2009 1:25:35 PM - System Checkpoint
RP635: 6/29/2009 3:38:32 PM - System Checkpoint
RP636: 6/30/2009 5:47:08 PM - System Checkpoint
RP637: 7/1/2009 6:37:27 PM - System Checkpoint
RP638: 7/2/2009 7:13:40 PM - System Checkpoint

==== Installed Programs ======================


123 Free Solitaire
Access Drivers
Access to MySQL 4.1
Ad-Aware
Adobe Acrobat 6.0.1 Professional
Adobe Acrobat and Reader 6.0.3 Update
Adobe Acrobat and Reader 6.0.4 Update
Adobe Acrobat and Reader 6.0.5 Update
Adobe Acrobat and Reader 6.0.6 Update
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe AIR
Adobe Atmosphere Player for Acrobat and Adobe Reader
Adobe Common File Installer
Adobe Flash Player 10 ActiveX
Adobe GoLive CS2
Adobe GoLive CS2 English
Adobe Help Center 1.0
Adobe Photoshop 7.0.1
Adobe Photoshop CS2
Adobe Reader 8.1.2
Adobe Reader 8.1.2 Security Update 1 (KB403742)
Adobe Reader 8.1.3
Adobe Shockwave Player
Adobe Stock Photos 1.0
Adobe SVG Viewer 3.0
AOL Uninstaller (Choose which Products to Remove)
ASAP
Audacity 1.2.6
BACS
Belarc Advisor 7.2
Bible Explorer 4 Download Edition
BiblePro
Bonjour
Broadcom Advanced Control Suite
CoffeeCup Flash Password Wizard
CoffeeCup Web Calendar
Compatibility Pack for the 2007 Office system
Creative Modem Blaster V.92 DE5621
Dell ResourceCD
ERUNT 1.1j
FaxTools
Finale NotePad 2008
FrontLook Java Effects
FrontLook Java Effects VE
Google Earth
Google Video Player
HijackThis 2.0.2
HTML Password Lock 3.2.6
Intel(R) 537EP V9x DF PCI Modem
Intel(R) Extreme Graphics 2 Driver
Intel(R) PRO Network Adapters and Drivers
Intel(R) PROSet for Wired Connections
Ipswitch WS_FTP Pro
iTunes
Java(TM) SE Runtime Environment 6 Update 1
Juno
LAME v3.98.2 for Audacity
Lernout & Hauspie TruVoice for Microsoft Agent
LimeWire 5.1.2
Macromedia Dreamweaver MX 2004
Macromedia Extension Manager
Macromedia Fireworks MX 2004
Macromedia Flash 8
Macromedia Flash 8 Video Encoder
Macromedia Flash MX 2004
Macromedia Flash Player 8
Macromedia Flash Player 8 Plugin
Macromedia HomeSite+
MapleStory
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft ICE
Microsoft IntelliPoint 6.1
Microsoft IntelliType Pro 6.1
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Access 2003
Microsoft Office Converter Pack
Microsoft Office FrontPage 2003
Microsoft Office Outlook 2003 Calendar Views Add-in
Microsoft Office Small Business Edition 2003
Microsoft Office XP Web Components
Microsoft Project 98
Microsoft Silverlight
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Tools Express Edition
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft SQL Server VSS Writer
Microsoft Visual C++ 2005 Redistributable
Microsoft WSE 2.0 SP3 Runtime
Microsoft XML Parser
Move Networks Media Player for Internet Explorer
Mozilla Firefox (2.0.0.16)
MSXML 4.0 SP2 (KB925672)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 6.0 Parser
My Journal 1.0
NavStudio
NETGEAR WG111v3 wireless USB 2.0 adapter
Netscape Browser (remove only)
NetZero Internet
Opera 9.10
Pivot Stickfigure Animator
POINT
QuickTime
RealPlayer
Security Update for CAPICOM (KB931906)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB941569)
Setup
Simple CSS 1.2
Sonic DLA
Sonic RecordNow!
Sonic Update Manager
Sony ACID Music Studio 5.0
SoundMAX
Spybot - Search & Destroy
Spybot - Search & Destroy 1.5.2.20
SQLyog 4.06
StuffIt 11
Sudoku Puzzles Pro (remove only)
Symantec KB-DocID:2003093015493306
Viewpoint Media Player
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
WavePad Sound Editor
WebFldrs XP
Webshots Desktop
What's Running 2.2
WinBoard
Windows Defender Signatures
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage v1.3.0254.0
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live installer
Windows Live Mail
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Media Format 11 runtime
Windows Media Format Runtime
Windows Media Player 10
Windows Media Player 11
Windows XP Service Pack 3
WinRAR archiver
WinZip
XZAKT FrontFX Tools+ 2 1.0
XZAKT Media FrontFXTools+1
Yahoo! Toolbar

==== Event Viewer Messages From Past Week ========

7/2/2009 5:58:10 PM, error: Dhcp [1002] - The IP address lease 192.168.0.2 for the Network Card with network address 001E2AD26E59 has been denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message).
7/2/2009 12:52:16 AM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service MDM with arguments "" in order to run the server: {943B6A75-BB5E-41A7-A6D3-A1A5E892B33B}
7/1/2009 7:06:45 PM, error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error: An instance of the service is already running.
6/29/2009 9:53:03 PM, error: Service Control Manager [7034] - The SSDP Discovery Service service terminated unexpectedly. It has done this 3 time(s).
6/29/2009 9:53:03 PM, error: Service Control Manager [7031] - The Universal Plug and Play Device Host service terminated unexpectedly. It has done this 3 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
6/29/2009 9:41:59 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
6/29/2009 9:40:58 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
6/29/2009 9:40:27 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
6/29/2009 9:39:51 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD BANTExt driverdrv Fips intelppm IPSec MRxSmb NetBIOS NetBT OMCI RasAcd Rdbss Tcpip WS2IFSL
6/29/2009 9:39:51 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
6/29/2009 9:39:51 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
6/29/2009 9:39:51 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
6/29/2009 9:39:51 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
6/29/2009 5:44:33 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service iPod Service with arguments "" in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}
6/29/2009 10:37:59 AM, error: Service Control Manager [7034] - The WebClient service terminated unexpectedly. It has done this 1 time(s).
6/29/2009 10:37:59 AM, error: Service Control Manager [7034] - The TCP/IP NetBIOS Helper service terminated unexpectedly. It has done this 1 time(s).
6/29/2009 10:37:59 AM, error: Service Control Manager [7034] - The SSDP Discovery Service service terminated unexpectedly. It has done this 1 time(s).
6/29/2009 10:37:59 AM, error: Service Control Manager [7031] - The Universal Plug and Play Device Host service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
6/29/2009 10:37:59 AM, error: Service Control Manager [7031] - The Remote Registry service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.
6/29/2009 10:36:29 AM, error: Service Control Manager [7034] - The Application Layer Gateway Service service terminated unexpectedly. It has done this 1 time(s).
6/29/2009 10:22:07 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: driverdrv
6/29/2009 10:16:33 PM, error: Service Control Manager [7034] - The SSDP Discovery Service service terminated unexpectedly. It has done this 4 time(s).
6/29/2009 10:16:33 PM, error: Service Control Manager [7031] - The Universal Plug and Play Device Host service terminated unexpectedly. It has done this 4 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
6/28/2009 12:49:52 PM, error: Service Control Manager [7000] - The CSS DVP service failed to start due to the following error: The system cannot find the file specified.
6/28/2009 12:49:34 PM, error: DCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {DCBCA92E-7DBE-4EDA-8B7B-3AAEA4DD412B} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18). This security permission can be modified using the Component Services administrative tool.
6/28/2009 1:58:07 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service MDM with arguments "" in order to run the server: {0C0A3666-30C9-11D0-8F20-00805F2CD064}
6/27/2009 3:58:11 PM, error: Service Control Manager [7031] - The Lavasoft Ad-Aware Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

==== End Of File ===========================

Thanks for your help.

Doug

[Blade81]

Hi Doug,

Are you using Firefox browser? Uninstall the version you have there. If you're still using it then get version 3.5 here.

IMPORTANT I notice there are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer.


LimeWire


I'd like you to read this thread.

Please go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red).

After that:

Please visit this webpage for download links, and instructions for running ComboFix tool:

http://www.bleepingcomputer.com/comb...o-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
   Remember to re-enable them afterwards.
   
   
2. Click Yes to allow ComboFix to continue scanning for malware.

When the tool is finished, it will produce a report for you.

Please include the following reports for further review, and so we may continue cleansing the system:

C:\ComboFix.txt
New dds.txt log.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.

[HSPower1972]

Per your instructions, I have uninstalled Firefox and Limewire and run the Combofix application. Here is the Combo Fix log:

ComboFix 09-07-06.02 - DBP 07/06/2009 17:42.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.240 [GMT -7:00]
Running from: c:\documents and settings\DBP\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Charlie\Application Data\SpyGuardPro
c:\documents and settings\Charlie\Application Data\SpyGuardPro\Logs\threats.log
c:\documents and settings\Charlie\Application Data\SpyGuardPro\Logs\update.log
c:\documents and settings\Charlie\ResErrors.log
c:\documents and settings\Charlie\services.exe
c:\documents and settings\DBP\Application Data\SpyGuardPro
c:\documents and settings\DBP\Application Data\SpyGuardPro\Logs\threats.log
c:\documents and settings\DBP\Application Data\SpyGuardPro\PGE.dat
c:\documents and settings\DBP\ResErrors.log
c:\documents and settings\Kathy\Application Data\SpyGuardPro
c:\documents and settings\Kathy\Application Data\SpyGuardPro\Logs\threats.log
c:\documents and settings\Kathy\Application Data\SpyGuardPro\Logs\update.log
c:\recycler\S-1-5-21-494109675-391593797-3254085505-1007
c:\recycler\S-1-5-21-494109675-391593797-3254085505-500
c:\recycler\S-1-5-21-507921405-764733703-725345543-500
c:\windows\Installer\14670.msi
c:\windows\Installer\4dd83.msi
c:\windows\Installer\4dd88.msi
c:\windows2\Downloaded Program Files\ODCTOOLS
c:\windows2\Fonts\a.zip
c:\windows2\system32\drivers\fad.sys
c:\windows2\system32\mcrh.tmp
c:\windows2\system32\url(3).dll
c:\windows2\system32\windows.txt
c:\windows2\Tasks\SysFile.brk

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_DRIVERDRV
-------\Legacy_NETWORK_MONITOR
-------\Service_driver
-------\Service_driverdrv


((((((((((((((((((((((((( Files Created from 2009-06-07 to 2009-07-07 )))))))))))))))))))))))))))))))
.

