asking for help - got infected

Ransimch · Jul 15, 2010

hello,

i probably got infected with something and i'll appreciate any help.
discription of the problem:
1- the wave column on the master volume jumps to minimum by it self every few minutes
2-every few minutes an advertisement jumps all over my screen.
(i know its not related to what i do at the moment because i use chrome and the advertisement jump on IE)
3- i hear a lot of mouse clicking sounds though i dont have those sounds regularly, and they appear even when i dont click the mouse.

here is the DSS log and thanks a lot for your time

DDS (Ver_10-03-17.01) - NTFSx86
Run by ran simchas at 19:03:43.56 on Thu 07/15/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Professional 5.1.2600.2.1255.972.1033.18.2045.1181 [GMT 3:00]

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
svchost.exe 4
C:\WINDOWS\system32\spoolsv.exe
svchost.exe 4
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\FolderSize\FolderSizeSvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\XpertVision\TBPanel.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\NetLimiter\NetLimiter.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Babylon\Babylon-Pro\Babylon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ProcessQuickLink 2\ProcessQuickLink 2\ProcessQuickLink2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Mainconcept\PVR\PvrLauncher.exe
C:\Program Files\Mainconcept\PVR\mcavserv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Documents and Settings\ran simchas\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ran simchas\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ran simchas\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ran simchas\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ran simchas\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ran simchas\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ran simchas\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ran simchas\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ran simchas\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\ran simchas\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearch Page = hxxp://search.live.com
uInternet Settings,ProxyOverride = *.local
mSearchAssistant = hxxp://search.live.com/sphome.aspx
uURLSearchHooks: sratim4u Toolbar: {1ec8a687-ee92-4e42-9838-5215ef8d9381} - c:\program files\sratim4u\tbsra0.dll
BHO: sratim4u Toolbar: {1ec8a687-ee92-4e42-9838-5215ef8d9381} - c:\program files\sratim4u\tbsra0.dll
BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
BHO: BitComet Helper: {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - c:\program files\bitcomet\tools\BitCometBHO_1.4.1.27.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: AGFormHelperObj Class: {6620e618-1ab9-4eb2-aca4-cbbe9066dbe6} - c:\program files\agat\agform\AGFormsHelper.dll
BHO: עוזר הכניסה של Windows Live: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Babylon IE plugin: {9cfaccb6-2f3f-4177-94ea-0d2b72d384c1} - c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: AGForms: {ed2e7de7-07db-4941-a06d-f780b93ba730} - c:\program files\agat\agform\AGForms.dll
TB: sratim4u Toolbar: {1ec8a687-ee92-4e42-9838-5215ef8d9381} - c:\program files\sratim4u\tbsra0.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [AdobeUpdater] c:\program files\common files\adobe\updater5\AdobeUpdater.exe
uRun: [MsnMsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [Google Update] "c:\documents and settings\ran simchas\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [Uniblue ProcessQuickLink 2] "c:\program files\processquicklink 2\processquicklink 2\ProcessQuickLink2.exe" /autostart
mRun: [Gainward] c:\program files\xpertvision\TBPanel.exe /A
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXE
mRun: [NetLimiter] c:\program files\netlimiter\NetLimiter.exe /s
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [nwiz] nwiz.exe /installquiet
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [Babylon Client] c:\program files\babylon\babylon-pro\Babylon.exe -AutoStart
dRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\11gwir~1.lnk - c:\program files\levelone\11g wireless lan\WLanUtility.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\pvrlau~1.lnk - c:\program files\mainconcept\pvr\PvrLauncher.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\upnpav~1.lnk - c:\program files\mainconcept\pvr\mcavserv.exe
IE: &D&ownload &with BitComet - c:\program files\bitcomet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:\program files\bitcomet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:\program files\bitcomet\BitComet.exe/AddAllLink.htm
IE: &יצא ל- Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: Translate this web page with Babylon - c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll/ActionTU.htm
IE: Translate with Babylon - c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll/Action.htm
IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://c:\program files\bitcomet\tools\BitCometBHO_1.4.1.27.dll/206
IE: {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - res://c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll/ActionTU.htm
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
LSP: c:\program files\netlimiter\nl_lsp.dll
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} - hxxp://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {41564D57-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/0/A/9/0A9F8B32-9F8C-4D74-A130-E4CAB36EB01F/wmvadvd.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1258653490156
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: {D1BB8531-18CA-407E-99E6-6DDCC293D840} = 192.168.123.254
TCP: {F194A711-11DB-48CC-8B16-B9B4F509F647} = 212.150.49.10,212.150.48.169
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: avgrsstarter - avgrsstx.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\ransim~1\applic~1\mozilla\firefox\profiles\n4wi8h1c.default\
FF - component: c:\documents and settings\ran simchas\application data\mozilla\firefox\profiles\n4wi8h1c.default\extensions\{b042753d-f57e-4e8e-a01b-7379a6d4cefb}\components\IBitCometExtension.dll
FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
FF - plugin: c:\documents and settings\ran simchas\application data\facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\documents and settings\ran simchas\application data\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\ran simchas\local settings\application data\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\unity\webplayer\loader\npUnity3D32.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 Achernar;Achernar - SCSI Command Filters;c:\windows\system32\drivers\Achernar.sys [2008-2-23 17920]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-1-22 216200]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-1-22 29584]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-11-13 242896]
R2 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-7-7 611664]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-1-22 297752]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-3-14 308064]
R3 Aldebaran;Aldebaran - SCSI Command Filters;c:\windows\system32\drivers\Aldebaran.sys [2008-2-23 13824]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-3-17 136176]
S3 RTLWUSB;11g Wireless USB Adapter;c:\windows\system32\drivers\RTL8187.sys [2007-12-12 178048]
S3 SjyPkt;SjyPkt;\??\c:\windows\system32\drivers\sjypkt.sys --> c:\windows\system32\drivers\SjyPkt.sys [?]
S3 XDva032;XDva032;\??\c:\windows\system32\xdva032.sys --> c:\windows\system32\XDva032.sys [?]
S4 UniFS;UniFS;c:\program files\unisonplay\UniFSService.exe [2009-11-24 130560]

=============== Created Last 30 ================

2030-08-29 13:22:32 56832 ------w- c:\windows\system32\iyvu9_32.dll
2030-08-29 13:22:32 143872 ------w- c:\windows\system32\iacenc.dll
2010-07-12 16:49:23 0 d-----w- c:\windows\system32\wbem\Repository
2010-06-26 18:14:14 0 d-----w- c:\program files\Bonjour
2010-06-22 21:49:12 0 d-----w- c:\program files\FolderSize

==================== Find3M ====================

2010-06-03 05:54:26 242896 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2008-02-26 22:20:46 14509 ----a-w- c:\program files\common files\wekadakiba.inf
2008-02-26 22:20:46 11982 ----a-w- c:\program files\common files\esicurox.db
2008-02-26 22:20:46 10545 ----a-w- c:\program files\common files\ezoroqowut.inf
2009-05-06 06:24:42 44191776 --sha-w- c:\windows\system32\drivers\fidbox.dat

============= FINISH: 19:04:01.57 ===============

Blade81 · Jul 20, 2010

Hello,

IMPORTANT I notice there are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer.

µTorrent
BitComet

I'd like you to read this thread.

Please go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red).

After that:

Please visit this webpage for download links, and instructions for running ComboFix tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please ensure you read this guide carefully first.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
Remember to re-enable them afterwards.
Click Yes to allow ComboFix to continue scanning for malware.

When the tool is finished, it will produce a report for you.

Please include the following reports for further review, and so we may continue cleansing the system:

C:\ComboFix.txt
New dds log.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.

Ransimch · Jul 22, 2010

hello,
thank you for yor answer.
before the reports i'll just say that my AVG was working strangely since day 1, and i couldnt ,in anyway, shut it down so i removed it for now.

thank you for your time and effort

and here are the reports:

ComboFix 10-07-21.02 - ran simchas 07/22/2010 18:04:54.4.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1255.972.1033.18.2045.1670 [GMT 3:00]
Running from: c:\documents and settings\ran simchas\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\install.exe
c:\windows\system32\_id.dat
c:\windows\system32\2631095256.dat
c:\windows\system32\3069611c.dat
c:\windows\system32\CMb15Yi4.exe.a_a
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\note32.exe.tmp
c:\windows\system32\Process.exe
c:\windows\system32\sdjeavd.tmp
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
c:\windows\system32\Xf71NgL7.exe.a_a
c:\windows\system32\zlibwapi.dll

.
((((((((((((((((((((((((( Files Created from 2010-06-22 to 2010-07-22 )))))))))))))))))))))))))))))))
.

2030-08-29 13:22 . 2030-08-29 13:22 56832 ------w- c:\windows\system32\iyvu9_32.dll
2030-08-29 13:22 . 2030-08-29 13:22 143872 ------w- c:\windows\system32\iacenc.dll
2010-07-22 14:59 . 2010-07-22 14:59 4 ----a-w- c:\program files\39468.dat
2010-07-20 09:30 . 2010-07-20 09:35 -------- d-----w- c:\documents and settings\ran simchas\Application Data\HpUpdate
2010-07-20 09:30 . 2010-07-20 09:30 -------- d-----w- c:\windows\Hewlett-Packard
2010-07-18 21:58 . 2010-07-18 21:59 26641904 ----a-w- c:\documents and settings\ran simchas\Application Data\Real\Update\setup3.12\rp\RealPlayerSPGold.exe
2010-07-18 21:58 . 2010-07-18 21:58 220272 ----a-w- c:\documents and settings\ran simchas\Application Data\Real\Update\setup3.12\gtb\GOOGLE_TOOLBAR\GoogleToolbarInstaller.exe
2010-07-18 21:58 . 2010-07-18 21:58 149000 ----a-w- c:\documents and settings\ran simchas\Application Data\Real\Update\setup3.12\chr_helper\LaunchHelper.exe
2010-07-18 21:58 . 2010-07-18 21:58 13407072 ----a-w- c:\documents and settings\ran simchas\Application Data\Real\Update\setup3.12\chr\ChromeInstaller.exe
2010-07-18 21:57 . 2010-07-18 21:57 79368 ----a-w- c:\documents and settings\ran simchas\Application Data\Real\Update\setup3.12\RUP\vista.exe
2010-07-18 21:57 . 2010-07-18 21:57 73344 ----a-w- c:\documents and settings\ran simchas\Application Data\Real\Update\setup3.12\RUP\inst_config\gtapi_v6.dll
2010-07-18 21:57 . 2010-07-18 21:57 64000 ----a-w- c:\documents and settings\ran simchas\Application Data\Real\Update\setup3.12\RUP\inst_config\gcapi_dll.dll
2010-07-18 21:57 . 2010-07-18 21:57 52288 ----a-w- c:\documents and settings\ran simchas\Application Data\Real\Update\setup3.12\RUP\inst_config\gtapi.dll
2010-07-18 21:57 . 2010-07-18 21:57 122880 ----a-w- c:\documents and settings\ran simchas\Application Data\Real\Update\setup3.12\RUP\inst_config\compat.dll
2010-07-18 13:57 . 2010-07-18 13:57 452104 ----a-w- c:\documents and settings\ran simchas\Application Data\Real\Update\setup3.12\setup.exe
2010-07-17 05:01 . 2010-07-17 05:01 242896 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtdix.sys
2010-07-17 05:01 . 2010-07-17 05:01 216200 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgldx86.sys
2010-07-17 05:00 . 2010-07-17 05:00 813336 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avginet.dll
2010-07-17 05:00 . 2010-07-17 05:00 624920 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgiproxy.exe
2010-07-17 05:00 . 2010-07-17 05:00 1690464 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll
2010-07-17 05:00 . 2010-07-17 05:00 1038688 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.exe
2010-07-15 21:06 . 2010-07-15 21:06 -------- d-----w- c:\program files\Common Files\Skype
2010-07-15 15:57 . 2010-07-15 16:00 -------- d-----w- c:\program files\ERUNT
2010-07-12 16:49 . 2010-07-12 16:49 -------- d-----w- c:\windows\system32\wbem\Repository
2010-07-12 14:03 . 2010-07-12 14:03 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Conduit
2010-07-12 12:34 . 2010-07-12 12:34 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE
2010-07-10 08:04 . 2010-07-12 12:30 -------- d-----w- c:\documents and settings\ran simchas\Application Data\vlc
2010-06-26 18:14 . 2010-06-26 18:14 -------- d-----w- c:\program files\Bonjour
2010-06-22 21:49 . 2010-06-22 21:49 -------- d-----w- c:\program files\FolderSize