2009-07-04 02:52 . 2009-07-04 02:52 84832 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\ShellExt.dll
2009-07-04 02:52 . 2009-07-04 02:52 1630560 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll
2009-06-30 04:41 . 2009-06-30 04:41 -------- d-sh--w- c:\documents and settings\Administrator.MARKETING\IETldCache
2009-06-30 01:08 . 2009-06-30 01:08 314712 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe
2009-06-30 01:08 . 2009-06-30 01:08 25440 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\savapibridge.dll
2009-06-30 01:08 . 2009-06-30 01:08 169312 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\lavamessage.dll
2009-06-30 01:07 . 2009-06-30 01:07 348496 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\lavalicense.dll
2009-06-30 01:07 . 2009-06-30 01:07 298336 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2009-06-30 01:05 . 2009-06-30 01:05 246128 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll
2009-06-30 01:04 . 2009-06-30 01:04 40288 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2009-06-30 01:04 . 2009-06-30 01:04 85352 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\Drivers\32\AAWDriverTool.exe
2009-06-30 01:04 . 2009-06-30 01:04 664424 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2009-06-30 01:03 . 2009-06-30 01:03 563064 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2009-06-30 01:03 . 2009-06-30 01:03 566632 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2009-06-30 01:02 . 2009-06-30 01:02 2352968 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2009-06-30 01:01 . 2009-06-30 01:01 629072 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\AAWWSC.exe
2009-06-30 01:00 . 2009-06-30 01:00 520024 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe
2009-06-30 01:00 . 2009-06-30 01:00 1029456 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2009-06-30 00:13 . 2009-06-30 00:13 -------- d-----w- c:\program files\Trend Micro
2009-06-30 00:10 . 2009-06-30 00:10 -------- d-----w- c:\program files\ERUNT
2009-06-27 18:06 . 2009-06-27 18:09 -------- d--h--w- c:\windows2\msdownld.tmp
2009-06-27 18:06 . 2009-06-27 18:06 -------- d-----w- c:\windows2\Logs
2009-06-20 15:22 . 2009-06-20 18:54 -------- d-----w- c:\program files\XZAKTFrontFXTools1
2009-06-16 02:56 . 2009-06-16 02:56 -------- d-sh--w- c:\documents and settings\LocalService.NT AUTHORITY.000\IETldCache
2009-06-15 02:46 . 2009-06-15 00:56 15688 ----a-w- c:\windows2\system32\lsdelete.exe
2009-06-15 00:56 . 2009-06-15 00:54 64160 ----a-w- c:\windows2\system32\drivers\Lbd.sys
2009-06-15 00:56 . 2009-06-15 00:56 15688 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe
2009-06-15 00:54 . 2009-06-15 00:54 64160 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\Drivers\32\lbd.sys
2009-06-15 00:45 . 2009-06-15 00:45 -------- dc-h--w- c:\documents and settings\All Users.WINDOWS2\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-06-15 00:45 . 2009-03-12 08:17 2902048 -c--a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}\Ad-AwareAE.exe
2009-06-15 00:45 . 2009-06-15 00:45 -------- d-----w- c:\program files\Lavasoft
2009-06-12 00:17 . 2009-06-12 00:17 -------- d-----w- c:\windows2\system32\wbem\Repository
2009-06-12 00:15 . 2009-06-12 00:15 -------- d-----w- c:\program files\Common Files\WORDsearch
2009-06-12 00:15 . 2009-06-12 00:15 -------- d-----w- c:\documents and settings\All Users.WINDOWS2\Application Data\wsc
2009-06-12 00:15 . 2009-06-12 00:15 -------- d-----w- c:\documents and settings\DBP\Application Data\EBookSys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-04 04:59 . 2007-05-26 02:26 -------- d-----w- c:\documents and settings\DBP\Application Data\LimeWire
2009-07-01 05:02 . 2007-08-21 18:28 524288 ----a-w- c:\windows2\system32\Busy_Wait.exe
2009-06-30 05:13 . 2009-03-23 08:36 -------- d-----w- c:\program files\Bonjour
2009-06-28 00:43 . 2006-09-02 21:34 -------- d-----w- c:\program files\UIU
2009-06-27 23:52 . 2006-02-27 19:14 -------- d-----w- c:\program files\WhatsRunning
2009-06-20 15:20 . 2006-05-25 16:27 -------- d-----w- c:\program files\XZAKT FrontFX Tools+ 2
2009-06-15 00:45 . 2007-07-04 08:51 -------- d-----w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft
2009-06-12 00:16 . 2006-03-24 00:48 -------- d-----w- c:\documents and settings\DBP\Application Data\Xara
2009-06-12 00:16 . 2006-04-26 19:33 -------- d-----w- c:\program files\HTML Password Lock
2009-06-12 00:16 . 2009-04-25 21:04 -------- d-----w- c:\program files\Xara
2009-06-12 00:15 . 2009-05-26 23:44 -------- dc-h--w- c:\documents and settings\All Users.WINDOWS2\Application Data\{CDF61231-6AD7-4969-B4DD-9E6C0F51DD5E}
2009-06-12 00:15 . 2008-03-17 16:28 -------- d-----w- c:\program files\Bible Explorer 4
2009-06-12 00:14 . 2009-03-23 08:33 -------- d-----w- c:\program files\Common Files\Apple
2009-06-12 00:14 . 2005-09-14 02:15 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-06-12 00:13 . 2004-12-10 22:50 -------- d-----w- c:\program files\Common Files\Macromedia
2009-06-12 00:13 . 2005-11-03 21:58 -------- d-----w- c:\program files\Opera
2009-06-12 00:13 . 2005-10-24 19:32 -------- d-----w- c:\program files\Macromedia
2009-06-12 00:10 . 2009-05-09 05:24 -------- d-----w- c:\program files\Lame for Audacity
2009-06-11 23:54 . 2008-08-29 03:02 -------- d-----w- c:\program files\SourceTec
2009-06-11 23:54 . 2008-08-29 03:02 -------- d-----w- c:\program files\Common Files\SourceTec
2009-06-11 23:52 . 2006-03-07 17:12 -------- d-----w- c:\program files\CoffeeCup Software
2009-05-27 03:00 . 2005-10-20 22:12 852432 ----a-w- c:\documents and settings\DBP\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-23 18:28 . 2009-02-26 18:58 -------- d-----w- c:\program files\My Journal
2009-05-23 01:21 . 2009-04-30 21:15 -------- d-----w- c:\documents and settings\DBP\Application Data\Move Networks
2009-05-22 05:44 . 2004-12-03 08:49 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-15 06:12 . 2009-05-15 06:12 45056 ----a-r- c:\documents and settings\DBP\Application Data\Microsoft\Installer\{885A63EA-382B-4DD4-A755-14809B8557D6}\ARPPRODUCTICON.exe
2009-05-10 08:45 . 2009-05-10 08:45 -------- d-----w- c:\documents and settings\DBP\Application Data\Doomi.809F847005C7832B69625A614BB25CA209244440.1
2009-05-09 02:45 . 2009-05-09 02:45 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-05-09 02:43 . 2009-05-09 02:45 38208 ----a-w- c:\documents and settings\DBP\Application Data\Macromedia\Flash Player\http://www.macromedia.com\bin\airapp...pinstaller.exe
2009-05-02 23:04 . 2009-05-02 23:04 34062 ----a-w- c:\documents and settings\DBP\Application Data\Move Networks\ie_bin\Uninst.exe
2009-05-01 05:31 . 2009-05-01 05:31 295606 ----a-r- c:\documents and settings\DBP\Application Data\Microsoft\Installer\{AC76BA86-7AD7-1033-7B44-A81300000003}\SC_Reader.exe
2009-04-29 21:37 . 2009-04-29 21:37 21035 ----a-w- c:\windows2\system32\drivers\AegisP.sys
2008-02-27 08:05 . 2008-02-27 08:06 774144 ----a-w- c:\program files\RngInterstitial.dll
2007-08-21 18:28 . 2007-08-21 18:28 491 ----a-w- c:\program files\UnInst.log
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-06 413696]

c:\documents and settings\DBP\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
Webshots.lnk - c:\program files\Webshots\Launcher.exe [2004-12-10 45056]

c:\documents and settings\All Users.WINDOWS2\Start Menu\Programs\Startup\
NETGEAR WG111v3 Smart Wizard.lnk - c:\program files\NETGEAR\WG111v3\WG111v3.exe [2008-7-1 2326528]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SDhelper"=2 (0x2)
"ADSService"=2 (0x2)
"ElnkFWPPService"=3 (0x3)
"cmdService"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"Symantec Core LC"=2 (0x2)
"Pml Driver HPZ12"=3 (0x3)
"ose"=3 (0x3)
"NetSvc"=2 (0x2)
"MDM"=2 (0x2)
"Macromedia Licensing Service"=2 (0x2)
"LiveUpdate"=3 (0x3)
"gusvc"=3 (0x3)
"ccSetMgr"=2 (0x2)
"ccPwdSvc"=3 (0x3)
"ccEvtMgr"=2 (0x2)
"Automatic LiveUpdate Scheduler"=2 (0x2)
"iPod Service"=3 (0x3)
"Bonjour Service"=2 (0x2)
"Adobe LM Service"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\America Online 9.0b\\waol.exe"=
"c:\\Program Files\\Common Files\\AOL\\1157172737\\EE\\AOLServiceHost.exe"=
"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
"c:\\Program Files\\Common Files\\AOL\\1157172737\\EE\\aim6.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"=
"c:\\WINDOWS2\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS2\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Macromedia\\Dreamweaver MX 2004\\Dreamweaver.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\msncall.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1157172737\\EE\\aolsoftware.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8097:TCP"= 8097:TCP:*:Disabled:EarthLink UHP Modem Support
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"8085:TCP"= 8085:TCP:driver

R0 Lbd;Lbd;c:\windows2\system32\drivers\Lbd.sys [6/14/2009 5:56 PM 64160]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows2\system32\drivers\EAPPkt.sys [10/9/2007 1:13 PM 38144]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [3/9/2009 12:06 PM 1029456]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [6/17/2008 10:34 PM 24652]
R3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows2\system32\drivers\wg111v3.sys [12/28/2007 3:02 PM 287232]
S1 tdpipee;tdpipee;c:\windows2\system32\drivers\tdpipee.sys --> c:\windows2\system32\drivers\tdpipee.sys [?]
S3 acfva;acfva;c:\windows2\system32\drivers\acfva.sys [9/2/2006 2:34 PM 28445]
S3 ADSFilter;ADSFilter - (Aluria Filter Driver);c:\windows2\system32\DRIVERS\ADSFilter.sys --> c:\windows2\system32\DRIVERS\ADSFilter.sys [?]
S3 BW2NDIS5;BW2NDIS5;c:\windows2\system32\Drivers\BW2NDIS5.sys --> c:\windows2\system32\Drivers\BW2NDIS5.sys [?]
S3 WlanUIG;2Wire 802.11g USB Driver;c:\windows2\system32\drivers\WlanUIG.sys [1/13/2007 5:05 PM 347648]
S4 Stuffit Archive Name Service;Stuffit Archive Name Service;c:\program files\Smith Micro\StuffIt11\ArcNameService.exe [7/18/2007 3:26 PM 157000]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows2\system32\rundll32.exe" "c:\windows2\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-06-30 c:\windows2\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 01:03]
.
- - - - ORPHANS REMOVED - - - -

BHO-{8B2A62D8-E333-42C1-955B-DC5278F9FF4D} - c:\windows2\system32\vtsqq.dll
HKU-Default-Run-ALUAlert - c:\program files\Symantec\LiveUpdate\ALUNotify.exe
Notify-byxvvtr - byxvvtr.dll


.
------- Supplementary Scan -------
.
mSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
uInternet Settings,ProxyServer = 192.168.0.5:8080
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com
IE: Display All Images with Full Quality - c:\program files\NetZero\qsacc\appres.dll/228
IE: Display Image with Full Quality - c:\program files\NetZero\qsacc\appres.dll/227
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: att.net
Trusted Zone: microsoft.com\office
Trusted Zone: sbcglobal.net
Trusted Zone: yahoo.com
TCP: {F9CDFA58-BAA3-4C29-BD94-83FBB681E11B} = 207.69.188.185,207.69.188.186
Handler: ezpp - {810403FA-E82E-11D5-8AAB-0010A404A3DE} - c:\windows2\system32\EZTOOL~1.DLL
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS2/Java/classes/xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-06 18:07
Windows 5.1.2600 Service Pack 3, v.3311 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-583907252-287218729-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{C55B90D8-06FA-C0FF-A797-9AB19D80AB23}*]
"kagkcelciikijpllbmpoca"=hex:66,61,69,6a,66,69,6c,64,6a,6a,6f,63,00,6b
"kagkcelciikijpllbmpopp"=hex:67,61,69,6b,6c,66,69,6f,62,67,66,6a,6c,6b,00,00
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2580)
c:\windows2\system32\ieframe.dll
c:\windows2\system32\webcheck.dll
c:\windows2\system32\WPDShServiceObj.dll
c:\program files\Common Files\aolshare\aolshcpy.dll
c:\windows2\system32\dot3dlg.dll
c:\windows2\system32\PortableDeviceTypes.dll
c:\windows2\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\windows2\system32\wbem\unsecapp.exe
c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
c:\progra~1\Webshots\webshots.scr
.
**************************************************************************
.
Completion time: 2009-07-07 18:20 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-07 01:18

Pre-Run: 23,973,187,584 bytes free
Post-Run: 24,845,434,880 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS2
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS2="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

263 --- E O F --- 2009-06-11 22:47

And here is the new DDS log:


DDS (Ver_09-06-26.01) - NTFSx86
Run by DBP at 19:09:28.90 on Mon 07/06/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_01
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.199 [GMT -7:00]


============== Running Processes ===============

C:\WINDOWS2\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS2\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS2\system32\spoolsv.exe
C:\WINDOWS2\system32\msiexec.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS2\system32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS2\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\NETGEAR\WG111v3\WG111v3.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\WINDOWS2\system32\wscntfy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\DBP\Desktop\system\dds.scr

============== Pseudo HJT Report ===============

mSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
uInternet Settings,ProxyServer = 192.168.0.5:8080
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com
uURLSearchHooks: H - No File
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: X1IEHook Class: {52706ef7-d7a2-49ad-a615-e903858cf284} - c:\program files\netzero\qsacc\X1IEBHO.dll
BHO: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\progra~1\yahoo!\common\yiesrvc.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows2\system32\dla\tfswshx.dll
BHO: WsftpBrowserHelper Class: {601ed020-fb6c-11d3-87d8-0050da59922b} - c:\program files\ipswitch\ws_ftp pro\wsbho2k0.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_01\bin\ssv.dll
BHO: {8B2A62D8-E333-42C1-955B-DC5278F9FF4D} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
BHO: SidebarAutoLaunch Class: {f2aa9440-6328-4933-b7c9-a6ccdf9cbf6d} - c:\program files\yahoo!\browser\YSidebarIEBHO.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
TB: ZeroBar: {f5735c15-1fb2-41fe-ba12-242757e69dde} - c:\program files\netzero\toolbar.dll
TB: ZeroBar: {f0f8ecbe-d460-4b34-b007-56a92e8f84a7} - c:\program files\netzero\Toolbar.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - No File
TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File
TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File
TB: {5854FAC4-5BF0-47DD-B5A9-A5EA8CFF3CF4} - No File
TB: {0C6DD65A-F36B-4AC8-89EB-6175AEE6BB8C} - No File
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
StartupFolder: c:\docume~1\dbp\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\docume~1\dbp\startm~1\programs\startup\webshots.lnk - c:\program files\webshots\Launcher.exe
StartupFolder: c:\docume~1\alluse~2.win\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear\wg111v3\WG111v3.exe
IE: Display All Images with Full Quality - c:\program files\netzero\qsacc\appres.dll/228
IE: Display Image with Full Quality - c:\program files\netzero\qsacc\appres.dll/227
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_01\bin\ssv.dll
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\progra~1\yahoo!\common\yiesrvc.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
Trusted Zone: att.net
Trusted Zone: microsoft.com\office
Trusted Zone: sbcglobal.net
Trusted Zone: yahoo.com
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS2/Java/classes/xmldso.cab
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://go.microsoft.com/fwlink/?linkid=58813
DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} - hxxps://support.microsoft.com/OAS/ActiveX/MSDcode.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/5/b/0/5b0d4654-aa20-495c-b89f-c1c34c691085/LegitCheckControl.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} - hxxps://webdl.symantec.com/activex/symdlmgr.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} - hxxp://www.sibelius.com/download/software/win/ActiveXPlugin.cab
DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: {F9CDFA58-BAA3-4C29-BD94-83FBB681E11B} = 207.69.188.185,207.69.188.186
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
Handler: ezpp - {810403FA-E82E-11D5-8AAB-0010A404A3DE} - c:\windows2\system32\EZTOOL~1.DLL
Handler: junomsg - {C4D10830-379D-11d4-9B2D-00C04F1579A5} - c:\program files\juno\bin\jmsgpph.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows2\system32\WPDShServiceObj.dll
STS: IE Component Categories cache daemon: {553858a7-4922-4e7e-b1c1-97140c1c16ef} - c:\windows2\system32\ieframe.dll

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows2\system32\drivers\Lbd.sys [2009-6-14 64160]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows2\system32\drivers\EAPPkt.sys [2007-10-9 38144]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 1029456]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-6-17 24652]
R3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows2\system32\drivers\wg111v3.sys [2007-12-28 287232]
S1 tdpipee;tdpipee;c:\windows2\system32\drivers\tdpipee.sys --> c:\windows2\system32\drivers\tdpipee.sys [?]
S3 acfva;acfva;c:\windows2\system32\drivers\acfva.sys [2006-9-2 28445]
S3 ADSFilter;ADSFilter - (Aluria Filter Driver);c:\windows2\system32\drivers\adsfilter.sys --> c:\windows2\system32\drivers\ADSFilter.sys [?]
S3 BW2NDIS5;BW2NDIS5;c:\windows2\system32\drivers\bw2ndis5.sys --> c:\windows2\system32\drivers\BW2NDIS5.sys [?]
S3 WlanUIG;2Wire 802.11g USB Driver;c:\windows2\system32\drivers\WlanUIG.sys [2007-1-13 347648]
S4 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2007-1-9 108648]
S4 ccPwdSvc;Symantec Password Validation;c:\program files\common files\symantec shared\CCPWDSVC.EXE [2004-12-13 79520]
S4 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2007-1-9 108648]
S4 Stuffit Archive Name Service;Stuffit Archive Name Service;c:\program files\smith micro\stuffit11\ArcNameService.exe [2007-7-18 157000]
S4 Symantec Core LC;Symantec Core LC;c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe [2006-8-18 1251720]