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-22 14:55 . 2010-04-27 08:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Babylon
2010-07-22 14:53 . 2009-11-13 17:15 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2010-07-22 04:20 . 2008-03-27 10:40 -------- d-----w- c:\documents and settings\ran simchas\Application Data\uTorrent
2010-07-20 19:30 . 2010-03-01 10:37 -------- d-----w- c:\program files\BitComet
2010-07-20 09:36 . 2008-09-28 11:37 -------- d-----w- c:\documents and settings\ran simchas\Application Data\Image Zone Express
2010-07-20 09:31 . 2008-09-28 11:17 -------- d-----w- c:\program files\HP
2010-07-19 13:06 . 2008-03-17 12:45 -------- d-----w- c:\documents and settings\ran simchas\Application Data\skypePM
2010-07-17 00:06 . 2009-02-27 07:08 -------- d-----w- c:\documents and settings\ran simchas\Application Data\Skype
2010-07-15 21:06 . 2008-04-02 12:53 -------- d-----r- c:\program files\Skype
2010-07-15 21:05 . 2008-03-17 12:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2010-07-13 13:36 . 2009-02-13 00:01 -------- d-----w- c:\documents and settings\ran simchas\Application Data\dvdcss
2010-07-06 13:57 . 2010-04-18 13:54 439816 ----a-w- c:\documents and settings\ran simchas\Application Data\Real\Update\setup3.10\setup.exe
2010-07-03 16:22 . 2007-12-11 21:05 59256 ----a-w- c:\documents and settings\ran simchas\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-07-01 15:45 . 2010-04-27 08:24 -------- d-----w- c:\documents and settings\ran simchas\Application Data\Babylon
2010-06-11 13:51 . 2010-06-11 13:51 3055600 ----a-w- c:\documents and settings\ran simchas\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll
2010-06-11 13:36 . 2010-06-11 13:36 275952 ----a-w- c:\documents and settings\ran simchas\Application Data\Mozilla\plugins\npgoogletalk.dll
2010-05-24 15:55 . 2010-05-24 15:55 503808 ----a-w- c:\documents and settings\ran simchas\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-6b34a3ca-n\msvcp71.dll
2010-05-24 15:55 . 2010-05-24 15:55 499712 ----a-w- c:\documents and settings\ran simchas\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-6b34a3ca-n\jmc.dll
2010-05-24 15:55 . 2010-05-24 15:55 348160 ----a-w- c:\documents and settings\ran simchas\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-6b34a3ca-n\msvcr71.dll
2008-02-26 22:20 . 2008-02-26 22:20 14509 ----a-w- c:\program files\Common Files\wekadakiba.inf
2008-02-26 22:20 . 2008-02-26 22:20 11982 ----a-w- c:\program files\Common Files\esicurox.db
2008-02-26 22:20 . 2008-02-26 22:20 10545 ----a-w- c:\program files\Common Files\ezoroqowut.inf
2009-05-06 06:24 . 2008-09-27 21:58 44191776 --sha-w- c:\windows\system32\drivers\fidbox.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{1ec8a687-ee92-4e42-9838-5215ef8d9381}"= "c:\program files\sratim4u\tbsra0.dll" [2010-05-19 2515552]

[HKEY_CLASSES_ROOT\clsid\{1ec8a687-ee92-4e42-9838-5215ef8d9381}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1ec8a687-ee92-4e42-9838-5215ef8d9381}]
2010-05-19 13:14 2515552 ----a-w- c:\program files\sratim4u\tbsra0.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{1ec8a687-ee92-4e42-9838-5215ef8d9381}"= "c:\program files\sratim4u\tbsra0.dll" [2010-05-19 2515552]

[HKEY_CLASSES_ROOT\clsid\{1ec8a687-ee92-4e42-9838-5215ef8d9381}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{1EC8A687-EE92-4E42-9838-5215EF8D9381}"= "c:\program files\sratim4u\tbsra0.dll" [2010-05-19 2515552]

[HKEY_CLASSES_ROOT\clsid\{1ec8a687-ee92-4e42-9838-5215ef8d9381}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 2321600]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"Google Update"="c:\documents and settings\ran simchas\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-08 133104]
"Uniblue ProcessQuickLink 2"="c:\program files\ProcessQuickLink 2\ProcessQuickLink 2\ProcessQuickLink2.exe" [2008-04-02 655640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gainward"="c:\program files\XpertVision\TBPanel.exe" [2007-10-02 2165256]
"RTHDCPL"="RTHDCPL.EXE" [2007-06-13 16377344]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-05-16 185896]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2010-06-09 49208]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2008-11-02 167936]
"NetLimiter"="c:\program files\NetLimiter\NetLimiter.exe" [2004-03-31 823296]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-22 141608]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-01-11 13666408]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-01-11 110696]
"Babylon Client"="c:\program files\Babylon\Babylon-Pro\Babylon.exe" [2010-04-27 3730832]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
11g Wireless LAN Utility.lnk - c:\program files\LevelOne\11g Wireless LAN\WLanUtility.exe [2007-12-12 712704]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
PVR Launcher.lnk - c:\program files\Mainconcept\PVR\PvrLauncher.exe [2008-2-23 69632]
UPnP AV Server.lnk - c:\program files\Mainconcept\PVR\mcavserv.exe [2008-2-23 147456]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Mainconcept\\PVR\\mcavserv.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Documents and Settings\\ran simchas\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\ran simchas\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\frd.exe"=
"c:\\Program Files\\UnisonPlay\\UniFS.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"16952:TCP"= 16952:TCP:utorrent

R0 Achernar;Achernar - SCSI Command Filters;c:\windows\system32\drivers\Achernar.sys [23/02/2008 17:24 17920]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [22/01/2009 16:44 297752]
R3 Aldebaran;Aldebaran - SCSI Command Filters;c:\windows\system32\drivers\Aldebaran.sys [23/02/2008 17:24 13824]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [17/03/2010 14:16 136176]
S3 RTLWUSB;11g Wireless USB Adapter;c:\windows\system32\drivers\RTL8187.sys [12/12/2007 00:10 178048]
S3 SjyPkt;SjyPkt;\??\c:\windows\System32\Drivers\SjyPkt.sys --> c:\windows\System32\Drivers\SjyPkt.sys [?]
S3 XDva032;XDva032;\??\c:\windows\system32\XDva032.sys --> c:\windows\system32\XDva032.sys [?]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [29/01/2009 13:14 664064]
S4 UniFS;UniFS;c:\program files\UnisonPlay\UniFSService.exe [24/11/2009 23:46 130560]
.
Contents of the 'Scheduled Tasks' folder

2010-07-17 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 09:34]

2010-07-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-17 11:15]

2010-07-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-17 11:15]

2010-07-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-789336058-1935655697-725345543-1003Core.job
- c:\documents and settings\ran simchas\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-08 15:18]

2010-07-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-789336058-1935655697-725345543-1003UA.job
- c:\documents and settings\ran simchas\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-08 15:18]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: &יצא ל- Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Translate this web page with Babylon - c:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm
IE: Translate with Babylon - c:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm
LSP: c:\program files\NetLimiter\nl_lsp.dll
TCP: {D1BB8531-18CA-407E-99E6-6DDCC293D840} = 192.168.123.254
TCP: {F194A711-11DB-48CC-8B16-B9B4F509F647} = 212.150.49.10,212.150.48.169
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\ran simchas\Application Data\Mozilla\Firefox\Profiles\n4wi8h1c.default\
FF - plugin: c:\documents and settings\ran simchas\Application Data\Facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\documents and settings\ran simchas\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-nwiz - nwiz.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-22 18:08
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,10,c9,b6,e6,89,ca,fb,49,bf,57,9d,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,10,c9,b6,e6,89,ca,fb,49,bf,57,9d,\

[HKEY_USERS\S-1-5-21-789336058-1935655697-725345543-1003\Software\SecuROM\License information*]
"datasecu"=hex:4b,1e,15,04,b2,67,32,2a,e0,d3,a8,ba,d1,da,e3,c2,fd,7c,69,81,14,
a7,bd,51,2e,3a,24,c0,a1,5b,39,7c,62,5b,ac,c0,85,ef,64,d3,f5,84,e6,c4,19,f3,\
"rkeysecu"=hex:00,af,aa,cf,92,65,87,7b,05,ed,91,bf,54,e2,41,3c

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):28,f4,a0,4b,a6,9a,b8,e4,63,29,17,41,89,b1,48,b2,3e,4e,61,95,b3,
c9,89,f4,ca,6d,30,99,86,ef,ad,79,44,af,28,5f,c9,75,b4,ea,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{98ae4bdd-cafe-4d42-9c5f-50fbbb3b7b45}]
@Denied: (Full) (Everyone)
"Model"=dword:0000006b
"Therad"=dword:00000001
"MData"=hex(0):cb,9b,ad,ef,27,7d,29,69,f5,02,f0,76,aa,4a,f1,7c,d3,d9,67,7f,6a,
4b,7b,ad,04,7a,b1,b5,76,9b,27,47,f1,6d,e9,9f,93,ee,31,01,7b,21,38,7e,56,55,\
.
Completion time: 2010-07-22 18:09:24
ComboFix-quarantined-files.txt 2010-07-22 15:09
ComboFix2.txt 2008-03-06 17:48

Pre-Run: 13,164,122,112 bytes free
Post-Run: 14,033,199,104 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - B44518765AEA7E235997B3FD80665CD8

DDS (Ver_10-03-17.01) - NTFSx86
Run by ran simchas at 18:11:09.12 on Thu 07/22/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Professional 5.1.2600.2.1255.972.1033.18.2045.1406 [GMT 3:00]

AV: AVG Anti-Virus Free *On-access scanning disabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\FolderSize\FolderSizeSvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
svchost.exe 4
svchost.exe 4
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\ran simchas\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ran simchas\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ran simchas\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ran simchas\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ran simchas\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\ran simchas\Desktop\dds.scr

============== Pseudo HJT Report ===============

uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: sratim4u Toolbar: {1ec8a687-ee92-4e42-9838-5215ef8d9381} - c:\program files\sratim4u\tbsra0.dll
BHO: sratim4u Toolbar: {1ec8a687-ee92-4e42-9838-5215ef8d9381} - c:\program files\sratim4u\tbsra0.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: AGFormHelperObj Class: {6620e618-1ab9-4eb2-aca4-cbbe9066dbe6} - c:\program files\agat\agform\AGFormsHelper.dll
BHO: עוזר הכניסה של Windows Live: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Babylon IE plugin: {9cfaccb6-2f3f-4177-94ea-0d2b72d384c1} - c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll
BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: AGForms: {ed2e7de7-07db-4941-a06d-f780b93ba730} - c:\program files\agat\agform\AGForms.dll
TB: sratim4u Toolbar: {1ec8a687-ee92-4e42-9838-5215ef8d9381} - c:\program files\sratim4u\tbsra0.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [AdobeUpdater] c:\program files\common files\adobe\updater5\AdobeUpdater.exe
uRun: [MsnMsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [Google Update] "c:\documents and settings\ran simchas\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [Uniblue ProcessQuickLink 2] "c:\program files\processquicklink 2\processquicklink 2\ProcessQuickLink2.exe" /autostart
mRun: [Gainward] c:\program files\xpertvision\TBPanel.exe /A
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXE
mRun: [NetLimiter] c:\program files\netlimiter\NetLimiter.exe /s
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [Babylon Client] c:\program files\babylon\babylon-pro\Babylon.exe -AutoStart
dRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\11gwir~1.lnk - c:\program files\levelone\11g wireless lan\WLanUtility.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\pvrlau~1.lnk - c:\program files\mainconcept\pvr\PvrLauncher.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\upnpav~1.lnk - c:\program files\mainconcept\pvr\mcavserv.exe
IE: &יצא ל- Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: Translate this web page with Babylon - c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll/ActionTU.htm
IE: Translate with Babylon - c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll/Action.htm
IE: {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - res://c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll/ActionTU.htm
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
LSP: c:\program files\netlimiter\nl_lsp.dll
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} - hxxp://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {41564D57-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/0/A/9/0A9F8B32-9F8C-4D74-A130-E4CAB36EB01F/wmvadvd.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1258653490156
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: {D1BB8531-18CA-407E-99E6-6DDCC293D840} = 192.168.123.254
TCP: {F194A711-11DB-48CC-8B16-B9B4F509F647} = 212.150.49.10,212.150.48.169
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\ransim~1\applic~1\mozilla\firefox\profiles\n4wi8h1c.default\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 Achernar;Achernar - SCSI Command Filters;c:\windows\system32\drivers\Achernar.sys [2008-2-23 17920]
R2 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-7-7 611664]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-1-22 297752]
R3 Aldebaran;Aldebaran - SCSI Command Filters;c:\windows\system32\drivers\Aldebaran.sys [2008-2-23 13824]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-3-17 136176]
S3 RTLWUSB;11g Wireless USB Adapter;c:\windows\system32\drivers\RTL8187.sys [2007-12-12 178048]
S3 SjyPkt;SjyPkt;\??\c:\windows\system32\drivers\sjypkt.sys --> c:\windows\system32\drivers\SjyPkt.sys [?]
S3 XDva032;XDva032;\??\c:\windows\system32\xdva032.sys --> c:\windows\system32\XDva032.sys [?]
S4 UniFS;UniFS;c:\program files\unisonplay\UniFSService.exe [2009-11-24 130560]

=============== Created Last 30 ================

2030-08-29 13:22:32 56832 ------w- c:\windows\system32\iyvu9_32.dll
2030-08-29 13:22:32 143872 ------w- c:\windows\system32\iacenc.dll
2010-07-22 15:03:00 0 d-sha-r- C:\cmdcons
2010-07-22 14:59:05 77312 ----a-w- c:\windows\MBR.exe
2010-07-22 14:59:05 256512 ----a-w- c:\windows\PEV.exe
2010-07-22 14:59:05 161792 ----a-w- c:\windows\SWREG.exe
2010-07-22 14:59:04 98816 ----a-w- c:\windows\sed.exe
2010-07-22 14:59:03 4 ----a-w- c:\program files\39468.dat
2010-07-20 09:30:46 0 d-----w- c:\docume~1\ransim~1\applic~1\HpUpdate
2010-07-20 09:30:32 0 d-----w- c:\windows\Hewlett-Packard
2010-07-20 09:14:09 21124 ------w- c:\windows\hpomdl07.dat.temp
2010-07-12 16:49:23 0 d-----w- c:\windows\system32\wbem\Repository
2010-06-26 18:14:14 0 d-----w- c:\program files\Bonjour
2010-06-22 21:49:12 0 d-----w- c:\program files\FolderSize

==================== Find3M ====================

2008-02-26 22:20:46 14509 ----a-w- c:\program files\common files\wekadakiba.inf
2008-02-26 22:20:46 11982 ----a-w- c:\program files\common files\esicurox.db
2008-02-26 22:20:46 10545 ----a-w- c:\program files\common files\ezoroqowut.inf
2009-05-06 06:24:42 44191776 --sha-w- c:\windows\system32\drivers\fidbox.dat

============= FINISH: 18:11:17.51 ===============

Blade81 · Jul 22, 2010

Hi again,

Uninstall sratim4u Toolbar if not installed on purpose.