=============== Created Last 30 ================

2009-07-06 18:17 <DIR> -cd----- c:\windows2\system32\dllcache\cache
2009-07-06 17:16 <DIR> a-dshr-- C:\cmdcons
2009-07-06 17:11 161,792 a------- c:\windows2\SWREG.exe
2009-07-06 17:11 155,136 a------- c:\windows2\PEV.exe
2009-07-06 17:11 98,816 a------- c:\windows2\sed.exe
2009-06-29 17:13 <DIR> --d----- c:\program files\Trend Micro
2009-06-27 11:06 <DIR> --d-h--- c:\windows2\msdownld.tmp
2009-06-27 11:06 <DIR> --d----- c:\windows2\Logs
2009-06-20 08:22 <DIR> --d----- c:\program files\XZAKTFrontFXTools1
2009-06-14 19:46 15,688 a------- c:\windows2\system32\lsdelete.exe
2009-06-14 17:56 64,160 a------- c:\windows2\system32\drivers\Lbd.sys
2009-06-14 17:45 <DIR> -cd-h--- c:\docume~1\alluse~2.win\applic~1\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-06-14 17:45 <DIR> --d----- c:\program files\Lavasoft
2009-06-11 17:17 <DIR> --d----- c:\windows2\system32\wbem\Repository
2009-06-11 17:15 <DIR> --d----- c:\program files\common files\WORDsearch
2009-06-11 17:15 <DIR> --d----- c:\docume~1\alluse~2.win\applic~1\wsc
2009-06-11 17:15 <DIR> --d----- c:\docume~1\dbp\applic~1\EBookSys
2009-06-10 22:15 66 a----r-- c:\windows2\amunres.lsl

==================== Find3M ====================

2009-06-30 22:02 524,288 a------- c:\windows2\system32\Busy_Wait.exe
2008-05-13 19:49 13 ----h--- c:\docume~1\alluse~2.win\applic~1\ÝÃÄΛÒ3113›.sys
2008-03-30 08:45 2,400,784 a------- c:\documents and settings\dbp\WLinstaller.exe
2008-03-04 11:10 724,984 a------- c:\documents and settings\dbp\gotomypc_437.exe
2008-02-27 01:05 774,144 a------- c:\program files\RngInterstitial.dll
2008-02-08 14:03 13 ----h--- c:\docume~1\alluse~2.win\applic~1\ÐÒÝÃÄ3113›˜.sys
2007-12-28 15:02 287,232 a------- c:\windows2\inf\wg111v3\wg111v3.sys
2007-12-28 14:59 342,528 a------- c:\windows2\inf\wg111v3\vista64\wg111v3.sys
2007-11-27 17:53 63,488 a------- c:\windows2\inf\wg111v3\SetDrv64.exe
2007-11-27 17:52 32,768 a------- c:\windows2\inf\wg111v3\SetDrv.exe
2007-08-21 14:10 3,902,784 a------- c:\documents and settings\dbp\gosetup.exe
2007-08-21 11:28 491 a------- c:\program files\UnInst.log
2007-01-25 21:28 722,176 a------- c:\documents and settings\dbp\gotomypc_428.exe
2007-01-20 10:01 563,712 a------- c:\documents and settings\dbp\gotomypc_370.exe
2006-12-15 11:30 315,392 a------- c:\windows2\inf\wg111v3\InstallDriver.exe
2006-12-15 11:30 212,992 a------- c:\windows2\inf\wg111v3\CopyWHQLDriver.exe
2006-12-15 11:30 98,304 a------- c:\windows2\inf\wg111v3\UScanM.exe
2006-12-15 11:30 20,480 a------- c:\windows2\inf\wg111v3\RTWUPath.exe
2006-12-15 11:30 19,968 a------- c:\windows2\inf\wg111v3\RTWREFU.EXE
2006-03-07 17:09 13 ----h--- c:\docume~1\alluse~2.win\applic~1\ÝÙÃÄ3113›.sys
2006-02-07 12:36 563,712 a------- c:\documents and settings\dbp\370_gotomypc.exe
2005-11-22 10:40 483,401 a------- c:\documents and settings\dbp\314_gotomypc.exe
2005-11-02 20:01 13 ----h--- c:\docume~1\alluse~2.win\applic~1\13.sys
2008-02-26 06:36 32,768 a--sh--- c:\windows2\system32\config\systemprofile\local settings\history\history.ie5\mshist012008022620080227\index.dat

============= FINISH: 19:10:10.87 ===============

at the present there are no IP ports open to 600pics.com (according to What's Running), but I am still finding that when I open Internext Explorer, The Task Manager shows me that two instances of that application are running, one significantly larger than the other (4mb compared to 49mb).

Thanks for your help.

Doug

[Blade81]

Hi again,

Upload following file to http://www.virustotal.com (answer yes if asked question about re-scan) and post back the results or a link to the results:
c:\windows2\system32\Busy_Wait.exe

Do you have special use for Adobe Acrobat 6.0.1 Professional? I'm asking cos vulnerabilities in Adobe Acrobat's old versions are widely exploited. Recommended action would be to uninstall that. In some cases it's not possible and then it's at least not advisable to open PDF documents with outdated Adobe Acrobat but with up-to-date Adobe Reader or some alternative PDF reader.

Anyway, Uninstall old Adobe Reader versions and get the latest one (9.1 + 9.1.2 update for it) here or get Foxit Reader here. Make sure you don't install toolbar if choose Foxit Reader! You may also check free readers introduced here.


Open notepad and copy/paste the text in the quotebox below into it:

Driver::
tdpipee

DDS::
uURLSearchHooks: H - No File
mSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
uSearchURL,(Default) = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com
BHO: {8B2A62D8-E333-42C1-955B-DC5278F9FF4D} - No File
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - No File
TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File
TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File
TB: {5854FAC4-5BF0-47DD-B5A9-A5EA8CFF3CF4} - No File
TB: {0C6DD65A-F36B-4AC8-89EB-6175AEE6BB8C} - No File

Regnull::
[HKEY_USERS\S-1-5-21-583907252-287218729-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{C55B90D8-06FA-C0FF-A797-9AB19D80AB23}*]

File::
c:\windows2\system32\drivers\tdpipee.sys
c:\docume~1\alluse~2.win\applic~1\ÝÃÄΛÒ3113›.sys
c:\docume~1\alluse~2.win\applic~1\ÐÒÝÃÄ3113›˜.sys
c:\docume~1\alluse~2.win\applic~1\ÝÙÃÄ3113›.sys
c:\docume~1\alluse~2.win\applic~1\13.sys

Folder::
c:\documents and settings\DBP\Application Data\LimeWire

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

Save this as
CFScript

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.



Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.


Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.


Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version...

Updating Java:

• Download the latest version of Java Runtime Environment (JRE) 6 Update 14.
• Click the
  Download
  button to the right.
• Select Windows on platform combobox and check the box that says:
  Accept License Agreement. Click continue.
  
• The page will refresh.
• Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java versions.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-6u14-windows-i586-p.exe to install the newest version. Uncheck MSN toolbar if it's offered there.

Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.


Please run an online scan with Kaspersky Online Scanner as instructed in the screenshot here.


Post back its report, a fresh dds.txt log and above mentioned ComboFix resultant log.

but I am still finding that when I open Internext Explorer, The Task Manager shows me that two instances of that application are running

Yes, that's in IE 8 by design.

[HSPower1972]

Here are the results of the Kaspersky scan:

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Wednesday, July 8, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3, v.3311 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Wednesday, July 08, 2009 06:32:20
Records in database: 2440451
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - Critical Areas:
C:\Documents and Settings\All Users.WINDOWS2\Start Menu\Programs\Startup
C:\Documents and Settings\DBP\Start Menu\Programs\Startup
C:\Program Files
C:\WINDOWS2

Scan statistics:
Files scanned: 83538
Threat name: 4
Infected objects: 4
Suspicious objects: 0
Duration of the scan: 02:29:59


File name / Threat name / Threats count
C:\Program Files\MSN Gaming Zone\rteje.html Infected: Trojan-Clicker.HTML.IFrame.dn 1
C:\WINDOWS2\Fonts\zia03376 Infected: Trojan-Downloader.Win32.VB.bsa 1
C:\WINDOWS2\system32\edcA18\edcA182328.exe Infected: Trojan-Downloader.Win32.VB.ceh 1
C:\WINDOWS2\system32\winsckdo.dll Infected: Trojan-GameThief.Win32.Nilage.cbq 1

The selected area was scanned.


dds and combofix logs to follow in separate post due to length restrictions.

Doug

[HSPower1972]

DDS Log:


DDS (Ver_09-06-26.01) - NTFSx86
Run by DBP at 1:59:30.18 on Wed 07/08/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.137 [GMT -7:00]


============== Running Processes ===============

C:\WINDOWS2\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS2\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS2\system32\spoolsv.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS2\system32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS2\system32\wscntfy.exe
C:\WINDOWS2\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\NETGEAR\WG111v3\WG111v3.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Documents and Settings\DBP\Desktop\system\dds.scr