Open notepad and copy/paste the text in the quotebox below into it:

Code:

File::
c:\program files\39468.dat
c:\program files\Common Files\wekadakiba.inf
c:\program files\Common Files\esicurox.db
c:\program files\Common Files\ezoroqowut.inf
Folder::
c:\documents and settings\ran simchas\Application Data\uTorrent
c:\program files\BitComet
c:\program files\eMule
Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\eMule\\emule.exe"=-
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"16952:TCP"=-
RegLockDel::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{98ae4bdd-cafe-4d42-9c5f-50fbbb3b7b45}]

Save this as
CFScript

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.

Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.

Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

* Go here to run an online scanner from ESET.

Note: You will need to use Internet explorer for this scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is UNchecked.
Click Scan
Wait for the scan to finish.

Post back its report, a fresh dds.txt log and above mentioned ComboFix resultant log.

Ransimch · Jul 22, 2010

hello,

the ESET scan was clean - no threats.
i wasn't able to run dds, i dont know why, when i click on it a black window opens and disappear immediately.
here is the combofix log

thanks.

ComboFix 10-07-22.01 - ran simchas 07/22/2010 21:45:39.5.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1255.972.1033.18.2045.1441 [GMT 3:00]
Running from: c:\documents and settings\ran simchas\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\ran simchas\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FILE ::
"c:\program files\39468.dat"
"c:\program files\Common Files\esicurox.db"
"c:\program files\Common Files\ezoroqowut.inf"
"c:\program files\Common Files\wekadakiba.inf"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\ran simchas\Application Data\uTorrent
c:\documents and settings\ran simchas\Application Data\uTorrent\????(bbs.wofei.net).?????.720p.????.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\500.Days.Of.Summer.BDRip.XviD-ARiGOLD.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Age of Empires 2.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Age Of Empires 3 Incl Expansion and keys.1.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Age Of Empires 3 Incl Expansion and keys.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Apocalypse.Now.Redux.DVDRIP-ZEKTORM.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Ass Stretchers POV XXX [DVDRip][www.zonatorrent.com].torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Beowulf[2007]DvDrip[Eng]-FXG.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Big Tits At School - Special Learning Needs - Nikki Benz.mp4.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Blade Runner The final cut KLAXXON.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Bolt KLAXXON DVDRIP.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Bolt.DVDSCR.XViD.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Bolt[2008]DvDrip[Eng]-FXG.1.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Bolt[2008]DvDrip[Eng]-FXG.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Brazil.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Bride Wars[2009]DvDrip[Eng]-FXG.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Brothers and Sisters Season 1.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Call of duty 4 [PC-DVD] [English] [www.topetorrent.com].torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Cheating.Wives.Tales.10(DVDRiP)(www.pornorip.net).torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Closing Time.1.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Closing Time.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Command & Conquer Red Alert Xp.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Command and Conquer Generals - Zero Hour.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Command And Conquer Red Alert 3 CRACK ONLY-RELOADED.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Command.And.Conquer.Red.Alert.3-RELOADED.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Command.And.Conquer.Red.Alert.3.CRACK+SERIAL.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Contact (1997).torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Coraline 720p BluRay x264-REFiNED.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Desperate Housewives (Season 1).torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Desperate Housewives S3 DVDRip.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Desperate Housewives Season 2 Complete.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Desperate Housewives Season 4 Complete HDTV XVID-soagg.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Desperate.Housewives.S05E21.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Desperate.Housewives.S05E22.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Desperate.Housewives.S05E23.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Desperate.Housewives.S05E24.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Desperate.Housewives.S06E03.HDTV.XviD-2HD.[VTV].avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Desperate.Housewives.S06E04.The.God-Why-Dont-You-Love-Me.Blues.HDTV.XviD-FQM.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Desperate.Housewives.S06E05.HDTV.XviD-NoTV.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Desperate.Housewives.S06E06.HDTV.XviD-FEVER.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Desperate.Housewives.S06E07.HDTV.XviD-P0W4.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Desperate.Housewives.S06E08.HDTV.XviD-P0W4.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Desperate.Housewives.S06E09.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Desperate.Housewives.S06E10.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Desperate.Housewives.S06E11.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Desperate.Housewives.S06E12.HDTV.XviD-2HD.[VTV].avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Desperate.Housewives.S06E13.HDTV.XviD-NoTV.[VTV].avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Desperate.Housewives.S06E14.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Desperate.Housewives.S06E15.HDTV.XviD-LOL.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Desperate.Housewives.S06E16.HDTV.XviD-LOL.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Desperate.Housewives.S06E17.PROPER.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Desperate.Housewives.S06E18.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Desperate.Housewives.S06E19.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Desperate.Housewives.S06E20.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Desperate.Housewives.S06E21.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Desperate.Housewives.S06E22.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Desperate.Housewives.S06E23.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\dht.dat
c:\documents and settings\ran simchas\Application Data\uTorrent\dht.dat.old
c:\documents and settings\ran simchas\Application Data\uTorrent\DISNEY PIXARS TOY STORY TWO[DVDRIP][ENG]-KIDZCORNER&J.T.R.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\East.India.Company-SKIDROW.CRACK.ONLY.rar.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Eastern Promises[2007]DvDrip[Eng]-FXG.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Entourage - Season 5.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Entourage Season 4.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Entourage Season 6.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Entourage.S06E06.PROPER.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Entourage.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Fame[2009][Extended Edition]DvDrip-aXXo.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Finding.Nemo.2003.720p.HDTV.DTS.x264-ESiR.1.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Finding.Nemo.2003.720p.HDTV.DTS.x264-ESiR.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Finding.Nemo.x264.720p-HR.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\FTV - Veronica.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\G.A...3.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Generals and Zero Hour.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Gilmore Girls Season 7.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Gladiator (2000) [ENG] [DVDrip].torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Gladiator[Extended.Edition]DvDrip.AC3[Eng]-aXXo.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Glee.S01E09.HDTV.XviD-2HD.[VTV].avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Glee.S01E10.Ballad.HDTV.XviD-FQM.[VTV].avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Glee.S01E11.HDTV.XviD-2HD.[VTV].avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Glee.S01E12.HDTV.XviD-P0W4.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Glee.S01E13.Sectionals.HDTV.XviD-FQM.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Glee.S01E14.HDTV.XviD-LOL.[VTV].avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Glee.S01E15.HDTV.XviD-LOL.[VTV].avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Glee.S01E16.HDTV.XviD-LOL.[VTV].avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Glee.S01E17.HDTV.XviD-LOL.[VTV].avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Glee.S01E18.HDTV.XviD-LOL.[VTV].avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Glee.S01E19.HDTV.XviD-LOL.[VTV].avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Glee.S01E20.HDTV.XviD-LOL.[VTV].avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Glee.S01E21.HDTV.XviD-LOL.[VTV].avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Glee.S01E22.HDTV.XviD-LOL.[VTV].avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Gran.Torino.720p.BluRay.x264-REFiNED.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Grave.of.the.fireflies.DVDRip.XviD-flourIsh.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Grey's anatomy - Season 1 Full - ENG.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Grey's Anatomy S03 E01-25.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Grey Anatomy Season 1Complete widescreen.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys Anatomy S04E16 S04E17 HDTV XviD-FoV[Www.Overget.Com].torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S04E01.HDTV.XViD-Caph.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S04E02.HDTV.XViD-Caph.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S04E03.HDTV.XViD-Caph.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S04E04.HDTV.XViD-YesTV.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S04E05.HDTV.XViD-Caph.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S04E06.HDTV.XviD-2HD.1.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S04E06.HDTV.XviD-2HD.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S04E07.HDTV.XviD-XOR.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S04E08.HDTV.XViD-Caph.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S04E09.HDTV.XviD-XOR.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S04E10.HDTV.XViD-Caph.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S04E11.HDTV.XviD-0TV.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S04E12.HDTV.XViD-dot [btarena.org].avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S04E13.HDTV.XviD-2HD.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S04E14.HDTV.XviD-2HD.[VTV].avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S04E15.HDTV.XViD-dot [btarena.org].avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S05E03.HDTV.XViD-DOT.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S05E04.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S05E05.HDTV.XviD-XOR.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S05E06.HDTV.XviD-0TV.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S05E07.HDTV.XviD-XOR.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S05E08.HDTV.XViD-DOT.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S05E08.PROPER.HDTV.XviD-2HD.[VTV].avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S05E09.PROPER.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S05E10.REAL.PROPER.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S05E11.HDTV.XviD-LOL.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S05E12.HDTV.XviD-XOR.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S05E13.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S05E14.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S05E15.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S05E16.An.Honest.Mistake.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S05E17.HDTV.XviD-2HD.[VTV].avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S05E18.PROPER.HDTV.XviD-2HD.[VTV].avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S05E19.PROPER.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S05E20.HDTV.XviD-XOR.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S05E21.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S05E22.PROPER.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S05E23E24.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S06E01E02.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S06E03.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S06E04.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S06E05.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S06E06.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S06E07.HDTV.XviD-FEVER.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S06E08.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S06E09.New.History.HDTV.XviD-FQM.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S06E10.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S06E11.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S06E12.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S06E13.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S06E14.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S06E15.HDTV.XviD-LOL.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S06E16.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S06E17.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S06E18.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S06E19.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S06E20.HDTV.XviD-2HD.[VTV].avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S06E21.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S06E22.HDTV.XviD-P0W4.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S06E23.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Greys.Anatomy.S06E24.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\hardcore MOMS-40+.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Heroes - Season 3.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Heroes Season 1 Complete-Xvid-MFG.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Heroes Season 2 HDTV XviD.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Heroes Season 2.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Heroes.S03E00.HDTV.XviD-XOR.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Interactive Sex With Jenna Haze [XXX] DVD [XviD].zip.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Iron Man[2008]DvDrip[Eng]-FXG.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Iron.Man[2008]DvDrip-aXXo.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Jersey Girl KLAXXON.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Jersey.Girl.2004.DVDRip.Xvid-Nile.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Julie.and.Julia.DVDRip.XviD-iMBT.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Kika - Un corpo in prestito.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Le.Scaphandre.Et.Le.Papillon.FRENCH.DVDRiP.REPACK.XViD-STS.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Maid In Manhattan [XviD][2002].AVI.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Mainconcept.PVR.v1.1.4.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Meet.The.Fuckers.8(DVDRiP)(www.pornorip.net).torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\MILFs Like It Big (Ava Devine) XXX [DVDRip][Mature][www.sexotoorrent.com].torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Mulan.2009.DVDRip.XviD.AC3-ViSiON.NoRar.www.crazy-torrent.com.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Nero 6 DVD-Video Plugin + Serial.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\No Country for Old Men[2007]DvDrip[Eng]Swesub-FXG.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\No.Country.for.Old.Men.DVDRip.XviD-DiAMOND.[www.torrentfive.com].torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\No.Country.for.Old.Men.DVDSCR.XviD-DoNE_[www.MusicFilmsDownloads.Net].torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Over.the.Hedge.DVDRip.XviD-DiAMOND.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Over.The.Hedge[2006]DvDrip.AC3[Eng]-aXXo.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Patch.v1.01.rar.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\PC - TOCA RACE DRIVER 3 by globe@.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Red Alert 3 Serial Keys.rtf.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\resume.dat
c:\documents and settings\ran simchas\Application Data\uTorrent\resume.dat.1.bad
c:\documents and settings\ran simchas\Application Data\uTorrent\resume.dat.old
c:\documents and settings\ran simchas\Application Data\uTorrent\Rome - Season 1.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Rome Season 1.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Rome Season 2.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Rome Total War.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Rome Total War+ Rome Total War Barbarian Invasion+ Rome Total War Alexander.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\rss.dat
c:\documents and settings\ran simchas\Application Data\uTorrent\rss.dat.old
c:\documents and settings\ran simchas\Application Data\uTorrent\Season 4.1.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Season 4.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\settings.dat
c:\documents and settings\ran simchas\Application Data\uTorrent\settings.dat.old
c:\documents and settings\ran simchas\Application Data\uTorrent\Sex.And.The.City-The.Movie[2008][Extended.Cut]DvDrip-aXXo.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Sin.City.2005.720p.BluRay.x264-SEPTiC.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Sin.City.RECUT.AND.EXTENDED.DVDRip.XviD-DiAMOND.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Spartacus.Blood.and.Sand.S01E02.HDTV.XviD-SYS.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Spartacus.Blood.and.Sand.S01E03.HDTV.XviD-SYS.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Spartacus.Blood.and.Sand.S01E04.HDTV.XviD-SYS.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Spartacus.Blood.and.Sand.S01E06.HDTV.XviD-SYS.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Spartacus.Blood.and.Sand.S01E07.720p.HDTV.X264-DIMENSION.mkv.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Spartacus.Blood.and.Sand.S01E10.HDTV.XviD-SYS.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Spartacus.Blood.and.Sand.S01E11.HDTV.XviD-XII.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Spartacus.Blood.and.Sand.S01E12.REPACK.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Spartacus.Blood.and.Sand.S01E13.HDTV.XviD-SYS.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Step.Up.2-The.Streets[2008]DvDrip-aXXo.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Step.Up[2006]DvDrip[Eng]-aXXo.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Sunshine.Cleaning.2008.LiMiTED.DVDRiP.XViD.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\The Curious Case of Benjamin Button[2008]DvDrip[Eng]-FXG.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\The Doors - The Soft Parade (Perception Remaster) [EAC-FLAC] [RePoPo].torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\The.300.Spartans.1962.WS.DVDRip.XviD-AXIAL.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\The_Doors-The_Soft_Parade-(Deluxe_Edition)-2007-EON.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\There.Will.Be.Blood[2007]DvDrip[Eng]-aXXo.1.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\There.Will.Be.Blood[2007]DvDrip[Eng]-aXXo.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Tiberian Sun.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Transformers[2007]DvDrip[Eng]-aXXo.1.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Transformers[2007]DvDrip[Eng]-aXXo.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\ts.1.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\ts.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Ugly.Betty.S03E24.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Ugly.Betty.S04E01E02.HDTV.XviD-NoTV.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Ugly.Betty.S04E01E02.REPACK.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Ugly.Betty.S04E03.HDTV.XviD-NoTV.avi.1.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Ugly.Betty.S04E03.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Ugly.Betty.S04E03.HDTV.XviD-NoTV.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Ugly.Betty.S04E04.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Ugly.Betty.S04E05.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Ugly.Betty.S04E06.HDTV.XviD-P0W4.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Ugly.Betty.S04E07.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Ugly.Betty.S04E08.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Ugly.Betty.S04E09.Be-Shure.HDTV.XviD-FQM.avi.1.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Ugly.Betty.S04E09.Be-Shure.HDTV.XviD-FQM.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Ugly.Betty.S04E10.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Ugly.Betty.S04E11.Back.in.Her.Place.HDTV.XviD-FQM.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Ugly.Betty.S04E12.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Ugly.Betty.S04E13.Chica.and.the.Man.HDTV.XviD-FQM.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Ugly.Betty.S04E14.Smokin.Hot.HDTV.XviD-FQM.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Ugly.Betty.S04E18.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Ugly.Betty.S04E19.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Ugly.Betty.S04E20.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\utorrent.lng
c:\documents and settings\ran simchas\Application Data\uTorrent\VIV THOMAS PRESENTS SOPHIE MOONE RED IN BED XXX.zip.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\WALL-E 2008 TELESYNC XviD-KingBen (Kingdom-Release).torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Wall.E.R5.XviD-TRADINGSTANDARDS.[www.UsaBit.com].torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Weeds Season 1-OnlyMe1.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\WifeCrazy - Over Due Ass Fucking-LKRG.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\Wings Of Desire.avi.torrent
c:\documents and settings\ran simchas\Application Data\uTorrent\You Don't Mess with the Zohan 2008 R5 LINE H264-KingBen (Kingdom-Release).torrent
c:\program files\39468.dat
c:\program files\BitComet
c:\program files\Common Files\esicurox.db
c:\program files\Common Files\ezoroqowut.inf
c:\program files\Common Files\wekadakiba.inf
c:\program files\eMule
c:\program files\eMule\changelog.ger.txt
c:\program files\eMule\changelog.txt
c:\program files\eMule\config\AC_BootstrapIPs.dat
c:\program files\eMule\config\AC_IPFilterUpdateURLs.dat
c:\program files\eMule\config\AC_SearchStrings.dat
c:\program files\eMule\config\AC_ServerMetURLs.dat
c:\program files\eMule\config\addresses.dat
c:\program files\eMule\config\cancelled.met
c:\program files\eMule\config\clients.met
c:\program files\eMule\config\clients.met.bak
c:\program files\eMule\config\cryptkey.dat
c:\program files\eMule\config\emfriends.met
c:\program files\eMule\config\key_index.dat
c:\program files\eMule\config\known.met
c:\program files\eMule\config\known2_64.met
c:\program files\eMule\config\load_index.dat
c:\program files\eMule\config\nodes.dat
c:\program files\eMule\config\preferences.dat
c:\program files\eMule\config\preferences.ini
c:\program files\eMule\config\preferencesKad.dat
c:\program files\eMule\config\SearchSpam.met
c:\program files\eMule\config\server.met
c:\program files\eMule\config\server_met.old
c:\program files\eMule\config\shareddir.dat
c:\program files\eMule\config\src_index.dat
c:\program files\eMule\config\staticservers.dat
c:\program files\eMule\config\statistics.ini
c:\program files\eMule\config\webservices.dat
c:\program files\eMule\downloads.bak
c:\program files\eMule\downloads.txt
c:\program files\eMule\eMule Light.tmpl
c:\program files\eMule\eMule.chm
c:\program files\eMule\emule.exe
c:\program files\eMule\eMule.tmpl
c:\program files\eMule\Incoming\[0] Command & Conquer Red Alert 3 Serials.txt
c:\program files\eMule\Incoming\[SERIAL] Command & Conquer Keys (The First Decade, Tiberian Sun, Renegade, Red Alert 2, Yuri's Revenge, Generals, Zero Hour).txt
c:\program files\eMule\Incoming\קורין אלאל - הטבעת נפלה.mp3
c:\program files\eMule\Incoming\06 - Just The Two Of Us.mp3
c:\program files\eMule\Incoming\2 Command & Conquer Generals Zero Hour Serials.txt
c:\program files\eMule\Incoming\Al Jarreau & George Benson - Just The Two Of Us.mp3
c:\program files\eMule\Incoming\C&C - Red Alert 1-2-3 - Tiberian Sun serial.txt
c:\program files\eMule\Incoming\C&C 3 Tiberium Wars -Kane Edition- Serial Key.txt
c:\program files\eMule\Incoming\C&C Red Alert 3-Tiberian Sun Cd Key.txt
c:\program files\eMule\Incoming\c&c red alert 3 cd key.txt
c:\program files\eMule\Incoming\C&C Red Alert 3 Tiberian Sun Cd-Key.txt
c:\program files\eMule\Incoming\Command & Conquer Generals Zero Hour Serials.txt
c:\program files\eMule\Incoming\Command & Conquer Red Alert 3 - Serial.txt
c:\program files\eMule\Incoming\George Benson - Just The Two of Us.mp3
c:\program files\eMule\Incoming\Grover Washington Jr. - Just The Two Of Us.mp3
c:\program files\eMule\Incoming\IPod Access for Windows v4 0 5.rar
c:\program files\eMule\Incoming\IPod Access For Windows v4.2 Incl. Keygen-CORE [FEV-07-08].rar
c:\program files\eMule\Incoming\Joe Jackson - Stepping Out-cortar.mp3
c:\program files\eMule\Incoming\Joe Jackson - Stepping Out.mp3
c:\program files\eMule\Incoming\Netlimiter 1.30 Serial.txt
c:\program files\eMule\Incoming\NetLimiter.1.30.+.Crack.rar
c:\program files\eMule\Incoming\Serial and Authorization Code spss14.txt
c:\program files\eMule\Incoming\Serial C&C 3.txt
c:\program files\eMule\Incoming\SharePod.zip
c:\program files\eMule\Incoming\Spss 14 Licence Code.doc
c:\program files\eMule\Incoming\Spss 14 Licence Code.txt
c:\program files\eMule\Incoming\Spss 14 Serial And Authorization Code 2008.txt
c:\program files\eMule\Incoming\spss 14 serial.txt
c:\program files\eMule\Incoming\SPSS 14.0 + Crack.rar
c:\program files\eMule\Incoming\SPSS 15 espa?ol (windows).rar
c:\program files\eMule\Incoming\SPSS V15 Espa_ol + Licencia Infinita.rar
c:\program files\eMule\Incoming\SPSS_14_Crack\file_id.diz
c:\program files\eMule\Incoming\SPSS_14_Crack\Read Me First!!.txt
c:\program files\eMule\Incoming\The Doors - Touch Me.mp3
c:\program files\eMule\Incoming\Willy Smith - Just The Two Of Us.mp3
c:\program files\eMule\Incoming\אסף ארליך - לא ידוע.mp3
c:\program files\eMule\Incoming\אסף ארליך - לטייל.mp3
c:\program files\eMule\Incoming\אסף ארליך - כמה מדרגות(1).mp3
c:\program files\eMule\Incoming\אסף ארליך - כמה מדרגות.mp3
c:\program files\eMule\Incoming\אסף ארליך - יושב בכורסא.mp3
c:\program files\eMule\Incoming\איציק קלה ליאור פרחי - תזהר ממנה.mp3
c:\program files\eMule\lang\ar_AE.dll
c:\program files\eMule\lang\ba_BA.dll
c:\program files\eMule\lang\bg_BG.dll
c:\program files\eMule\lang\ca_ES.dll
c:\program files\eMule\lang\cz_CZ.dll
c:\program files\eMule\lang\da_DK.dll
c:\program files\eMule\lang\de_DE.dll
c:\program files\eMule\lang\el_GR.dll
c:\program files\eMule\lang\es_AS.dll
c:\program files\eMule\lang\es_ES_T.dll
c:\program files\eMule\lang\et_EE.dll
c:\program files\eMule\lang\fa_IR.dll
c:\program files\eMule\lang\fi_FI.dll
c:\program files\eMule\lang\fr_BR.dll
c:\program files\eMule\lang\fr_FR.dll
c:\program files\eMule\lang\gl_ES.dll
c:\program files\eMule\lang\he_IL.dll
c:\program files\eMule\lang\hu_HU.dll
c:\program files\eMule\lang\it_IT.dll
c:\program files\eMule\lang\jp_JP.dll
c:\program files\eMule\lang\ko_KR.dll
c:\program files\eMule\lang\lt_LT.dll
c:\program files\eMule\lang\lv_LV.dll
c:\program files\eMule\lang\mt_MT.dll
c:\program files\eMule\lang\nb_NO.dll
c:\program files\eMule\lang\nl_NL.dll
c:\program files\eMule\lang\nn_NO.dll
c:\program files\eMule\lang\pl_PL.dll
c:\program files\eMule\lang\pt_BR.dll
c:\program files\eMule\lang\pt_PT.dll
c:\program files\eMule\lang\ro_RO.dll
c:\program files\eMule\lang\ru_RU.dll
c:\program files\eMule\lang\sl_SI.dll
c:\program files\eMule\lang\sq_AL.dll
c:\program files\eMule\lang\sv_SE.dll
c:\program files\eMule\lang\tr_TR.dll
c:\program files\eMule\lang\ua_UA.dll
c:\program files\eMule\lang\va_ES.dll
c:\program files\eMule\lang\vi_VN.dll
c:\program files\eMule\lang\zh_CN.dll
c:\program files\eMule\lang\zh_TW.dll
c:\program files\eMule\license-GER.txt
c:\program files\eMule\license.txt
c:\program files\eMule\LinkCreator.exe
c:\program files\eMule\readme.txt
c:\program files\eMule\Template.eMuleSkin.ini
c:\program files\eMule\Template.Notifier.ini
c:\program files\eMule\Uninstall.exe
c:\program files\eMule\webserver\add_server.gif
c:\program files\eMule\webserver\arrow_down.gif
c:\program files\eMule\webserver\arrow_up.gif
c:\program files\eMule\webserver\arrow_up_q.gif
c:\program files\eMule\webserver\black.gif
c:\program files\eMule\webserver\blue1.gif
c:\program files\eMule\webserver\blue2.gif
c:\program files\eMule\webserver\blue3.gif
c:\program files\eMule\webserver\blue4.gif
c:\program files\eMule\webserver\blue5.gif
c:\program files\eMule\webserver\blue6.gif
c:\program files\eMule\webserver\checked.gif
c:\program files\eMule\webserver\checked_no.gif
c:\program files\eMule\webserver\complete.gif
c:\program files\eMule\webserver\completing.gif
c:\program files\eMule\webserver\connecting.gif
c:\program files\eMule\webserver\ct_0.gif
c:\program files\eMule\webserver\ct_1.gif
c:\program files\eMule\webserver\ct_a.gif
c:\program files\eMule\webserver\ct_h.gif
c:\program files\eMule\webserver\ct_l.gif
c:\program files\eMule\webserver\ct_m.gif
c:\program files\eMule\webserver\ct_s.gif
c:\program files\eMule\webserver\ct_u.gif
c:\program files\eMule\webserver\disconnected.gif
c:\program files\eMule\webserver\downloading.gif
c:\program files\eMule\webserver\error.gif
c:\program files\eMule\webserver\failed.gif
c:\program files\eMule\webserver\favicon.ico
c:\program files\eMule\webserver\file.gif
c:\program files\eMule\webserver\filedown.gif
c:\program files\eMule\webserver\filetype_archive.gif
c:\program files\eMule\webserver\filetype_audio.gif
c:\program files\eMule\webserver\filetype_cdimage.gif
c:\program files\eMule\webserver\filetype_document.gif
c:\program files\eMule\webserver\filetype_emulecollection.gif
c:\program files\eMule\webserver\filetype_other.gif
c:\program files\eMule\webserver\filetype_picture.gif
c:\program files\eMule\webserver\filetype_program.gif
c:\program files\eMule\webserver\filetype_video.gif
c:\program files\eMule\webserver\green.gif
c:\program files\eMule\webserver\greenpercent.gif
c:\program files\eMule\webserver\h_emule.gif
c:\program files\eMule\webserver\h_graph.gif
c:\program files\eMule\webserver\h_graphs.gif
c:\program files\eMule\webserver\h_kad.gif
c:\program files\eMule\webserver\h_log.gif
c:\program files\eMule\webserver\h_preferences.gif
c:\program files\eMule\webserver\h_search.gif
c:\program files\eMule\webserver\h_server.gif
c:\program files\eMule\webserver\h_shared.gif
c:\program files\eMule\webserver\h_statistic.gif
c:\program files\eMule\webserver\h_transfer.gif
c:\program files\eMule\webserver\hashing.gif
c:\program files\eMule\webserver\high.gif
c:\program files\eMule\webserver\is_a4af.gif
c:\program files\eMule\webserver\is_banned.gif
c:\program files\eMule\webserver\is_credit.gif
c:\program files\eMule\webserver\is_friend.gif
c:\program files\eMule\webserver\is_getflc.gif
c:\program files\eMule\webserver\is_halfcmtbad.gif
c:\program files\eMule\webserver\is_halfcmtgood.gif
c:\program files\eMule\webserver\is_halfnone.gif
c:\program files\eMule\webserver\is_none.gif
c:\program files\eMule\webserver\is_release.gif
c:\program files\eMule\webserver\is_static.gif
c:\program files\eMule\webserver\l_add.gif
c:\program files\eMule\webserver\l_calendar.gif
c:\program files\eMule\webserver\l_cancel.gif
c:\program files\eMule\webserver\l_catarrow.gif
c:\program files\eMule\webserver\l_category.gif
c:\program files\eMule\webserver\l_catprio.gif
c:\program files\eMule\webserver\l_clear.gif
c:\program files\eMule\webserver\l_clock.gif
c:\program files\eMule\webserver\l_close.gif
c:\program files\eMule\webserver\l_comments.gif
c:\program files\eMule\webserver\l_con.gif
c:\program files\eMule\webserver\l_connect.gif
c:\program files\eMule\webserver\l_dndoublearrow.gif
c:\program files\eMule\webserver\l_downarrow.gif
c:\program files\eMule\webserver\l_ed2klink.gif
c:\program files\eMule\webserver\l_filedonkey.gif
c:\program files\eMule\webserver\l_filesearch.gif
c:\program files\eMule\webserver\l_forum.gif
c:\program files\eMule\webserver\l_friend.gif
c:\program files\eMule\webserver\l_getflc.gif
c:\program files\eMule\webserver\l_hasherror.gif
c:\program files\eMule\webserver\l_homepage.gif
c:\program files\eMule\webserver\l_info.gif
c:\program files\eMule\webserver\l_logout.gif
c:\program files\eMule\webserver\l_none.gif
c:\program files\eMule\webserver\l_options.gif
c:\program files\eMule\webserver\l_pause.gif
c:\program files\eMule\webserver\l_reboot.gif
c:\program files\eMule\webserver\l_remove.gif
c:\program files\eMule\webserver\l_rename.gif
c:\program files\eMule\webserver\l_resume.gif
c:\program files\eMule\webserver\l_search.gif
c:\program files\eMule\webserver\l_server.gif
c:\program files\eMule\webserver\l_shared.gif
c:\program files\eMule\webserver\l_showcat.gif
c:\program files\eMule\webserver\l_shutdown.gif
c:\program files\eMule\webserver\l_sources_0.gif
c:\program files\eMule\webserver\l_sources_10.gif
c:\program files\eMule\webserver\l_sources_25.gif
c:\program files\eMule\webserver\l_sources_5.gif
c:\program files\eMule\webserver\l_sources_50.gif
c:\program files\eMule\webserver\l_static.gif
c:\program files\eMule\webserver\l_stop.gif
c:\program files\eMule\webserver\l_timer.gif
c:\program files\eMule\webserver\l_timer_off.gif
c:\program files\eMule\webserver\l_uparrow.gif
c:\program files\eMule\webserver\l_updoublearrow.gif
c:\program files\eMule\webserver\l_users.gif
c:\program files\eMule\webserver\l_version.gif
c:\program files\eMule\webserver\login_bottom.gif
c:\program files\eMule\webserver\login_downmain.gif
c:\program files\eMule\webserver\login_lefttop.gif
c:\program files\eMule\webserver\login_righttop.gif
c:\program files\eMule\webserver\login_top.gif
c:\program files\eMule\webserver\login_topdown.gif
c:\program files\eMule\webserver\login_topseperator.gif
c:\program files\eMule\webserver\logo.jpg
c:\program files\eMule\webserver\low.gif
c:\program files\eMule\webserver\m_category.gif
c:\program files\eMule\webserver\m_catprio.gif
c:\program files\eMule\webserver\m_clearcompleted.gif
c:\program files\eMule\webserver\main_bg.gif
c:\program files\eMule\webserver\main_menubg.gif
c:\program files\eMule\webserver\main_topbar.gif
c:\program files\eMule\webserver\main_topbardarker.gif
c:\program files\eMule\webserver\main_topbarseperator.gif
c:\program files\eMule\webserver\p_black.gif
c:\program files\eMule\webserver\p_blue1.gif
c:\program files\eMule\webserver\p_blue2.gif
c:\program files\eMule\webserver\p_blue3.gif
c:\program files\eMule\webserver\p_blue4.gif
c:\program files\eMule\webserver\p_blue5.gif
c:\program files\eMule\webserver\p_blue6.gif
c:\program files\eMule\webserver\p_green.gif
c:\program files\eMule\webserver\p_greenpercent.gif
c:\program files\eMule\webserver\p_red.gif
c:\program files\eMule\webserver\p_yellow.gif
c:\program files\eMule\webserver\paused.gif
c:\program files\eMule\webserver\qs_con.jpg
c:\program files\eMule\webserver\qs_down.jpg
c:\program files\eMule\webserver\qs_up.jpg
c:\program files\eMule\webserver\qs_user.jpg
c:\program files\eMule\webserver\red.gif
c:\program files\eMule\webserver\stalled.gif
c:\program files\eMule\webserver\stats_0.gif
c:\program files\eMule\webserver\stats_1.gif
c:\program files\eMule\webserver\stats_10.gif
c:\program files\eMule\webserver\stats_11.gif
c:\program files\eMule\webserver\stats_12.gif
c:\program files\eMule\webserver\stats_13.gif
c:\program files\eMule\webserver\stats_14.gif
c:\program files\eMule\webserver\stats_15.gif
c:\program files\eMule\webserver\stats_16.gif
c:\program files\eMule\webserver\stats_17.gif
c:\program files\eMule\webserver\stats_2.gif
c:\program files\eMule\webserver\stats_3.gif
c:\program files\eMule\webserver\stats_4.gif
c:\program files\eMule\webserver\stats_5.gif
c:\program files\eMule\webserver\stats_6.gif
c:\program files\eMule\webserver\stats_7.gif
c:\program files\eMule\webserver\stats_8.gif
c:\program files\eMule\webserver\stats_9.gif
c:\program files\eMule\webserver\stats_back.gif
c:\program files\eMule\webserver\stats_con.gif
c:\program files\eMule\webserver\stats_down.gif
c:\program files\eMule\webserver\stats_hidden.gif
c:\program files\eMule\webserver\stats_space.gif
c:\program files\eMule\webserver\stats_up.gif
c:\program files\eMule\webserver\stats_visible.gif
c:\program files\eMule\webserver\stopped.gif
c:\program files\eMule\webserver\t_complete.gif
c:\program files\eMule\webserver\t_completing.gif
c:\program files\eMule\webserver\t_connecting.gif
c:\program files\eMule\webserver\t_downloading.gif
c:\program files\eMule\webserver\t_error.gif
c:\program files\eMule\webserver\t_hashing.gif
c:\program files\eMule\webserver\t_next.gif
c:\program files\eMule\webserver\t_paused.gif
c:\program files\eMule\webserver\t_stalled.gif
c:\program files\eMule\webserver\t_stopped.gif
c:\program files\eMule\webserver\t_uploading.gif
c:\program files\eMule\webserver\t_waiting.gif
c:\program files\eMule\webserver\t_waitinghash.gif
c:\program files\eMule\webserver\transparent.gif
c:\program files\eMule\webserver\waiting.gif
c:\program files\eMule\webserver\waitinghash.gif
c:\program files\eMule\webserver\yellow.gif
c:\windows\system32\zlibwapi.dll