============== Pseudo HJT Report ===============

uInternet Settings,ProxyServer = 192.168.0.5:8080
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com
uURLSearchHooks: H - No File
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: X1IEHook Class: {52706ef7-d7a2-49ad-a615-e903858cf284} - c:\program files\netzero\qsacc\X1IEBHO.dll
BHO: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\progra~1\yahoo!\common\yiesrvc.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows2\system32\dla\tfswshx.dll
BHO: WsftpBrowserHelper Class: {601ed020-fb6c-11d3-87d8-0050da59922b} - c:\program files\ipswitch\ws_ftp pro\wsbho2k0.dll
BHO: {8B2A62D8-E333-42C1-955B-DC5278F9FF4D} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SidebarAutoLaunch Class: {f2aa9440-6328-4933-b7c9-a6ccdf9cbf6d} - c:\program files\yahoo!\browser\YSidebarIEBHO.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
TB: ZeroBar: {f5735c15-1fb2-41fe-ba12-242757e69dde} - c:\program files\netzero\toolbar.dll
TB: ZeroBar: {f0f8ecbe-d460-4b34-b007-56a92e8f84a7} - c:\program files\netzero\Toolbar.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
StartupFolder: c:\docume~1\dbp\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\docume~1\dbp\startm~1\programs\startup\webshots.lnk - c:\program files\webshots\Launcher.exe
StartupFolder: c:\docume~1\alluse~2.win\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear\wg111v3\WG111v3.exe
IE: Display All Images with Full Quality - c:\program files\netzero\qsacc\appres.dll/228
IE: Display Image with Full Quality - c:\program files\netzero\qsacc\appres.dll/227
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\progra~1\yahoo!\common\yiesrvc.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
Trusted Zone: att.net
Trusted Zone: microsoft.com\office
Trusted Zone: sbcglobal.net
Trusted Zone: yahoo.com
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS2/Java/classes/xmldso.cab
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://go.microsoft.com/fwlink/?linkid=58813
DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} - hxxps://support.microsoft.com/OAS/ActiveX/MSDcode.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/5/b/0/5b0d4654-aa20-495c-b89f-c1c34c691085/LegitCheckControl.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} - hxxps://webdl.symantec.com/activex/symdlmgr.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} - hxxp://www.sibelius.com/download/software/win/ActiveXPlugin.cab
DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: {F9CDFA58-BAA3-4C29-BD94-83FBB681E11B} = 207.69.188.185,207.69.188.186
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
Handler: ezpp - {810403FA-E82E-11D5-8AAB-0010A404A3DE} - c:\windows2\system32\EZTOOL~1.DLL
Handler: junomsg - {C4D10830-379D-11d4-9B2D-00C04F1579A5} - c:\program files\juno\bin\jmsgpph.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows2\system32\WPDShServiceObj.dll
STS: IE Component Categories cache daemon: {553858a7-4922-4e7e-b1c1-97140c1c16ef} - c:\windows2\system32\ieframe.dll

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows2\system32\drivers\Lbd.sys [2009-6-14 64160]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows2\system32\drivers\EAPPkt.sys [2007-10-9 38144]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-6-17 24652]
R3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows2\system32\drivers\wg111v3.sys [2007-12-28 287232]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 1029456]
S3 acfva;acfva;c:\windows2\system32\drivers\acfva.sys [2006-9-2 28445]
S3 ADSFilter;ADSFilter - (Aluria Filter Driver);c:\windows2\system32\drivers\adsfilter.sys --> c:\windows2\system32\drivers\ADSFilter.sys [?]
S3 BW2NDIS5;BW2NDIS5;c:\windows2\system32\drivers\bw2ndis5.sys --> c:\windows2\system32\drivers\BW2NDIS5.sys [?]
S3 WlanUIG;2Wire 802.11g USB Driver;c:\windows2\system32\drivers\WlanUIG.sys [2007-1-13 347648]
S4 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2007-1-9 108648]
S4 ccPwdSvc;Symantec Password Validation;c:\program files\common files\symantec shared\CCPWDSVC.EXE [2004-12-13 79520]
S4 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2007-1-9 108648]
S4 Stuffit Archive Name Service;Stuffit Archive Name Service;c:\program files\smith micro\stuffit11\ArcNameService.exe [2007-7-18 157000]
S4 Symantec Core LC;Symantec Core LC;c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe [2006-8-18 1251720]

=============== Created Last 30 ================

2009-07-07 19:30 410,984 a------- c:\windows2\system32\deploytk.dll
2009-07-07 19:30 73,728 a------- c:\windows2\system32\javacpl.cpl
2009-07-06 18:17 <DIR> -cd----- c:\windows2\system32\dllcache\cache
2009-07-06 17:16 <DIR> a-dshr-- C:\cmdcons
2009-07-06 17:11 161,792 a------- c:\windows2\SWREG.exe
2009-07-06 17:11 155,136 a------- c:\windows2\PEV.exe
2009-07-06 17:11 98,816 a------- c:\windows2\sed.exe
2009-06-29 17:13 <DIR> --d----- c:\program files\Trend Micro
2009-06-27 11:06 <DIR> --d-h--- c:\windows2\msdownld.tmp
2009-06-27 11:06 <DIR> --d----- c:\windows2\Logs
2009-06-20 08:22 <DIR> --d----- c:\program files\XZAKTFrontFXTools1
2009-06-14 19:46 15,688 a------- c:\windows2\system32\lsdelete.exe
2009-06-14 17:56 64,160 a------- c:\windows2\system32\drivers\Lbd.sys
2009-06-14 17:45 <DIR> -cd-h--- c:\docume~1\alluse~2.win\applic~1\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-06-14 17:45 <DIR> --d----- c:\program files\Lavasoft
2009-06-11 17:17 <DIR> --d----- c:\windows2\system32\wbem\Repository
2009-06-11 17:15 <DIR> --d----- c:\program files\common files\WORDsearch
2009-06-11 17:15 <DIR> --d----- c:\docume~1\alluse~2.win\applic~1\wsc
2009-06-11 17:15 <DIR> --d----- c:\docume~1\dbp\applic~1\EBookSys
2009-06-10 22:15 66 a----r-- c:\windows2\amunres.lsl

==================== Find3M ====================

2009-06-30 22:02 524,288 a------- c:\windows2\system32\Busy_Wait.exe
2008-03-30 08:45 2,400,784 a------- c:\documents and settings\dbp\WLinstaller.exe
2008-03-04 11:10 724,984 a------- c:\documents and settings\dbp\gotomypc_437.exe
2008-02-27 01:05 774,144 a------- c:\program files\RngInterstitial.dll
2007-12-28 15:02 287,232 a------- c:\windows2\inf\wg111v3\wg111v3.sys
2007-12-28 14:59 342,528 a------- c:\windows2\inf\wg111v3\vista64\wg111v3.sys
2007-11-27 17:53 63,488 a------- c:\windows2\inf\wg111v3\SetDrv64.exe
2007-11-27 17:52 32,768 a------- c:\windows2\inf\wg111v3\SetDrv.exe
2007-08-21 14:10 3,902,784 a------- c:\documents and settings\dbp\gosetup.exe
2007-08-21 11:28 491 a------- c:\program files\UnInst.log
2007-01-25 21:28 722,176 a------- c:\documents and settings\dbp\gotomypc_428.exe
2007-01-20 10:01 563,712 a------- c:\documents and settings\dbp\gotomypc_370.exe
2006-12-15 11:30 315,392 a------- c:\windows2\inf\wg111v3\InstallDriver.exe
2006-12-15 11:30 212,992 a------- c:\windows2\inf\wg111v3\CopyWHQLDriver.exe
2006-12-15 11:30 98,304 a------- c:\windows2\inf\wg111v3\UScanM.exe
2006-12-15 11:30 20,480 a------- c:\windows2\inf\wg111v3\RTWUPath.exe
2006-12-15 11:30 19,968 a------- c:\windows2\inf\wg111v3\RTWREFU.EXE
2006-02-07 12:36 563,712 a------- c:\documents and settings\dbp\370_gotomypc.exe
2005-11-22 10:40 483,401 a------- c:\documents and settings\dbp\314_gotomypc.exe
2008-02-26 06:36 32,768 a--sh--- c:\windows2\system32\config\systemprofile\local settings\history\history.ie5\mshist012008022620080227\index.dat

============= FINISH: 2:00:44.87 ===============

[HSPower1972]

Combofix logis too long to copy paste all at once, so here is first part:

ComboFix 09-07-07.A2 - DBP 07/07/2009 17:42.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.267 [GMT -7:00]
Running from: c:\documents and settings\DBP\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\DBP\Desktop\cfscript.txt
* Created a new restore point