.
((((((((((((((((((((((((( Files Created from 2010-06-22 to 2010-07-22 )))))))))))))))))))))))))))))))
.

2030-08-29 13:22 . 2030-08-29 13:22 56832 ------w- c:\windows\system32\iyvu9_32.dll
2030-08-29 13:22 . 2030-08-29 13:22 143872 ------w- c:\windows\system32\iacenc.dll
2010-07-20 09:30 . 2010-07-20 09:35 -------- d-----w- c:\documents and settings\ran simchas\Application Data\HpUpdate
2010-07-20 09:30 . 2010-07-20 09:30 -------- d-----w- c:\windows\Hewlett-Packard
2010-07-18 21:58 . 2010-07-18 21:59 26641904 ----a-w- c:\documents and settings\ran simchas\Application Data\Real\Update\setup3.12\rp\RealPlayerSPGold.exe
2010-07-18 21:58 . 2010-07-18 21:58 220272 ----a-w- c:\documents and settings\ran simchas\Application Data\Real\Update\setup3.12\gtb\GOOGLE_TOOLBAR\GoogleToolbarInstaller.exe
2010-07-18 21:58 . 2010-07-18 21:58 149000 ----a-w- c:\documents and settings\ran simchas\Application Data\Real\Update\setup3.12\chr_helper\LaunchHelper.exe
2010-07-18 21:58 . 2010-07-18 21:58 13407072 ----a-w- c:\documents and settings\ran simchas\Application Data\Real\Update\setup3.12\chr\ChromeInstaller.exe
2010-07-18 21:57 . 2010-07-18 21:57 79368 ----a-w- c:\documents and settings\ran simchas\Application Data\Real\Update\setup3.12\RUP\vista.exe
2010-07-18 21:57 . 2010-07-18 21:57 73344 ----a-w- c:\documents and settings\ran simchas\Application Data\Real\Update\setup3.12\RUP\inst_config\gtapi_v6.dll
2010-07-18 21:57 . 2010-07-18 21:57 64000 ----a-w- c:\documents and settings\ran simchas\Application Data\Real\Update\setup3.12\RUP\inst_config\gcapi_dll.dll
2010-07-18 21:57 . 2010-07-18 21:57 52288 ----a-w- c:\documents and settings\ran simchas\Application Data\Real\Update\setup3.12\RUP\inst_config\gtapi.dll
2010-07-18 21:57 . 2010-07-18 21:57 122880 ----a-w- c:\documents and settings\ran simchas\Application Data\Real\Update\setup3.12\RUP\inst_config\compat.dll
2010-07-18 13:57 . 2010-07-18 13:57 452104 ----a-w- c:\documents and settings\ran simchas\Application Data\Real\Update\setup3.12\setup.exe
2010-07-17 05:01 . 2010-07-17 05:01 242896 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtdix.sys
2010-07-17 05:01 . 2010-07-17 05:01 216200 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgldx86.sys
2010-07-17 05:00 . 2010-07-17 05:00 813336 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avginet.dll
2010-07-17 05:00 . 2010-07-17 05:00 624920 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgiproxy.exe
2010-07-17 05:00 . 2010-07-17 05:00 1690464 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll
2010-07-17 05:00 . 2010-07-17 05:00 1038688 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.exe
2010-07-15 21:06 . 2010-07-15 21:06 -------- d-----w- c:\program files\Common Files\Skype
2010-07-15 15:57 . 2010-07-15 16:00 -------- d-----w- c:\program files\ERUNT
2010-07-12 16:49 . 2010-07-12 16:49 -------- d-----w- c:\windows\system32\wbem\Repository
2010-07-12 14:03 . 2010-07-12 14:03 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Conduit
2010-07-12 12:34 . 2010-07-12 12:34 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE
2010-07-10 08:04 . 2010-07-12 12:30 -------- d-----w- c:\documents and settings\ran simchas\Application Data\vlc
2010-06-26 18:14 . 2010-06-26 18:14 -------- d-----w- c:\program files\Bonjour
2010-06-22 21:49 . 2010-06-22 21:49 -------- d-----w- c:\program files\FolderSize

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-22 18:14 . 2010-04-27 08:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Babylon
2010-07-22 14:53 . 2009-11-13 17:15 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2010-07-20 09:36 . 2008-09-28 11:37 -------- d-----w- c:\documents and settings\ran simchas\Application Data\Image Zone Express
2010-07-20 09:31 . 2008-09-28 11:17 -------- d-----w- c:\program files\HP
2010-07-19 13:06 . 2008-03-17 12:45 -------- d-----w- c:\documents and settings\ran simchas\Application Data\skypePM
2010-07-17 00:06 . 2009-02-27 07:08 -------- d-----w- c:\documents and settings\ran simchas\Application Data\Skype
2010-07-15 21:06 . 2008-04-02 12:53 -------- d-----r- c:\program files\Skype
2010-07-15 21:05 . 2008-03-17 12:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2010-07-13 13:36 . 2009-02-13 00:01 -------- d-----w- c:\documents and settings\ran simchas\Application Data\dvdcss
2010-07-06 13:57 . 2010-04-18 13:54 439816 ----a-w- c:\documents and settings\ran simchas\Application Data\Real\Update\setup3.10\setup.exe
2010-07-03 16:22 . 2007-12-11 21:05 59256 ----a-w- c:\documents and settings\ran simchas\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-07-01 15:45 . 2010-04-27 08:24 -------- d-----w- c:\documents and settings\ran simchas\Application Data\Babylon
2010-06-11 13:51 . 2010-06-11 13:51 3055600 ----a-w- c:\documents and settings\ran simchas\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll
2010-06-11 13:36 . 2010-06-11 13:36 275952 ----a-w- c:\documents and settings\ran simchas\Application Data\Mozilla\plugins\npgoogletalk.dll
2010-05-24 15:55 . 2010-05-24 15:55 503808 ----a-w- c:\documents and settings\ran simchas\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-6b34a3ca-n\msvcp71.dll
2010-05-24 15:55 . 2010-05-24 15:55 499712 ----a-w- c:\documents and settings\ran simchas\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-6b34a3ca-n\jmc.dll
2010-05-24 15:55 . 2010-05-24 15:55 348160 ----a-w- c:\documents and settings\ran simchas\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-6b34a3ca-n\msvcr71.dll
2009-05-06 06:24 . 2008-09-27 21:58 44191776 --sha-w- c:\windows\system32\drivers\fidbox.dat
.

((((((((((((((((((((((((((((( SnapShot@2010-07-22_15.08.03 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-12-11 19:26 . 2010-07-22 14:59 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2007-12-11 19:26 . 2010-07-22 18:45 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2007-12-11 19:26 . 2010-07-22 14:59 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2007-12-11 19:26 . 2010-07-22 18:45 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2007-12-11 19:26 . 2010-07-22 14:59 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2007-12-11 19:26 . 2010-07-22 18:45 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-03-25 16:55 . 2009-03-25 16:55 4286 c:\windows\Installer\{111481C4-FE6C-44AF-B6BF-B10E9CCD0672}\LaunchSignAndVerif_111481C4FE6C44AFB6BFB10E9CCD0672_1.exe
+ 2009-03-25 16:55 . 2010-07-22 15:18 4286 c:\windows\Installer\{111481C4-FE6C-44AF-B6BF-B10E9CCD0672}\LaunchSignAndVerif_111481C4FE6C44AFB6BFB10E9CCD0672_1.exe
- 2009-03-25 16:55 . 2009-03-25 16:55 4286 c:\windows\Installer\{111481C4-FE6C-44AF-B6BF-B10E9CCD0672}\LaunchSignAndVerif_111481C4FE6C44AFB6BFB10E9CCD0672.exe
+ 2009-03-25 16:55 . 2010-07-22 15:18 4286 c:\windows\Installer\{111481C4-FE6C-44AF-B6BF-B10E9CCD0672}\LaunchSignAndVerif_111481C4FE6C44AFB6BFB10E9CCD0672.exe
+ 2009-03-25 16:55 . 2010-07-22 15:18 4286 c:\windows\Installer\{111481C4-FE6C-44AF-B6BF-B10E9CCD0672}\ARPPRODUCTICON.exe
- 2009-03-25 16:55 . 2009-03-25 16:55 4286 c:\windows\Installer\{111481C4-FE6C-44AF-B6BF-B10E9CCD0672}\ARPPRODUCTICON.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{1ec8a687-ee92-4e42-9838-5215ef8d9381}"= "c:\program files\sratim4u\tbsra0.dll" [2010-05-19 2515552]

[HKEY_CLASSES_ROOT\clsid\{1ec8a687-ee92-4e42-9838-5215ef8d9381}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1ec8a687-ee92-4e42-9838-5215ef8d9381}]
2010-05-19 13:14 2515552 ----a-w- c:\program files\sratim4u\tbsra0.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{1ec8a687-ee92-4e42-9838-5215ef8d9381}"= "c:\program files\sratim4u\tbsra0.dll" [2010-05-19 2515552]

[HKEY_CLASSES_ROOT\clsid\{1ec8a687-ee92-4e42-9838-5215ef8d9381}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{1EC8A687-EE92-4E42-9838-5215EF8D9381}"= "c:\program files\sratim4u\tbsra0.dll" [2010-05-19 2515552]

[HKEY_CLASSES_ROOT\clsid\{1ec8a687-ee92-4e42-9838-5215ef8d9381}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 2321600]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"Google Update"="c:\documents and settings\ran simchas\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-08 133104]
"Uniblue ProcessQuickLink 2"="c:\program files\ProcessQuickLink 2\ProcessQuickLink 2\ProcessQuickLink2.exe" [2008-04-02 655640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gainward"="c:\program files\XpertVision\TBPanel.exe" [2007-10-02 2165256]
"RTHDCPL"="RTHDCPL.EXE" [2007-06-13 16377344]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-05-16 185896]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2010-06-09 49208]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2008-11-02 167936]
"NetLimiter"="c:\program files\NetLimiter\NetLimiter.exe" [2004-03-31 823296]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-22 141608]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-01-11 13666408]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-01-11 110696]
"Babylon Client"="c:\program files\Babylon\Babylon-Pro\Babylon.exe" [2010-04-27 3730832]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
11g Wireless LAN Utility.lnk - c:\program files\LevelOne\11g Wireless LAN\WLanUtility.exe [2007-12-12 712704]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
PVR Launcher.lnk - c:\program files\Mainconcept\PVR\PvrLauncher.exe [2008-2-23 69632]
UPnP AV Server.lnk - c:\program files\Mainconcept\PVR\mcavserv.exe [2008-2-23 147456]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mainconcept\\PVR\\mcavserv.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Documents and Settings\\ran simchas\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\ran simchas\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\frd.exe"=
"c:\\Program Files\\UnisonPlay\\UniFS.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 Achernar;Achernar - SCSI Command Filters;c:\windows\system32\drivers\Achernar.sys [23/02/2008 17:24 17920]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [22/01/2009 16:44 297752]
R3 Aldebaran;Aldebaran - SCSI Command Filters;c:\windows\system32\drivers\Aldebaran.sys [23/02/2008 17:24 13824]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [29/01/2009 13:14 664064]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [17/03/2010 14:16 136176]
S3 RTLWUSB;11g Wireless USB Adapter;c:\windows\system32\drivers\RTL8187.sys [12/12/2007 00:10 178048]
S3 SjyPkt;SjyPkt;\??\c:\windows\System32\Drivers\SjyPkt.sys --> c:\windows\System32\Drivers\SjyPkt.sys [?]
S3 XDva032;XDva032;\??\c:\windows\system32\XDva032.sys --> c:\windows\system32\XDva032.sys [?]
S4 UniFS;UniFS;c:\program files\UnisonPlay\UniFSService.exe [24/11/2009 23:46 130560]
.
Contents of the 'Scheduled Tasks' folder

2010-07-17 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 09:34]

2010-07-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-17 11:15]

2010-07-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-17 11:15]

2010-07-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-789336058-1935655697-725345543-1003Core.job
- c:\documents and settings\ran simchas\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-08 15:18]

2010-07-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-789336058-1935655697-725345543-1003UA.job
- c:\documents and settings\ran simchas\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-08 15:18]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: &יצא ל- Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Translate this web page with Babylon - c:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm
IE: Translate with Babylon - c:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm
LSP: c:\program files\NetLimiter\nl_lsp.dll
TCP: {D1BB8531-18CA-407E-99E6-6DDCC293D840} = 192.168.123.254
TCP: {F194A711-11DB-48CC-8B16-B9B4F509F647} = 212.150.49.10,212.150.48.169
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\ran simchas\Application Data\Mozilla\Firefox\Profiles\n4wi8h1c.default\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-22 21:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,10,c9,b6,e6,89,ca,fb,49,bf,57,9d,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,10,c9,b6,e6,89,ca,fb,49,bf,57,9d,\

[HKEY_USERS\S-1-5-21-789336058-1935655697-725345543-1003\Software\SecuROM\License information*]
"datasecu"=hex:4b,1e,15,04,b2,67,32,2a,e0,d3,a8,ba,d1,da,e3,c2,fd,7c,69,81,14,
a7,bd,51,2e,3a,24,c0,a1,5b,39,7c,62,5b,ac,c0,85,ef,64,d3,f5,84,e6,c4,19,f3,\
"rkeysecu"=hex:00,af,aa,cf,92,65,87,7b,05,ed,91,bf,54,e2,41,3c

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):28,f4,a0,4b,a6,9a,b8,e4,63,29,17,41,89,b1,48,b2,3e,4e,61,95,b3,
c9,89,f4,ca,6d,30,99,86,ef,ad,79,44,af,28,5f,c9,75,b4,ea,00,00,00,00,00,00,\
.
Completion time: 2010-07-22 21:50:06
ComboFix-quarantined-files.txt 2010-07-22 18:50
ComboFix2.txt 2010-07-22 15:09
ComboFix3.txt 2008-03-06 17:48

Pre-Run: 14,062,575,616 bytes free
Post-Run: 14,051,725,312 bytes free

- - End Of File - - B3F3F28AE5F6E61A469AA3366DDBB0A9

Blade81 · Jul 23, 2010

Please run DDS after a reboot. How's the system running?

Ransimch · Jul 23, 2010

hello,

my problems are still there.