FILE ::
"c:\docume~1\alluse~2.win\applic~1\ÐÒÝÃÄ3113›˜.sys"
"c:\docume~1\alluse~2.win\applic~1\ÝÙÃÄ3113›.sys"
"c:\docume~1\alluse~2.win\applic~1\ÝÃÄΛÒ3113›.sys"
"c:\docume~1\alluse~2.win\applic~1\13.sys"
"c:\windows2\system32\drivers\tdpipee.sys"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\alluse~2.win\applic~1\ÐÒÝÃÄ3113›˜.sys
c:\docume~1\alluse~2.win\applic~1\ÝÙÃÄ3113›.sys
c:\docume~1\alluse~2.win\applic~1\ÝÃÄΛÒ3113›.sys
c:\docume~1\alluse~2.win\applic~1\13.sys
c:\documents and settings\DBP\Application Data\LimeWire
c:\documents and settings\DBP\Application Data\LimeWire\412splashfree.png
c:\documents and settings\DBP\Application Data\LimeWire\414splashfree.png
c:\documents and settings\DBP\Application Data\LimeWire\browser\xul-v2.0b2.4-do-not-remove
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\AccessibleMarshal.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\chrome\branding.jar
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\chrome\branding.manifest
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\chrome\classic.jar
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\chrome\classic.manifest
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\chrome\comm.jar
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\chrome\comm.manifest
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\chrome\en-US.jar
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\chrome\en-US.manifest
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\chrome\limewire.jar
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\chrome\limewire.manifest
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\chrome\pippki.jar
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\chrome\pippki.manifest
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\chrome\toolkit.jar
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\chrome\toolkit.manifest
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\accessibility-msaa.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\accessibility.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\alerts.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\appshell.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\appshell_modal.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\appshell_modal.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\appstartup.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\auth.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\autocomplete.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\autoconfig.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\autoconfig.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\caps.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\chardet.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\chrome.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\commandhandler.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\commandlines.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\composer.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\content_base.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\content_html.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\content_htmldoc.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\content_xmldoc.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\content_xslt.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\content_xtf.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\contentprefs.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\cookie.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\directory.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\docshell_base.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\dom.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\dom_base.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\dom_canvas.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\dom_core.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\dom_css.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\dom_events.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\dom_html.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\dom_json.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\dom_loadsave.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\dom_offline.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\dom_range.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\dom_sidebar.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\dom_storage.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\dom_stylesheets.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\dom_svg.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\dom_traversal.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\dom_views.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\dom_xbl.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\dom_xpath.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\dom_xul.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\downloads.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\editor.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\embed_base.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\extensions.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\exthandler.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\exthelper.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\fastfind.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\FeedProcessor.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\feeds.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\find.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\gfx.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\htmlparser.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\imgicon.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\imglib2.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\inspector.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\intl.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\jar.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\jsconsole-clhandler.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\jsdservice.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\layout_base.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\layout_printing.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\layout_xul.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\layout_xul_tree.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\locale.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\loginmgr.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\lwbrk.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\mimetype.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\mozbrwsr.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\mozfind.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\necko.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\necko_about.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\necko_cache.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\necko_cookie.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\necko_dns.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\necko_file.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\necko_ftp.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\necko_http.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\necko_res.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\necko_socket.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\necko_strconv.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\necko_viewsource.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\nsAddonRepository.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\nsBadCertHandler.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\nsBlocklistService.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\nsContentDispatchChooser.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\nsContentPrefService.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\nsDefaultCLH.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\nsDictionary.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\nsDownloadManagerUI.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\nsExtensionManager.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\nsHandlerService.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\nsHelperAppDlg.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\nsLivemarkService.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\nsLoginInfo.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\nsLoginManager.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\nsLoginManagerPrompter.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\nsPostUpdateWin.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\nsProgressDialog.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\nsProxyAutoConfig.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\nsResetPref.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\nsTaggingService.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\nsTryToClose.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\nsUpdateService.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\nsURLFormatter.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\nsWebHandlerApp.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\nsXmlRpcClient.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\nsXULAppInstall.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\oji.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\parentalcontrols.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\pipboot.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\pipboot.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\pipnss.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\pipnss.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\pippki.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\pippki.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\places.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\plugin.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\pluginGlue.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\pref.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\prefetch.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\profile.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\proxyObject.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\rdf.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\satchel.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\saxparser.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\shistory.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\spellchecker.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\storage-Legacy.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\storage.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\toolkitprofile.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\transformiix.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\txEXSLTRegExFunctions.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\txmgr.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\txtsvc.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\uconv.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\unicharutil.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\universalchardet.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\update.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\uriloader.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\urlformatter.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\webBrowser_core.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\webbrowserpersist.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\webshell_idls.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\websrvcs.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\widget.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\windowds.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\windowwatcher.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\xml-rpc.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\xmlextras.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\xpcom_base.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\xpcom_components.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\xpcom_ds.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\xpcom_io.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\xpcom_system.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\xpcom_thread.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\xpcom_xpti.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\xpconnect.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\xpinstall.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\xulapp.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\xulapp_setup.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\xuldoc.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\xultmpl.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\xulutil.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\components\zipwriter.xpt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\crashreporter.exe
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\crashreporter.ini
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\defaults\autoconfig\platform.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\defaults\autoconfig\prefcalls.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\defaults\pref\xulrunner.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\defaults\profile\chrome\userChrome-example.css
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\defaults\profile\chrome\userContent-example.css
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\defaults\profile\localstore.rdf
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\defaults\profile\US\chrome\userChrome-example.css
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\defaults\profile\US\chrome\userContent-example.css
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\defaults\profile\US\localstore.rdf
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\dependentlibs.list
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\dictionaries\en-US.aff
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\dictionaries\en-US.dic
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\freebl3.chk
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\freebl3.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\greprefs\all.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\greprefs\security-prefs.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\greprefs\xpinstall.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\IA2Marshal.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\javaxpcom.jar
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\javaxpcomglue.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\js3250.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\LICENSE
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\modules\debug.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\modules\DownloadUtils.jsm
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\modules\ISO8601DateUtils.jsm
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\modules\JSON.jsm
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\modules\Microformats.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\modules\PluralForm.jsm
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\modules\utils.js
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\modules\XPCOMUtils.jsm
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\mozctl.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\mozctlx.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\MSVCP71.DLL
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\msvcr71.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\nspr4.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\nss3.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\nssckbi.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\nssdbm3.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\nssutil3.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\platform.ini
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\plc4.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\plds4.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\plugins\npnul32.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\README.txt
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\arrow.gif
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\arrowd.gif
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\broken-image.gif
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\charsetalias.properties
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\charsetData.properties
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\contenteditable.css
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\designmode.css
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\dtd\mathml.dtd
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\dtd\xhtml11.dtd
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\EditorOverride.css
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\entityTables\html40Latin1.properties
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\entityTables\html40Special.properties
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\entityTables\html40Symbols.properties
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\entityTables\htmlEntityVersions.properties
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\entityTables\mathml20.properties
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\entityTables\transliterate.properties
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfont.properties
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontStandardSymbolsL.properties
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontSTIXNonUnicode.properties
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontSTIXSize1.properties
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontSymbol.properties
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontUnicode.properties
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\forms.css
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\grabber.gif
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\hiddenWindow.html
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\html.css
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\html\folder.png
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\langGroups.properties
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\language.properties
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\loading-image.gif
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\mathml.css
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\quirk.css
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\svg.css
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\table-add-column-after-active.gif
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\table-add-column-after-hover.gif