1- the wave column on the master volume jumps to minimum by it self every few minutes
2-every few minutes an advertisement jumps all over my screen.
(i know its not related to what i do at the moment because i use chrome and the advertisement jump on IE)
3- i hear a lot of mouse clicking sounds though i dont have those sounds regularly, and they appear even when i dont click the mouse.

thanks a l-o-t for your time and effort

here is the dds log:

DDS (Ver_10-03-17.01) - NTFSx86
Run by ran simchas at 21:04:24.73 on Fri 07/23/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Professional 5.1.2600.2.1255.972.1033.18.2045.1437 [GMT 3:00]

AV: AVG Anti-Virus Free *On-access scanning disabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
svchost.exe 4
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
svchost.exe 4
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\FolderSize\FolderSizeSvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\XpertVision\TBPanel.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\NetLimiter\NetLimiter.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Babylon\Babylon-Pro\Babylon.exe
C:\Program Files\ProcessQuickLink 2\ProcessQuickLink 2\ProcessQuickLink2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Mainconcept\PVR\PvrLauncher.exe
C:\Program Files\Mainconcept\PVR\mcavserv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\ran simchas\Desktop\dds.com

============== Pseudo HJT Report ===============

uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: sratim4u Toolbar: {1ec8a687-ee92-4e42-9838-5215ef8d9381} - c:\program files\sratim4u\tbsra0.dll
BHO: sratim4u Toolbar: {1ec8a687-ee92-4e42-9838-5215ef8d9381} - c:\program files\sratim4u\tbsra0.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {54B02808-B60E-44CD-A72D-9865117E4E62} - No File
BHO: AGFormHelperObj Class: {6620e618-1ab9-4eb2-aca4-cbbe9066dbe6} - c:\program files\agat\agform\AGFormsHelper.dll
BHO: עוזר הכניסה של Windows Live: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Babylon IE plugin: {9cfaccb6-2f3f-4177-94ea-0d2b72d384c1} - c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll
BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: AGForms: {ed2e7de7-07db-4941-a06d-f780b93ba730} - c:\program files\agat\agform\AGForms.dll
TB: sratim4u Toolbar: {1ec8a687-ee92-4e42-9838-5215ef8d9381} - c:\program files\sratim4u\tbsra0.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [AdobeUpdater] c:\program files\common files\adobe\updater5\AdobeUpdater.exe
uRun: [MsnMsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [Google Update] "c:\documents and settings\ran simchas\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [Uniblue ProcessQuickLink 2] "c:\program files\processquicklink 2\processquicklink 2\ProcessQuickLink2.exe" /autostart
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [Gainward] c:\program files\xpertvision\TBPanel.exe /A
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXE
mRun: [NetLimiter] c:\program files\netlimiter\NetLimiter.exe /s
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [Babylon Client] c:\program files\babylon\babylon-pro\Babylon.exe -AutoStart
dRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\11gwir~1.lnk - c:\program files\levelone\11g wireless lan\WLanUtility.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\pvrlau~1.lnk - c:\program files\mainconcept\pvr\PvrLauncher.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\upnpav~1.lnk - c:\program files\mainconcept\pvr\mcavserv.exe
IE: &יצא ל- Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: Translate this web page with Babylon - c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll/ActionTU.htm
IE: Translate with Babylon - c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll/Action.htm
IE: {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - res://c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll/ActionTU.htm
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
LSP: c:\program files\netlimiter\nl_lsp.dll
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} - hxxp://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {41564D57-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/0/A/9/0A9F8B32-9F8C-4D74-A130-E4CAB36EB01F/wmvadvd.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1258653490156
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: {D1BB8531-18CA-407E-99E6-6DDCC293D840} = 192.168.123.254
TCP: {F194A711-11DB-48CC-8B16-B9B4F509F647} = 212.150.49.10,212.150.48.169
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\ransim~1\applic~1\mozilla\firefox\profiles\n4wi8h1c.default\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 Achernar;Achernar - SCSI Command Filters;c:\windows\system32\drivers\Achernar.sys [2008-2-23 17920]
R2 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-7-7 611664]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-1-22 297752]
R3 Aldebaran;Aldebaran - SCSI Command Filters;c:\windows\system32\drivers\Aldebaran.sys [2008-2-23 13824]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-3-17 136176]
S3 RTLWUSB;11g Wireless USB Adapter;c:\windows\system32\drivers\RTL8187.sys [2007-12-12 178048]
S3 SjyPkt;SjyPkt;\??\c:\windows\system32\drivers\sjypkt.sys --> c:\windows\system32\drivers\SjyPkt.sys [?]
S3 XDva032;XDva032;\??\c:\windows\system32\xdva032.sys --> c:\windows\system32\XDva032.sys [?]
S4 UniFS;UniFS;c:\program files\unisonplay\UniFSService.exe [2009-11-24 130560]

=============== Created Last 30 ================

2030-08-29 13:22:32 56832 ------w- c:\windows\system32\iyvu9_32.dll
2030-08-29 13:22:32 143872 ------w- c:\windows\system32\iacenc.dll
2010-07-23 05:48:54 0 d-----w- c:\windows\system32\drivers\avg
2010-07-22 15:03:00 0 d-sha-r- C:\cmdcons
2010-07-22 14:59:05 77312 ----a-w- c:\windows\MBR.exe
2010-07-22 14:59:05 256512 ----a-w- c:\windows\PEV.exe
2010-07-22 14:59:05 161792 ----a-w- c:\windows\SWREG.exe
2010-07-22 14:59:04 98816 ----a-w- c:\windows\sed.exe
2010-07-20 09:30:46 0 d-----w- c:\docume~1\ransim~1\applic~1\HpUpdate
2010-07-20 09:30:32 0 d-----w- c:\windows\Hewlett-Packard
2010-07-20 09:14:09 21124 ------w- c:\windows\hpomdl07.dat.temp
2010-07-12 16:49:23 0 d-----w- c:\windows\system32\wbem\Repository
2010-06-26 18:14:14 0 d-----w- c:\program files\Bonjour

==================== Find3M ====================

2009-05-06 06:24:42 44191776 --sha-w- c:\windows\system32\drivers\fidbox.dat

============= FINISH: 21:04:37.81 ===============

Blade81 · Jul 23, 2010

Hi,

Please download MBRCheck to your desktop.

1. Double click MBRCheck.exe to run it (Right click and run as Administrator for Vista).
2. It will open a black window, please do not fix anything (if it gives you an option).
3. Exit that window and it will produce a log (MBRCheck_date_time).
4. Please post that log in your reply.

Ransimch · Jul 24, 2010

hello,

here is the log

thanks.

MBRCheck, version 1.1.1

(c) 2010, AD

\\.\C: --> \\.\PhysicalDrive0

\\.\D: --> \\.\PhysicalDrive0

Size Device Name MBR Status

--------------------------------------------

149 GB \\.\PhysicalDrive0 Known-bad MBR code detected (Whistler / Black Internet)!

Found non-standard or infected MBR.

Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done! Press ENTER to exit...

Blade81 · Jul 24, 2010

Hi,

Please print these instructions unless you have second computer to access them.

1. Restart your computer
2. Before Windows loads, you will be prompted to choose which Operating System to start
3. Use the up and down arrow key to select Microsoft Windows Recovery Console
4. You must enter which Windows installation to log onto. Type 1 and press enter.
5. At the C:\Windows prompt, type the following bolded text, and press Enter (allow the change if asked):

fixmbr

6. At the next prompt, type the following bolded text, and press Enter:

exit

Windows will now begin loading. Post a fresh MBRCheck log + dds.txt log.

Ransimch · Jul 24, 2010

hello,
i didnt mentioned that i couldnt ran it as Administrator for vista (i use xp),
it says that i have wrong user name or password.

thanks again.

Ransimch · Jul 24, 2010

hello,

i still cant do it as administrator

but here are the new logs.

thanks.

MBRCheck, version 1.1.1

(c) 2010, AD

\\.\C: --> \\.\PhysicalDrive0

\\.\D: --> \\.\PhysicalDrive0

Size Device Name MBR Status

--------------------------------------------

149 GB \\.\PhysicalDrive0 Windows XP MBR code detected

Done! Press ENTER to exit...

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 11/12/2007 23:58:53
System Uptime: 24/07/2010 12:14:07 (0 hours ago)

Motherboard: Intel Corporation | | DG31PR
Processor: Intel(R) Core(TM)2 Duo CPU E6550 @ 2.33GHz | J3E1 | 2309/1333mhz
Processor: Intel(R) Core(TM)2 Duo CPU E6550 @ 2.33GHz | J3E1 | 2309/1333mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 51 GiB total, 12.806 GiB free.
D: is FIXED (NTFS) - 98 GiB total, 9.948 GiB free.
E: is CDROM ()
F: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4D36E96B-E325-11CE-BFC1-08002BE10318}
Description: Standard 101/102-Key or Microsoft Natural PS/2 Keyboard
Device ID: ACPI\PNP0303\4&2C575ACB&0
Manufacturer: (Standard keyboards)
Name: Standard 101/102-Key or Microsoft Natural PS/2 Keyboard
PNP Device ID: ACPI\PNP0303\4&2C575ACB&0
Service: i8042prt

Class GUID: {4D36E96F-E325-11CE-BFC1-08002BE10318}
Description: Logitech PS/2 Port Mouse
Device ID: ACPI\PNP0F12\4&2C575ACB&0
Manufacturer: Logitech
Name: Logitech PS/2 Port Mouse
PNP Device ID: ACPI\PNP0F12\4&2C575ACB&0
Service: i8042prt

==== System Restore Points ===================

RP947: 12/07/2010 02:22:35 - System Checkpoint
RP948: 12/07/2010 19:48:42 - Restore Operation
RP949: 12/07/2010 19:52:07 - Avg8 Update
RP950: 12/07/2010 19:52:25 - Avg8 Update
RP951: 13/07/2010 16:22:03 - Removed Google Talk Plugin
RP952: 15/07/2010 16:18:40 - System Checkpoint
RP953: 16/07/2010 00:06:11 - הוסר Skype™ 4.0
RP954: 17/07/2010 01:02:38 - System Checkpoint
RP955: 17/07/2010 08:00:19 - Avg Update
RP956: 17/07/2010 08:01:52 - Avg Update
RP957: 18/07/2010 08:14:38 - System Checkpoint
RP958: 19/07/2010 09:14:38 - System Checkpoint
RP959: 20/07/2010 10:18:25 - System Checkpoint
RP960: 20/07/2010 12:31:33 - Removed HP Software Update
RP961: 20/07/2010 12:31:49 - HP Update הותקן.
RP962: 22/07/2010 17:47:12 - Removed AVG Free 9.0
RP963: 22/07/2010 17:51:32 - Removed AVG Free 9.0
RP964: 22/07/2010 17:52:52 - Removed AVG Free 9.0
RP965: 22/07/2010 17:53:50 - Installed AVG Free 9.0
RP966: 23/07/2010 18:09:45 - System Checkpoint

==== Installed Programs ======================

Adobe Flash Player 10 Plugin
Adobe Shockwave Player 11.5
Advanced SystemCare 3
Apple Application Support
Apple Mobile Device Support
Babylon
E-GOV.IL Sign&Verify Software - AGForm toolbar
ERUNT 1.1j
Facebook Plug-In
Folder Size for Windows
Google Chrome
Google Earth
Google Talk Plugin
Google Update Helper
HijackThis 2.0.2
HP Update
Image Resizer Powertoy for Windows XP
iTunes
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Visual C++ 2005 Redistributable
MobileMe Control Panel
Mozilla Firefox (3.5.7)
MSVCRT
NVIDIA Display Control Panel
NVIDIA Drivers
NVIDIA nView Desktop Manager
QuickTime
Safari
Segoe UI
Skype Toolbars
Skype™ 4.2
sratim4u Toolbar
Uniblue ProcessQuickLink 2
Unison Play UniFS
Update for Windows XP (KB898461)
Update for Windows XP (KB932823-v3)
VLC media player 1.1.0
WebFldrs XP
Windows Genuine Advantage Validation Tool (KB892130)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Messenger
Windows Media Player Firefox Plugin
מסייע הכניסה של Windows Live