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\table-add-column-after.gif
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\table-add-column-before-active.gif
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\table-add-column-before-hover.gif
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\table-add-column-before.gif
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\table-add-row-after-active.gif
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\table-add-row-after-hover.gif
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\table-add-row-after.gif
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\table-add-row-before-active.gif
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\table-add-row-before-hover.gif
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\table-add-row-before.gif
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\table-remove-column-active.gif
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\table-remove-column-hover.gif
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\table-remove-column.gif
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\table-remove-row-active.gif
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\table-remove-row-hover.gif
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\table-remove-row.gif
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\ua.css
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\viewsource.css
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\res\wincharset.properties
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\smime3.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\softokn3.chk
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\softokn3.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\sqlite3.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\ssl3.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\updater.exe
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\version.properties
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\xpcom.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\xpcshell.exe
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\xpicleanup.exe
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\xpidl.exe
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\xpt_dump.exe
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\xpt_link.exe
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\xul.dll
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\xulrunner-stub.exe
c:\documents and settings\DBP\Application Data\LimeWire\browser\xulrunner\xulrunner.exe
c:\documents and settings\DBP\Application Data\LimeWire\bugs.data
c:\documents and settings\DBP\Application Data\LimeWire\certificate\limewire.keystore
c:\documents and settings\DBP\Application Data\LimeWire\createtimes.cache
c:\documents and settings\DBP\Application Data\LimeWire\data.ser
c:\documents and settings\DBP\Application Data\LimeWire\downloads.dat
c:\documents and settings\DBP\Application Data\LimeWire\fileurns.bak
c:\documents and settings\DBP\Application Data\LimeWire\fileurns.cache
c:\documents and settings\DBP\Application Data\LimeWire\filters.props
c:\documents and settings\DBP\Application Data\LimeWire\gnutella.net
c:\documents and settings\DBP\Application Data\LimeWire\installation.props
c:\documents and settings\DBP\Application Data\LimeWire\library.dat
c:\documents and settings\DBP\Application Data\LimeWire\library5.dat
c:\documents and settings\DBP\Application Data\LimeWire\limewire.props
c:\documents and settings\DBP\Application Data\LimeWire\mojito.props
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\.autoreg
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\Cache\_CACHE_001_
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\Cache\_CACHE_002_
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\Cache\_CACHE_003_
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\Cache\_CACHE_MAP_
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\Cache\18AD2C19d01
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\Cache\27F0EFC1d01
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\Cache\43333CB8d01
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\Cache\7973F814d01
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\Cache\7A2D9D1Ed01
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\Cache\7BD6A121d01
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\Cache\AE98BDFAd01
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\Cache\BAFF9A8Cd01
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\Cache\FD7C3D70d01
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\cert8.db
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\compreg.dat
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\cookies.sqlite
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\downloads.sqlite
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\extensions.cache
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\extensions.ini
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\history.dat
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\key3.db
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\OfflineCache\index.sqlite
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\permissions.sqlite
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\places.sqlite-journal
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\places.sqlite
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\pluginreg.dat
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\prefs.js
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\secmod.db
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\XPC.mfl
c:\documents and settings\DBP\Application Data\LimeWire\mozilla-profile\xpti.dat
c:\documents and settings\DBP\Application Data\LimeWire\promotion\promodb.backup
c:\documents and settings\DBP\Application Data\LimeWire\promotion\promodb.data
c:\documents and settings\DBP\Application Data\LimeWire\promotion\promodb.properties
c:\documents and settings\DBP\Application Data\LimeWire\promotion\promodb.script
c:\documents and settings\DBP\Application Data\LimeWire\pub1.key
c:\documents and settings\DBP\Application Data\LimeWire\public.key
c:\documents and settings\DBP\Application Data\LimeWire\questions.props
c:\documents and settings\DBP\Application Data\LimeWire\responses.cache
c:\documents and settings\DBP\Application Data\LimeWire\secureMessage.key
c:\documents and settings\DBP\Application Data\LimeWire\simpp.xml
c:\documents and settings\DBP\Application Data\LimeWire\spam.dat
c:\documents and settings\DBP\Application Data\LimeWire\tables.props
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme.lwtp
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme\01_star.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme\02_star.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme\03_star.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme\04_star.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme\05_star.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme\chat.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme\dir_closed.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme\dir_open.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme\forward_dn.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme\forward_up.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme\kill.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme\kill_on.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme\lime.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme\logo.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme\notsearching.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme\pause_dn.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme\pause_up.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme\play_dn.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme\play_up.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme\question.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme\rewind_dn.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme\rewind_up.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme\searching.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme\splash.png
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme\splashpro.png
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme\stop_dn.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme\stop_up.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme\theme.txt
c:\documents and settings\DBP\Application Data\LimeWire\themes\black_theme\warning.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\classic_theme.lwtp
c:\documents and settings\DBP\Application Data\LimeWire\themes\classic_theme\01_star.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\classic_theme\02_star.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\classic_theme\03_star.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\classic_theme\04_star.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\classic_theme\05_star.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\classic_theme\chat.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\classic_theme\dir_closed.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\classic_theme\dir_open.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\classic_theme\forward_dn.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\classic_theme\forward_up.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\classic_theme\kill.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\classic_theme\logo.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\classic_theme\notsearching.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\classic_theme\pause_dn.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\classic_theme\pause_up.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\classic_theme\play_dn.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\classic_theme\play_up.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\classic_theme\question.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\classic_theme\rewind_dn.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\classic_theme\rewind_up.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\classic_theme\search.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\classic_theme\searching.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\classic_theme\splash.png
c:\documents and settings\DBP\Application Data\LimeWire\themes\classic_theme\splashpro.png
c:\documents and settings\DBP\Application Data\LimeWire\themes\classic_theme\stop_dn.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\classic_theme\stop_up.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\classic_theme\theme.txt
c:\documents and settings\DBP\Application Data\LimeWire\themes\classic_theme\warning.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme.lwtp
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme\01_star.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme\02_star.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme\03_star.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme\04_star.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme\05_star.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme\chat.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme\dir_closed.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme\dir_open.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme\forward_dn.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme\forward_up.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme\kill.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme\kill_on.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme\lime.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme\logo.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme\notsearching.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme\pause_dn.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme\pause_up.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme\play_dn.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme\play_up.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme\question.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme\rewind_dn.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme\rewind_up.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme\searching.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme\splash.png
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme\splashpro.png
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme\stop_dn.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme\stop_up.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme\theme.txt
c:\documents and settings\DBP\Application Data\LimeWire\themes\limewire_theme\warning.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\other_theme.lwtp
c:\documents and settings\DBP\Application Data\LimeWire\themes\other_theme\01_star.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\other_theme\02_star.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\other_theme\03_star.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\other_theme\04_star.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\other_theme\05_star.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\other_theme\chat.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\other_theme\forward_dn.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\other_theme\forward_up.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\other_theme\kill.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\other_theme\kill_on.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\other_theme\logo.png
c:\documents and settings\DBP\Application Data\LimeWire\themes\other_theme\name.txt
c:\documents and settings\DBP\Application Data\LimeWire\themes\other_theme\notsearching.png
c:\documents and settings\DBP\Application Data\LimeWire\themes\other_theme\pause_dn.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\other_theme\pause_up.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\other_theme\play_dn.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\other_theme\play_up.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\other_theme\question.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\other_theme\rewind_dn.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\other_theme\rewind_up.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\other_theme\searching.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\other_theme\splash.png
c:\documents and settings\DBP\Application Data\LimeWire\themes\other_theme\splashpro.png
c:\documents and settings\DBP\Application Data\LimeWire\themes\other_theme\stop_dn.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\other_theme\stop_up.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\other_theme\theme.txt
c:\documents and settings\DBP\Application Data\LimeWire\themes\other_theme\version.txt
c:\documents and settings\DBP\Application Data\LimeWire\themes\other_theme\warning.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\windows_theme.lwtp
c:\documents and settings\DBP\Application Data\LimeWire\themes\windows_theme\01_star.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\windows_theme\02_star.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\windows_theme\03_star.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\windows_theme\04_star.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\windows_theme\05_star.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\windows_theme\chat.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\windows_theme\forward_dn.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\windows_theme\forward_up.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\windows_theme\kill.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\windows_theme\kill_on.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\windows_theme\logo.png
c:\documents and settings\DBP\Application Data\LimeWire\themes\windows_theme\notsearching.png
c:\documents and settings\DBP\Application Data\LimeWire\themes\windows_theme\pause_dn.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\windows_theme\pause_up.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\windows_theme\play_dn.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\windows_theme\play_up.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\windows_theme\question.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\windows_theme\rewind_dn.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\windows_theme\rewind_up.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\windows_theme\searching.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\windows_theme\splash.png
c:\documents and settings\DBP\Application Data\LimeWire\themes\windows_theme\splashpro.png
c:\documents and settings\DBP\Application Data\LimeWire\themes\windows_theme\stop_dn.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\windows_theme\stop_up.gif
c:\documents and settings\DBP\Application Data\LimeWire\themes\windows_theme\theme.txt
c:\documents and settings\DBP\Application Data\LimeWire\themes\windows_theme\version.txt
c:\documents and settings\DBP\Application Data\LimeWire\themes\windows_theme\warning.gif
c:\documents and settings\DBP\Application Data\LimeWire\Thumbs.db
c:\documents and settings\DBP\Application Data\LimeWire\ttdata.cache
c:\documents and settings\DBP\Application Data\LimeWire\ttree.cache
c:\documents and settings\DBP\Application Data\LimeWire\ttrees.cache
c:\documents and settings\DBP\Application Data\LimeWire\ttroot.cache
c:\documents and settings\DBP\Application Data\LimeWire\update.xml
c:\documents and settings\DBP\Application Data\LimeWire\version.key
c:\documents and settings\DBP\Application Data\LimeWire\version.xml
c:\documents and settings\DBP\Application Data\LimeWire\versions.props
c:\documents and settings\DBP\Application Data\LimeWire\xml\data\audio.sxml2
c:\documents and settings\DBP\Application Data\LimeWire\xml\data\audio.sxml3
c:\documents and settings\DBP\Application Data\LimeWire\xml\data\delete_me
c:\documents and settings\DBP\Application Data\LimeWire\xml\data\video.sxml3
c:\documents and settings\DBP\Application Data\LimeWire\xml\misc\application.gif
c:\documents and settings\DBP\Application Data\LimeWire\xml\misc\audio.gif
c:\documents and settings\DBP\Application Data\LimeWire\xml\misc\document.gif
c:\documents and settings\DBP\Application Data\LimeWire\xml\misc\image.gif
c:\documents and settings\DBP\Application Data\LimeWire\xml\misc\video.gif
c:\documents and settings\DBP\Application Data\LimeWire\xml\schemas\application.xsd
c:\documents and settings\DBP\Application Data\LimeWire\xml\schemas\audio.xsd
c:\documents and settings\DBP\Application Data\LimeWire\xml\schemas\document.xsd
c:\documents and settings\DBP\Application Data\LimeWire\xml\schemas\image.xsd
c:\documents and settings\DBP\Application Data\LimeWire\xml\schemas\video.xsd