==== Event Viewer Messages From Past Week ========

24/07/2010 12:14:53, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: i8042prt
23/07/2010 16:54:14, error: Service Control Manager [7023] - The HID Input Service service terminated with the following error: The specified module could not be found.
23/07/2010 16:54:14, error: Service Control Manager [7000] - The nVidia WDM Video Capture (universal) service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
23/07/2010 16:54:14, error: Service Control Manager [7000] - The nVidia WDM A/V Crossbar service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
22/07/2010 16:00:00, error: Schedule [7901] - The At41.job command failed to start due to the following error: %%2147942402
22/07/2010 16:00:00, error: Schedule [7901] - The At17.job command failed to start due to the following error: %%2147942402
22/07/2010 13:00:00, error: Schedule [7901] - The At38.job command failed to start due to the following error: %%2147942402
22/07/2010 13:00:00, error: Schedule [7901] - The At14.job command failed to start due to the following error: %%2147942402
22/07/2010 12:00:00, error: Schedule [7901] - The At37.job command failed to start due to the following error: %%2147942402
22/07/2010 12:00:00, error: Schedule [7901] - The At13.job command failed to start due to the following error: %%2147942402
22/07/2010 08:00:00, error: Schedule [7901] - The At9.job command failed to start due to the following error: %%2147942402
22/07/2010 08:00:00, error: Schedule [7901] - The At33.job command failed to start due to the following error: %%2147942402
22/07/2010 07:00:00, error: Schedule [7901] - The At8.job command failed to start due to the following error: %%2147942402
22/07/2010 07:00:00, error: Schedule [7901] - The At32.job command failed to start due to the following error: %%2147942402
22/07/2010 06:00:00, error: Schedule [7901] - The At7.job command failed to start due to the following error: %%2147942402
22/07/2010 06:00:00, error: Schedule [7901] - The At31.job command failed to start due to the following error: %%2147942402
22/07/2010 01:00:00, error: Schedule [7901] - The At26.job command failed to start due to the following error: %%2147942402
22/07/2010 01:00:00, error: Schedule [7901] - The At2.job command failed to start due to the following error: %%2147942402
21/07/2010 17:00:00, error: Schedule [7901] - The At42.job command failed to start due to the following error: %%2147942402
21/07/2010 17:00:00, error: Schedule [7901] - The At18.job command failed to start due to the following error: %%2147942402
21/07/2010 15:00:00, error: Schedule [7901] - The At16.job command failed to start due to the following error: %%2147942402
21/07/2010 10:00:00, error: Schedule [7901] - The At35.job command failed to start due to the following error: %%2147942402
21/07/2010 10:00:00, error: Schedule [7901] - The At11.job command failed to start due to the following error: %%2147942402
21/07/2010 05:00:00, error: Schedule [7901] - The At6.job command failed to start due to the following error: %%2147942402
21/07/2010 05:00:00, error: Schedule [7901] - The At30.job command failed to start due to the following error: %%2147942402
21/07/2010 04:00:00, error: Schedule [7901] - The At5.job command failed to start due to the following error: %%2147942402
21/07/2010 04:00:00, error: Schedule [7901] - The At29.job command failed to start due to the following error: %%2147942402
21/07/2010 03:00:00, error: Schedule [7901] - The At4.job command failed to start due to the following error: %%2147942402
21/07/2010 03:00:00, error: Schedule [7901] - The At28.job command failed to start due to the following error: %%2147942402
21/07/2010 02:00:00, error: Schedule [7901] - The At3.job command failed to start due to the following error: %%2147942402
21/07/2010 02:00:00, error: Schedule [7901] - The At27.job command failed to start due to the following error: %%2147942402
20/07/2010 23:00:00, error: Schedule [7901] - The At48.job command failed to start due to the following error: %%2147942402
20/07/2010 23:00:00, error: Schedule [7901] - The At24.job command failed to start due to the following error: %%2147942402
20/07/2010 22:00:00, error: Schedule [7901] - The At47.job command failed to start due to the following error: %%2147942402
20/07/2010 22:00:00, error: Schedule [7901] - The At23.job command failed to start due to the following error: %%2147942402
20/07/2010 20:00:00, error: Schedule [7901] - The At21.job command failed to start due to the following error: %%2147942402
20/07/2010 00:13:00, error: Schedule [7901] - The At25.job command failed to start due to the following error: %%2147942402
19/07/2010 18:00:00, error: Schedule [7901] - The At43.job command failed to start due to the following error: %%2147942402
19/07/2010 18:00:00, error: Schedule [7901] - The At19.job command failed to start due to the following error: %%2147942402
19/07/2010 14:00:00, error: Schedule [7901] - The At15.job command failed to start due to the following error: %%2147942402

==== End Of File ===========================

Blade81 · Jul 24, 2010

Hi,

"run as Administrator" part affects only Windows Vista. Your log shows MBRCheck ran as expected.

You posted attach.txt log twice. Please copy-paste dds.txt contents and let me know if problems still exist.

Ransimch · Jul 24, 2010

hello,

sorry about that.
i watched a movie for 10 min and there were no sounds break downs, no advertisements or clicking sounds. though they werent so frequent i think they might gone.

here is the dds log:

DDS (Ver_10-03-17.01) - NTFSx86
Run by ran simchas at 12:17:28.04 on Sat 07/24/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Professional 5.1.2600.2.1255.972.1033.18.2045.1539 [GMT 3:00]

AV: AVG Anti-Virus Free *On-access scanning disabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\FolderSize\FolderSizeSvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\XpertVision\TBPanel.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\NetLimiter\NetLimiter.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Babylon\Babylon-Pro\Babylon.exe
C:\Program Files\ProcessQuickLink 2\ProcessQuickLink 2\ProcessQuickLink2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Mainconcept\PVR\PvrLauncher.exe
C:\Program Files\Mainconcept\PVR\mcavserv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Documents and Settings\ran simchas\Desktop\dds.com

============== Pseudo HJT Report ===============

uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: sratim4u Toolbar: {1ec8a687-ee92-4e42-9838-5215ef8d9381} - c:\program files\sratim4u\tbsra0.dll
BHO: sratim4u Toolbar: {1ec8a687-ee92-4e42-9838-5215ef8d9381} - c:\program files\sratim4u\tbsra0.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {54B02808-B60E-44CD-A72D-9865117E4E62} - No File
BHO: AGFormHelperObj Class: {6620e618-1ab9-4eb2-aca4-cbbe9066dbe6} - c:\program files\agat\agform\AGFormsHelper.dll
BHO: עוזר הכניסה של Windows Live: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Babylon IE plugin: {9cfaccb6-2f3f-4177-94ea-0d2b72d384c1} - c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll
BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: AGForms: {ed2e7de7-07db-4941-a06d-f780b93ba730} - c:\program files\agat\agform\AGForms.dll
TB: sratim4u Toolbar: {1ec8a687-ee92-4e42-9838-5215ef8d9381} - c:\program files\sratim4u\tbsra0.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [AdobeUpdater] c:\program files\common files\adobe\updater5\AdobeUpdater.exe
uRun: [MsnMsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [Google Update] "c:\documents and settings\ran simchas\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [Uniblue ProcessQuickLink 2] "c:\program files\processquicklink 2\processquicklink 2\ProcessQuickLink2.exe" /autostart
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [Gainward] c:\program files\xpertvision\TBPanel.exe /A
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXE
mRun: [NetLimiter] c:\program files\netlimiter\NetLimiter.exe /s
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [Babylon Client] c:\program files\babylon\babylon-pro\Babylon.exe -AutoStart
dRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\11gwir~1.lnk - c:\program files\levelone\11g wireless lan\WLanUtility.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\pvrlau~1.lnk - c:\program files\mainconcept\pvr\PvrLauncher.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\upnpav~1.lnk - c:\program files\mainconcept\pvr\mcavserv.exe
IE: &יצא ל- Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: Translate this web page with Babylon - c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll/ActionTU.htm
IE: Translate with Babylon - c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll/Action.htm
IE: {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - res://c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll/ActionTU.htm
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
LSP: c:\program files\netlimiter\nl_lsp.dll
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} - hxxp://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {41564D57-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/0/A/9/0A9F8B32-9F8C-4D74-A130-E4CAB36EB01F/wmvadvd.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1258653490156
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: {D1BB8531-18CA-407E-99E6-6DDCC293D840} = 192.168.123.254
TCP: {F194A711-11DB-48CC-8B16-B9B4F509F647} = 212.150.49.10,212.150.48.169
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\ransim~1\applic~1\mozilla\firefox\profiles\n4wi8h1c.default\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 Achernar;Achernar - SCSI Command Filters;c:\windows\system32\drivers\Achernar.sys [2008-2-23 17920]
R2 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-7-7 611664]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-1-22 297752]
R3 Aldebaran;Aldebaran - SCSI Command Filters;c:\windows\system32\drivers\Aldebaran.sys [2008-2-23 13824]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-3-17 136176]
S3 RTLWUSB;11g Wireless USB Adapter;c:\windows\system32\drivers\RTL8187.sys [2007-12-12 178048]
S3 SjyPkt;SjyPkt;\??\c:\windows\system32\drivers\sjypkt.sys --> c:\windows\system32\drivers\SjyPkt.sys [?]
S3 XDva032;XDva032;\??\c:\windows\system32\xdva032.sys --> c:\windows\system32\XDva032.sys [?]
S4 UniFS;UniFS;c:\program files\unisonplay\UniFSService.exe [2009-11-24 130560]

=============== Created Last 30 ================

2030-08-29 13:22:32 56832 ------w- c:\windows\system32\iyvu9_32.dll
2030-08-29 13:22:32 143872 ------w- c:\windows\system32\iacenc.dll
2010-07-23 05:48:54 0 d-----w- c:\windows\system32\drivers\avg
2010-07-22 15:03:00 0 d-sha-r- C:\cmdcons
2010-07-22 14:59:05 77312 ----a-w- c:\windows\MBR.exe
2010-07-22 14:59:05 256512 ----a-w- c:\windows\PEV.exe
2010-07-22 14:59:05 161792 ----a-w- c:\windows\SWREG.exe
2010-07-22 14:59:04 98816 ----a-w- c:\windows\sed.exe
2010-07-20 09:30:46 0 d-----w- c:\docume~1\ransim~1\applic~1\HpUpdate
2010-07-20 09:30:32 0 d-----w- c:\windows\Hewlett-Packard
2010-07-20 09:14:09 21124 ------w- c:\windows\hpomdl07.dat.temp
2010-07-12 16:49:23 0 d-----w- c:\windows\system32\wbem\Repository
2010-06-26 18:14:14 0 d-----w- c:\program files\Bonjour

==================== Find3M ====================

2009-05-06 06:24:42 44191776 --sha-w- c:\windows\system32\drivers\fidbox.dat

============= FINISH: 12:17:43.60 ===============

Blade81 · Jul 24, 2010

Hi,

Looks like it's time to secure your system to prevent against further intrusions

THESE STEPS ARE VERY IMPORTANT

Let's reset system restore
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: You will lose all previous restore points which are likely to be infected. Please note you need Administrator Access to do clean the restore points.

1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
NOTE: only do this ONCE,NOT on a regular basis

Now lets uninstall ComboFix:

Click START then RUN
Now copy-paste Combofix /uninstall in the runbox and click OK

Please download OTC and save it to desktop.

Double-click OTC.exe.
Click the CleanUp! button.
Select Yes when the
Begin cleanup Process?
prompt appears.
If you are prompted to Reboot during the cleanup, select Yes.
The tool will delete itself once it finishes, if not delete it by yourself.

Note: If you receive a warning from your firewall or other security programs regarding OTC attempting to contact the internet, please allow it to do so.

UPDATING WINDOWS AND INTERNET EXPLORER

IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site to get the critical updates.

If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed (Free) Microsoft Office Update.

Make your Internet Explorer more secure

This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.

The following are recommended third party programs that are designed to keep your computer clean. A link as well as a brief description is included with each item.

hosts file:
- Every version of windows has a hosts file as part of them.
- In a very basic sense, they are used to locate webpages.
- We can customize a hosts file so that it blocks certain webpages.
- However, it can slow down certain computers.
- This is why using a hosts file is optional!!
Download it here. Make sure you read the instructions on how to install the hosts file. There is a good tutorial here
If you decide to download the hosts file, the slowdown problems can usually be avoided by following these steps:
1. [*]Click the start button (at the lower left hand corner of your screen) [*]Click run [*]In the dialog box, type services.msc [*]hit enter, then locate dns client [*]Highlight it, then double-click it. [*]On the dropdown box, change the setting from automatic to manual. [*]Click ok
Download and run Secunia Personal Software Inspector (PSI) and fix its findings.
Get Anti Virus Software and keep it updated - Most AVs will update automatically, but if not I would recommend making updating the AV the first job every time the PC is connected to the internet. An AV that is using defs that are seven days old is not going to be much protection. If you do not update your anti virus software then it will not be able to catch any of the new variants that may come out. Good free antivirus programs are:
Antivir
Avast!
Good commercial ones are from:
Kaspersky and
ESET
Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. For more info, check this webpage out.
If you don't have a 3rd party firewall or a router behind NAT then I recommend getting one. I recommend either Online Armor Free or Comodo Firewall Pro (If you choose Comodo: Uncheck during installation Install Comodo HopSurf.., Make Comodo my default search provider and Make Comodo Search my homepage and install firewall ONLY!). Both providers have support forums that help with configuration related questions.

Just a final reminder for you. I am trying to stress these two points.
UPDATE UPDATE UPDATE!!! Make sure you do this about every 1-2 weeks.
Make sure all of your security programs are up to date.
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Once again, please post and tell me how things are going with your system... problems etc.

Have a great day,
Blade

Ransimch · Jul 24, 2010

hello,

my system is looking great so far.
i dowmloaded antivir, and for some reason it wont let me do an update, i will try again later.

as i said everything is looking good.
i think it is the only forum in the whole world that worth a dime and much more.
you are so good, profesional and accurate.

thank you
thank you
thank you
thank you
thank you
thank you
thank you

Blade81 · Jul 24, 2010

You're welcome

i dowmloaded antivir, and for some reason it wont let me do an update, i will try again later.

Did it give any error message? It may be some temporary issue. Also, if you have a firewall installed, make sure it has a rule to allow Antivir.

Blade81 · Jul 30, 2010

Since this issue appears to be resolved ... this Topic has been closed. Glad I could help.

Note:If it has been three days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh DDS log and a link to your previous thread.

If it has been less than three days since your last response and you need the thread re-opened, please send me or other MOD a private message (pm). A valid, working link to the closed topic is required.

asking for help - got infected

Ransimch

New member

Blade81

Security Expert: Emeritus

Ransimch

New member

Blade81

Security Expert: Emeritus

Ransimch

New member

Blade81

Security Expert: Emeritus

Ransimch

New member

Blade81

Security Expert: Emeritus

Ransimch

New member

Blade81

Security Expert: Emeritus

Ransimch

New member

Ransimch

New member

Blade81

Security Expert: Emeritus

Ransimch

New member

Blade81

Security Expert: Emeritus

Ransimch

New member

Blade81

Security Expert: Emeritus

Blade81

Security Expert: Emeritus