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

[HSPower1972]

Here is remainder:


-------\Legacy_TDPIPEE
-------\Service_tdpipee


((((((((((((((((((((((((( Files Created from 2009-06-08 to 2009-07-08 )))))))))))))))))))))))))))))))
.

2009-07-04 02:52 . 2009-07-04 02:52 84832 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\ShellExt.dll
2009-07-04 02:52 . 2009-07-04 02:52 1630560 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll
2009-06-30 04:41 . 2009-06-30 04:41 -------- d-sh--w- c:\documents and settings\Administrator.MARKETING\IETldCache
2009-06-30 01:08 . 2009-06-30 01:08 314712 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe
2009-06-30 01:08 . 2009-06-30 01:08 25440 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\savapibridge.dll
2009-06-30 01:08 . 2009-06-30 01:08 169312 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\lavamessage.dll
2009-06-30 01:07 . 2009-06-30 01:07 348496 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\lavalicense.dll
2009-06-30 01:07 . 2009-06-30 01:07 298336 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2009-06-30 01:05 . 2009-06-30 01:05 246128 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll
2009-06-30 01:04 . 2009-06-30 01:04 40288 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2009-06-30 01:04 . 2009-06-30 01:04 85352 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\Drivers\32\AAWDriverTool.exe
2009-06-30 01:04 . 2009-06-30 01:04 664424 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2009-06-30 01:03 . 2009-06-30 01:03 563064 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2009-06-30 01:03 . 2009-06-30 01:03 566632 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2009-06-30 01:02 . 2009-06-30 01:02 2352968 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2009-06-30 01:01 . 2009-06-30 01:01 629072 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\AAWWSC.exe
2009-06-30 01:00 . 2009-06-30 01:00 520024 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe
2009-06-30 01:00 . 2009-06-30 01:00 1029456 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2009-06-30 00:13 . 2009-06-30 00:13 -------- d-----w- c:\program files\Trend Micro
2009-06-30 00:10 . 2009-06-30 00:10 -------- d-----w- c:\program files\ERUNT
2009-06-27 18:06 . 2009-06-27 18:09 -------- d--h--w- c:\windows2\msdownld.tmp
2009-06-27 18:06 . 2009-06-27 18:06 -------- d-----w- c:\windows2\Logs
2009-06-20 15:22 . 2009-07-07 02:22 -------- d-----w- c:\program files\XZAKTFrontFXTools1
2009-06-16 02:56 . 2009-06-16 02:56 -------- d-sh--w- c:\documents and settings\LocalService.NT AUTHORITY.000\IETldCache
2009-06-15 02:46 . 2009-06-15 00:56 15688 ----a-w- c:\windows2\system32\lsdelete.exe
2009-06-15 00:56 . 2009-06-15 00:54 64160 ----a-w- c:\windows2\system32\drivers\Lbd.sys
2009-06-15 00:56 . 2009-06-15 00:56 15688 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe
2009-06-15 00:54 . 2009-06-15 00:54 64160 ----a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft\Ad-Aware\Update\Drivers\32\lbd.sys
2009-06-15 00:45 . 2009-06-15 00:45 -------- dc-h--w- c:\documents and settings\All Users.WINDOWS2\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-06-15 00:45 . 2009-03-12 08:17 2902048 -c--a-w- c:\documents and settings\All Users.WINDOWS2\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}\Ad-AwareAE.exe
2009-06-15 00:45 . 2009-06-15 00:45 -------- d-----w- c:\program files\Lavasoft
2009-06-12 00:17 . 2009-06-12 00:17 -------- d-----w- c:\windows2\system32\wbem\Repository
2009-06-12 00:15 . 2009-06-12 00:15 -------- d-----w- c:\program files\Common Files\WORDsearch
2009-06-12 00:15 . 2009-06-12 00:15 -------- d-----w- c:\documents and settings\All Users.WINDOWS2\Application Data\wsc
2009-06-12 00:15 . 2009-06-12 00:15 -------- d-----w- c:\documents and settings\DBP\Application Data\EBookSys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-01 05:02 . 2007-08-21 18:28 524288 ----a-w- c:\windows2\system32\Busy_Wait.exe
2009-06-30 05:13 . 2009-03-23 08:36 -------- d-----w- c:\program files\Bonjour
2009-06-28 00:43 . 2006-09-02 21:34 -------- d-----w- c:\program files\UIU
2009-06-27 23:52 . 2006-02-27 19:14 -------- d-----w- c:\program files\WhatsRunning
2009-06-20 15:20 . 2006-05-25 16:27 -------- d-----w- c:\program files\XZAKT FrontFX Tools+ 2
2009-06-15 00:45 . 2007-07-04 08:51 -------- d-----w- c:\documents and settings\All Users.WINDOWS2\Application Data\Lavasoft
2009-06-12 00:16 . 2006-03-24 00:48 -------- d-----w- c:\documents and settings\DBP\Application Data\Xara
2009-06-12 00:16 . 2006-04-26 19:33 -------- d-----w- c:\program files\HTML Password Lock
2009-06-12 00:16 . 2009-04-25 21:04 -------- d-----w- c:\program files\Xara
2009-06-12 00:15 . 2009-05-26 23:44 -------- dc-h--w- c:\documents and settings\All Users.WINDOWS2\Application Data\{CDF61231-6AD7-4969-B4DD-9E6C0F51DD5E}
2009-06-12 00:15 . 2008-03-17 16:28 -------- d-----w- c:\program files\Bible Explorer 4
2009-06-12 00:14 . 2009-03-23 08:33 -------- d-----w- c:\program files\Common Files\Apple
2009-06-12 00:14 . 2005-09-14 02:15 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-06-12 00:13 . 2004-12-10 22:50 -------- d-----w- c:\program files\Common Files\Macromedia
2009-06-12 00:13 . 2005-11-03 21:58 -------- d-----w- c:\program files\Opera
2009-06-12 00:13 . 2005-10-24 19:32 -------- d-----w- c:\program files\Macromedia
2009-06-12 00:10 . 2009-05-09 05:24 -------- d-----w- c:\program files\Lame for Audacity
2009-06-11 23:54 . 2008-08-29 03:02 -------- d-----w- c:\program files\SourceTec
2009-06-11 23:54 . 2008-08-29 03:02 -------- d-----w- c:\program files\Common Files\SourceTec
2009-06-11 23:52 . 2006-03-07 17:12 -------- d-----w- c:\program files\CoffeeCup Software
2009-05-27 03:00 . 2005-10-20 22:12 852432 ----a-w- c:\documents and settings\DBP\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-23 18:28 . 2009-02-26 18:58 -------- d-----w- c:\program files\My Journal
2009-05-23 01:21 . 2009-04-30 21:15 -------- d-----w- c:\documents and settings\DBP\Application Data\Move Networks
2009-05-22 05:44 . 2004-12-03 08:49 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-15 06:12 . 2009-05-15 06:12 45056 ----a-r- c:\documents and settings\DBP\Application Data\Microsoft\Installer\{885A63EA-382B-4DD4-A755-14809B8557D6}\ARPPRODUCTICON.exe
2009-05-10 08:45 . 2009-05-10 08:45 -------- d-----w- c:\documents and settings\DBP\Application Data\Doomi.809F847005C7832B69625A614BB25CA209244440.1
2009-05-09 02:45 . 2009-05-09 02:45 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-05-09 02:43 . 2009-05-09 02:45 38208 ----a-w- c:\documents and settings\DBP\Application Data\Macromedia\Flash Player\http://www.macromedia.com\bin\airapp...pinstaller.exe
2009-05-02 23:04 . 2009-05-02 23:04 34062 ----a-w- c:\documents and settings\DBP\Application Data\Move Networks\ie_bin\Uninst.exe
2009-05-01 05:31 . 2009-05-01 05:31 295606 ----a-r- c:\documents and settings\DBP\Application Data\Microsoft\Installer\{AC76BA86-7AD7-1033-7B44-A81300000003}\SC_Reader.exe
2009-04-29 21:37 . 2009-04-29 21:37 21035 ----a-w- c:\windows2\system32\drivers\AegisP.sys
2008-02-27 08:05 . 2008-02-27 08:06 774144 ----a-w- c:\program files\RngInterstitial.dll
2007-08-21 18:28 . 2007-08-21 18:28 491 ----a-w- c:\program files\UnInst.log
.

((((((((((((((((((((((((((((( SnapShot@2009-07-07_01.07.33 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-07 13:20 . 2009-07-07 13:20 512000 c:\windows2\ERDNT\AutoBackup\7-7-2009\Users\00000002\UsrClass.dat
+ 2009-07-07 13:20 . 2005-10-20 19:02 163328 c:\windows2\ERDNT\AutoBackup\7-7-2009\ERDNT.EXE
+ 2009-07-07 13:20 . 2009-07-07 13:20 11935744 c:\windows2\ERDNT\AutoBackup\7-7-2009\Users\00000001\ntuser.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-06 413696]

c:\documents and settings\DBP\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
Webshots.lnk - c:\program files\Webshots\Launcher.exe [2004-12-10 45056]

c:\documents and settings\All Users.WINDOWS2\Start Menu\Programs\Startup\
NETGEAR WG111v3 Smart Wizard.lnk - c:\program files\NETGEAR\WG111v3\WG111v3.exe [2008-7-1 2326528]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SDhelper"=2 (0x2)
"ADSService"=2 (0x2)
"ElnkFWPPService"=3 (0x3)
"cmdService"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"Symantec Core LC"=2 (0x2)
"Pml Driver HPZ12"=3 (0x3)
"ose"=3 (0x3)
"NetSvc"=2 (0x2)
"MDM"=2 (0x2)
"Macromedia Licensing Service"=2 (0x2)
"LiveUpdate"=3 (0x3)
"gusvc"=3 (0x3)
"ccSetMgr"=2 (0x2)
"ccPwdSvc"=3 (0x3)
"ccEvtMgr"=2 (0x2)
"Automatic LiveUpdate Scheduler"=2 (0x2)
"iPod Service"=3 (0x3)
"Bonjour Service"=2 (0x2)
"Adobe LM Service"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\America Online 9.0b\\waol.exe"=
"c:\\Program Files\\Common Files\\AOL\\1157172737\\EE\\AOLServiceHost.exe"=
"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
"c:\\Program Files\\Common Files\\AOL\\1157172737\\EE\\aim6.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"=
"c:\\WINDOWS2\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS2\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Macromedia\\Dreamweaver MX 2004\\Dreamweaver.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\msncall.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1157172737\\EE\\aolsoftware.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8097:TCP"= 8097:TCP:*:Disabled:EarthLink UHP Modem Support
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"8085:TCP"= 8085:TCP:driver

R0 Lbd;Lbd;c:\windows2\system32\drivers\Lbd.sys [6/14/2009 5:56 PM 64160]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows2\system32\drivers\EAPPkt.sys [10/9/2007 1:13 PM 38144]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [3/9/2009 12:06 PM 1029456]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [6/17/2008 10:34 PM 24652]
R3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows2\system32\drivers\wg111v3.sys [12/28/2007 3:02 PM 287232]
S3 acfva;acfva;c:\windows2\system32\drivers\acfva.sys [9/2/2006 2:34 PM 28445]
S3 ADSFilter;ADSFilter - (Aluria Filter Driver);c:\windows2\system32\DRIVERS\ADSFilter.sys --> c:\windows2\system32\DRIVERS\ADSFilter.sys [?]
S3 BW2NDIS5;BW2NDIS5;c:\windows2\system32\Drivers\BW2NDIS5.sys --> c:\windows2\system32\Drivers\BW2NDIS5.sys [?]
S3 WlanUIG;2Wire 802.11g USB Driver;c:\windows2\system32\drivers\WlanUIG.sys [1/13/2007 5:05 PM 347648]
S4 Stuffit Archive Name Service;Stuffit Archive Name Service;c:\program files\Smith Micro\StuffIt11\ArcNameService.exe [7/18/2007 3:26 PM 157000]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows2\system32\rundll32.exe" "c:\windows2\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-06-30 c:\windows2\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 01:03]
.
- - - - ORPHANS REMOVED - - - -

BHO-{8B2A62D8-E333-42C1-955B-DC5278F9FF4D} - (no file)


.
------- Supplementary Scan -------
.
uInternet Settings,ProxyServer = 192.168.0.5:8080
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com
IE: Display All Images with Full Quality - c:\program files\NetZero\qsacc\appres.dll/228
IE: Display Image with Full Quality - c:\program files\NetZero\qsacc\appres.dll/227
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: att.net
Trusted Zone: microsoft.com\office
Trusted Zone: sbcglobal.net
Trusted Zone: yahoo.com
TCP: {F9CDFA58-BAA3-4C29-BD94-83FBB681E11B} = 207.69.188.185,207.69.188.186
Handler: ezpp - {810403FA-E82E-11D5-8AAB-0010A404A3DE} - c:\windows2\system32\EZTOOL~1.DLL
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS2/Java/classes/xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-07 18:02
Windows 5.1.2600 Service Pack 3, v.3311 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3712)
c:\windows2\system32\ieframe.dll
c:\windows2\system32\webcheck.dll
c:\windows2\system32\WPDShServiceObj.dll
c:\program files\Common Files\aolshare\aolshcpy.dll
c:\windows2\system32\dot3dlg.dll
c:\windows2\system32\PortableDeviceTypes.dll
c:\windows2\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\windows2\system32\wbem\unsecapp.exe
c:\windows2\system32\wscntfy.exe
c:\progra~1\Webshots\webshots.scr
c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
.
**************************************************************************
.
Completion time: 2009-07-08 18:16 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-08 01:15
ComboFix2.txt 2009-07-07 01:20

Pre-Run: 24,736,305,152 bytes free
Post-Run: 24,730,943,488 bytes free

765 --- E O F --- 2009-06-11 22:47